$Name: release2_0-12 $
$Id: README,v 1.4 2001/06/19 18:22:15 ttsai Exp $

This directory contains sample buffer overflow exploits.  t1, t3, and t4 are
simple examples.  xlock-exploit is a real exploit of a bug in xlockmore version
3.10.  These four exploits all attempt to obtain a shell.  Since
xlock/xlockmore is usually owned by root and run in set-uid mode, the
successful xlock-exploit would obtain a root shell.

As a demonstration of how libsafe works, do the following:
(1) Build the libsafe shared library and the exploits by executing "make" in
	the top-level libsafe directory.
(2) Execute each program as is (i.e., without libsafe).  For each program, the
	result should be an interactive shell.  When executing xlock-exploit,
	use "-nolock" as a command-line argument to avoid having to enter your
	password when returning from the xlock screensaver.  You will have to
	hit a key on the keyboard to return from the screensaver.
(3) Execute each program with libsafe.  The simplest way to do this is to use
	the "int.sh" script in the ./exploits directory.  For example, to
	execute "t1" with libsafe, execute "int.sh t1".  Repeat for t2, t4, and
	xlock-exploit.  Remember to specify "-nolock" for xlock-exploit (i.e.,
	"int.sh xlock-exploit -nolock").  For each exploit, libsafe should
	output a detection message to stderr and add an entry to
	/var/log/secure.
