Skip to content

Instantly share code, notes, and snippets.

View brant-ruan's full-sized avatar
🍁
独立寒秋

Bonan Ruan brant-ruan

🍁
独立寒秋
563 followers · 602 following
View GitHub Profile
@brant-ruan
brant-ruan / bpf_example_maps.c
Created January 14, 2023 08:46
Pawnyable LK06
#include "bpf_insn.h"
#include <linux/bpf.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
@brant-ruan
brant-ruan / bpf_example_filter.c
Last active January 14, 2023 08:46
Pawnyable LK06
#include <linux/bpf.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
// https://pawnyable.cafe/linux-kernel/LK06/distfiles/bpf_insn.h
#include "bpf_insn.h"
@brant-ruan
brant-ruan / fuse_example.c
Last active January 13, 2023 10:11
Pawnyable LK04
// gcc fuse.c -o test -D_FILE_OFFSET_BITS=64 -static -pthread -lfuse -ldl
#define FUSE_USE_VERSION 29
#include <errno.h>
#include <fuse.h>
#include <stdio.h>
#include <string.h>
void fatal(const char *msg) {
perror(msg);
exit(1);
@brant-ruan
brant-ruan / exploit_race_fuse.c
Last active January 13, 2023 09:53
Pawnyable LK04
// gcc exploit.c -o exploit -D_FILE_OFFSET_BITS=64 -static -pthread -lfuse -ldl
#define _GNU_SOURCE
#define FUSE_USE_VERSION 29
#include <assert.h>
#include <errno.h>
#include <fcntl.h>
#include <fuse.h>
#include <linux/fuse.h>
#include <pthread.h>
#include <stdio.h>
@brant-ruan
brant-ruan / exploit_race_uffd.c
Last active January 13, 2023 08:59
Pawnyable LK04
#define _GNU_SOURCE
#include <assert.h>
#include <fcntl.h>
#include <linux/userfaultfd.h>
#include <poll.h>
#include <pthread.h>
#include <sched.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
@brant-ruan
brant-ruan / leak_kbase_and_heap.c
Last active January 13, 2023 09:00
Pawnyable LK04
#define _GNU_SOURCE
#include <assert.h>
#include <fcntl.h>
#include <linux/userfaultfd.h>
#include <poll.h>
#include <pthread.h>
#include <sched.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
@brant-ruan
brant-ruan / uffd_example.c
Last active January 9, 2023 04:23
Pawnyable LK04
#define _GNU_SOURCE
#include <assert.h>
#include <fcntl.h>
#include <linux/userfaultfd.h>
#include <poll.h>
#include <pthread.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
@brant-ruan
brant-ruan / race_poc.c
Last active January 9, 2023 04:13
Pawnyable LK04
// gcc exploit.c -static -no-pie -lpthread -o exploit
#include <fcntl.h>
#include <pthread.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
@brant-ruan
brant-ruan / exploit.c
Last active February 20, 2023 03:27
CVE-2020-14364 QEMU escape (from https://xz.aliyun.com/t/8320 and https://www.anquanke.com/post/id/227283)
#include <assert.h>
#include <fcntl.h>
#include <inttypes.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/io.h>
#include <sys/mman.h>
@brant-ruan
brant-ruan / Makefile
Created December 13, 2022 10:50
container breakout with CAP_SYS_MODULE
obj-m := reverse_shell_lkm.o
KBUILD_DIR := /lib/modules/`uname -r`/build
CFLAGS_vuln.o := -O0
all:
$(MAKE) -C $(KBUILD_DIR) M=$(shell pwd) modules
clean:
$(MAKE) -C $(KBUILD_DIR) M=$(shell pwd) clean