search

worawit / CVE-2021-3156

Sudo Baron Samedit Exploit
BSD 3-Clause "New" or "Revised" License
737 stars 168 forks source link

Can you make Exploit code in 32bit? (no tcache) #4

Closed BruteKoon closed 3 years ago

BruteKoon commented 3 years ago

Hi!, I want to make exploit code in 32 bit environment.

There have been various attempts, but the most fundamental problem is that there is only one space(Unsorted bin) in the bins just before the overflow buffer is allocated.

image

Is there any way to increase this? (i want to use small bins, fast bins... but always Only unsorted bins remain.)

**

BruteKoon commented 3 years ago

Oh, and the create_libx code is missing in exploit_nss_u14.py.

worawit commented 3 years ago

Thanks for reporting. I added missing create_libx in exploit_nss_u14.py.

I have no plan to support Linux 32 bit.

Exploiting without tcache on debian based (including Ubuntu) by overwriting struct serviceuser is not straightforward. On 64 bit, I had to trace heap usage and adjust number of argument to make a fastbin existed. Then, I tried with many LC* combination to get a free fastbin before struct service_user.

I don't know if it is possible to overwrite struct service_user on Ubuntu 14.04 32 bit. But overwriting userspec method should be possible.