Chapter 12 errors on the system kernel level
the unauthorized reproduction in whole or in part of this publication in any form is prohibited.
Let's copy the files that will be used during the demonstration.
We should remember the characteristics of the buffer overflow attack for this purpose we'll look at
a simple example.
Using the you limit command we can set your file to any size and check the function of our program
as we can see the stack frame has been overwritten with the argument we entered due to which the program
ended with a segmentation error.
Let's now take a look at an example of a core module and try to take advantage of the buffer overflow
error existing in this module.
We will now compile and upload the susceptible module.
These operations can be performed only by the system administrator.
From the moment the module is uploaded our current system up time is included in the file slash proc
slash.
J i f f i.e. as.
Let's see what will happen if we write data to the file that the program doesn't expect the change of
the file content should be visible in the core logs.
As we can see after writing data of more than 16 bytes to the file a core exception has been generated
since we are able to control the core module function by changing the IP pointer will use the shell
code for our purpose
let's modify the previous make file file to compile the shellcode
after changing it into binary form our shell code looks like this.
Let's use the ready made exploit code containing the shell code and write its data to the file.
It worked and we control the execution of the susceptible module by creating a child process with system
administrator rights.
Now let's consider a real example we know about the existing of an error in the implementation of the
Bluetooth protocol.
Let's check it
the error is in sacque underscore create the function responsible for the creation of a socket by manipulating
with a variable.
It is possible to execute our own code
our shellcode should raise the privileges of the process currently started up.
So let's modify it.
Here's the binary form of our shellcode.
It will be used in the body of a new exploit.
The next step is to discover the address of the BT Protel table.
Will try to find the address of a bloating the suspectible module and modify the exploit.
We did it we discovered the address by analyzing the system kernel.
Now we can check the functioning of our exploit.
In practice
in this way we obtained unlimited access to the system.
If the B.T. underscore Protel table address is missing we can use the force method
the address of the search table has been found as we can see the operation has been successful.