QEMU Escape: Part 5 Put Everything Together (nographic mode)

Screenshot from 2018-03-13 22-07-42

Introduction

Yesterday I have already demonstrated how to hijack the control flow via leaking the base address of heap. Therefore, the only remaining step is to get the shell or view the flag, which will be discussed in this post. The final result is already given in the cover image. The full exploit is given in my github repository [2].
Continue reading “QEMU Escape: Part 5 Put Everything Together (nographic mode)”

Advertisements

QEMU Escape: Part 4 Hijack Control Flow (CVE-2015-7504)

Screenshot from 2018-03-13 22-07-42

Introduction

In the original post on QEMU escape, the author only introduces the details about the out-of-bound overflow (CVE-2015-7504) in QEMU. However, it adds no details on how to hijack the control flow. In this post, I will give more details on how I hijack the control to 0x414141414141 as shown in cover image.
Continue reading “QEMU Escape: Part 4 Hijack Control Flow (CVE-2015-7504)”

QEMU escape: Part 3 Information Leakage (CVE-2015-5165)

Screenshot from 2018-03-08 11-14-48

Introduction

This post will give some more debugging details on CVE-2015-5165. Based on the poc code in [1], we make some modification to the code according to the information of local machine.
As we know, QEMU is an application running on the host machine. The goal of the VM escape in the guest machine is that we have to retrieve the base address of text segment of QEMU application on the host machine and the base address of the virtual memory that are mapped to emulate the physical memory of guest machine.
The final result of the information leakage is given as the cover image of this post.
Continue reading “QEMU escape: Part 3 Information Leakage (CVE-2015-5165)”

QEMU escape: Part 2 Debugging Environment Set-up

20180308001.jpg

Introduction

In the previous part, I give an introduction on how to create an ubuntu image for QEMU. However, after beginning to analyse the qemu vulnerability I feel the debugging process is very uncomfortable. What I prefer is just a terminal of QEMU with a guest running on that. This makes me recall what I do on Syzkaller fuzzer.
In this post, I just list the necessary steps to create a much more friendly debugging environment.
Continue reading “QEMU escape: Part 2 Debugging Environment Set-up”