提交 ee5e81fa 编写于 作者: J Jonas Eriksson

nx exploit application: Avoid building if available

Tested by running: nx
Signed-off-by: NJonas Eriksson <jonas.eriksson@enea.com>
上级 d6cf9179
...@@ -22,36 +22,39 @@ def run(test, params, env): ...@@ -22,36 +22,39 @@ def run(test, params, env):
vm.verify_alive() vm.verify_alive()
session = vm.wait_for_login(timeout=int(params.get("login_timeout", 360))) session = vm.wait_for_login(timeout=int(params.get("login_timeout", 360)))
exploit_file = os.path.join(data_dir.get_deps_dir(), 'nx', 'x64_sc_rdo.c') exploit_cmd = params.get("exploit_cmd", "")
dst_dir = '/tmp' if not exploit_cmd or session.cmd_status("test -x %s" % exploit_cmd):
exploit_file = os.path.join(data_dir.get_deps_dir(), 'nx', 'x64_sc_rdo.c')
dst_dir = '/tmp'
error.context("Copy the Exploit file to guest.", logging.info) error.context("Copy the Exploit file to guest.", logging.info)
vm.copy_files_to(exploit_file, dst_dir) vm.copy_files_to(exploit_file, dst_dir)
error.context("Build exploit program in guest.", logging.info) error.context("Build exploit program in guest.", logging.info)
build_exploit = "gcc -o /tmp/nx_exploit /tmp/x64_sc_rdo.c" build_exploit = "gcc -o /tmp/nx_exploit /tmp/x64_sc_rdo.c"
if session.cmd_status(build_exploit): if session.cmd_status(build_exploit):
raise error.TestError("Failed to build the exploit program") raise error.TestError("Failed to build the exploit program")
exploit_cmd = "/tmp/nx_exploit"
error.context("Run exploit program in guest.", logging.info) error.context("Run exploit program in guest.", logging.info)
exec_exploit = "/tmp/nx_exploit"
# if nx is enabled (by default), the program failed. # if nx is enabled (by default), the program failed.
# segmentation error. return value of shell is not zero. # segmentation error. return value of shell is not zero.
exec_res = session.cmd_status(exec_exploit) exec_res = session.cmd_status(exploit_cmd)
nx_on = params.get('nx_on', 'yes') nx_on = params.get('nx_on', 'yes')
if nx_on == 'yes': if nx_on == 'yes':
if exec_res: if exec_res:
logging.info('NX works good.') logging.info('NX works good.')
error.context("Using execstack to remove the protection.", error.context("Using execstack to remove the protection.",
logging.info) logging.info)
enable_exec = 'execstack -s /tmp/nx_exploit' enable_exec = 'execstack -s %s' % exploit_cmd
if session.cmd_status(enable_exec): if session.cmd_status(enable_exec):
if session.cmd_status("execstack --help"): if session.cmd_status("execstack --help"):
msg = "Please make sure guest have execstack command." msg = "Please make sure guest have execstack command."
raise error.TestError(msg) raise error.TestError(msg)
raise error.TestError('Failed to enable the execstack') raise error.TestError('Failed to enable the execstack')
if session.cmd_status(exec_exploit): if session.cmd_status(exploit_cmd):
raise error.TestFail('NX is still protecting. Error.') raise error.TestFail('NX is still protecting. Error.')
else: else:
logging.info('NX is disabled as desired. good') logging.info('NX is disabled as desired. good')
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册