Модератор: Модераторы разделов
Дистрибутив openSUSE без всякой платной техподдержки.
Дистрибутивное ядро обновлено сегодня, сабжевая заплатка в комплекте.
http://download.opensuse.org/update/10.3/rpm/i586/?C=M;O=D
Код: Выделить всё
$ uname -a
Linux aliCQ.ali.mtu.ru 2.6.24.1-28.fc9 #1 SMP Sun Feb 10 16:47:10 EST 2008 x86_64 x86_64 x86_64 GNU/Linux
[test@aliCQ ~]$ gcc -o exploit28 expl.c
[test@aliCQ ~]$ ./exploit28
-----------------------------------
Linux vmsplice Local Root Exploit
By qaaz
-----------------------------------
[+] mmap: 0x100000000000 .. 0x100000001000
[+] page: 0x100000000000
[+] page: 0x100000000038
[+] mmap: 0x4000 .. 0x5000
[+] page: 0x4000
[+] page: 0x4038
[+] mmap: 0x1000 .. 0x2000
[+] page: 0x1000
[+] mmap: 0x2aaaaaada000 .. 0x2aaaaab0c000
[-] vmsplice: Bad addressКод: Выделить всё
$ uname -a
Linux aliCQ.ali.mtu.ru 2.6.23.15-137.fc8 #1 SMP Sun Feb 10 17:03:13 EST 2008 x86_64 x86_64 x86_64 GNU/Linux
$ ./expl
........
[-] vmsplice: Bad address
Код: Выделить всё
$ gcc sploit.c
sploit.c:19:22: error: asm/page.h: Нет такого файла или каталога
sploit.c: В функции ‘main’
sploit.c:200: ошибка: ‘PAGE_SIZE’ undeclared (first use in this function)
sploit.c:200: ошибка: (Each undeclared identifier is reported only once
sploit.c:200: ошибка: for each function it appears in.)
Susel писал(а): ↑12.02.2008 20:49Арч обновился еще позавчера: http://archlinux.org/news/383/ или там про другую уязвимость?
?sudo yum update kernel
---> Package kernel.i686 0:2.6.23.15-80.fc7 set to be installed
---> Package kernel.i686 0:2.6.23.12-52.fc7 set to be erased
однако:Ali1 писал(а): ↑12.02.2008 23:27http://ftp.yandex.ru/fedora/linux/updates/...37.fc8.i686.rpm
Проверь updates - включен ли.
Код:
$ syu kernel kernel-headers kernel-devel
Loading "fastestmirror" plugin
Loading mirror speeds from cached hostfile
* fedora: allotter.yandex.net
* updates: allotter.yandex.net
Resolving Dependencies
--> Running transaction check
---> Package kernel.i686 0:2.6.23.15-80.fc7 set to be installed
---> Package kernel-headers.i386 0:2.6.23.15-80.fc7 set to be updated
---> Package kernel-devel.i686 0:2.6.23.15-80.fc7 set to be installed
--> Finished Dependency Resolution
--> Running transaction check
---> Package kernel.i686 0:2.6.23.15-80.fc7 set to be installed
---> Package kernel.i686 0:2.6.23.12-52.fc7 set to be erased
---> Package kernel-devel.i686 0:2.6.23.12-52.fc7 set to be erased
---> Package kernel-headers.i386 0:2.6.23.15-80.fc7 set to be updated
---> Package kernel-devel.i686 0:2.6.23.15-80.fc7 set to be installed
--> Finished Dependency Resolution
Dependencies Resolved
=============================================================================
Package Arch Version Repository Size
=============================================================================
Installing:
kernel i686 2.6.23.15-80.fc7 updates 16 M
kernel-devel i686 2.6.23.15-80.fc7 updates 4.8 M
Updating:
kernel-headers i386 2.6.23.15-80.fc7 updates 654 k
Removing:
kernel i686 2.6.23.12-52.fc7 installed 44 M
kernel-devel i686 2.6.23.12-52.fc7 installed 15 M
Transaction Summary
=============================================================================
Install 2 Package(s)
Update 1 Package(s)
Remove 2 Package(s)
Total download size: 21 M 
Я вот вдруг осознал, что не понимаю, что это такое - "локальный пользователь".
Это тот, кто вошел в сеть с терминала подключенного непосредственно к серверу, или тот, кто входит в его группу 'users'?
Если первый, то он и так пароль рута знает, иначе его в серверную просто не впустят.
А если второй, то я даже и не знаю, кто в эту группу на сервере входит и зачем.
Или какие начальные права нужны...
Код: Выделить всё
...
[+] mmap: 0xb7eed000 .. 0xb7f1f000
[-] vmsplice: Bad address
$ uname -a
Linux 2.6.23.15-80.fc7 #1 SMP Sun Feb 10 17:29:10 EST 2008 i686 i686 i386 GNU/Linux
Уже понятнее, спасибо.Civil писал(а): ↑13.02.2008 07:56Я вот вдруг осознал, что не понимаю, что это такое - "локальный пользователь".
Я так полагаю, что это любой юзер, содержащийся в /etc/passwd
Может на сервере народ по ssh работает. Или просто прав рута не имеет. А может злобный хакер найдёт дыру в сервисе, позволяющую от имени nobody исполнить какой-нибудь код...
Код:
eldar@linux-tlto:~> gcc proof-of-concept.c -I /usr/src/linux/include
proof-of-concept.c:1: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘-’ token
In file included from /usr/include/_G_config.h:44,
from /usr/include/libio.h:32,
from /usr/include/stdio.h:75,
from proof-of-concept.c:10:
/usr/include/gconv.h:72: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/gconv.h:88: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/gconv.h:97: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/gconv.h:174: error: expected specifier-qualifier-list before ‘size_t’
In file included from /usr/include/stdio.h:75,
from proof-of-concept.c:10:
/usr/include/libio.h:329: error: expected specifier-qualifier-list before ‘size_t’
/usr/include/libio.h:361: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/libio.h:370: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/libio.h:486: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘_IO_sgetn’
In file included from proof-of-concept.c:10:
/usr/include/stdio.h:296: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/stdio.h:302: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/stdio.h:314: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/stdio.h:321: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/stdio.h:363: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/stdio.h:365: error: format string argument not a string type
/usr/include/stdio.h:367: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/stdio.h:573: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/stdio.h:576: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/stdio.h:586: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/stdio.h:616: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘fread’
/usr/include/stdio.h:622: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘fwrite’
/usr/include/stdio.h:644: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘fread_unlocked’
/usr/include/stdio.h:646: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘fwrite_unlocked’
In file included from proof-of-concept.c:12:
/usr/include/stdlib.h:140: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘__ctype_get_mb_cur_max’
In file included from proof-of-concept.c:12:
/usr/include/stdlib.h:455: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/stdlib.h:485: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/stdlib.h:487: error: nonnull argument with out-of-range operand number (argument 1, operand 4)
/usr/include/stdlib.h:589: error: expected ‘)’ before ‘__size’
/usr/include/stdlib.h:591: error: expected ‘)’ before ‘__nmemb’
/usr/include/stdlib.h:600: error: expected declaration specifiers or ‘...’ before ‘size_t’
In file included from /usr/include/stdlib.h:612,
from proof-of-concept.c:12:
/usr/include/alloca.h:33: error: expected ‘)’ before ‘__size’
In file included from proof-of-concept.c:12:
/usr/include/stdlib.h:617: error: expected ‘)’ before ‘__size’
/usr/include/stdlib.h:622: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/stdlib.h:622: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/stdlib.h:774: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/stdlib.h:774: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/stdlib.h:775: error: nonnull argument with out-of-range operand number (argument 1, operand 5)
/usr/include/stdlib.h:779: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/stdlib.h:779: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/stdlib.h:780: error: nonnull argument with out-of-range operand number (argument 1, operand 4)
/usr/include/stdlib.h:852: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/stdlib.h:855: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/stdlib.h:859: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/stdlib.h:863: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/stdlib.h:872: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/stdlib.h:876: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/stdlib.h:883: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘mbstowcs’
/usr/include/stdlib.h:886: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘wcstombs’
/usr/include/stdlib.h:949: error: expected declaration specifiers or ‘...’ before ‘size_t’
In file included from proof-of-concept.c:13:
/usr/include/string.h:39: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/string.h:43: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/string.h:52: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/string.h:59: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/string.h:62: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/string.h:66: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/string.h:77: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/string.h:88: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/string.h:96: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/string.h:102: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/string.h:109: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘strxfrm’
/usr/include/string.h:124: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘strxfrm_l’
/usr/include/string.h:138: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/string.h:184: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘strcspn’
/usr/include/string.h:188: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘strspn’
/usr/include/string.h:225: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/string.h:226: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/string.h:227: error: nonnull argument with out-of-range operand number (argument 1, operand 3)
/usr/include/string.h:232: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/string.h:235: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/string.h:242: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘strlen’
/usr/include/string.h:249: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘strnlen’
/usr/include/string.h:281: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/string.h:294: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/string.h:298: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/string.h:302: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/string.h:305: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/string.h:335: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/string.h:347: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/string.h:348: error: nonnull argument with out-of-range operand number (argument 1, operand 4)
/usr/include/string.h:376: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/string.h:379: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/string.h:386: error: expected declaration specifiers or ‘...’ before ‘size_t’
In file included from proof-of-concept.c:14:
/usr/include/malloc.h:49: error: expected ‘)’ before ‘__size’
/usr/include/malloc.h:52: error: expected ‘)’ before ‘__nmemb’
/usr/include/malloc.h:57: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/malloc.h:67: error: expected ‘)’ before ‘__alignment’
/usr/include/malloc.h:71: error: expected ‘)’ before ‘__size’
/usr/include/malloc.h:76: error: expected ‘)’ before ‘__size’
/usr/include/malloc.h:132: error: expected ‘)’ before ‘__pad’
/usr/include/malloc.h:136: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘malloc_usable_size’
/usr/include/malloc.h:155: error: expected ‘)’ before ‘__size’
/usr/include/malloc.h:157: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/malloc.h:159: error: expected ‘)’ before ‘__alignment’
In file included from /usr/include/signal.h:348,
from proof-of-concept.c:16:
/usr/include/bits/sigstack.h:54: error: expected specifier-qualifier-list before ‘size_t’
In file included from proof-of-concept.c:17:
/usr/include/unistd.h:327: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/unistd.h:333: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/unistd.h:343: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/unistd.h:351: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/unistd.h:371: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/unistd.h:375: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/unistd.h:471: error: expected declaration specifiers or ‘...’ before ‘size_t’
In file included from proof-of-concept.c:17:
/usr/include/unistd.h:568: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘confstr’
/usr/include/unistd.h:740: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/unistd.h:776: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/unistd.h:787: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/unistd.h:823: error: expected declaration specifiers or ‘...’ before ‘size_t’
In file included from proof-of-concept.c:17:
/usr/include/unistd.h:845: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/unistd.h:852: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/unistd.h:863: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/unistd.h:865: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/unistd.h:883: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/unistd.h:884: error: expected declaration specifiers or ‘...’ before ‘size_t’
In file included from /usr/include/sys/uio.h:29,
from proof-of-concept.c:18:
/usr/include/bits/uio.h:47: error: expected specifier-qualifier-list before ‘size_t’
In file included from proof-of-concept.c:19:
/usr/include/sys/mman.h:58: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/sys/mman.h:71: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/sys/mman.h:77: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/sys/mman.h:82: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/sys/mman.h:90: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/sys/mman.h:95: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/sys/mman.h:99: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/sys/mman.h:104: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/sys/mman.h:107: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/sys/mman.h:124: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/sys/mman.h:134: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/sys/mman.h:134: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/sys/mman.h:139: error: expected declaration specifiers or ‘...’ before ‘size_t’
/usr/include/sys/mman.h:140: error: expected declaration specifiers or ‘...’ before ‘size_t’
proof-of-concept.c: In function ‘main’:
proof-of-concept.c:182: error: ‘size_t’ undeclared (first use in this function)
proof-of-concept.c:182: error: (Each undeclared identifier is reported only once
proof-of-concept.c:182: error: for each function it appears in.)
proof-of-concept.c:182: error: expected ‘;’ before ‘map_size’
proof-of-concept.c:204: error: ‘map_size’ undeclared (first use in this function)
proof-of-concept.c:206: error: too many arguments to function ‘mmap’
proof-of-concept.c:210: error: too many arguments to function ‘memset’
proof-of-concept.c:226: error: too many arguments to function ‘mmap’
proof-of-concept.c:230: error: too many arguments to function ‘memset’
proof-of-concept.c:244: error: too many arguments to function ‘mmap’
proof-of-concept.c:247: error: too many arguments to function ‘memset’
proof-of-concept.c:254: error: too many arguments to function ‘mmap’
proof-of-concept.c:258: error: too many arguments to function ‘memset’
proof-of-concept.c:263: error: too many arguments to function ‘munmap’
proof-of-concept.c:271: error: ‘struct iovec’ has no member named ‘iov_len’ 