Dailydave: Re: re: PaX PoC-exploit.

[Sinan Eren <sinan.eren () immunitysec com>]

i am happy that Joel came up with that unnecessary and much pointless poc  
code, here you GO! we end up learning something of this novel and smart:
"""
pageexec () freemail hu wrote:

> as i said, only for the trivial case (/lib/ld-linux.so.2 /mnt/nonexec/app),
> you can still construct a special ELF without executable PT_LOAD segments
> that would overlap the stack and do a ret2libc to mprotect then execute
> itself - that was the PoC i was referring to (and that's what won't work
> under PaX).
"""

this is a real cool technique!

thanks,
-sinan
_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
http://www.immunitysec.com/mailman/listinfo/dailydave