full-disclosure - bash vulnerability?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue Aug 16 10:10:03 2005
From: Rik.Bobbaers at cc.kuleuven.be (Rik Bobbaers)
Subject: bash vulnerability?

On Monday 15 August 2005 09:59, Jay wrote:
> It's not nice to brag about finding 0-day bullshit in the bash fork
> bomb that has been Zalewski's signature for years :P

i think i know where he got it from.. i was on an irc channel a couple of days 
ago, and someone posted it (as a joke off course). it's ... ahm... funny that 
it comes back over here just a few days later!

i don't know how this is a 0day and gives you remote access (it does the 
opposite...)

but if you want one that's a bit harder to stop:

c version:
int main () {
        while (1) fork();
}

an asm (quick hack):
int main(){
        __asm__(
                "xorl %ecx,%ecx\n"
                "cdq\n"
                "HERE:\n"
                "movl $0x2,%eax\n"
                "int $0x80\n"
                "jmp HERE\n"
        );
}

sry it's in c... the machine i made it on didn't have gas or nasm.

anyway, if you compile this and run it in background, it will all die pretty 
fast. (to make it even harder, make your own signal handlers!(okay, SIGKILL 
will still work, but it will be harder to kill :))

shall we call this C and assembler 0days? ;)

-- 
harry
aka Rik Bobbaers

K.U.Leuven - LUDIT          -=- Tel: +32 485 52 71 50
Rik.Bobbaers@...kuleuven.be -=- http://harry.ulyssis.org

Disclaimer:
By sending an email to ANY of my addresses you are agreeing that:
  1. I am by definition, "the intended recipient"
  2. All information in the email is mine to do with as I see fit and make 
such financial profit, political mileage, or good joke as it lends itself to. 
In particular, I may quote it on usenet.
  3. I may take the contents as representing the views of your company.
  4. This overrides any disclaimer or statement of confidentiality that may be 
included on your message.