4 ms·
I seem to recall a much earlier version of this idea, maybe ca 2008, and it came with source code, still by The Grugq. Interesting idea, it shows that Linux ex
by bediger4000 3y ago
I seem to recall a much earlier version of this idea, maybe ca 2008, and it came with source code, still by The Grugq.
Interesting idea, it shows that Linux execute(2) system call doesn't do any magic, except look at setuid bits.
Also, isn't this pretty much what Windows people call "process hollowing" or some such?
- grugq 3y agoI invented it, as far as I know. There was no publicly available code on doing this and so I wrote it. I’m not sure what the terminology is these days, but I called it userland exec() because it was an implementation of execve in userland… I wrote it in, 2003 or 2004? I can’t find an original link anymore, but I posted it to bugtraq the week after I finished it.
- bediger4000 3y agoThis is the link I was thinking of: https://seclists.org/bugtraq/2004/Jan/2 https://seclists.org/bugtraq/2004/Jan/2 By 2008, your original code didn't seem to work: https://lkml.indiana.edu/hypermail/linux/kernel/0803.3/1215.html https://lkml.indiana.edu/hypermail/linux/kernel/0803.3/1215....