News for hackers. Stuff that matters.

A comment on Linux PIE/stack corruption. Parent comment

Re:Linux PIE/stack corruption by bennofs on Friday September 29, 2017 @06:05AM (#15364013)
You can exploit existing binaries such as ping that have special capabilities or are setuid to get privilege escalation.

A better link would have been https://www.qualys.com/2017/09/26/cve-2017-1000253/cve-2017-... which also explains an actual exploit.

[ Parent | on HN ]
Re:Linux PIE/stack corruption by willvarfar on Friday September 29, 2017 @06:09AM (#15364032)
Fair enough.

(But e.g. ping doesn't >128MB .data+.bss? ;) )

[ Parent | on HN ]
Re:Linux PIE/stack corruption by bennofs on Friday September 29, 2017 @06:30AM (#15364100)
The article also explains this. It seems to be possible to get a much smaller distance if you eat up a lot of stack space using large execve arguments for example (this might be wrong, I haven't 100% understood all details yet). But the article has a POC for ping.
[ Parent | on HN ]