arno/kernel_rop
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
4 Commits 3 Branches 0 Tags 42 KiB
C 88.7%
Python 7%
Makefile 4.3%
b5dab95d89
Go to file
Hashcrack b5dab95d89 added the ROP exploit
2016-06-22 22:00:49 +10:00
drv.c vulnerable kernel driver 2016-01-19 22:57:11 +11:00
drv.h vulnerable kernel driver 2016-01-19 22:57:11 +11:00
find_offset.py added the ROP exploit 2016-06-22 22:00:49 +10:00
Makefile vulnerable kernel driver 2016-01-19 22:57:11 +11:00
README.md fixed readme 2016-01-20 15:06:35 +11:00
rop_exploit.c added the ROP exploit 2016-06-22 22:00:49 +10:00
trigger.c vulnerable kernel driver 2016-01-19 22:57:11 +11:00

README.md

Linux Kernel ROP demo

This is a vulnerable Linux kernel driver used to demonstrate in-kernel privilege escalation ROP (Return Oriented Programming) chain in practice. The article URL for Part 1 is available at https://cyseclabs.com/page?n=17012016.

The driver module is vulnerable to OOB access and allows arbitrary code execution. An arbitrary offset can be passed from user space via the provided ioctl(). This offset is then used as the index for the 'ops' array to obtain the function address to be executed.

  • drv.c - vulnerable kernel driver
  • trigger.c - user-space application to trigger the OOB access via the provided ioctl

The goal is to construct and execute a ROP chain that will satisfy the following requirements:

  • Execute a privilege escalation payload
  • Data residing in user space may be referenced (i.e., "fetching" data from user space is allowed)
  • Instructions residing in user space may not be executed