RE: [Openvds-devel] Control Panel for OpenVDS-2

[Paul Sladen]

On Mon, 14 Jan 2002, Dave Cost wrote:

> > You'll have to have some *tight* capabilites;  consider that:
> >
> >   a) root can create a hard link to inode zero (jail busted).
> >
> >   b) do anything they want with /proc/kcore (*whatever* to *whoever*).
> 
> Could you please provide pointers to some working exploits so I can run some
> tests?

First one requires system calls--second one is as simple as:

  cat /dev/zero > /proc/kcore

  <crash>

And again, remember that even if the dev-nodes don't exist, *root* can
easily recreate them!

> You'll only be able to bind the virtual address even if you bind
> 0.0.0.0,

Excellent!

        -Paul