3 ms·
No workie here on ArchLinux: $ uname -a Linux sekhmet 3.2.1-1-ARCH #1 SMP PREEMPT Fri Jan 13 06:50:31 CET 2012 x86_64 Intel(R) Core(TM) i7-2600 CPU @ 3
by lloeki 15y ago
No workie here on ArchLinux:
$ uname -a
Linux sekhmet 3.2.1-1-ARCH #1 SMP PREEMPT Fri Jan 13 06:50:31 CET 2012 x86_64 Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz GenuineIntel GNU/Linux
$ ./mempodipper
===============================
= Mempodipper =
= by zx2c4 =
= Jan 21, 2012 =
===============================
[+] Waiting for transferred fd in parent.
[+] Executing child from child fork.
[+] Opening parent mem /proc/3196/mem in child.
[+] Sending fd 3 to parent.
[+] Received fd at 5.
[+] Assigning fd 5 to stderr.
[+] Reading su for exit@plt.
[+] Resolved exit@plt to 0x401a60.
[+] Calculating su padding.
[+] Seeking to offset 0x401a57.
[+] Executing su with shellcode.
zsh: segmentation fault ./mempodipper
- caf 15y agoHave you checked if Arch's su uses a relocatable text segment?
- ahv 15y agoAlso works on Arch with minor modifications. Had to change 'exit@plt' to '<exit@plt' where it searches for the relevant function and change the program run from /bin/su to /bin/mount.
- zx2c4 15y agoThanks for the improvement. I've made the < modification in this commit: http://git.zx2c4.com/CVE-2012-0056/commit/?id=49174152d57ffc2fb7ab56b91211a3a0f78fbabb http://git.zx2c4.com/CVE-2012-0056/commit/?id=49174152d57ffc... And made a separate branch for /bin/mount: http://git.zx2c4.com/CVE-2012-0056/commit/?h=mount http://git.zx2c4.com/CVE-2012-0056/commit/?h=mount