Is there anyone experienced with systrace who might be able to answer the follow question?!

I am looking to run an exploit under systrace. The exploit is a ctorrent exploit
and it is found at http://www.milw0rm.com/exploits/8470. ctorrent is a torrent
application and the exploit is a python script which coverts a torrent file to
a malicious torrent which, when run by ctorrent, causes a buffer overflow
attack and a Segmentation fault message appears. I have successfully run the
exploit using ctorrent and get the appropriate message, however, when I run it
using systrace while enforcing a policy I don't get the Segmentation fault
message, and I don't get any log errors, but a multitude of system calls are
being performed and the actions completes.

I have also changed the policy to remove permissions of a system call which the
exploit requires, and when run under systrace -a, it logs this error and an
error messages comes up saying the operation can not be performed. It seems to
me as if the action is taking place, however the Segmentation fault message
simply isn't being displayed... but this doesn't make sense to me...

Is there any information or help that you could provide me with to help me
conclude whether or not the exploit is being properly executed, and a message
just isn't being displayed?

Your post might violate a forum rule:

• Posts containing information about cracking, piracy, warez, fraud or any topic that could be damaging to either LinuxQuestions.org or any third party will be immediately removed.

Click here to read a complete list of forum rules.

Really? It sounds more to me the guy is trying to do a trace of what the code is doing, see what the code is exploiting. This is a security question, not a leet d00d haxx0r question.

Actually, I am trying to do research for a vulnerability analysis tool which is used to test the vulnerabilities of IDSs (intrusion detection systems) so it would be considered white-hat hacking. The vulnerability analysis tool tries to alter the system calls of the exploit to decrease the anomaly rate of the IDS and thus identifying the IDS weakness...

And, I am a not a guy, I am a girl...

But really, any help would be greatly appreciated.

I'd love to know who wrote that 'exploit'- not even my students write python that poorly.

So break this down; you essentially need to know whether the exploit is being run or not? Why not check it's exist status? Just modify the code to use exit statuses.

Of course, and this may be a stupid question, you are trying this on a 2.4 kernel with python 1.5, right?

(Sorry for the gender confusion, its often a safe assumption, for what its worth)

Hi! Thanks for replying, and unfortunately, it is often a safe assumption.

I am using a RHL9.0 with a 2.4.20 kernel rather than 27, but I made an assumption that because it is an older version that it would be OK. I am also using the correct version of python and the ctorrent application.

The exploit works by changing the contents of the torrent file, so writing an exit status in the python code itself wouldn't be helpful as it is the torrent file itself which executes the exploit... So, I am rather stuck.

Ah, I thought you meant the python ought to be seg faulting. Well, can't you trace it's completion based upon whether or not the expected result happens? That is to say, is port 4444 listening?