			SPARC Buffer Overflows
		  (Presented at DEFCON 8, July 2000)

	   Copyright (C) 2000 ghandi <ghandi@dopesquad.net>

INTRODUCTION

This presentation covers the basics of stack-based overflows on SPARC
based machines.  I wrote and tested this stuff on a SPARCbook 3GX
(sun4m) running Solaris 2.6 and a SPARCstation 2 Weitek PowerUP
(sun4c) running OpenBSD 2.6.

CONTENTS
code/
  bindshell/		Shellcode-in-progress to bind a shell to port 2000
  libc/			Example exploitation of libc LC_MESSAGES overflow
  shellcode/		Evolution of working shellcode
  smashme/		Example exploitation of unbounded strcat().

doc/			LaTeX source to my slides

misc/
  dis2h.c		Simple filter from disassembler output to header
			file for use in example exploits
  slide-show.sh		Make Xdvi think it is PowerPoint
  test-sc.c		Cast shellcode character array into a function
			pointer and run it

Many of the programs #include "shellcode.h", make sure you have one
there or they won't compile.  I'd recommend using code/shellcode/3.h
or (even better) your own creation.
			
ACKNOWLEDGEMENTS

The libc LC_MESSAGES example is quite old and was discovered and
disclosed by UNYUN in May 1999.  I learned this stuff from Aleph1's
"Smashing the Stack for Fun and Profit" in Phrack 49 and applied it to
the SPARC.  I discovered that the Bourne Shell discards euids less
than 100 (when they do not match the real uid) from Wombat.
