构建具有一些内核内存泄露的应用程序
我想构建一个 C 应用程序，然后可以利用它从内核内存中获取一些机密信息。
问题是我真的不明白从哪里开始...我发现在没有对返回值进行适当检查的情况下使用 copy_to_user() 可能会导致此类问题，但我不明白它是如何发生的然后就可以被利用了。 如果您能给我一些指导，以便我能够进步，那就太好了。
编辑：我想要的是一种像这样的利用： http://inj3ct0r.com/ exploits/7837 ，其中最终转储了 X 字节的内核内存。
事实上，我不需要任何 SCTP 套接字或任何东西，但“仅”是重新创建此机密信息转储的最简单方法。
为了与缓冲区溢出进行并行，我想创建文件 vuln.c ，它将使用 gets() 函数，然后构建将完成这项工作的特殊字符串......在披露的情况下，我认为这将是另一个 C 文件。
我希望这是有道理的......
最好的。
I'd like to build a C application that I can then exploit to get some confidential information from the kernel memory.
The issue is that I don't really understand where to start... I've found that the use of copy_to_user() without appropriate checks on the return value could lead to this sort of issue, but I don't understand how it can be then exploitable.
If you could give me some pointers so I can progress, it would be great.
Edit : What I'd like to have, is a kind of exploit like this : http://inj3ct0r.com/exploits/7837 , where there is X bytes of kernel memory that are finally dumped.
The fact is I don't want any SCTP socket or anything, but "only" the easiest way to recreate this dump of confidential information.
To make a parallel with a buffer overflow, I 'd like to create the file vuln.c which would be using the gets() function, and then build the special string that will do the job... In the case of disclosure, I think that it will be another C file.
I hope this makes sense...
Best.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
现实情况是，有多种方法可以继续，具体取决于您想要学习的漏洞类型。
copy_to_user，使用关闭一个错误？The reality is that there are a number of ways to proceed depending on what sort of exploit you are trying to learn.
copy_to_userthat you want to exploit using an off by one error?假设您不关心内核内部结构，请查看此问题。
Assuming you're not after kernel internals, take a look at this question.