3. Enable testing mode with the -z option. This uses a special test
shellcode that will setrlimit(RLIM_CPU, ...); with a 20 second hard limit
and then enter an infinite loop. Without the setrlimit(), there'd be a nasty
hang on a lot of boxes. The purpose of this shellcode is to let you know
that the packet_close() cleanup function pointer (see DETAILS) has been
overwritten. You'll know this because the client will seem to hang much
longer than it would on a failed exploitation attempt. The default number of
repetitions for this shellcode is 10,000. This appears to be optimal and
ensures that for each chunk size tried (see step 4) you'll know it's either
a valid chunk size or not, because if it's valid, the function pointer will
most definitely be overwritten.
No comments:
Post a Comment