Re: [Full-disclosure] Symlink vulnerabilities

[Benjamin Renaut <benml@xxxxxxxxxx>]

On 27/10/11 19:34, vladz wrote:
> Nice thing, but for sure, it can be optimized. For example, to save 
> time, I would suggest you to use rename() instead of using both 
> unlink() and rmdir() functions. Same thing for your write_shellcode() 
> function, it contains too much calls. It would be preferable to create 
> your nasty shell script first, and then (when it's time), rename() it 
> as dirname. Cheers, 

True !
Several people also suggested using inotify instead of looping over 
opendir/readdir like crazy. I tried that but strangely enough, it seems 
to decrease the chances of success (in my test env and with the code 
as-is, exploitation succeeds in most cases anyway with the dirent 
version) - I'm wondering if the very fact that there's an horrible 
while(1) taking up much of the CPU doesn't actually help by slowing down 
the system.
Cheers

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/