Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 2 down vote favorite
2

I have some interest if finding out a bit more about an exploit that was published that creates a root user in a linux machine; however, before I run the code, I want to make sure I understand all of it and I can't seem to find any information on the hex codes being used.

This is the link to the exploit code source: exploitdb.com/exploits/17439

It's a basic C program, but the value of one of the pointers uses code like this:

           "\x6a\x26\x5a\x25\x04\xe3\xb3\x64"
           "\x04\xc7\x03\x65\x48\xe6\x02\xc3"

How do I decode this to ASCII and how can I re-encode it back?

I'm thinking I could be totally off-base here and really this code should decode to assembly, but I don't really know. Either way, what can I do with this code to make sure I'n not executing arbitrary commands?

I'm completely new to C, but know enough VB.net/C#/PHP to be dangerous.

P.S. For those of you who are concerned, I'll be running this in a VM.

share|improve this question

3 Answers

up vote 1 down vote accepted

Python's REPL is good in a pinch for stuff like this.

>>> "\x6a\x26\x5a\x25\x04\xe3\xb3\x64"
'j&Z%\x04\xe3\xb3d'
>>> "\x04\xc7\x03\x65\x48\xe6\x02\xc3"
'\x04\xc7\x03eH\xe6\x02\xc3'

So yeah, pretty much all assembly. You'll need a disassembler (or a CPU databook and a lot of patience) in order to read it.

share|improve this answer
This is probably getting in to stack overflow territory, but could you provide a basic code example (even if pseudo-code) of how to get python to parse this? – skub Jul 8 '11 at 5:50
There is no further parsing. What I showed is what Python knows about it. You will need a disassembler (or a ...) from here. – Ignacio Vazquez-Abrams Jul 8 '11 at 5:52
Maybe you want to ask this on codegolf.stackexchange.com perhaps they can help you. – Michael K Jul 8 '11 at 7:26
up vote 4 down vote

The very database entry that you pointed to gives both the original assembly language program, and its C language equivalents, immediately above the hex-encoded raw machine code. It's SuperH assembly language.

share|improve this answer
Yes, I know; the comments that contain the assembly may or may not necessarily be the code that in the pointer. I was requesting a way (method or process) to check the code to ensure it is indeed the assembly noted above. And also a method to encode to the appropriate hex code values (which no one answered). – skub Jul 8 '11 at 12:52
That's not in your question as asked, which didn't say anything at all about verification of machine code against assembly language, but did ask about converting to ASCII characters, which is why people's answers talk about that. You didn't ask anything like what you are asking now. And the method to encode assembly language to machine code is known as an assembler. – JdeBP Jul 8 '11 at 14:27
>Either way, what can I do with this code to make sure I'n not executing arbitrary commands? – skub Jul 9 '11 at 2:56
up vote 0 down vote

Decoding it to ASCII would be useless as it is not a text string - the \x0... bytes map to control characters in the ASCII character set, not to printable characters.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.