4 ms·
The /proc/kallsyms values are identical across identical kernel compilations. Suppose you have a vulnerable CentOS 7 system that you want to exploit - you coul
by javanix 11y ago
The /proc/kallsyms values are identical across identical kernel compilations.
Suppose you have a vulnerable CentOS 7 system that you want to exploit - you could get the proper addresses from your own CentOS 7 VM running the same kernel, apply those to a modified exploit compilation, and run that compilation on your target host.
- benmmurphy 11y agoLatest versions of Linux have Kernel ASLR for text but I think lots of distributions have it disabled because they set CONFIG_HIBERNATION: https://www.kernel.org/doc/Documentation/kernel-parameters.txt https://www.kernel.org/doc/Documentation/kernel-parameters.t... Also, it is not bullet proof because apparently there are lots of info leaks in linux and I think linux also does not reboot after a panic (http://www.cyberciti.biz/tips/reboot-linux-box-after-a-kernel-panic.html http://www.cyberciti.biz/tips/reboot-linux-box-after-a-kerne...) so if the entropy for KASLR is small enough you can retry very aggressively. Though in this particular instance if you have to wait 30 minutes between each try that would kill brute forcing.