An obscure kernel feature to get more info about dying processes

#1

Post by ice799 » Mon, Sep 20, 2010, 4:05 PM UTC

An obscure kernel feature to get more info about dying processes
timetobleed.com

Re: An obscure kernel feature to get more info about dying processes

#2

Post by JoeAltmaier » Mon, Sep 20, 2010, 4:54 PM UTC

Hook root when a process crashes? How long until an exploit?

Re: An obscure kernel feature to get more info about dying processes

#3

Post by [deleted] » Mon, Sep 20, 2010, 4:59 PM UTC

JoeAltmaier wrote: post #2

Hook root when a process crashes? How long until an exploit?

[deleted]

Re: An obscure kernel feature to get more info about dying processes

#4

Post by InclinedPlane » Mon, Sep 20, 2010, 5:03 PM UTC

JoeAltmaier wrote: post #2

Hook root when a process crashes? How long until an exploit?

If you have the ability to modify or create files in /proc you almost certainly already control the system.

Re: An obscure kernel feature to get more info about dying processes

#5

Post by [deleted] » Mon, Sep 20, 2010, 5:03 PM UTC

[deleted]

Re: An obscure kernel feature to get more info about dying processes

#6

Post by [deleted] » Mon, Sep 20, 2010, 5:07 PM UTC

JoeAltmaier wrote: post #2

Hook root when a process crashes? How long until an exploit?

[deleted]

Re: An obscure kernel feature to get more info about dying processes

#7

Post by [deleted] » Mon, Sep 20, 2010, 5:10 PM UTC

JoeAltmaier wrote: post #2

Hook root when a process crashes? How long until an exploit?

[deleted]

Re: An obscure kernel feature to get more info about dying processes

#8

Post by dododo » Mon, Sep 20, 2010, 5:11 PM UTC

InclinedPlane wrote: post #4

JoeAltmaier wrote: post #2

Hook root when a process crashes? How long until an exploit?

If you have the ability to modify or create files in /proc you almost certainly already control the system.

on the other hand, it makes for an interesting rootkit hook.

Re: An obscure kernel feature to get more info about dying processes

#9

Post by moonpolysoft » Mon, Sep 20, 2010, 5:12 PM UTC

[deleted] wrote: post #5

[deleted]

Why you mad tho?

Re: An obscure kernel feature to get more info about dying processes

#10

Post by gruseom » Mon, Sep 20, 2010, 5:12 PM UTC

[deleted] wrote: post #5

[deleted]

I read it as simply that he was excited about something cool he found. And it is cool. Perhaps you already knew about it; I didn't. Either way, there's no need to be an asshole. ("This plebe"? That's crossing the A-line.)