Updated Level1 of KernelExploitation
This commit is contained in:
@@ -26,9 +26,17 @@ int main() {
|
||||
printf("%s", &buf[0x200]);
|
||||
return 0;
|
||||
}
|
||||
// $ sudo cat /proc/modules
|
||||
|
||||
// Protection:
|
||||
// - No KASLR.
|
||||
// - CONFIG_SLAB_FREELIST_RANDOM=n
|
||||
// - CONFIG_SLAB_FREELIST_HARDENED=n
|
||||
|
||||
// Debug:
|
||||
// Use `sudo cat /proc/modules` to get kernel module base.
|
||||
// gdb> add-symbol-file /challenge/challenge1.ko 0xffffffffc0000000
|
||||
// gdb> b kheap_open
|
||||
// gdb> b kheap_ioctl
|
||||
// A slot is 0x200 bytes.
|
||||
// An aligned slub slot is 0x200 bytes.
|
||||
|
||||
// $ gcc exploit.c -o exploit
|
||||
Reference in New Issue
Block a user