[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <4632A38E-244F-42CF-935E-A560B34BC778@gmail.com>
Date: Wed, 20 Feb 2019 09:43:53 +0400
From: Ilya Matveychikov <matvejchikov@...il.com>
To: lkrg-users@...ts.openwall.com
Subject: LKRG 6.0 Exploit Detection bypass
Hello,
I’d like to show few more exploit detection bypass techniques:
https://github.com/milabs/kernel-exploits/commit/6bd99d97c3f99a0a743a012b9cb90fb2fe1c0970
By this commit we have the list of following:
- (1) LKRG ED bypass using UMH and chmod + chwon, the very first bypass
- (2) LKRG ED bypass by owerwriting inode->i_{uid,gid,mode} using simple_setattr()
- (3) LKRG ED bypass by owerwriting inode->i_{uid,gid,mode} directly
- (4) LKRG ED bypass by unlocking "UMH lock down" with LD_PRELOAD
- LKRG "poor man's CFI" bypass
(1) and (2) were introduced few months before.
(3) is the improvement of (2) which uses DKOM technique to manipulate inode
directly without being detected by simple_setattr() hook.
(4) is the bypass of "UMH locking by using whitelist of programs" which basically
allows one to use LD_PRELOAD to inject his payload to /sbin/modprobe or similar.
Since the use of (3) and (4) is locked by pCFI (poor man's Control Flow Integrity)
mitigation introduced in LKRG 6.0 I had to add the “rich man’s CFI bypass” which
wraps calls to all of the listed bypasses with 2 macros which are actually fakes
the call stack for the time of exploitation so LKRG could not see this.
Ilya
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
