Modern Kernel Stack Overflow Exploitation

Tested on modern (quite modern) kernel

Used 32 bit for simplicity with addressing.

Kernel 4.3.5

Compiled vulnerable module

Wrote exploit to take advantage of the vulnerability

Disabled Kernel Protection NX and Stack Canaries

Local Root Exploit (chage privs of the current process to root)

Was hard to find working example with commit_creds for modern Kernel (not 2.6.x :))

Used two threads, one with shell, the other one calling commit_creds and called after overwriting EIP (root privs)

Wanted to exploit BlueBorne - Bluetooth Stack Overflow (CVE-2017-1000251)

Challenges:

Technical description:

Get a second Bluetooth Adapter (USB dongle)

Read Bluetooth Documentation (very long)

Understand L2CAP Protocol and Messages exchanges.

Compile Kernel with Debug capabilities (via Virtual Serial Device in Virtual Box)

Debug Kernel :)

Read Kernel Source - it's all there

Trigger BlueBorne

Disable Kernel Protection NX and Stack Canaries

Prepare Shellcode (Trick out the Bluetooth Protocol to pack shellcode in)

Tested with 32 bit Kernel without Protections

Tricking out L2CAP messages

Finding Gadgets

Packing up shellcode

printk() shellcode

Executing

Stabilizing Kernel after shellcode execute