# # # redhat:/usr/src# rpm -ivh libsafe-2.0-2.i386.rpm libsafe ################################################## # # # redhat:/usr/src/# new.tar zxvfp libsafe-2.0-2.tgz # # # /usr/local/src# new.tar zxvfp libsafe-2.0-2.tgz # /usr/local/src/libsafe-2.0-2# make # /usr/local/src/libsafe-2.0-2# make install # # # vi ~/.bashrc vi /etc/profile ... export LD_PRELOAD=/lib/libsafe.so.2 # # ldconfig -p ldconfig -v # # see /var/log/secure # # # # Sources # -------- redhat:/usr/local/src/libsafe-2.0-2# make # # redhat:/usr/local/src/libsafe-2.0-2/exploits# make # redhat:/usr/local/src/libsafe-2.0-2/exploits# ./int.sh t1 redhat:/usr/local/src/libsafe-2.0-2/exploits# ./int.sh t3 redhat:/usr/local/src/libsafe-2.0-2/exploits# ./int.sh t4 # redhat:/usr/local/src/libsafe-2.0-2/exploits# ./canary-exploit # - it worked - exploited ...have /bin/sh prompt: ( sh-2.04# ) # ============= # redhat:/usr/local/src/libsafe-2.0-2/exploits# ./xlock -nolock # # grep libsafe /var/log/secure # # load the env variable # redhat:/usr/local/src/libsafe-2.0-2/src# source /etc/profile # redhat:/usr/local/src/libsafe-2.0-2/exploits# ./exploit-non-exec-stack # - it did NOT work this time # ============ # # # To Unload libsafe # ================= # unset libsafe # # # end of file