out-of-tree kernel {module, exploit} development tool
config | ||
examples | ||
qemu | ||
snap | ||
tools | ||
.gitignore | ||
.travis.yml | ||
bootstrap.config.go | ||
bootstrap.go | ||
debug.go | ||
gen.go | ||
kernel.go | ||
LICENSE | ||
main.go | ||
pew.go | ||
README.md |
out-of-tree
out-of-tree kernel {module, exploit} development tool
Requirements
Qemu, docker and golang is required.
Also do not forget to set GOPATH and PATH e.g.:
$ echo 'export GOPATH=$HOME' >> ~/.bashrc
$ echo 'export PATH=$PATH:$HOME/bin' >> ~/.bashrc
$ source ~/.bashrc
Gentoo
# emerge app-emulation/qemu app-emulation/docker dev-lang/go
macOS
$ brew install go qemu
$ brew cask install docker
Installation
$ go get github.com/jollheef/out-of-tree
$ out-of-tree bootstrap
Then you can check it on kernel module example:
$ cd $GOPATH/github.com/jollheef/out-of-tree/examples/kernel-module
$ out-of-tree kernel autogen # generate kernels based on .out-of-tree.toml
$ out-of-tree pew
Examples
Run by absolute path
$ out-of-tree --path /path/to/exploit/directory pew
Test only with one kernel:
$ out-of-tree pew --kernel='Ubuntu:4.10.0-30-generic'
Run debug environment:
$ out-of-tree debug --kernel='Ubuntu:4.10.0-30-generic'
Test binary module/exploit with implicit defined test ($BINARY_test)
$ out-of-tree pew --binary /path/to/exploit
Test binary module/exploit with explicit defined test
$ out-of-tree pew --binary /path/to/exploit --test /path/to/exploit_test
Guess work kernels:
$ out-of-tree pew --guess
Use custom kernels config
$ out-of-tree --kernels /path/to/kernels.toml pew
Generate all kernels
Does not required if you dont need to use --guess
.
$ cd $GOPATH/src/github.com/jollheef/out-of-tree/tools/kernel-factory
$ ./bootstrap.sh # more than 6-8 hours for all kernels
$ export OUT_OF_TREE_KCFG=$GOPATH/src/github.com/jollheef/out-of-tree/tools/kernel-factory/output/kernels.toml
Development
Read Qemu API.
Generate images
$ cd $GOPATH/src/github.com/jollheef/out-of-tree/tools/qemu-debian-img/
$ docker run --privileged -v $(pwd):/shared -e IMAGE=/shared/ubuntu1404.img -e RELEASE=trusty -t gen-ubuntu1804-image
$ docker run --privileged -v $(pwd):/shared -e IMAGE=/shared/ubuntu1604.img -e RELEASE=xenial -t gen-ubuntu1804-image