パッケージのページはここ。自分がco-maintainerになって初のバージョン。
動作確認はlibsafe付属のexploitで可能。でも、libsafeはdebianに入っていないので(；∀；) アップストリームから要ダウンロード。
mars:/home/masami/libsafe-2.0-16/exploits# ls canary-exploit exploit-non-exec-stack Makefile t10.c t1w.c t3w t4.c t5 t6.c canary-exploit.c exploit-non-exec-stack.c README t1.c t3 t3w.c t4w t5.c core int.sh t1 t1w t3.c t4 t4w.c t6 mars:/home/masami/libsafe-2.0-16/exploits# cat /proc/sys/kernel/exec-shield <-- 設定を確認 1 <-- 1なのでexec-shield機能は有効 mars:/home/masami/libsafe-2.0-16/exploits# ./t1 <-- exploit実行 This program tries to use strcpy() to overflow the buffer. If you get a /bin/sh prompt, then the exploit has worked. Press any key to continue... <-- enterキーを押してshellが立ち上がればexploit成功 Segmentation fault <-- 落ちたのでexec-shieldが機能している mars:/home/masami/libsafe-2.0-16/exploits# echo 0 > /proc/sys/kernel/exec-shield <-- exec-shieldを無効に mars:/home/masami/libsafe-2.0-16/exploits# ./t1 <-- もう一回実行 This program tries to use strcpy() to overflow the buffer. If you get a /bin/sh prompt, then the exploit has worked. Press any key to continue... sh-3.2# exit <-- プロンプトが変わってshellが立ち上がったのでexploit成功 exit mars:/home/masami/libsafe-2.0-16/exploits# echo 1 > /proc/sys/kernel/exec-shield <-- 再度exec-shieldを有効に mars:/home/masami/libsafe-2.0-16/exploits# ./t1 <-- exploit実行 This program tries to use strcpy() to overflow the buffer. If you get a /bin/sh prompt, then the exploit has worked. Press any key to continue... Segmentation fault <-- exec-shield機能が有効なのでshellが立ち上がらない
dmesgするとこんな感じのログが出る。
[ 192.134999] t1[3673] general protection ip:80485a8 sp:bfa05eec error:0 in t1[8048000+1000] [ 227.539664] t1[3774] general protection ip:80485a8 sp:bfc028ec error:0 in t1[8048000+1000]
