thesnkchrmr.wordpress.com
RageAgainstTheCage | thesnkchrmr
https://thesnkchrmr.wordpress.com/2011/03/24/rageagainstthecage
Skip to main content. Skip to secondary content. Full disclosure for people. Udev Exploit (exploid) →. March 24, 2011. This post gives a detailed explanation of the RageAgainstTheCage (RATC) exploit. Also commonly known as the “. Adb setuid exhaustion attack. Getrlimit(RLIMIT NPROC, &rl). If a process tries to perform a fork and the user that owns that process already. RLIMIT NPROC processes, then the fork fails. Adb pid = find adb();. This function merely finds the adbdaemon’s. Kill(adb pid, 9);. This i...
thesnkchrmr.wordpress.com
About Me | thesnkchrmr
https://thesnkchrmr.wordpress.com/about
Skip to main content. Skip to secondary content. Full disclosure for people. I am an awfully bored grad student. With no better thing to do in my life, I decided to create this blog to see how I could bore people in newer ways. PS: I can’t believe you actually read this far… Go, get a life, start a blog, maybe then, I could read your. 3 responses ». March 26, 2011 at 8:03 pm. I hope there are no prizes for the first comment on the about page🙂. March 27, 2011 at 7:46 pm. No This made me look like an idiot.
linux.slashdot.org
Local Privilege Escalation On All Linux Kernels - Slashdot
https://linux.slashdot.org/story/09/08/13/2022212/Local-Privilege-Escalation-On-All-Linux-Kernels
Slashdot is powered by your submissions. So send in your scoop. Discover the Many Uses of Python and Strive Towards a Successful IT System Administration Career with 60 Hours of Training for 95% off. Local Privilege Escalation On All Linux Kernels. On Thursday August 13, 2009 @04:54PM. QuesarVII writes "Tavis Ormandy and Julien Tinnes have discovered a severe security flaw in all 2.4 and 2.6 kernels. You may like to read:. 18M Contract For Transparency Website Released — But Blacked Out. On Thursday Augu...
thesnkchrmr.wordpress.com
udev Exploit (exploid) | thesnkchrmr
https://thesnkchrmr.wordpress.com/2011/03/27/udev-exploit-exploid
Skip to main content. Skip to secondary content. Full disclosure for people. March 27, 2011. This post explains the exploid exploit or the udev exploit. You copy the exploid binary onto /sqlite stmt journals/exploid. The /sqlite stmt journals directory is used because it has the RW permissions for any user. If (geteuid() = 0 & getuid()! This checks for the Effective User ID (EUID) and the Real User ID (UID). Every process in a *nix machine is associated with a EUID and a UID. Is the same as. Netlink is u...
thesnkchrmr.wordpress.com
thesnkchrmr | thesnkchrmr
https://thesnkchrmr.wordpress.com/author/thesnkchrmr
Skip to main content. Skip to secondary content. Full disclosure for people. March 27, 2011. This post explains the exploid exploit or the udev exploit. You copy the exploid binary onto /sqlite stmt journals/exploid. The /sqlite stmt journals directory is used because it has the RW permissions for any user. If (geteuid() = 0 & getuid()! This checks for the Effective User ID (EUID) and the Real User ID (UID). Every process in a *nix machine is associated with a EUID and a UID. Is the same as. Netlink is u...
lcamtuf.coredump.cx
The Tangled Web
http://lcamtuf.coredump.cx/tangled
A Guide to Securing Modern Web Applications. Is my second book, a lovingly crafted guide to the world of browser security. It enters an overcrowded market, but there are two reasons why you may want to care. First of all, where other books simply dispense old and tired advice on remediating common vulnerabilities, The Tangled Web. The other reason is that it is based on years of original research - including, of course, my Browser Security Handbook. The book was published by No Starch Press. Helion), Kor...
blog.do9.kr
do9dark
http://blog.do9.kr/category/Wargame/Pwn
에 해당되는 글 3. S/W 신규 취약점 - XE. The GNU C library dynamic linker expands $ORIGIN in setuid library search path. SHA-1 함수는 SHA(Secure Hash Algorithm)이라 불리는 SHA 함수 중 하나이며, 많은 곳에서 쓰이고 있다. SHA-1의 해시값 크기는 160bit이며 16진수로 40개의 문자로 표현된다. 간단하게 "do9dark" 값과 .(점)을 찍은 "do9dark." 값의 SHA-1 해시값을 비교하면 눈사태 효과(쇄도 효과)에 의해서 출력값에 상당한 변화가 발생된다. SHA1("do9dark.") = 16e9f7ac968899b5d94eff21fe4918a651e75fde. 이러한 특징 때문에 파일, 인증서 등에 위변조 판단 여부로도 많이 사용되고 있다. 2017년 2월 23일,. Google Security Blog를 통해서 ". Announcing the first SHA1 collision.
blog.cr0.org
cr0 blog: June 2009
http://blog.cr0.org/2009_06_01_archive.html
A blog about IT security and other geek interests. Friday, June 26, 2009. Bypassing Linux' NULL pointer dereference exploit prevention (mmap min addr). And others have a story about an exploit by Bradley Spengler. Which uses our technique to exploit a null pointer dereference in the Linux kernel. EDIT2: As of July 13th 2009, the Linux kernel integrates our patch. 2631-rc3). Our patch also made it into -stable. EDIT1: This is now referenced as a vulnerability and tracked as CVE-2009-1895. This used to not...
