0

Needless to I say I have no idea how to do this.

I'm performing a pentest and I found an exploit related the box : https://www.exploit-db.com/exploits/44298

In the exploit comments, the author said :

if different kernel adjust CRED offset + check kernel stack size

I see there is a variable for CRED : #define CRED_OFFSET 0x5f8 but I have no idea how to adjust it. Also, I don't see anywhere in the exploit code where I should adjust the kernel stack size.

My Kernel is 4.4.0-81-generic (Unbutu 16)

How does this get solved ?

Improve this question

1 Answer 1

Reset to default
0

CRED_OFFSET needs to be adjusted, so it's offset of cred member of struct task_struct. This can differ across kernel versions and compilation options that influence presence and size of other task_struct members. Not sure what the quickest way to check this is. I'd get target kernel vmlinux and use gdb to get the offset.

Stack refers to get_sp, where it calculates stack pointer. This can again be different (I think on newer kernels stack can be independent of task_struct, so you can't just calculate it), but if kernel version is approximately the same, you'll probably get away leaving it as is.

Improve this answer
3
  • omg. In conclusion I'm better of leaving Metasploit do this for me. lol. Anyway, how would you exactly use gdb to the offset ? Do you pass it a kernel image ?
    – steven miller
    Sep 25, 2020 at 20:41
  • Yes, you pass it a kernel image. You could cast 0 to pointer to task_struct, then print address of ->cred. From memory, something like p &(((struct task_struct*)0)->cred)
    – domen
    Sep 26, 2020 at 21:05
  • Wow. OK I think it's a bit out of my league. I'm pretty much a junior/intermediate pentester Thank you for your answer Domen
    – steven miller
    Sep 26, 2020 at 21:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .