CVE-2008-5736, branch master Local root exploit for FreeBSD <= 6.4-Stable. https://git.zx2c4.com/CVE-2008-5736/atom/?h=master 2011-03-09T18:39:56Z Add title. 2011-03-09T18:39:56Z Jason A. Donenfeld Jason@zx2c4.com 2011-03-09T18:39:56Z urn:sha1:41baf29b19fb984b81da4ebd45c8be98a6b3c93e Add l33t comment. 2011-02-28T01:52:59Z Jason A. Donenfeld Jason@zx2c4.com 2011-02-28T01:52:59Z urn:sha1:19e04e2be9f96d27160bbccc9da952828bf161af Print to stdout, not stderr. 2011-02-28T01:06:46Z Jason A. Donenfeld Jason@zx2c4.com 2011-02-28T01:06:46Z urn:sha1:41ee184ac9c9ad06221abd3464f1eba81f71167f Get out of jail by copying fds from pid 1. 2011-02-27T08:47:07Z Jason A. Donenfeld Jason@zx2c4.com 2011-02-27T08:47:07Z urn:sha1:4c9211d7f685f873aa3ce5796c0f4e63e6b50ddd Don't copy. Just jmp to function. 2011-02-27T06:48:51Z Jason A. Donenfeld Jason@zx2c4.com 2011-02-27T06:48:51Z urn:sha1:83ff9d1ee5964795911c113fb8962de91e58398e Non functional jail escape functionality. 2011-02-27T06:21:43Z Jason A. Donenfeld Jason@zx2c4.com 2011-02-27T06:21:43Z urn:sha1:e90174bd63a6cbb3403e222e9bb72ea6949e332c Clean up headers. Make l33t. 2011-02-27T03:03:28Z Jason A. Donenfeld Jason@zx2c4.com 2011-02-27T02:57:37Z urn:sha1:60cecd4a4ec67109f421ffd7ebb00589e30f0cf8 Since the template search is a little buggy and sometimes causes panic, just do a more traditional UID=0 for the current thread and then execl sh into the process. 2011-02-27T02:16:18Z Jason A. Donenfeld Jason@zx2c4.com 2011-02-27T02:16:18Z urn:sha1:395301fae72bdb466a51f8cc1ea950fe8db8be64 Instead of going to a fixed place, as Don does, search the entire kernel for the locks that are commonly before allproc. 2011-02-27T02:15:01Z Adam Weiss adam@signal11.com 2011-02-27T02:15:01Z urn:sha1:71c0068b8a7ea89731fcd074a273a77671be08d1 Import Don Bailey's original exploit code. 2011-02-27T02:13:48Z Jason A. Donenfeld Jason@zx2c4.com 2011-02-27T02:13:48Z urn:sha1:cc0d7ca2b5f3bde23d10d625e37c60d2af8cc761