159 Commits (494711ee6517b2125c889b354d851f067822b2c1)

Author	SHA1	Message	Date
jvazquez-r7	8b251b053e	initializing msghdr a little better	2012-09-18 12:12:27 +02:00
jvazquez-r7	16c5df46fc	fix while testing ubuntu intrepid	2012-09-18 11:52:50 +02:00
James Lee	bbeb6cc97a	Add a privilege escalation exploit for udev < 1.4.1 ... Also includes a new ```rm_f``` method for Post::File for deleting remote files in a platform-independent way.	2012-09-10 12:32:14 -05:00
sinn3r	3cb60fb42a	Fix 1.8-specific regexp syntax bug ... The bug was: line 343: warning: regexp has invalid interval line 343: warning: regexp has '}' without escape	2012-07-26 02:19:13 -05:00
James Lee	d238debb2f	Add disclo date, discoverers, and better description	2012-07-18 16:14:32 -06:00
James Lee	ebe48ecf16	Add Rank for schelevator, update sock_sendpage's	2012-07-18 11:16:29 -06:00
James Lee	7091d1c65b	Add an exploit for sock_sendpage ... Unfortunately, adds a dep on bionic for runtime compilation. Gets ring0, sets the (res)uid to 0 and jumps to the payload. Still some payload issues because linux stagers don't mprotect(2) the buffer they read(2) into. Single payloads work fine, though. Also cleans up and improves local exploits' ability to compile C. [SEERM #3038]	2012-07-15 20:29:48 -06:00
James Lee	6913440d67	More progress on syscall wrappers ... Something is still broken, my socket() is returning EAFNOSUPPORT whereas what looks like the same syscall in wunderbar_emporium's exploit.c is returning a socket. Similarly, my __mmap2() is returning EFAULT when trying to map anything, not just NULL.	2012-06-22 17:45:49 -06:00
James Lee	fd8b1636b9	Add the first bits of a sock_sendpage exploit ... This can currently build an executable that creates a socket, opens a temporary file, truncates that file with ftruncate(2) and calls sendfile. Still needs to mmap NULL and figure out ring0 shellcode. Baby steps.	2012-06-22 00:03:29 -06:00