Ayer volvió a escribir Specter y contó el problema que tiene que solventar, al parecer cuando se cierra el webkit el exploit kernel muere tambien. Os dejo la conversación:
Specter - Yesterday at 11:09 PM
Exploit part is done, patches are applied and payloads can be ran but exiting WebKit = RIP
Write-up I'll probably put out a little bit after the exploit
I want to polish it up and add more
X41 - Yesterday at 11:11 PM
aww shame, i was hoping i could get to read it asap :T
does webkit shit its pants when you try to exit or the kernel?
Specter - Yesterday at 11:11 PM
Kernel
If it were WebKit would be no issue
X41 - Yesterday at 11:12 PM
you know why yet, or does the lack of a proper debugger get in the way?
Specter - Yesterday at 11:13 PM
I know why but I don't know why
Specter - Yesterday at 11:13 PM
I know where it's crashing, but the code shouldn't be getting executed that's crashing it
X41 - Yesterday at 11:14 PM
the crash happens when you to to kill webkit though, right?
have you tried to fork something in the background from userspace and run the kexploit from there? you should then be able to close webkit without influencing the kernel
rriiight?
Specter - Yesterday at 11:15 PM
Can't fork without privileges