linuxthor

//  linuxthor
//
//  Showing how to open a socket connection to dbus and do 'raw' messages (i.e. just sending
//  some bytes and not worrying about weird stuff like Dict of{String, Variant} or whatever 
//  for the moment..) 
// 
//  Started off fun but the whole thing is surprisingly bulky & annoying tbh

#include <stdio.h>
#include <stdlib.h>

linuxthor

                           A couple of thoughts about SFTP & SCP
                           =====================================                           
                           
 SCP looks long in the tooth now and people have come to talk about deprecating it entirely. This
 is due to SCP being the spiritual successor of RCP and inheriting a bunch of cruft that makes it 
 vulnerable to stuff like CVE-2019-6111 (the one where the server could overwrite arbitrary files
 on the client) and CVE-2020-15778 (the one where shell commands could be put in backticks in 
 filenames) so SFTP seems to be the replacement.. It's a more flexible protocol for sure but there
 can be a gotcha not present with SCP.. 
 

linuxthor

; linuxthor
;
; ELF destruct
;
; this file, when executed, will overwrite it's own image in memory 
;
; nasm -f bin -o elfdestruct elfdestruct.asm 

BITS 64
    org 0x010000                 

linuxthor

The 'mizers dream
=================

The GCC randstruct plugin (randomize_layout_plugin.c) by Open Source Security, Inc., Brad Spengler and PaX Team 
allows some sensitive structures in the Linux Kernel to have their layout shuffled. The aim is to obfuscate the
location of sensitive data (e.g some function pointers) and make certain types of exploitation more difficult. 
It's explained in detail here: https://lwn.net/Articles/722293/

The randstruct plugin is built with a randomisation seed included (randomize_layout_seed.h) which is generated 
at compile time by the gen-random-seed.sh script:

linuxthor

#include <linux/module.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/kprobes.h>

static struct kprobe kp = {
    .symbol_name  = "kallsyms_lookup_name"
};

int init_module(void)

linuxthor

#include <linux/module.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/kprobes.h>

int init_module(void)
{
    struct module *mahjool; 
    struct kobject kobj; 
    unsigned long addy; 

linuxthor

#include <linux/module.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/kprobes.h>

char *mota = "__NO__";

static int kp_pre_handler(struct kprobe *p, struct pt_regs *regs)
{
    // kprobe pre 'hook' 

linuxthor

#include <linux/module.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/fs.h>
#include <linux/mm.h>
#include <linux/uio.h>  
#include <linux/slab.h>
#include <linux/vmalloc.h>
#include <linux/kallsyms.h>
#include <linux/uaccess.h>

linuxthor

#include <linux/module.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/fs.h>
#include <linux/mm.h>
#include <linux/slab.h>
#include <linux/vmalloc.h>
#include <linux/uaccess.h>

int init_module(void)

linuxthor

#include <linux/module.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/fs.h>
#include <linux/mm.h>
#include <linux/slab.h>
#include <linux/vmalloc.h>
#include <linux/uaccess.h>

unsigned long *amem;