k3170

Search This Blog

About me

Get link
Facebook
Twitter
Pinterest
Email
Other Apps

Get link
Facebook
Twitter
Pinterest
Email
Other Apps

[Linux Kernel Exploitation 0x0] Debugging the Kernel with QEMU

Hi folks, in this post I'm going to walk through how to setup the linux kernel for debugging. I will also demonstrate that the setup works by setting a break-point to a test driver I wrote myself. All the code will be available from my gitlab, all the links to my gitlab will be re-posted at the end. The setup I describe here re-uses some parts of the syzkaller setup, and for good reason later on in the post series I will break into a tutorial for the syzkaller tool as well. So lets get on with it. Screenshot of a successful debug session with full debug symbols for the kernel! We can even see the call to start_kernel and a frame before that as well! The Process Okay so we want to study kernel exploitation but given that the kernel isn't something totally accessible in userspace, its not as convenient to debug as userpace stuff, we need a bit of a run up before we can actually poke and prod the kernel to figure out how to write our exploits. So there's a number of importa

The Science of Google Dorking

In this post I'm in proposing some new and improved Google dorks for hackers/pentesters and generally any one that likes finding web based targets based on the vulnerabilities they expose, the dorks I will discuss here include servers exhibiting: Local file inclusion / Remote File inclusion vulnerabilities SQL injection Error based injection

[Memory Corruption Bugs] Lftp Null pointer dereference (<= 4.9.1) in CmdExec::FeedCmd

Date: 06-21-20 Vendor Homepage: https://lftp.yar.ru/ Software Link: http://lftp.yar.ru/ftp/lftp-4.9.1.tar.gz Version: <= 4.9.1 Bug link: https://github.com/lavv17/lftp/issues/593 I've discovered a null pointer deference bug in LFTP version 4.9.1 which probably affects previous versions. The bug occurs in CmdExec::FeedCmd and triggers in strlen due to a null pointer argument. The following gdb trace demonstrates this: (gdb) r -f lftp_cmdfile_fuzz/crashes/id:000000,sig:11,src:000000,op:havoc,rep:4 The program being debugged has been started already. ... Breakpoint 5, 0x0000000000461b61 in CmdExec::FeedCmd(char const*) () (gdb) x/5ig $rip => 0x461b61 <_ZN7CmdExec7FeedCmdEPKc+97>: callq 0x43a3a0 <strlen@plt> 0x461b66 <_ZN7CmdExec7FeedCmdEPKc+102>: mov %rbx,%rdi 0x461b69 <_ZN7CmdExec7FeedCmdEPKc+105>: mov %r14,%rsi 0x461b6c <_ZN7CmdExec7FeedCmdEPKc+108>: mov %eax,%edx 0x461b6e <_ZN7CmdExec7FeedCmdEPKc+110>:

Powered by Blogger

Keith Makan