A.Bug.Hunters.Diary.A.Guided.Tour.Through.the.Wilds.of.Software.Security 笔记

最新推荐文章于 2024-09-25 07:51:53 发布

instruder

最新推荐文章于 2024-09-25 07:51:53 发布

阅读量727

点赞数

分类专栏：漏洞分析文章标签： input list vmware security null c

本文链接：https://blog.csdn.net/instruder/article/details/7006603

版权

漏洞分析专栏收录该内容

39 篇文章 0 订阅

订阅专栏

一 kernel 漏洞的空指针引用利用

1. Trigger the NULL pointer dereference for a denial of service.
2. Use the zero page to get control over EIP/RIP.

第三章那个内核漏洞的利用真是经典啊

二开源系统的系统驱动漏洞查找

Step 1: List the IOCTLs of the kernel.
? Step 2: Identify the input data.
? Step 3: Trace the input data.

三内核驱动的挖掘

Step 1: Prepare a VMware guest for kernel
debugging.
? Step 2: Generate a list of the drivers and
device objects created by avast!
? Step 3: Check the device security settings.
? Step 4: List the IOCTLs.
? Step 5: Find the user-controlled input values.
? Step 6: Reverse engineer the IOCTL handler

irp 60 8 4 c currentstack inputlength outputlenght ioctrlcode

01 #include <windows.h>
02 #include <stdio.h>
03
04 int
05 main (int argc, char *argv[])
06 {
07 unsigned int method = 0;
08 unsigned int code = 0;
09
10 if (argc != 2) {
11 fprintf (stderr, "Usage: %s <IOCTL code>\n", argv[0]);
12 return 1;
13 }
14
15 code = strtoul (argv[1], (char **) NULL, 16);
16 method = code & 3;
17
18 switch (method) {
19 case 0:
20 printf ("METHOD_BUFFERED\n");
21 break;
22 case 1:
23 printf ("METHOD_IN_DIRECT\n");
24 break;
25 case 2:
26 printf ("METHOD_OUT_DIRECT\n");
27 break;
28 case 3:
29 printf ("METHOD_NEITHER\n");
30 break;
31 default:
32 fprintf (stderr, "ERROR: invalid IOCTL data transfer method\n");
33 break;
34 }
35
36 return 0;
37 }