OS X Kernel-mode Exploitation in a Weekend .pdf

《OS X Kernel-mode Exploitation in a Weekend .pdf》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。

1、OSXKernel-modeExploitationinaWeekendSeptember,2007DavidMaynordave@erratasec.comhttp://www.erratasec.com/AbstractApple’sMacOSXoperatingsystemisattractingmoreattentionfromusersandsecurityresearchersalike.Despitethisincreasedinterest,thereisstillanapparentlackofdetailedvulnerabil

2、itydevelopmentinformationforOSX.Thispaperwillattempttohelpbridgethisgapbywalkingthroughtheentirevul-nerabilitydevelopmentprocess.Thisprocessstartswithvulnerabilitydiscoveryandultimatelyfinishedwitharemotecodeexecution.Tohelpillustratethisprocess,arealvulnerabilityfoundintheOSXw

3、irelessdevicedriverisused.Chapter1IntroductionOSXhasastrangeplaceintheheartsandthemindsoftheresearchcommunity.Securityresearchers,likemostotherusers,enjoyawell-builtandreliablehard-wareplatformtoppedoffbyanoperatingsystemwithaslickinterface.Switchgearsfromtheusersexperiencetoam

4、oreresearch-orientedfocusandprob-lemsstarttoappear.ResearchershavehistoricallyexploredanddocumentedinternalsofoperatingsystemslikeMicrosoft’sWindowsandopensourcecoun-terpartssuchasLinuxandBSDvariants.TheknowledgegapsforOSXareinnowayashowstopperforresearchingsecurityvulnerabili

5、tiesonOSX;still,theyprovetobeafrustratingspeedbump.WhilestaticanalysisofbinariesinaWindowsenvironmentmaybetrivial,thesamecannotbesaidtobetrueonOSX.ThisdocumentcontainsinformationcollectedfromavarietyofsourcesafterdiscoveringaflawinawirelessdevicedriverforOSX.Beforetheaccidental

6、discoveryofthewirelessflaw,theauthorknewnexttonothingabouttheinternalsofOSX,the“xnu”kernel.Google,inararefailure,alsoprovidednexttonohelp.Allthearticlestheauthorencounteredonlynarrowlycoveredatopicwithouttalkingabouthowonecouldgoaboutbuildingausefulresearchenvironment.Manyofthe

7、searticlestalkedaboutsomethingeachrespectiveauthordiscoveredwithoutshowinghowotherscouldrediscoverit.Forthisreason,theauthorincludestipsthroughoutthispaperintheformofsectionsentitled“ThingsIwishGoogletoldme”.TheTestNetworkManyelementsarerequiredwhenfindingandduplicatingawireles

8、svulnerabil-ity.Sincethetargetfortheattackdescribedinthispape