Though I didn’t mention it in the article, I did think of dlsym before looking into mmap but the issue is the same as execve, that is there is no symbol that is usable most of the time that lives in the same object as dlsym.
If we wanted to go further, an option would be to reimplement dlsym in user code, leak the base address of libc by reading /proc/<pid>/maps and load symbols. We still need what’s done in the article to get open/read access.
Love the cat-and-mouse game of casual sandboxing like this. My guess would be that
dlsym(RTLD_NEXT, "execve")should work as well.score 1 · canonical
Only if
dlsymis an allowed symbol.score 1 · canonical
Though I didn’t mention it in the article, I did think of
dlsymbefore looking intommapbut the issue is the same asexecve, that is there is no symbol that is usable most of the time that lives in the same object asdlsym.If we wanted to go further, an option would be to reimplement
dlsymin user code, leak the base address oflibcby reading/proc/<pid>/mapsand load symbols. We still need what’s done in the article to getopen/readaccess.score 1 · canonical