Vulnerability Development mailing list archives

some things to play with


From: typo () SCENE AT (Firstname Lastname)
Date: Thu, 13 Jul 2000 11:39:31 +0200


too lazy to check thse:

enemy:~# perl5.6.0 -e 'print "\$\{" . "x" x 300 . "};"' > frob.pl
enemy:~# perl5.00503 frob.pl
Segmentation fault (core dumped)
enemy:~# perl5.6.0 frob.pl
Identifier too long at frob.pl line 1.

enemy:~# cat 2b.c
#include <unistd.h>
int main(int argc, char **argv) {
    if (argc < 2)
        exit(-1);
    execvp(argv[1], &argv[2]);
}

null pointer crashes in str(r)chr(), basename, ...
weird behaviour in some other privileged programs (argc = 0)...
enemy:~# ./2b /usr/bin/gpasswd
Segmentation fault (core dumped)
enemy:~# ./2b /usr/bin/at
Segmentation fault (core dumped)
enemy:~# ./2b /usr/bin/chage
Segmentation fault (core dumped)
...(lots more)

never said any of these are exploitable..

--
so much entropy, so little time



Current thread: