RE: https://swecyb.com/@orlysec/116534940626646604
I'm too tired to troll the whole "FreeBSD had a vuln ZOMG" thing so maybe some of you would rather do it today.
Timeline
Post
Remote status
Context
2
@cR0w I keep trying to run it on my FreeBSD workstation and it never gets me root it just keeps crashing lol
=== EXEC-1 LPE v21: LD_PRELOAD injection ===
N=128 entries, OOB=2024 bytes, D=265166
Target: /usr/libexec/sshd-session via LD_PRELOAD=/tmp/evil.so
Rounds: 10000, mem_churn: 0MB
P(panic first trigger) = 1/128 = 0.8%
mlock (non-fatal): Cannot allocate memory
[*] Preseed: 2686 env entries (2652 pad + 35 payload)
[*] Copyin iterations: ~2686 (est ~8ms per exec)
[*] Payload: 229 bytes at D=265166 (OOB=2024, margin=1795)
[*] Preseeding all 128 entries...
zsh: segmentation fault ./a.out
=== EXEC-1 LPE v21: LD_PRELOAD injection ===
N=128 entries, OOB=2024 bytes, D=265166
Target: /usr/libexec/sshd-session via LD_PRELOAD=/tmp/evil.so
Rounds: 10000, mem_churn: 0MB
P(panic first trigger) = 1/128 = 0.8%
mlock (non-fatal): Cannot allocate memory
[*] Preseed: 2686 env entries (2652 pad + 35 payload)
[*] Copyin iterations: ~2686 (est ~8ms per exec)
[*] Payload: 229 bytes at D=265166 (OOB=2024, margin=1795)
[*] Preseeding all 128 entries...
zsh: segmentation fault ./a.out
@feld Aww, that's no fun.
Replies
1