Introduction

Write a post to log the necessary steps for Linux Kernel pwn challenges in CTF.

Extracting Files

Usually a compressed file is given in challenges containing the following files:
bzImage: the bootable image of the linux kernel
rootfs.cpio: the file system used in the challenge
shart.sh: the shell script to run qemu on the image

Use the extract-vm script to extract vmlinux file. If the script does not exist, use sudo apt-get install linux-headers-$(uname -r) to down load the files.

Next extract the file system. Since we need to decompress and compress the file system frequently during the exploitation, create an empty file for the extracted file.

If we take a look at the init script in the extracted files as below, we can find that /dev/ptmx is mounted and the vulnerable kernel module memo.ko is loaded.

Build and run exploit

After decompressing the file, the next step is to run the exploit code in qemu. Since busybox does not provide any compiler, the only option left is to compile the exploit in the host machine and compress the file system again. Modify the file system location in starting script and run the script. It is recommended to do stuff above in a shell.

Taking Tips

The debugging process has been discussed in many previous posts. Here takes some useful notes in such challenges.
(1) Gain root privilege at first step so that we can gain some useful information for debugging.

(2)After the above step, leak the base address of loaded module and function info for further debugging and exploitation.

Conclusion

Here I listed the necessary steps before starting the real kernel exploitation as note for myself.