1
2
3
4
5
6
7
8
9
seccomp_rule_add(v1, 0x7FFF0000, 2, 0);
seccomp_rule_add(v1, 0x7FFF0000, 257, 0);
seccomp_rule_add(v1, 2147418112, 0, 0);
seccomp_rule_add(v1, 2147418112, 1, 0);
seccomp_rule_add(v1, 2147418112, 14, 0);
seccomp_rule_add(v1, 2147418112, 15, 0);
seccomp_rule_add(v1, 2147418112, 60, 0);
seccomp_rule_add(v1, 2147418112, 231, 0);
seccomp_rule_add(v1, 2147418112, 322, 0);
0x7FFF0000 == 2147418112 == SCMP_ACT_ALLOW
1
2
3
4
5
6
7
8
9
0 read read from a file descriptor
1 write write to a file descriptor
2 open open a file
14 rt_sigprocmask manipulate blocked signal mask
15 rt_sigreturn return from signal handler
60 exit terminate current thread/process
231 exit_group terminate all threads in process
257 openat open a file relative to a directory fd
322 execveat execute a program relative to a directory fd
主函数：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
int __fastcall main(int argc, const char **argv, const char **envp)
{
char *s; // [rsp+8h] [rbp-18h] BYREF
int n[2]; // [rsp+10h] [rbp-10h] BYREF
unsigned __int64 v6; // [rsp+18h] [rbp-8h]
v6 = __readfsqword(0x28u);
init(argc, argv, envp);
setup_seccomp();
printf("%p\n", &setvbuf);
__isoc99_scanf("%zu %zu ", &s, n);
fgets(s, n[0], stdin);
fork();
return 0;
}
向任意地址写入任意长度数据 & 给出libc基地址.
从沙箱来看，用ORW? SROP? 执行到execveat?
比较奇怪的是最后的fork, 理论上他会调用57号系统调用，但是这一题沙箱允许的syscall中并不包含，所以会报：
1
zsh: invalid system call (core dumped) ./vuln_patched