ptrace/kmod exploit still works in 2.4.21?

ptrace/kmod exploit still works in 2.4.21?

[Pete Taphouse]

[-- Attachment #1: signed data --]
[-- Type: text/plain, Size: 949 bytes --]

Hi,

I've been doing some experiments with the 2.4.21 kernel, and the ptrace 
exploit: the result of which is that I've compiled a kernel with the 
processor set to i386.  I then ran this kernel on 2 computers, one is a Duron 
machine with SIS chipset, the other is a Pentium 4 machine with the Intel 845 
chipset. The exploit still gave me a root shell on the Pentium 4 machine, but 
didn't on the Duron one.

I've read the previous post about this, and in both cases I only logged in as 
an unprivileged user.  I didn't login as root and then su to an unprivileged 
use first. I checked to see that I was root by opening /etc/shadow.

The exploit used was:
http://packetstormsecurity.nl/0304-exploits/ptrace-kmod.c

The config file for the kernel I compiled is at:
http://www.bytemark-hosting.co.uk/config.txt

Any ideas?

-- 
Peter Taphouse

Bytemark Hosting
http://www.bytemark-hosting.co.uk
tel. +44 (0) 8707 455 026

[-- Attachment #2: signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: ptrace/kmod exploit still works in 2.4.21?

[Andre Tomt]

On ons, 2003-06-18 at 13:22, Pete Taphouse wrote:
<snip FAQ>

Check your exploit binary for the suid flag. If run successfully once on
a older kernel, it cheats by setting suid root.

-- 
Mvh,
André Tomt

Re: ptrace/kmod exploit still works in 2.4.21?

[Pete Taphouse]

[-- Attachment #1: signed data --]
[-- Type: text/plain, Size: 397 bytes --]

On Wednesday 18 June 2003 12:38, you wrote:
> On ons, 2003-06-18 at 13:22, Pete Taphouse wrote:
> <snip FAQ>
>
> Check your exploit binary for the suid flag. If run successfully once on
> a older kernel, it cheats by setting suid root.
Doh!  Apologies for time/space wastage.

Cheers,
-- 
Peter Taphouse

Bytemark Hosting
http://www.bytemark-hosting.co.uk
tel. +44 (0) 8707 455 026

[-- Attachment #2: signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]