DirtyCow Exploit - Null/DC chennai - 27/11

Dirty Cow exploit presentation done at Null/DC meet held at thoughtworks Chennai.

Transcript

1. DIRTYCOW EXPLOIT (CVE-2016-5195) SANTHOSH KUMAR NULL/DC MEET – 27.11.2016
2. About me. • Cybersecurity consultant at EY chennai. • Consultant by the day/Researcher by the night. • Love breaking stuff and witnessing the chaos. • Speaker at various cons around the world including owasp appsec usa,DEFCON , Bsides Las Vegas Disclaimer : Views expressed here are my own not that of my employer.
3. Before anything..
4. Cow what? • Cow is termed as “copy on write”. • Issues lies with how the memory mapping occurs with the linux operating system. • The bug existed from kernel version 2.6.22 aka from 2007 :P • Affects large number of linux based system including droids, iot etc.
5. Memory mapping • Memory maping in the linux is where a file is linked to the virutal memory but not copied as a whole to the virtual memory. • This bug is a race condition exploit which means it wont happen in the ideal time but the race condition needs to be triggered for it to work .
6. Bad news.
7. Demo
8. What happened? • Lets have a look at the source code. • Start with main() https://github.com/dirtycow/dirtycow.github.io/blob/master/dirtyc0w.c
9. What happened
10. Madvise • The madvise() system call advises the kernel about how to handle paging input/output in the address range beginning at address addr and with size length bytes. It allows an application to tell the kernel how it expects to use some mapped or shared memory areas, so that the kernel can choose appropriate read-ahead and caching techniques. This call does not influence the semantics of the application. https://linux.die.net/man/2/madvise MADV_DONTNEED Do not expect access in the near future. Application is done don’t expect access in the future.Memory is cleared
11. What happened? • https://linux.die.net/man/2/madvise
12. Patch? • Linux upstream patched with this commit • https://git.kernel.org/cgit/linux/kernel/git/torvalds/linu x.git/commit/?id=19be0eaffa3ac7d8eb6784ad9bdbc 7d67ed8e619 • New flag – FOLL_COW flag to stop the race condition. • Ubuntu and various other distributions released their patches along the way. • https://github.com/dirtycow/dirtycow.github.io/wiki/Pa tched-Kernel-Versions • You cant monitor this one in syslog.
13. Exploit effects • This one is rather used as chained exploit than standlone exploit. • Android has a specific poc. • https://github.com/timwr/CVE-2016-5195
14. • Metasploit module as well. • You can get root shell by replacing /etc/passwd https://github.com/gbonacini/CVE-2016- 5195/blob/master/dcow.cpp • https://github.com/gbonacini/CVE-2016- 5195
15. So whatnext ? • Patch your systems. • Add a read only user rule in /proc/*/mem ? • ^defenders your views on this. • There has been cases where it can change as well . • You tell me !