fixed ghxx exploit

This commit is contained in:
2026-02-01 01:01:07 -05:00
parent bf1dc9da7a
commit 4f50d90b79
11 changed files with 138 additions and 94 deletions
+9 -10
View File
@@ -10,8 +10,7 @@ local kernel = {}
kernel.LOG_Text=""
kernel.version="HyperionOS V1.0.0"
kernel.process = "Kernel"
kernel.user = "root"
kernel.group = "root"
kernel.username = "root"
kernel.hostname = "hyperion"
kernel.groups = {0}
kernel.uid = 0
@@ -28,15 +27,15 @@ local windowsExp = false
function kernel.log(msg, level, c)
c=c or 12
kernel.LOG_Text = kernel.LOG_Text..tostring(computer:time()).." "..kernel.user.." "..kernel.process.."["..tostring(level or "INFO").."]: "..msg.."\n"
kernel.LOG_Text = kernel.LOG_Text..tostring(computer:time()).." "..kernel.username.." "..kernel.process.."["..tostring(level or "INFO").."]: "..msg.."\n"
if kernel.status == "start" then
screen:setTextColor(c)
screen:print(tostring(computer:time()).." "..kernel.user.." "..kernel.process.."["..tostring(level or "INFO").."]: "..msg)
screen:print(tostring(computer:time()).." "..kernel.username.." "..kernel.process.."["..tostring(level or "INFO").."]: "..msg)
elseif kernel.status == "init" then
kernel.standbyTask=kernel.currentTask
kernel.currentTask=kernel.kernelTask
kernel.tty.setTextColor(c)
kernel.tty.print(tostring(computer:time()).." "..kernel.user.." "..kernel.process.."["..tostring(level or "INFO").."]: "..msg)
kernel.tty.print(tostring(computer:time()).." "..kernel.username.." "..kernel.process.."["..tostring(level or "INFO").."]: "..msg)
kernel.currentTask=kernel.standbyTask
end
end
@@ -48,7 +47,7 @@ function kernel.PANIC(msg)
kernel.status="Panic"
kernel.reason=msg
screen:setTextColor(2)
screen:setBackgroundColor(0)
screen:setBackgroundColor(16)
screen:clear()
screen:setCursorPos(1,1)
screen:print(kernel.LOG_Text)
@@ -208,7 +207,7 @@ kernel.kernelTask = {
status="R",
pid=0,
tgid=0,
user="root",
username="root",
uid=0,
fd={},
exit="",
@@ -236,12 +235,12 @@ end
kernel.syscalls["time"]=function() return kernel.computer:time() end
kernel.syscalls["log"]=kernel.log
kernel.syscalls["getUptime"]=function() return kernel.computer:clock() end
kernel.syscalls["getUser"]=function() return kernel.user end
kernel.syscalls["getHostname"]=function() return kernel.host end
kernel.syscalls["getUsername"]=function() return kernel.username end
kernel.syscalls["getHostname"]=function() return kernel.hostname end
kernel.syscalls["getHost"]=function() return kernel.apis._HOST end
kernel.syscalls["version"]=function() return kernel.version end
kernel.syscalls["setHostname"]=function(name) if kernel.uid~=0 then error("Permission denied") end kernel.hostname=name end
kernel.syscalls["setUser"]=function(user) if kernel.uid~=0 then error("Permission denied") end kernel.currentTask.user=user end
kernel.syscalls["setUsername"]=function(user) if kernel.uid~=0 then error("Permission denied") end kernel.currentTask.username=user end
kernel.syscalls["test"]=function() return true end
kernel.log("Running modules")
@@ -1,6 +1,7 @@
--:Minify:--
local kernel = ...
local timeout=false
kernel.processes.keventd = function()
while true do
local event = {kernel.computer:getMachineEvent()}
@@ -13,6 +14,12 @@ kernel.processes.keventd = function()
end
end
kernel.io.pushEvent("raw", table.unpack(event))
timeout=false
else
timeout=true
end
if timeout then
sleep(.05)
end
end
end
@@ -2,17 +2,28 @@
local args={...}
local kernel=args[1]
kernel._G=_G
kernel._U=setmetatable({},{
__index = kernel._G,
__newindex = function(t,k,v)
if kernel.config.allowGlobalOverwrites or kernel.allowGlobalOverwrites then
rawset(t,k,v)
return
end
error("Attempt to modify global variable '"..k.."'",2)
end,
__metatable = false
})
local function fixstupidghxxexploit(tbl)
return setmetatable({},{
__index = function(t,k)
if type(tbl[k])=="table" then
return fixstupidghxxexploit(tbl[k])
else
return tbl[k]
end
end,
__newindex = function(t,k,v)
if kernel.config.allowGlobalOverwrites or kernel.allowGlobalOverwrites then
rawset(tbl,k,v)
return
end
error("Attempt to modify global variable '"..k.."'",2)
end,
__metatable = false
})
end
kernel._U=fixstupidghxxexploit(kernel._G)
kernel.allowGlobalOverwrites=true
kernel._U._G=kernel._U
kernel.allowGlobalOverwrites=false
@@ -39,7 +39,7 @@ function sys.spawn(func, name, envars, args, tgid)
status="R",
pid=id,
tgid=tgid or kernel.currentTask.tgid,
user=kernel.user,
username=kernel.username,
uid=kernel.uid,
fd={},
exit="",
@@ -86,7 +86,7 @@ function sys.getTask(pid)
status=task.status,
pid=task.pid,
tgid=task.tgid,
user=task.user,
username=task.username,
uid=task.uid,
exit=task.exit,
sleep=task.sleep,
@@ -302,7 +302,7 @@ function kernel.main()
end
if task.status == "R" then
kernel.currentTask = task
kernel.user = task.user
kernel.username = task.username
kernel.uid = task.uid
kernel.process = task.name
N = N + 1
@@ -331,14 +331,14 @@ function kernel.main()
if elapsed >= Tmax then Tmax_hit = Tmax_hit + 1 end
-- handle task results
if ret[1] == "error" then
if ret[1] == "error" or ret[1]==false then
kernel.log("processHandlerException: "..ret[2], "ERROR", 2)
task.status = "Z"
task.exit = "processHandlerException: "..ret[2]
elseif ret[1] == "timeout" then
task.ivs=task.ivs+1
task.syscallReturn = {}
elseif ret[1] == "success" then
elseif ret[1] == "success" or ret[1] == true then
task.vs=task.vs+1
if ret[2]=="syscall" then
if kernel.syscalls[ret[3]] then
@@ -25,7 +25,7 @@ kernel.tasks["1"] = {
status="R",
pid=1,
tgid=1,
user="root",
username="root",
uid=0,
fd={},
envars={},