1
0
out-of-tree/debug.go

275 lines
5.8 KiB
Go
Raw Normal View History

2018-11-25 14:46:29 +00:00
// Copyright 2018 Mikhail Klementev. All rights reserved.
// Use of this source code is governed by a AGPLv3 license
// (or later) that can be found in the LICENSE file.
package main
import (
"errors"
"fmt"
"io/ioutil"
"os"
"strings"
"time"
2023-03-18 21:30:07 +00:00
"github.com/rs/zerolog/log"
"gopkg.in/logrusorgru/aurora.v2"
2019-02-02 21:24:29 +00:00
"code.dumpstack.io/tools/out-of-tree/config"
"code.dumpstack.io/tools/out-of-tree/qemu"
2018-11-25 14:46:29 +00:00
)
2023-01-31 07:13:33 +00:00
type DebugCmd struct {
Kernel string `help:"regexp (first match)" required:""`
Gdb string `help:"gdb listen address" default:"tcp::1234"`
SshAddr string `help:"ssh address to listen" default:"127.0.0.1"`
SshPort int `help:"ssh port to listen" default:"50022"`
ArtifactConfig string `help:"path to artifact config" type:"path"`
2023-01-31 07:13:33 +00:00
Kaslr bool `help:"Enable KASLR"`
Smep bool `help:"Enable SMEP"`
Smap bool `help:"Enable SMAP"`
Kpti bool `help:"Enable KPTI"`
NoKaslr bool `help:"Disable KASLR"`
NoSmep bool `help:"Disable SMEP"`
NoSmap bool `help:"Disable SMAP"`
NoKpti bool `help:"Disable KPTI"`
}
// TODO: merge with pew.go
2023-01-31 07:13:33 +00:00
func (cmd *DebugCmd) Run(g *Globals) (err error) {
kcfg, err := config.ReadKernelConfig(g.Config.Kernels)
if err != nil {
2023-03-18 21:30:07 +00:00
log.Print(err)
2023-01-31 07:13:33 +00:00
}
var configPath string
if cmd.ArtifactConfig == "" {
configPath = g.WorkDir + "/.out-of-tree.toml"
} else {
configPath = cmd.ArtifactConfig
}
ka, err := config.ReadArtifactConfig(configPath)
2018-11-25 14:46:29 +00:00
if err != nil {
return
}
if ka.SourcePath == "" {
2023-02-23 08:25:19 +00:00
ka.SourcePath = g.WorkDir
2018-11-25 14:46:29 +00:00
}
2023-02-23 08:25:19 +00:00
ki, err := firstSupported(kcfg, ka, cmd.Kernel)
2018-11-25 14:46:29 +00:00
if err != nil {
return
}
kernel := qemu.Kernel{KernelPath: ki.KernelPath, InitrdPath: ki.InitrdPath}
2019-08-17 09:05:06 +00:00
q, err := qemu.NewSystem(qemu.X86x64, kernel, ki.RootFS)
2018-11-25 14:46:29 +00:00
if err != nil {
return
}
err = q.SetSSHAddrPort(cmd.SshAddr, cmd.SshPort)
if err != nil {
return
}
if ka.Qemu.Cpus != 0 {
q.Cpus = ka.Qemu.Cpus
}
if ka.Qemu.Memory != 0 {
q.Memory = ka.Qemu.Memory
}
if ka.Docker.Timeout.Duration != 0 {
2023-02-23 08:25:19 +00:00
g.Config.Docker.Timeout.Duration = ka.Docker.Timeout.Duration
}
q.SetKASLR(false) // set KASLR to false by default because of gdb
q.SetSMEP(!ka.Mitigations.DisableSmep)
q.SetSMAP(!ka.Mitigations.DisableSmap)
2019-08-20 00:05:19 +00:00
q.SetKPTI(!ka.Mitigations.DisableKpti)
2023-02-23 08:25:19 +00:00
if cmd.Kaslr {
q.SetKASLR(true)
2023-02-23 08:25:19 +00:00
} else if cmd.NoKaslr {
q.SetKASLR(false)
}
2023-02-23 08:25:19 +00:00
if cmd.Smep {
q.SetSMEP(true)
2023-02-23 08:25:19 +00:00
} else if cmd.NoSmep {
q.SetSMEP(false)
}
2023-02-23 08:25:19 +00:00
if cmd.Smap {
q.SetSMAP(true)
2023-02-23 08:25:19 +00:00
} else if cmd.NoSmap {
q.SetSMAP(false)
}
2023-02-23 08:25:19 +00:00
if cmd.Kpti {
2019-08-20 00:05:19 +00:00
q.SetKPTI(true)
2023-02-23 08:25:19 +00:00
} else if cmd.NoKpti {
2019-08-20 00:05:19 +00:00
q.SetKPTI(false)
}
redgreen := func(name string, enabled bool) aurora.Value {
if enabled {
return aurora.BgGreen(aurora.Black(name))
}
return aurora.BgRed(aurora.White(name))
}
2019-08-20 00:05:19 +00:00
fmt.Printf("[*] %s %s %s %s\n",
redgreen("KASLR", q.GetKASLR()),
redgreen("SMEP", q.GetSMEP()),
2019-08-20 00:05:19 +00:00
redgreen("SMAP", q.GetSMAP()),
redgreen("KPTI", q.GetKPTI()))
fmt.Printf("[*] SMP: %d CPUs\n", q.Cpus)
fmt.Printf("[*] Memory: %d MB\n", q.Memory)
2023-02-23 08:25:19 +00:00
q.Debug(cmd.Gdb)
coloredGdbAddress := aurora.BgGreen(aurora.Black(cmd.Gdb))
2019-08-21 06:16:25 +00:00
fmt.Printf("[*] gdb is listening on %s\n", coloredGdbAddress)
2018-11-25 14:46:29 +00:00
err = q.Start()
if err != nil {
return
}
defer q.Stop()
tmp, err := ioutil.TempDir("/tmp/", "out-of-tree_")
if err != nil {
return
}
defer os.RemoveAll(tmp)
2023-02-16 06:27:17 +00:00
err = q.WaitForSSH(time.Minute)
if err != nil {
return
}
2023-02-15 11:48:25 +00:00
if ka.StandardModules {
// Module depends on one of the standard modules
err = copyStandardModules(q, ki)
if err != nil {
2023-03-18 21:30:07 +00:00
log.Print(err)
2023-02-15 11:48:25 +00:00
return
}
}
2023-02-23 08:25:19 +00:00
err = preloadModules(q, ka, ki, g.Config.Docker.Timeout.Duration)
2020-06-14 20:14:59 +00:00
if err != nil {
2023-03-18 21:30:07 +00:00
log.Print(err)
2020-06-14 20:14:59 +00:00
return
}
buildDir, outFile, output, err := build(tmp, ka, ki, g.Config.Docker.Timeout.Duration)
2018-11-25 14:46:29 +00:00
if err != nil {
2023-03-18 21:30:07 +00:00
log.Print(err, output)
2018-11-25 14:46:29 +00:00
return
}
2019-08-16 05:38:25 +00:00
remoteFile := "/tmp/exploit"
2018-11-25 14:46:29 +00:00
if ka.Type == config.KernelModule {
2019-08-16 05:38:25 +00:00
remoteFile = "/tmp/module.ko"
2018-11-25 14:46:29 +00:00
}
err = q.CopyFile("user", outFile, remoteFile)
if err != nil {
return
}
// Copy all test files to the remote machine
2023-01-31 07:13:33 +00:00
for _, f := range ka.TestFiles {
if f.Local[0] != '/' {
f.Local = buildDir + "/" + f.Local
}
2023-01-31 07:13:33 +00:00
err = q.CopyFile(f.User, f.Local, f.Remote)
if err != nil {
2023-03-18 21:30:07 +00:00
log.Print("error copy err:", err, f.Local, f.Remote)
return
}
}
2018-11-25 14:46:29 +00:00
coloredRemoteFile := aurora.BgGreen(aurora.Black(remoteFile))
fmt.Printf("[*] build result copied to %s\n", coloredRemoteFile)
2019-08-17 09:05:06 +00:00
fmt.Printf("\n%s\n", q.GetSSHCommand())
2023-02-23 08:25:19 +00:00
fmt.Printf("gdb %s -ex 'target remote %s'\n\n", ki.VmlinuxPath, cmd.Gdb)
2019-08-16 06:32:26 +00:00
// TODO set substitute-path /build/.../linux-... /path/to/linux-source
2018-11-25 14:46:29 +00:00
err = interactive(q)
return
}
2023-02-23 08:25:19 +00:00
func firstSupported(kcfg config.KernelConfig, ka config.Artifact,
kernel string) (ki config.KernelInfo, err error) {
km, err := kernelMask(kernel)
if err != nil {
return
}
ka.SupportedKernels = []config.KernelMask{km}
for _, ki = range kcfg.Kernels {
var supported bool
supported, err = ka.Supported(ki)
if err != nil || supported {
return
}
}
err = errors.New("No supported kernel found")
return
}
func handleLine(q *qemu.System) (err error) {
fmt.Print("out-of-tree> ")
rawLine := "help"
fmt.Scanf("%s", &rawLine)
params := strings.Fields(rawLine)
cmd := params[0]
switch cmd {
case "h", "help":
fmt.Printf("help\t: print this help message\n")
fmt.Printf("log\t: print qemu log\n")
fmt.Printf("clog\t: print qemu log and cleanup buffer\n")
fmt.Printf("cleanup\t: cleanup qemu log buffer\n")
fmt.Printf("ssh\t: print arguments to ssh command\n")
fmt.Printf("quit\t: quit\n")
case "l", "log":
fmt.Println(string(q.Stdout))
case "cl", "clog":
fmt.Println(string(q.Stdout))
q.Stdout = []byte{}
case "c", "cleanup":
q.Stdout = []byte{}
case "s", "ssh":
fmt.Println(q.GetSSHCommand())
case "q", "quit":
return errors.New("end of session")
default:
fmt.Println("No such command")
}
return
}
func interactive(q *qemu.System) (err error) {
for {
err = handleLine(q)
if err != nil {
return
}
}
}