brant-ruan

#!/bin/bash

if [ "$(id -u)" -ne 0 ]; then
  echo "This script must be run as root. Please use 'sudo' to run it."
  exit 1
fi

if [ $# -eq 0 ]; then
  echo "Usage: $0 <version>"
  exit 1

brant-ruan

int nfsd_setuser(struct svc_rqst *rqstp, struct svc_export *exp)
{
    struct group_info *rqgi;
    struct group_info *gi;
    struct cred *new;
    int i, j;
    int flags = nfsexp_flags(rqstp, exp);

    validate_process_creds();

brant-ruan

/* CGI decoding as C program */

#include <stdlib.h>
#include <string.h>
#include <stdio.h>


int hex_values[256];

void init_hex_values() {

brant-ruan

Location = Tuple[str, int]

class Coverage:
    """Track coverage within a `with` block. Use as
    ```
    with Coverage() as cov:
        function_to_be_traced()
    c = cov.coverage()
    ```
    """

brant-ruan

def cgi_decode(s: str) -> str:
    """Decode the CGI-encoded string `s`:
       * replace '+' by ' '
       * replace "%xx" by the character with hex number xx.
       Return the decoded string.  Raise `ValueError` for invalid inputs."""

    # Mapping of hex digits to their integer values
    hex_values = {
        '0': 0, '1': 1, '2': 2, '3': 3, '4': 4,
        '5': 5, '6': 6, '7': 7, '8': 8, '9': 9,

brant-ruan

#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
#include <sys/mman.h>

brant-ruan

/* 
 * Linux Kernel <= 2.6.36-rc8 RDS privilege escalation exploit
 * CVE-2010-3904
 * by Dan Rosenberg <drosenberg@vsecurity.com>
 *
 * Copyright 2010 Virtual Security Research, LLC
 *
 * The handling functions for sending and receiving RDS messages
 * use unchecked __copy_*_user_inatomic functions without any
 * access checks on user-provided pointers.  As a result, by

brant-ruan

/*
 * CVE-2013-2094 exploit x86_64 Linux < 3.8.9
 * by sorbo (sorbo@darkircop.org) June 2013
 *
 * Based on sd's exploit.  Supports more targets.
 *
 */

#define _GNU_SOURCE
#include <string.h>

brant-ruan

/*
 * Linux kernel exploit (privilege escalation)
 * CVE-2013-2094 (PERF_EVENTS)
 * Vasileios P. Kemerlis <vpk@cs.columbia.edu>
 *
 * Based on the exploits of `sd', `sorbo', and `spender';
 * uses the `ret2dir' technique for bypassing:
 * 	- SMEP+SMAP		(Intel)
 * 	- KERNEXEC/UDEREF	(PaX)
 *

brant-ruan

#include "bpf_insn.h"
#include <linux/bpf.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>