Meltdown - Lectura de datos de la memoria del proceso

Question

Meltdown - Lectura de datos de la memoria del proceso

Navega tus respuestas

#1 de Mark (3 votos)

1

Probé este PoC:

enlace

Lo que funciona para la sys_call_table.

Pude leer la dirección syscall sys_read.

Quería probarlo con un programa de muestra para leer el valor de la memoria, pero en este caso no funciona. ¿Alguna idea a alguien? Muestra valores como 00 y su funcionamiento es mucho más lento.

./pass 
Password : secret
addr 0x7ffc9098b780


./poc 7ffc9098b780
cutoff: 96
0x7ffc9098b780 | 00 00 00 00 00 00 00 00 00   1.006466362648e-25 00

pass.c

#include <stdio.h>

int main(void) {

   char buf[7];

   printf("Password : ");
   fgets(buf, 7, stdin);
   sscanf(buf, "%s", buf);
   printf("addr %p\n",buf);
   while(1)
   {
   }
   printf("Password : %s\n",buf);
   return 0;
}

Gracias,

Actualización 1:

Encontré este programa que obtiene la dirección física del virtual desde el espacio del usuario:

enlace

Salida:

./pagemap2 18135
=== Maps for pid 18135
0x400000           : pfn 0                soft-dirty 1 file/shared 1 swapped 0 present 1 library /home/user/spectre-meltdown-poc/pass
0x600000           : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library /home/user/spectre-meltdown-poc/pass
0x601000           : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library /home/user/spectre-meltdown-poc/pass
0x206a000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library [heap]
0x206b000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x206c000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x206d000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x206e000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x206f000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2070000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2071000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2072000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2073000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2074000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2075000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2076000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2077000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2078000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2079000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x207a000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x207b000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x207c000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x207d000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x207e000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x207f000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2080000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2081000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2082000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2083000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2084000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2085000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2086000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2087000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2088000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2089000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x208a000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x7f27b2365000     : pfn 0                soft-dirty 1 file/shared 1 swapped 0 present 1 library /lib/x86_64-linux-gnu/ld-2.23.so
0x7f27b253d000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library 
0x7f27b253e000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library 
0x7f27b253f000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library 
0x7f27b2563000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library 
0x7f27b2564000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library 
0x7f27b2565000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library /lib/x86_64-linux-gnu/ld-2.23.so
0x7f27b2566000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library /lib/x86_64-linux-gnu/ld-2.23.so
0x7f27b2567000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library 
0x7ffe2498c000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe2498d000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe2498e000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe2498f000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe24990000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe24991000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe24992000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe24993000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe24994000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe24995000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe24996000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe24997000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe24998000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe24999000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe2499a000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe2499b000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe2499c000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe2499d000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe2499e000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe2499f000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe249a0000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe249a1000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe249a2000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe249a3000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe249a4000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe249a5000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe249a6000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe249a7000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe249a8000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe249a9000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library [stack]
0x7ffe249aa000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library [stack]
0x7ffe249ab000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe249ac000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library [stack]
0x7ffe249ca000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [vvar]
0x7ffe249cb000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [vvar]
0x7ffe249cc000     : pfn 0                soft-dirty 1 file/shared 1 swapped 0 present 1 library [vdso]
0x7ffe249cd000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [vdso]

¿Dónde estará mi cadena "secreta" ubicada en la pila? ¿Qué dirección física debo probar?

Gracias,

meltdown exploit-development

pregunta android_dev 09.01.2018 - 10:33

fuente

1 respuesta

Lea otras preguntas en las etiquetas meltdown exploit-development

¿Qué tan difícil es modificar el texto cifrado AES de una manera significativa? La forma más eficiente de escanear servidores web

score 3 · Accepted Answer

En Linux, la mitad del kernel del espacio de direcciones (todas las direcciones por encima de 0x800000000000000000) es constante en todas las aplicaciones. Si usa grep para encontrar la dirección de la tabla de llamadas del sistema, esa dirección seguirá siendo válida cuando poc vaya a buscar su contenido.

La mitad del espacio de direcciones del usuario, por otro lado, es única para cada proceso. Si apunta poc a 0x7ffc9098b780, le está pidiendo que obtenga el contenido de 0x7ffc9098b780 de poc , no 0x7ffc9098b780 de pass .

Si desea utilizar Meltdown para leer el contenido de la memoria de pass , será mucho más complicado que la prueba de concepto de juguete que haya encontrado. Deberá averiguar qué dirección de memoria física corresponde a la dirección virtual de pass 0x7ffc9098b780 , indague la asignación del kernel del espacio de direcciones físicas, luego lea la parte apropiada de la memoria física.