google / google/kernel-research
expkit: Add or Document better the way to put PushIndirect pivot into Payload.
- Dominant language
- C++
- Stars
- 90
- Forks
- 15
- PR merge metrics
- No merged PRs in 30d
Description
In order to port [exp65](https://github.com/google/security-research/blob/f102f0bad048368076affc692c6a0ceacba6eabd/pocs/linux/kernelctf/CVE-2023-4206_lts_cos_mitigation_2/exploit/lts-6.1.36/exploit.c#L663) for lts-6.1.36 to use Expkit I had to construct a Payload buffer with PushIndirect pivot being stored in first 8 bytes of the Payload.
> **_NOTE:_** If you need more details on why we need to do so, check description of stack pivot provided in Issue #33
Right now, in I'm achieving this in a following way:
```c
Payload payload(512);
payload.Reserve(0, 8);
PivotFinder pivot_finder(target.pivots, Register::RSI, payload);
auto rop_pivot = pivot_finder.PivotToRop(rop);
rop_pivot.PrintDebugInfo();
// Put PushIndirect at the very beginning of Payload
payload.Release(0, 8);
payload.Set(0, kernel_base + rop_pivot.pivot.GetGadgetOffset());
printf("[+] Payload:\n");
HexDump::Print(payload.GetUsedData());
```
in essence I have to `Release()` first 8 bytes before trying to put `PushIndirect` gadget there as `Set()` method is aware of Reserved bytes. At the same time I could not skip Reserving bytes as it'll take those 8 bytes by the rest of Stack Pivot as a result of generation with ` pivot_finder.PivotToRop(rop);`
It would be nice to have some easier way to add PushIndirect into Payload.
> **_NOTE:_** Ported exploit code: https://github.com/google/kernel-research/blob/main/expkit/samples/exp65/exploit.cpp
Contributor guide
Assessment
This issue has not been assessed yet.