0

Needless to I say I have no idea how to do this.

I'm performing a pentest and I found an exploit related the box : https://www.exploit-db.com/exploits/44298

In the exploit comments, the author said :

if different kernel adjust CRED offset + check kernel stack size

I see there is a variable for CRED : #define CRED_OFFSET 0x5f8 but I have no idea how to adjust it. Also, I don't see anywhere in the exploit code where I should adjust the kernel stack size.

My Kernel is 4.4.0-81-generic (Unbutu 16)

How does this get solved ?

1 Answer 1

0

CRED_OFFSET needs to be adjusted, so it's offset of cred member of struct task_struct. This can differ across kernel versions and compilation options that influence presence and size of other task_struct members. Not sure what the quickest way to check this is. I'd get target kernel vmlinux and use gdb to get the offset.

Stack refers to get_sp, where it calculates stack pointer. This can again be different (I think on newer kernels stack can be independent of task_struct, so you can't just calculate it), but if kernel version is approximately the same, you'll probably get away leaving it as is.

3
  • omg. In conclusion I'm better of leaving Metasploit do this for me. lol. Anyway, how would you exactly use gdb to the offset ? Do you pass it a kernel image ? Sep 25, 2020 at 20:41
  • Yes, you pass it a kernel image. You could cast 0 to pointer to task_struct, then print address of ->cred. From memory, something like p &(((struct task_struct*)0)->cred)
    – domen
    Sep 26, 2020 at 21:05
  • Wow. OK I think it's a bit out of my league. I'm pretty much a junior/intermediate pentester Thank you for your answer Domen Sep 26, 2020 at 21:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.