Mr Magorium's Wunderbar Emporium

*watch in HD fullscreen*

Exploits the vulnerability in all Linux kernels since 2001. Exploit works on all kernels since 2001. Disables SELinux, AppArmor, LSM -- you know the drill.

I had planned for this exploit to be more interactive, involving a simulated russian roulette (hence the video) where there would be a 1 in 6 chance of instead of the box being compromised, it would hot reboot into FreeDOS.
Unfortunately I lack the time needed to realize this dream.

The video displayed is embedded in the exploit binary and extracted/played at runtime.

Exploit (for a possibly false-negative test of vulnerability of your own machine) is at http://grsecurity.net/~spender/wunderbar_emporium.tgz

Category:

Comedy

Tags:

• Linux
• SELinux
• kernel
• 0day
• AppArmor
• LSM
• null ptr

[mcx271]

It doesn't work on my 2.6.22.1, which I compiled myself: [+] MAPPED ZERO PAGE!

unable to find a vulnerable domain, sorry

On kernel from Debian distribution it works. I don't know where exactly is the difference.

[spendergrsec]

The reason for the difference is that you removed all the vulnerable modules (or built in code) by compiling your own kernel with just the things you needed. It's a good idea in general to reduce your attack surface, and in this case it paid off for you.

[szymongruszczynski]

hm... does this exploits disable also tomoyo (on < 2.6.30 kernels)?

[spendergrsec]

Yes, the LSM disabling is enough to disable tomoyo.

[spendergrsec]

Click "more info" at the top right for a link to the exploit for testing vulnerability of your own machine. I forgot to link to it in the FD/DD mail.

[gn44]

what movie is that?

[spendergrsec]

13 Tzameti, check it out, not too bad (just don't watch the trailer) or actually, I may have already ruined the movie for you (that's how I felt after watching the trailer for it at least :P)

[levidos]

I get the same message on a 2.6.26-2-amd64  Debian GNU/Linux 5.0

Is there a workaround?

[SneakyTweaky]

Spender I'm trying on default 2.6.28-15-generic kernel but seams it wont work. The output ends with: UNABLE TO MAP ZERO PAGE!

[SneakyTweaky]

lol

[RafaelPoseddon]

PWN3D! \o/

[gn44]

thx spender

:)