爲什麼seccomp禁止我正常的系統調用

Question

這是pwnable.kr中的最新問題，asm.c使用seccomp來限制我的系統調用，除了write（），open（），read（）和exit（）。

asm.c：

#include <stdio.h> 
#include <string.h> 
#include <stdlib.h> 
#include <sys/mman.h> 
#include <seccomp.h> 
#include <sys/prctl.h> 
#include <fcntl.h> 

#define LENGTH 128 

void sandbox(){ 
    scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_KILL); 
    if (ctx == NULL) { 
     printf("seccomp error\n"); 
     exit(0); 
    } 

    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), 0); 
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 0); 
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 0); 
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit), 0); 
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0); 

    if (seccomp_load(ctx) < 0){ 
     seccomp_release(ctx); 
     printf("seccomp error\n"); 
     exit(0); 
    } 
    seccomp_release(ctx); 
} 

char stub[] = "\x48\x31\xc0\x48\x31\xdb\x48\x31\xc9\x48\x31\xd2\x48\x31\xf6\x48\x31\xff\x48\x31\xed\x4d\x31\xc0\x4d\x31\xc9\x4d\x31\xd2\x4d\x31\xdb\x4d\x31\xe4\x4d\x31\xed\x4d\x31\xf6\x4d\x31\xff"; 
unsigned char filter[256]; 
int main(int argc, char* argv[]){ 

    setvbuf(stdout, 0, _IONBF, 0); 
    setvbuf(stdin, 0, _IOLBF, 0); 

    printf("Welcome to shellcoding practice challenge.\n"); 
    printf("In this challenge, you can run your x64 shellcode under SECCOMP sandbox.\n"); 
    printf("Try to make shellcode that spits flag using open()/read()/write() systemcalls only.\n"); 
    printf("If this does not challenge you. you should play 'asg' challenge :)\n"); 

    char* sh = (char*)mmap(0x41414000, 0x1000, 7, MAP_ANONYMOUS | MAP_FIXED | MAP_PRIVATE, 0, 0); 
    memset(sh, 0x90, 0x1000); 
    memcpy(sh, stub, strlen(stub)); 

    int offset = sizeof(stub); 
    printf("give me your x64 shellcode: "); 
    read(0, sh+offset, 1000); 

    alarm(10); 
    sandbox(); 
    ((void (*)(void))sh)(); 
    return 0; 
} 

命名this_is_pwnable.kr_flag_file_please_read_this_file.sorry_the_file_name_is_very_loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo0000000000000000000000000ooooooooooooooooooooooo000000000000o0o0o0o0o0o0ong

於是我就用剛剛開放的標誌文件，讀寫使程序和它的工作（我做一個標記文件，自己和程序的打印它成功了），但是當我把shellcode放到./asm時，它通常會說Bad system call。我不知道我在哪裏犯了一個錯誤？

這是我的代碼：

[SECTION .text] 

global _start 

_start: 

    xor eax, eax 
    xor ebx, ebx 
    xor edx, edx 
    xor ecx, ecx 
    xor ebp, ebp 

    mov eax, 5 ;open file 
    mov ebx, file_name 
    mov ecx, 0 
    mov edx, 0777 
    int 0x80 

    mov [fd_in], eax 

    xor eax, eax ;read from file 
    mov eax, 3 
    mov ebx, [fd_in] 
    mov ecx, info 
    mov edx, 26 
    int 0x80 

    mov eax, 4 ;write flag 
    mov ebx, 1 
    mov ecx, info 
    mov edx, 26 
    int 0x80 

    mov al, 1 ;exit 
    int 0x80 


[SECTION .data] 
    file_name db 'this_is_pwnable.kr_flag_file_please_read_this_file.sorry_the_file_name_is_very_loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo0000000000000000000000000ooooooooooooooooooooooo000000000000o0o0o0o0o0o0ong' 

[SECTION .bss] 
    fd_in resb 1 
    info resb 26 

感謝

Answer 1

這是一個64位二進制和你的shellcode是32位。