-1

I've found many exploits for Dirty COW vulnerability with many methods that written in C programming language.

But I want to test this vulnerability on a target that doesn't have gcc as C compiler (or any other C compilers). So I can't use these exploits on that target.

And here is the question, Is there any Dirty COW exploits that written in bash scripting language? Or is there any way to use Dirty COW vulnerability without using gcc?

  • 5
    You can always download pre-compiled binaries (risky), or compile them on another machine similar to the target machine. – Mark Buffalo Oct 5 '17 at 17:19
1

What you can do that would be waaayyy easier than that, is to statically compile a working 32bit exploit and upload it into your target.

Here are some exploit implementations that might help you.

Now, answering your question, no, the vulnerability relies on using specific system calls, so you would be subject to whatever functions the developer decided to use, making it harder or impossible to exploit. Also, the issue uses a race condition to exploit the defective code. Supposing that that issue didn't exist, If you tried to use bash for that, this race condition attempts would suffer, as the execution chain would run through all the code layers going from scripting translation into real memory manipulation functions, only then arriving at the desired location. I cannot say that it would be impossible, but it would be painfully hard to do it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.