Though I didn’t mention it in the article, I did think of dlsym before looking into mmap but the issue is the same as execve, that is there is no symbol that is usable most of the time that lives in the same object as dlsym.
If we wanted to go further, an option would be to reimplement dlsym in user code, leak the base address of libc by reading /proc/<pid>/maps and load symbols. We still need what’s done in the article to get open/read access.
Though I didn’t mention it in the article, I did think of
dlsymbefore looking intommapbut the issue is the same asexecve, that is there is no symbol that is usable most of the time that lives in the same object asdlsym.If we wanted to go further, an option would be to reimplement
dlsymin user code, leak the base address oflibcby reading/proc/<pid>/mapsand load symbols. We still need what’s done in the article to getopen/readaccess.score 1 · canonical