full-disclosure - [ElectronicSouls] Outta userland & into yer kernel (LKM)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: es at hush.com (es@...h.com)
Subject: [ElectronicSouls] Outta userland & into yer kernel (LKM)

-----BEGIN PGP SIGNED MESSAGE-----

for i in /usr/include/*.h; do echo "#include <`basename $i`>"; done

Cheers.

/*
 * *******************
 * .:ElectronicSouls:.
 *   fake uname lkm
 * *******************
 *      ..have fun ;-)
 */

#include <linux/file.h>
#include <linux/smp.h>
#include <linux/smp_lock.h>
#include <linux/sem.h>
#include <linux/suxno.h>
#include <linux/sched.h>
#include <linux/msg.h>
#include <linux/mm.h>
#include <linux/shm.h>
#include <linux/stat.h>
#include <linux/mman.h>
#include <linux/utsname.h>
#include <asm/uaccess.h>
#include <asm/ipc.h>


//#define __NR_oldshit         59
//#define __NR_last           109
//#define __NR_uname              122

extern void *sys_call_table[];
void *old_val;

asmlinkage static int uname_new(struct uname_old* name)
{

 int sux;
 int i = 0;

 char ver_one[9];
 char ver_two[9] = "1.0.23.es\0\0\0";


 if (!name)
 {
    return -1;
 }

 for (i = 0; i < 9; i++)
 {
    ver_one[i] = system_utsname.release[i];
    system_utsname.release[i] = ver_two[i];
 }

 sux=copy_to_user(name, &system_utsname, sizeof (*name));
 for (i = 0; i < 9; i++)
 {
   system_utsname.release[i] = ver_one[i];
 }
 return(1);
}

int mod_start()
{
  old_val = (void *) sys_call_table[122];
  sys_call_table[122] = (void *) uname_new;
  return 0;
}

void mod_clean()
{
  sys_call_table[122] = old_val;
}

The Electronic Souls Crew
[ElectronicSouls] (c) 2002

"Blackhats and ebony."

-----BEGIN PGP SIGNATURE-----
Version: Hush 2.2 (Java)
Note: This signature can be verified at https://www.hushtools.com/verify

wlMEARECABMFAj3nPkMMHGVzQGh1c2guY29tAAoJEN5nGqhGcjltdvwAnjRJc35Jg0W1
nA+JoiUo60Qd0tRZAJ0XAlnsg3Iu90IS56EEVhTj8zSc0A==
=Prck
-----END PGP SIGNATURE-----




Concerned about your privacy? Follow this link to get
FREE encrypted email: https://www.hushmail.com/?l=2 

Big $$$ to be made with the HushMail Affiliate Program: 
https://www.hushmail.com/about.php?subloc=affiliate&l=427