Linux Kernel Do_brk(), Another Proof-of-Concept Code For I386
7 Dec. 2003
Summary
The previous version of the exploit was relying on the Linux ELF loader to call do_brk for us. This one uses sys_brk(), but to bypass a check of available memory in sys_brk we still have to map our code high in memory (but not past PAGE_OFFSET this time).
To be able to call sys_brk successfully we need to make sure that the stack isn't above our program (in most cases we have to move it).
Credit:
The information has been provided by Julien TINNES
Exploit:
; Use NASM 0.98.38 or higher to compile.
; Christophe Devine (devine at cr0.net) and Julien Tinnes (julien at cr0.org)
;
; This exploit uses sys_brk directly to expand his break and doesn't rely
; on the ELF loader to do it.
;
; To bypass a check in sys_brk against available memory, we use a high
; virtual address as base address
;
; In most case (let's say when no PaX w/ ASLR :) we have to move the stack
; so that we can expand our break
;
