d3kbus — d3c2026

Description

「 Everynight I look to the skies and wonder what we did Always a naive point of view that breaks us in the end

The archive provides a Linux 7.1.4 kernel, a QCOW2 root filesystem, the custom d3kbus.ko module, and a QEMU runner. The objective is to escape the unprivileged ctf shell and read the root-only flag.

Challenge Environment

run.sh boots an x86-64 guest with SMEP, SMAP, KASLR, and PTI enabled:

-cpu kvm64,+smep,+smap
-append "console=ttyS0 root=/dev/sda rw rdinit=/sbin/init quiet kaslr pti=on oops=panic panic=1"

The relevant part of /etc/init.d/rcS is:

chown root:root /flag
chmod 0400 /flag
insmod /root/d3kbus.ko

cd /home/ctf
su ctf -c sh

poweroff -d 0  -f

Thus the module is available to the unprivileged shell, while /flag can only be opened by root. Once that shell exits, the still-root init script runs BusyBox's poweroff applet.

The supplied module retains symbols, DWARF, and BTF. That made it possible to recover the two control ioctls and the producer/subscriber protocol without guessing:

#define D3KBUS_IOC_CREATE    0xc0186101UL
#define D3KBUS_IOC_SUBSCRIBE 0xc0286102UL
#define D3KBUS_WIRE_MAGIC    0x3361626eU
#define D3KBUS_FRAME_MAGIC   0x74747261U

struct d3kbus_wire_header {       /* 32 bytes */
    uint32_t magic;
    uint16_t header_length, flags;
    uint32_t payload_length, stream_id, user_tag, reserved;
    uint64_t opaque;
} __attribute__((packed));

struct d3kbus_frame_header {      /* 48 bytes */
    uint32_t magic;
    uint16_t header_length, flags;
    uint32_t channel_id, stream_id;
    uint64_t sequence, opaque;
    uint32_t user_tag, payload_length, window_offset, reserved;
} __attribute__((packed));

Creating a channel returns a producer fd, channel ID, and cookie. Subscribing with projection mode 2 and flag bit 2 requests a window projection with CRC32C.

Vulnerability Root Cause

External pages survive direct-splice ingestion

...