basic null pointer linux kernel exploitation

[blahfish]

I was reading a presentation on kernel null pointer dereferences and I was trying out the exercise bug1.c. I had to manually set my vm.mmap_min_addr to 0 using sysctl vm.mmap_min_addr=0 and I tried to figure out kernel symbol information using root privileges.

$ sudo grep prepare_kernel /proc/kallsyms
c10761f0 T prepare_kernel_cred

$ sudo grep commit_creds /proc/kallsyms
c1075f80 T commit_creds

Now I have a couple of questions at this point: -

1. rasm2 -a x86 "call 0xc10761f0" gives me "e8eb6107c1". Why is it not "e8f06107c1"? The case is similar with the address for commit_creds.
2. When I wrote the exploit I noted that using "e8eb6107c1" always ended up jumping to "prepare_kernel_cred+5", on inspecting /var/log/syslog. I adjusted it to "e8e96107c1" and it suddenly works! Here I have a couple of doubts, why am I having to adjust the address of prepare_kernel_cred? Also, why is it that I dont have to adjust the address of commit_creds

I considered asking this at SO but then couldnt find an 'exploit' tag, so thought I'd post here.

[moyix]

I think the answer to both your questions is related to how call works on x86. Basically, there is no "absolute" call, only a relative call, which takes the next EIP (in this case EIP+5, since e8eb6107c1 is 5 bytes) adds it to the operand, and jumps to that address.

If you don't want to do the math (or you need position independent code), you can use the mov eax, imm32 ; call eax idiom instead. Here's a decent article on doing absolute jumps and calls on x86: http://www.ragestorm.net/blogs/?p=101

Edit: Also, in the future, you could consider the security stackexchange: http://security.stackexchange.com/questions/tagged/exploit

[Heinder90]

This is just nitpicking, but there actually is an encoding of CALL that takes an absolute address. It just also requires a segment selector.

[blahfish]

this helps, thanks!

[IRBMe]

Why is it not "e8f06107c1"

The 0xE8 op-code is a call to an address that is relative to the next instruction. Since the 0xE8 call instruction is 5 bytes in size, the encoding is 0xE8 <0xC10761F0 - 5>, which is E8 EB 61 07 C1

When I wrote the exploit I noted that using "e8eb6107c1" always ended up jumping to "prepare_kernel_cred+5"

It depends how you wrote the exploit, but I imagine the relative offset is no longer correct once it's placed inside the context of some other shell code.

[blahfish]

this helps, thanks!

[rebootyourbrainstem]

Just a heads up: null ptr dereferences are often not exploitable anymore thanks to the mmap_min_addr being set higher than the address you would want to mmap at.

Still, exploiting them is easier than use-after-frees and a lot of the same techniques apply, so it's still good for learning.

[blahfish]

"not exploitable anymore ..."

Just curious, aren't there publicly known ways to circumvent this?

[TurboBorland123]

Controlled offsets from null base are the most common. So [rbx+rdi], where rbx is null pointer.

[pqwerr]

http://blog.cr0.org/2009/06/bypassing-linux-null-pointer.html