OS.md

OS/Unix, OSDev, binary exploitation and random shit

Resources

The little OS book Operating Systems - Andrew Tanenbaum Wiki - OSDEV How the Kernel manages your memory Itanium Linux ABI - LSB

Memory

Paging

Paging is a system which allows each process to see a full virtual address space, without actually requiring the full amount of physical memory to be available or present.

Paging is achieved through the use of the Memory Management Unit (MMU).

Virtual Memory: How does Virtual Memory Work

Permissions

Permission rings

Virtualization

Virtualization vs Hypervisors

Ring1 can be used to create an emulated real mode (ring0). [Linux Architecture - Securing The Stack - Youtube(https://www.youtube.com/watch?v=85eINAowuMc)

Unix

Suid, setuid, setreuid

SUID, SEUID, EUID

LD_PRELOAD

[https://stackoverflow.com/questions/9232892/ld-preload-with-setuid-binary](LD_PRELOAD with setuid - Stack Overflow)

Pipes

Unix Pipe Implementatin

Compilation

ELF Format

In-depth: ELF - The Extensible & Linkable Format Core files analysis - Stackoverflow

ASLR

$ echo 1 | sudo tee /proc/sys/kernel/randomize_va_space
1
$ ./a.out
executable: 0x400677
stack: 0x7fff0561a30c
heap: 0x602010
system@plt: 0x400550
libc: 0x7ff03b6e79b0
system: 0x7ff03af64480
$ ./a.out
executable: 0x400677
stack: 0x7fffe76dd26c
heap: 0x602010
system@plt: 0x400550
libc: 0x7f063ddf79b0
system: 0x7f063d674480

Memory corruption protection - ASLR

PIE + ASLR

$ echo 2 | sudo tee /proc/sys/kernel/randomize_va_space
2
$ ./a.out
executable: 0x55e8208157ca
stack: 0x7ffe5d194edc
heap: 0x55e821d11010
system@plt: 0x7f2904b01480
libc: 0x7f29052849b0
system: 0x7f2904b01480
$ ./a.out
executable: 0x55716e0817ca
stack: 0x7ffd23f4e40c
heap: 0x55716ee0e010
system@plt: 0x7fe427397480
libc: 0x7fe427b1a9b0
system: 0x7fe427397480

Memory corruption protection - PIE

GOT and PLT

GOT and PLT for pwning - System Overlord

Pwn

Shellcoding

Metasploit

Carving shellcode using restrictive charset Alphanum shellcode