来源

关联漏洞

描述

PoC for Dirty COW (CVE-2016-5195)

介绍

# 0xdeadbeef

PoC for [Dirty COW](http://dirtycow.ninja/) (CVE-2016-5195).

This PoC relies on ptrace (instead of `/proc/self/mem`) to patch vDSO. It has a
few advantages over PoCs modifying filesystem binaries:

- no setuid binary required
- SELinux bypass
- container escape
- no kernel crash because of filesystem writeback

And a few cons:

- architecture dependent (since the payload is written in assembly)
- doesn't work on every Linux version
- subject to vDSO changes


## Payload

The current payload is almost the same as in
[The Sea Watcher](https://github.com/scumjr/the-sea-watcher) and is executed
whenever a process makes a call to `clock_gettime()`. If the process has root
privileges and `/tmp/.x` doesn't exist, it forks, creates `/tmp/.x` and finally
creates a TCP reverse shell to the exploit. It isn't elegant but it could be
used for container escape.


## TODO

- payload improvement
- release of the tool for vDSO payloads testing

Detecting if vDSO is successfuly patched isn't bulletproof. During the *restore*
step, the vDSO is effectively restored but the exploit fails to report it
correctly. Indeed, the vDSO changes don't seem to affect the exploit process.

文件快照

 [4.0K]  /data/pocs/545365f4c035c4eaca142e77737e1c39e2db7f28
├── [ 13K]  0xdeadbeef.c
├── [1.0K]  LICENSE
├── [ 284]  Makefile
├── [3.4K]  payload.s
├── [1.2K]  README.md
└── [4.0K]  tools
    ├── [ 557]  dump_vdso.c
    ├── [ 351]  dump_vdso_prologue.sh
    ├── [ 234]  Makefile
    └── [ 508]  test_payload.c

1 directory, 9 files

备注