-
Notifications
You must be signed in to change notification settings - Fork 0
/
shell-exploit.c
108 lines (96 loc) · 2.35 KB
/
shell-exploit.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <string.h>
#include <sys/types.h>
#include <sys/mman.h>
#include <sys/prctl.h>
#include <linux/filter.h>
#include "seccomp-bpf.h"
#ifdef X86
#include <x86_64-linux-gnu/asm/unistd_32.h>
#endif
#include <assert.h>
void install_syscall_filter()
{
struct sock_filter filter[] = {
VALIDATE_ARCHITECTURE,
EXAMINE_SYSCALL,
ALLOW_SYSCALL(read),
ALLOW_SYSCALL(write),
ALLOW_SYSCALL(socket),
#ifdef X86
ALLOW_SYSCALL(socketcall),
#endif
ALLOW_SYSCALL(setsockopt),
ALLOW_SYSCALL(bind),
ALLOW_SYSCALL(listen),
ALLOW_SYSCALL(accept4),
KILL_PROCESS,
};
struct sock_fprog prog = {
.len = (unsigned short)(sizeof(filter)/sizeof(filter[0])),
.filter = filter,
};
assert(prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == 0);
assert(prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) == 0);
}
#ifdef __OPTIMIZE__
int sock_read(int connfd, char *buf) {
#else
int sock_read(int connfd) {
char buf[8];
#endif
int len = 0;
read(connfd, &len, sizeof(int));
write(connfd, buf, len);
return read(connfd, buf, len);
}
int main()
{
#ifdef __OPTIMIZE__
char buf[8];
#endif
struct sockaddr_in serv_addr;
int connfd;
int enable = 1;
//install_syscall_filter();
int listenfd = socket(AF_INET, SOCK_STREAM, 0);
if (listenfd < 0) {
printf("socket() failed\n");
return -1;
}
if (setsockopt(listenfd, SOL_SOCKET, SO_REUSEADDR, &enable, sizeof(int)) < 0)
{
printf("setsockopt(SO_REUSEADDR) failed");
return -1;
}
memset(&serv_addr, '0', sizeof(serv_addr));
serv_addr.sin_family = AF_INET;
serv_addr.sin_addr.s_addr = htonl(INADDR_ANY);
serv_addr.sin_port = htons(5000);
if (bind(listenfd, (struct sockaddr*)&serv_addr, sizeof(serv_addr)) < 0) {
printf("bind() failed\n");
return -1;
}
if (listen(listenfd, 10) < 0) {
printf("listen() failed\n");
return -1;
}
connfd = accept4(listenfd, (struct sockaddr*)NULL, NULL, 0);
if (connfd < 0) {
printf("accept() failed\n");
return -1;
}
#ifdef __OPTIMIZE__
sock_read(connfd, buf);
#else
sock_read(connfd);
// shall never return here
fprintf(stderr, "->>> Return from sock_read!!!\n");
#endif
return -1;
}