Post #2142682
2026-04-29 23:04 UTC
@wolf480pl @q3k
If you managed to get the page swapped out first (with an oom condition or sth), then probably yes, but idk how the page cache interacts with .text mappings to be sure.
If that is possible, then there should be plenty of tasty targets in pid1 - systemd is a pretty thicc binary
Replies (1)
-
@q3k@social.hackerspace.pl 2026-04-29 23:17
@implr @wolf480pl You can just write to any running process' .text if you have access to the binary. You should just be able to write a better implementation of close() into /lib/libc.so.6 - one that also drops you a +s, no questions asked su in /tmp before actually closing the file, and wait until a privileged process bites.