Skip to content

NEW: to prepare new section that is about kernel exp dev #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Aug 10, 2017
Merged

NEW: to prepare new section that is about kernel exp dev #11

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion chapter2/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
# 栈的安全


## 基本的漏洞利用

[format strings on linux32](./format-strings.md)
Expand Down
4 changes: 2 additions & 2 deletions chapter3/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,11 @@

## 套路研习

[heap overflow using unlink on linux32](./linux-x86-unlink.md) 过期！
[heap overflow using unlink on linux32](./linux-x86-unlink.md) 过时！

[heap overflow with using malloc maleficarum on linux32](./heap-overflow-uisng-malloc-maleficarum.md)

[off-by-one vulnerability (heap based) on linux32](./linux-x86-off-by-one.md) 过期！
[off-by-one vulnerability (heap based) on linux32](./linux-x86-off-by-one.md) 过时！

[use after free on linux32](./linux-x86-UAF.md) 主流！

Expand Down
24 changes: 24 additions & 0 deletions chapter4/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,25 @@
# 内核安全

## 安全机制

kernel ROP 非常类似于用户态的 ROP，主要区别是用户态使用`system()`来调用执行 shellcode，而内核 ROP 是通过`prepare_kernel_cred()`来提升权限,下面介绍 x86 上面 rop 构造 ret2dir。

[Linux kernel ROP](http://www.freebuf.com/articles/system/94198.html)

[ret2dir: Rethinking Kernel Isolation](http://www.cs.columbia.edu/~vpk/papers/ret2dir.sec14.pdf)

PXN 是 ARM 平台下的一项内核保护措施，该措施的目的是阻止内核执行用户态代码，保证内核的执行流程不会被劫持到用户空间。

[PXN 的研究与绕过](http://blog.csdn.net/hu3167343/article/details/47394707)

[Ownyour Android! Yet Another Universal Root](https://www.blackhat.com/docs/us-15/materials/us-15-Xu-Ah-Universal-Android-Rooting-Is-Back-wp.pdf)

## 现实案例研究

[CVE-2014-2851 group_info UAF Exploitation](http://www.freebuf.com/vuls/92465.html)

[(CVE-2015-3636) CVE-2015-3636 kernel: ping sockets: use-after-free leading to local privilege escalation](https://bugzilla.redhat.com/show_bug.cgi?id=1218074)

[ANALYSISAND EXPLOITATION OF A LINUX KERNEL VULNERABILITY (CVE-2016-0728)](http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-kernel-vulnerability-cve-2016-0728/)

[]