Exec-shield a Linux 2.6.0-test9-mm1 kernelhez

Nemtom, en csak portoltam a -test8-mm1 -test9-mm1-re. tulkeppen semmi nem valtozott, majdnem siman lehetett apply-olni a test9-mm1 ellen.

Szoval csak a biztonsag kedveert. Leforgattam, nekem tokeletesen megy:

sunshine:/home/trey# uname -a

Linux sunshine 2.6.0-test9-mm1-exec-shield #1 SMP Sun Nov 2 22:37:13 CET 2003 i686 GNU/Linux

sunshine:/home/trey# cat /proc/sys/kernel/exec-shield

2

sunshine:/home/trey#

Nezzuk a szokasos teszteket:

---------------------------------------------------------------------

sunshine:/home/trey/exec/libsafe-2.0-16/exploits# ./t1

This program tries to use strcpy() to overflow the buffer.

If you get a /bin/sh prompt, then the exploit has worked.

Press any key to continue...

Szegmens hiba

sunshine:/home/trey/exec/libsafe-2.0-16/exploits# ./t1

t1 t1w

sunshine:/home/trey/exec/libsafe-2.0-16/exploits# ./t1w

This program tries to use strcpy() to overflow the buffer.

If you get a /bin/sh prompt, then the exploit has worked.

Press any key to continue...

Szegmens hiba

sunshine:/home/trey/exec/libsafe-2.0-16/exploits# ./t3

This program will exec() a new program. The new program will

overflow the buffer using strcpy().

If you get a /bin/sh prompt, then the exploit has worked.

Press any key to continue...

Szegmens hiba

sunshine:/home/trey/exec/libsafe-2.0-16/exploits# ./t3w

This program will exec() a new program. The new program will

overflow the buffer using strcpy().

If you get a /bin/sh prompt, then the exploit has worked.

Press any key to continue...

Szegmens hiba

sunshine:/home/trey/exec/libsafe-2.0-16/exploits# ./t4

This program will fork() child process, and the child

will overflow the buffer using strcpy().

If you get a /bin/sh prompt, then the exploit has worked.

Press any key to continue...

parent process terminating

sunshine:/home/trey/exec/libsafe-2.0-16/exploits# ./t4w

This program will fork() child process, and the child

will overflow the buffer using strcpy().

If you get a /bin/sh prompt, then the exploit has worked.

Press any key to continue...

parent process terminating

sunshine:/home/trey/exec/libsafe-2.0-16/exploits# ./t5

This program tries to use strcat() to overflow the buffer.

If you get a /bin/sh prompt, then the exploit has worked.

Press any key to continue...

Szegmens hiba

sunshine:/home/trey/exec/libsafe-2.0-16/exploits# ./t6

This program tries to use scanf() to overflow the buffer.

If you get a /bin/sh prompt, then the exploit has worked.

Press any key to continue...

Szegmens hiba

sunshine:/home/trey/exec/libsafe-2.0-16/exploits#

---------------------------------------------------------------------

sunshine:/home/trey/exec/paxtest-0.9.1# ./paxtest

It may take a while for the tests to complete

Test results:

Executable anonymous mapping : Killed

Executable bss : Killed

Executable data : Killed

Executable heap : Killed

Executable stack : Killed

Executable anonymous mapping (mprotect) : Killed

Executable bss (mprotect) : Vulnerable

Executable data (mprotect) : Vulnerable

Executable heap (mprotect) : Vulnerable

Executable shared library bss (mprotect) : Vulnerable

Executable shared library data (mprotect): Vulnerable

Executable stack (mprotect) : Vulnerable

Anonymous mapping randomisation test : 16 bits (guessed)

Heap randomisation test (ET_EXEC) : 13 bits (guessed)

Heap randomisation test (ET_DYN) : 13 bits (guessed)

Main executable randomisation (ET_EXEC) : No randomisation

Main executable randomisation (ET_DYN) : 12 bits (guessed)

Shared library randomisation test : 12 bits (guessed)

Stack randomisation test (SEGMEXEC) : 17 bits (guessed)

Stack randomisation test (PAGEEXEC) : 17 bits (guessed)

Return to function (strcpy) : Vulnerable

Return to function (memcpy) : Vulnerable

Executable shared library bss : Killed

Executable shared library data : Killed

Writable text segments : Vulnerable

---------------------------------------------------------------------

X fut, Apache, MySQL, pppoe, xchat, Mozilla, stb. fut. Imho nezd at megegyszer :-)

szerintem valami olyasmi lehetett a cel, hogy bekeruljon a mainline kernelbe.

interju nincs, masfel eve egyszer probaltam, akkor nem valaszolt a levelemre. azota nem eroltettem.