google / google/kernel-research

expkit: Add or Document better the way to put PushIndirect pivot into Payload.

Open
#34 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
90
Forks
15
PR merge metrics
No merged PRs in 30d

Description

In order to port [exp65](https://github.com/google/security-research/blob/f102f0bad048368076affc692c6a0ceacba6eabd/pocs/linux/kernelctf/CVE-2023-4206_lts_cos_mitigation_2/exploit/lts-6.1.36/exploit.c#L663) for lts-6.1.36 to use Expkit I had to construct a Payload buffer with PushIndirect pivot being stored in first 8 bytes of the Payload.

> **_NOTE:_** If you need more details on why we need to do so, check description of stack pivot provided in Issue #33

Right now, in I'm achieving this in a following way:
```c
Payload payload(512);
payload.Reserve(0, 8);

PivotFinder pivot_finder(target.pivots, Register::RSI, payload);
auto rop_pivot = pivot_finder.PivotToRop(rop);
rop_pivot.PrintDebugInfo();

// Put PushIndirect at the very beginning of Payload
payload.Release(0, 8);
payload.Set(0, kernel_base + rop_pivot.pivot.GetGadgetOffset());

printf("[+] Payload:\n");
HexDump::Print(payload.GetUsedData());
```
in essence I have to `Release()` first 8 bytes before trying to put `PushIndirect` gadget there as `Set()` method is aware of Reserved bytes. At the same time I could not skip Reserving bytes as it'll take those 8 bytes by the rest of Stack Pivot as a result of generation with ` pivot_finder.PivotToRop(rop);`

It would be nice to have some easier way to add PushIndirect into Payload.

> **_NOTE:_** Ported exploit code: https://github.com/google/kernel-research/blob/main/expkit/samples/exp65/exploit.cpp

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.