O HAI THIS BLOG PURPZIEZ 2 B UZED AZ MAH PLESIOUS MEM. :)

2008/02/10

XXX for kernel 2.6.17 - 2.6.24.1

ファイル名がアレな件. :DDD
[OMG, THIS FILE NAME IZ NOT 4 UNDER 18!!1 :DDD]
bug #209460

以下,#-bugsでの騒ぎ.
[Yup, dudes on #-bugs GONNAGONUTZ!!1]
02/10 08:17:58 jakub
plopzie! Bug 209460
02/10 08:18:02 jeeves
jakub: https://bugs.gentoo.org/209460 cri, P2, All,
commando2004.yandex.ru-security.gentoo.org, NEW, pending, Linux
vmsplice Local Root Exploit
02/10 08:20:45 hiyuh
omg
02/10 08:20:46 hiyuh
jessica_biel_naked_in_my_bed.c
02/10 08:21:53 Jarda
ok
02/10 08:22:30 bheekling
Jarda, let's not be skeptical; maybe he has some nice ascii pr0n
02/10 08:23:01 eroyf
awesome
02/10 08:23:06 jakub
bheekling: hmmm well, it works ;P
02/10 08:23:27 bheekling
wheeeeee
02/10 08:23:28 jeeves
dooooooork
02/10 08:24:47 jakub
just needs sed -i -e "s:#include asm/page.h:#define PAGE_SIZE
sysconf(_SC_PAGE_SIZE):" - use while it's hot *g*
02/10 08:25:01 eroyf
it's actually a fairly nice exploit
02/10 08:26:12 *
jakub opens a beer :D
02/10 08:26:37 jakub
now I've got couple more root account :D
02/10 08:27:10 *
eroyf too
02/10 08:27:31 *
bheekling sips orange juice
02/10 08:27:37 bheekling
cheers jakub :P
02/10 08:27:52 jakub
pffft... juice is t3h fail :D
02/10 08:27:55 jakub
beer!
02/10 08:28:26 bheekling
beer, pfft, orange juice is great -- it's got electrolytes!
02/10 08:28:38 jakub
only w/ 50% of vodka ;P
02/10 08:29:59 *
bheekling sips his orange juice and looks down on these vodka/beer
drinking mortals
02/10 08:33:21 Jarda
does that work with vanilla?
02/10 08:33:28 Jarda
or only with gentoo-sources
02/10 08:34:36 eroyf
very likely.
02/10 08:34:54 jakub
vanilla works perfectly fine
02/10 08:34:56 eroyf
i can't see any reason why gentoo-sources would touch vmsplice
02/10 08:35:21 jakub
you can try hardened-sources as well for more phun :D
02/10 08:36:13 *
bheekling tries
02/10 08:36:32 eroyf
you should fix it instead of testing the exploit!
02/10 08:36:50 jakub
eroyf: why? I want more roots! :P
02/10 08:37:02 eroyf
heh.
02/10 08:37:57 eroyf
the exploit, as i read it, wouldn't currently affect selinux enabled
machines, but the error the exploit exploits could do some naughty
stuff
02/10 08:37:58 Jarda
oh, it works on older also
02/10 08:38:01 *
eroyf might be wrong though
02/10 08:39:38 jakub
don't have any selinux box... root or not :P
02/10 08:39:54 bheekling
w00t, works on debian too
02/10 08:40:02 hiyuh
w000000000t
02/10 08:40:02 bheekling
doesn't compile on hardened-sources
02/10 08:40:08 Jarda
bheekling: works from .17-.24
02/10 08:40:19 jakub
bheekling: I posted you a patch above :P
02/10 08:40:26 eroyf
selinux is made of awesome
02/10 08:40:41 bheekling
jakub, aaah
02/10 08:41:15 bheekling
w00t, works
02/10 08:41:29 jakub
*plop*
02/10 08:42:07 *
bheekling considers using selinux on his hardened server
02/10 08:42:17 bheekling
Or maybe apparmour
02/10 08:43:15 eroyf
apparmor is shit
02/10 08:43:29 jakub
didn't they bury the thing?
02/10 08:43:34 eroyf
i wish
02/10 08:43:37 bheekling
jakub, ubuntu uses it by default now :P
02/10 08:43:50 eroyf
ubuntu is also shit
02/10 08:44:12 bheekling
eroyf, but it also rules -
http://www.cafuego.net/2008/02/06/lca-stat-wars :P
02/10 08:44:21 bheekling
literally
02/10 08:46:49 bheekling
"[-] vmsplice: Function not implemented"
02/10 08:46:55 bheekling
dammit _
02/10 08:47:39 jakub
bheekling: running 2.0 kernel? :D
02/10 08:48:07 bheekling
jakub, 2.6.11-1.1369_FC4smp -- FC4 doesn't have it it seems :P
02/10 08:48:14 jakub
bheekling: too old
02/10 08:48:18 jakub
2.6.17+
02/10 08:48:18 Jarda
bheekling: applies only .17-
02/10 08:48:18 bheekling
Yeah
02/10 08:48:53 bheekling
Jarda, yeah, I remember; you mentioned it only a few lines above :)
02/10 08:49:11 bheekling
didn't check kernel version before trying it out
02/10 08:51:16 eroyf
jakub: run the exploit on dev.gentoo.org you pansy
02/10 08:51:28 eroyf
and add to solar's login file echo "LOLOLOL PWNED"
02/10 08:51:34 jakub
aaahahahah!
02/10 08:51:49 bheekling
:D
02/10 08:52:02 eroyf
do it!
02/10 08:52:18 jakub
eroyf: might finally get us rid of cvs as well... *g*
02/10 08:52:21 jakub
tempting
02/10 08:52:23 Jarda
echo "exit" /home/vapier/.bashrc
02/10 08:52:24 eroyf
haha.
02/10 08:52:30 Ken69267
but you could get something worse than cvs in return
02/10 08:52:31 Ken69267
:po

0 件のコメント: