Portoltam Molnár Ingo exec-shield patchét a napokban megjelent 2.6.0-test8 kernelhez.
A stuffot letöltheted innen: exec-shield-2.6.0-test8
Az alábbi programokkal lett tesztelve:
libsafe-2.0-16.tgz, paxtest-0.9.3.tar.gz
Az exec-shield telepítése itt. Az exec-shield-hez kapcsolódó HUP cikkek itt.
Az eredmények:===========================================
gmicsko03:/home/trey/devel/exploit/libsafe-2.0-16/exploits# echo "2" > /proc/sys/kernel/exec-shield
gmicsko03:/home/trey/devel/exploit/libsafe-2.0-16/exploits# cat /proc/sys/kernel/exec-shield
2
===========================================
libsafe-2.0-16 (exec-shield teljes védelem):
---------------------------------------------------------------------
gmicsko03:/home/trey/devel/exploit/libsafe-2.0-16/exploits# ./canary-exploit
This program tries to use printf("%n") to overwrite the
return address on the stack.
If you get a /bin/sh prompt, then the exploit has worked.
Press any key to continue...
Szegmens hiba
---------------------------------------------------------------------
---------------------------------------------------------------------
gmicsko03:/home/trey/devel/exploit/libsafe-2.0-16/exploits# ./exploit-non-exec-stack
This program demonstrates how a (stack) buffer overflow
can attack linux kernels with *non-executable* stacks.
This is variation on return-int-libc attack.
If you get a /bin/sh prompt, then the exploit has worked.
Press any key to continue...
Szegmens hiba
---------------------------------------------------------------------
---------------------------------------------------------------------
gmicsko03:/home/trey/devel/exploit/libsafe-2.0-16/exploits# ./t1
This program tries to use strcpy() to overflow the buffer.
If you get a /bin/sh prompt, then the exploit has worked.
Press any key to continue...
Szegmens hiba
---------------------------------------------------------------------
---------------------------------------------------------------------
gmicsko03:/home/trey/devel/exploit/libsafe-2.0-16/exploits# ./t1w
This program tries to use strcpy() to overflow the buffer.
If you get a /bin/sh prompt, then the exploit has worked.
Press any key to continue...
Szegmens hiba
---------------------------------------------------------------------
---------------------------------------------------------------------
gmicsko03:/home/trey/devel/exploit/libsafe-2.0-16/exploits# ./t3
This program will exec() a new program. The new program will
overflow the buffer using strcpy().
If you get a /bin/sh prompt, then the exploit has worked.
Press any key to continue...
Szegmens hiba
---------------------------------------------------------------------
---------------------------------------------------------------------
gmicsko03:/home/trey/devel/exploit/libsafe-2.0-16/exploits# ./t3w
This program will exec() a new program. The new program will
overflow the buffer using strcpy().
If you get a /bin/sh prompt, then the exploit has worked.
Press any key to continue...
Szegmens hiba
---------------------------------------------------------------------
---------------------------------------------------------------------
gmicsko03:/home/trey/devel/exploit/libsafe-2.0-16/exploits# ./t4
This program will fork() child process, and the child
will overflow the buffer using strcpy().
If you get a /bin/sh prompt, then the exploit has worked.
Press any key to continue...
parent process terminating
---------------------------------------------------------------------
---------------------------------------------------------------------
gmicsko03:/home/trey/devel/exploit/libsafe-2.0-16/exploits# ./t4w
This program will fork() child process, and the child
will overflow the buffer using strcpy().
If you get a /bin/sh prompt, then the exploit has worked.
Press any key to continue...
parent process terminating
---------------------------------------------------------------------
---------------------------------------------------------------------
gmicsko03:/home/trey/devel/exploit/libsafe-2.0-16/exploits# ./t5
This program tries to use strcat() to overflow the buffer.
If you get a /bin/sh prompt, then the exploit has worked.
Press any key to continue...
Szegmens hiba
---------------------------------------------------------------------
---------------------------------------------------------------------
gmicsko03:/home/trey/devel/exploit/libsafe-2.0-16/exploits# ./t6
This program tries to use scanf() to overflow the buffer.
If you get a /bin/sh prompt, then the exploit has worked.
Press any key to continue...
Szegmens hiba
---------------------------------------------------------------------
*************************************************
*************************************************
===========================================
gmicsko03:/home/trey/devel/exploit/libsafe-2.0-16/exploits# echo "2" > /proc/sys/kernel/exec-shield
gmicsko03:/home/trey/devel/exploit/libsafe-2.0-16/exploits# cat /proc/sys/kernel/exec-shield
2
===========================================
paxtest-0.9.3 (exec-shield bekapcsolva):
--------------------------------------------------------------------
gmicsko03:/home/trey/devel/exploit/paxtest-0.9.3# ./paxtest
PaXtest - Copyright(c) 2003 by Peter Busser
Released under the GNU Public Licence version 2 or later
It may take a while for the tests to complete
Test results:
PaXtest - Copyright(c) 2003 by Peter Busser
Released under the GNU Public Licence version 2 or later
Executable anonymous mapping : Killed
Executable bss : Killed
Executable data : Killed
Executable heap : Killed
Executable stack : Killed
Executable anonymous mapping (mprotect) : Killed
Executable bss (mprotect) : Vulnerable
Executable data (mprotect) : Vulnerable
Executable heap (mprotect) : Vulnerable
Executable shared library bss (mprotect) : Vulnerable
Executable shared library data (mprotect): Vulnerable
Executable stack (mprotect) : Vulnerable
Anonymous mapping randomisation test : 16 bits (guessed)
Heap randomisation test (ET_EXEC) : 13 bits (guessed)
Heap randomisation test (ET_DYN) : 13 bits (guessed)
Main executable randomisation (ET_EXEC) : No randomisation
Main executable randomisation (ET_DYN) : 12 bits (guessed)
Shared library randomisation test : 12 bits (guessed)
Stack randomisation test (SEGMEXEC) : 17 bits (guessed)
Stack randomisation test (PAGEEXEC) : 17 bits (guessed)
Return to function (strcpy) : Killed
Return to function (memcpy) : Executable shared library bss : Killed
Executable shared library data : Killed
Writable text segments : Vulnerable
gmicsko03:/home/trey/devel/exploit/paxtest-0.9.3#