First was to obtain the source code from blade72, /sources/apply-1.2 This wasn’t advertised, I happened to be digging around the filesystem one day and accidently stumbled upon it :) fortunately it’s pre-compiled.. I move the sources to my own box.. …
Now let’s start perfecting our exploit: STACK RANGE 0xFFBEE000 . . 0xFFBEE800 . . 0xFFBEF000 . . 0xFFBEF800 . 0xFFBF0000 The above is the typical Stack range for a 32-bit sparc app in 64-bit kernel. That’s as specific as I …
SO, back to exploiting the userland gets() function. Vulnerable Test Prog #include <stdio.h> unsigned long get_sp( void ) { __asm__("or %sp,%sp,%r1"); // %r1 may have to be %i0 in some circumstances?? weirdness.. } void copy( ){ char buf[256]; gets(buf); } …
Holy Mother of Pearl — SPARC Exploitation Excerpts! Read more »
I am reading on Source Code Auditing in the Shellcoder’s Handbook ed. 1 — Off-by-One vulnerabilities. in SPARC’s big-endian systems, they are not a real threat according to the handbook. They are still part of my research and apply to little …
After patching my /bin/bash with https://shellshocker.net/ scripts, I noticed some odd things. When I did an ssh -X, I would see this: sh: line 6: `BASH_FUNC_rvm_debug%%’: not a valid identifier Then X would start up after performing an X app, and …
Okies, so if you haven’t heard, I am hacking the Sun Blade 150, it’s a machine at school they still run that’s 10 years old. Pathetic. But it’s a good challenge for me to conquer and learn about operating systems …
Making Sense of Sun Blades and the UltraSPARC-IIe Read more »
I am reading the book Solaris Internals 1st edition where majority covers Solaris 7. I maintain this blog post as a place to show the differences I have found along the way. Solaris 7 data structure for an address …
Some grep things that I found handy: man grep Seriously. So yummy. Some handy things that I’m using right now. -A, -B, -C print an arbitrary number of lines After, Before, or Before/After the matched string line. Super cool. –no-filename, …
I am learning from the first edition of Solaris Internals, where the following is stated, talking about a user process: “Initially, a single page is allocated for the stack, and as the process executes and calls functions, it pushes the …
Find all Suid programs on disk find -follow -user root -perm -4000 -exec ls -lLdb {} \; 2>/dev/null Example Output -r-sr-xr-x 1 root 7240 Apr 10 2003 /usr/lib/utmp_update -r-s–x–x 1 root 19696 Oct 29 2003 /usr/lib/lp/bin/netpr -r-s–x–x 1 root 6848 …
Finding all suid programs on Sparc machine leads to Pwnage Read more »