diff --git a/PwnCollege/KernelExploitation/Level1/exploit.c b/PwnCollege/KernelExploitation/Level1/exploit.c index 7634ee3..46bc506 100644 --- a/PwnCollege/KernelExploitation/Level1/exploit.c +++ b/PwnCollege/KernelExploitation/Level1/exploit.c @@ -26,9 +26,17 @@ int main() { printf("%s", &buf[0x200]); return 0; } -// $ sudo cat /proc/modules + +// Protection: +// - No KASLR. +// - CONFIG_SLAB_FREELIST_RANDOM=n +// - CONFIG_SLAB_FREELIST_HARDENED=n + +// Debug: +// Use `sudo cat /proc/modules` to get kernel module base. // gdb> add-symbol-file /challenge/challenge1.ko 0xffffffffc0000000 // gdb> b kheap_open // gdb> b kheap_ioctl -// A slot is 0x200 bytes. +// An aligned slub slot is 0x200 bytes. + // $ gcc exploit.c -o exploit \ No newline at end of file