Re: Kernel exploit in brk() function.

Christophe Devine дµÀ:

>Ian Molton <[email protected]> wrote:
>
>  
>
>>>Seems this is how the debian servers got rooted last week.  Fixed in
>>>2.4.23. 
>>>      
>>>
>
>  
>
>>Impressive. fixed before release of a broken version, then discovered ;-)
>>    
>>
>
>The team that created the exploit just released the source, which is an
>impressive piece of work, and actually works. I tested it on Debian 3.0:
>
>bash-2.05a$ gcc -static hatorihanzo.c
>bash-2.05a$ ./a.out
>sh-2.05a# id
>uid=0(root) gid=0(root)
>
>You can download the code at http://www.cr0.net:8040/misc/hatorihanzo.c
>
>  
>
this my test on RH7.2 kernel 2.4.7

[ts@vs_ftp ts]$ cat /etc/redhat-release
Red Hat Linux release 7.2 (Enigma)
[ts@vs_ftp ts]$ uname -a
Linux vs_ftp 2.4.7-10 #1 Thu Sep 6 17:27:27 EDT 2001 i686 unknown
[ts@vs_ftp ts]$ gcc -static hatorihanzo.c
[ts@vs_ftp ts]$ ./a.out
[-] Unable to change page protection: Bad address
[-] Unable to exit, entering neverending loop.

[1]+ Stopped ./a.out
[ts@vs_ftp ts]$ id
uid=502(ts) gid=502(ts) groups=502(ts)
[ts@vs_ftp ts]$ ps
PID TTY TIME CMD
19412 pts/1 00:00:00 bash
19468 pts/1 00:00:01 a.out
19471 pts/1 00:00:00 ps
[ts@vs_ftp ts]$

-- 
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page