GCC. Error with compiled file

[banderas20]

Hello,

I am compiling a .c file by issuing

Code: Select all

gcc file.c -o file_compiled

If I try to run it on my local machine, it runs well. If I copy it to another machine, it says:

Code: Select all

Syntax error: "(" unexpected

Maybe I have to run gcc with some target specific options (target kernel is 3.2.0-23-generic-pae), but I don't know how.

¿Can you help me?

Thanks!

[pylkko]

This is indeed possible, but we do not have enough information to guess. For example are you linking in some libraries, what are the architectures of the processors and have you checked the code for error? What error messages upon compilation, are you using the "all warnings" flag of gcc when you compile? etc. More

[banderas20]

This is indeed possible, but we do not have enough information to guess. For example are you linking in some libraries, what are the architectures of the processors and have you checked the code for error? What error messages upon compilation, are you using the "all warnings" flag of gcc when you compile? etc. More

Hello.

I just run the command, without linking any libraries (AFAIK). The code is directly downloaded from a web and 99% percent tested and working.

These are the results of the "uname -r" command in both computers:

Working:

Code: Select all

4.13.0-kali1-amd64

Non-Working:

Code: Select all

3.2.0-23-generic-pae

If you need anything else, let me know how to figure it out.

Thank you for your help!

[pylkko]

Please show the source code

[banderas20]

Is this one:

https://www.exploit-db.com/exploits/33589/

[pylkko]

So you are compiling an exploit for an ubuntu kernel on Kali? But you don't use Debian at all?

[banderas20]

So you are compiling an exploit for an ubuntu kernel on Kali? But you don't use Debian at all?

So it seems. AFAIK, Kali is based on Debian. ¿Ubuntu isn't? Forgive by lack of knowledge about kernels...

Thank you very much!

[arzgi]

So it seems. AFAIK, Kali is based on Debian. ¿Ubuntu isn't? Forgive by lack of knowledge about kernels...

See for example this thread: http://forums.debian.net/viewtopic.php?f=3&t=138592

[banderas20]

I have seen that Ubuntu is debian based, but my compilation machine is x64 and the target is x86, so I will try to compile with -m32 parameter and see what happens.

Edit: I have copiled it with "-m32" and I get warnings:

Code: Select all

33589.c:52:21: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
  uint32_t *fixptr = (void*)AB(1);
                     ^
33589.c:55:33: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
  commit_creds_fn commit_creds = (commit_creds_fn)AB(2);
                                 ^
33589.c:56:47: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
  prepare_kernel_cred_fn prepare_kernel_cred = (prepare_kernel_cred_fn)AB(3);
                                               ^
33589.c:57:35: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]
  commit_creds(prepare_kernel_cred((uint64_t)NULL));
                                   ^
In file included from 33589.c:29:
33589.c: In function ‘main’:
33589.c:90:29: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
  assert((code = (void*)mmap((void*)kbase, KSIZE, 7, 0x32, 0, 0)) == (void*)kbase);
                             ^
33589.c:90:69: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
  assert((code = (void*)mmap((void*)kbase, KSIZE, 7, 0x32, 0, 0)) == (void*)kbase);
                                                                     ^
33589.c:90:29: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
  assert((code = (void*)mmap((void*)kbase, KSIZE, 7, 0x32, 0, 0)) == (void*)kbase);
                             ^
33589.c:90:69: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
  assert((code = (void*)mmap((void*)kbase, KSIZE, 7, 0x32, 0, 0)) == (void*)kbase);


If I try to run it on the target machine, now it yields errors:

Code: Select all

$ ./vnik32 0
IDT addr = 0xc1808000
vnik32: 33589.c:90: main: Assertion `(code = (void*)mmap((void*)kbase, KSIZE, 7, 0x32, 0, 0)) == (void*)kbase' failed.
Aborted (core dumped)

[debiman]

all the arguments so far are justified, but this:

Code: Select all

Syntax error: "(" unexpected

seems like such a blatant error; the only reason i can see why it comes up only on one OS is that the gcc versions differ vastly.
isn't there more to that error message? seems a little short.
did you use the compilation instructions in the comments?

[banderas20]

all the arguments so far are justified, but this:

Code: Select all

Syntax error: "(" unexpected

seems like such a blatant error; the only reason i can see why it comes up only on one OS is that the gcc versions differ vastly.
isn't there more to that error message? seems a little short.
did you use the compilation instructions in the comments?

Hello.

I have not that error anymore.

I use it the way it says in the comments, but for x32, like this:

Code: Select all

gcc 33589.c -O2 -m32 -o vnik32

(I only add the -m32)

And I get the warnings and error in my above post.

Thanks!

[pylkko]

compile it with the "all warnings" flag and post all the output here (use for example Wall or equivalent (see man gcc).

[banderas20]

compile it with the "all warnings" flag and post all the output here (use for example Wall or equivalent (see man gcc).

Ok. Here it is:

On Kali:

gcc 33589.c -O2 -m32 -o 33589 -Wall

Output:

Code: Select all

33589.c: In function ‘payload’:
33589.c:52:21: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
  uint32_t *fixptr = (void*)AB(1);
                     ^
33589.c:55:33: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
  commit_creds_fn commit_creds = (commit_creds_fn)AB(2);
                                 ^
33589.c:56:47: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
  prepare_kernel_cred_fn prepare_kernel_cred = (prepare_kernel_cred_fn)AB(3);
                                               ^
33589.c:57:35: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]
  commit_creds(prepare_kernel_cred((uint64_t)NULL));
                                   ^
33589.c: In function ‘main’:
33589.c:88:25: warning: format ‘%lx’ expects argument of type ‘long unsigned int’, but argument 2 has type ‘uint64_t’ {aka ‘long long unsigned int’} [-Wformat=]
  printf("IDT addr = 0x%lx\n", idt.addr);
                       ~~^     ~~~~~~~~
                       %llx
In file included from 33589.c:29:
33589.c:90:29: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
  assert((code = (void*)mmap((void*)kbase, KSIZE, 7, 0x32, 0, 0)) == (void*)kbase);
                             ^
33589.c:90:69: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
  assert((code = (void*)mmap((void*)kbase, KSIZE, 7, 0x32, 0, 0)) == (void*)kbase);
                                                                     ^
33589.c:90:29: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
  assert((code = (void*)mmap((void*)kbase, KSIZE, 7, 0x32, 0, 0)) == (void*)kbase);
                             ^
33589.c:90:69: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
  assert((code = (void*)mmap((void*)kbase, KSIZE, 7, 0x32, 0, 0)) == (void*)kbase);
                                                                     ^
33589.c:115:10: warning: suggest parentheses around assignment used as truth value [-Wparentheses]
   assert(p = memmem(code, 1024, &needle, 8));

Info about GCC
gcc -v

Code: Select all

Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/8/lto-wrapper
OFFLOAD_TARGET_NAMES=nvptx-none
OFFLOAD_TARGET_DEFAULT=1
Target: x86_64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Debian 8.2.0-6' --with-bugurl=file:///usr/share/doc/gcc-8/README.Bugs --enable-languages=c,ada,c++,go,brig,d,fortran,objc,obj-c++ --prefix=/usr --with-gcc-major-version-only --program-suffix=-8 --program-prefix=x86_64-linux-gnu- --enable-shared --enable-linker-build-id --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --libdir=/usr/lib --enable-nls --with-sysroot=/ --enable-clocale=gnu --enable-libstdcxx-debug --enable-libstdcxx-time=yes --with-default-libstdcxx-abi=new --enable-gnu-unique-object --disable-vtable-verify --enable-libmpx --enable-plugin --enable-default-pie --with-system-zlib --with-target-system-zlib --enable-objc-gc=auto --enable-multiarch --disable-werror --with-arch-32=i686 --with-abi=m64 --with-multilib-list=m32,m64,mx32 --enable-multilib --with-tune=generic --enable-offload-targets=nvptx-none --without-cuda-driver --enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu
Thread model: posix
gcc version 8.2.0 (Debian 8.2.0-6)

On the victim:
$ ./33589 0

Code: Select all

IDT addr = 0xc1808000
33589: 33589.c:90: main: Assertion `(code = (void*)mmap((void*)kbase, KSIZE, 7, 0x32, 0, 0)) == (void*)kbase' failed.
Aborted (core dumped)

Thanks!!!