Dirty Cow

• Why this topic?
  • The dirty cow attack represents
    • A serious system flaw
    • A serious security flaw caused by poor software implementation
    • And these are both issues are of interest to us right now.
  • You should have some experience with cybersecurity
  • I want to try speaking on this subject.
  • I want to generate some excitement for the cyber classes next spring.
• Security
  • Confidentiality
  • Integrity
  • Availability
• Dirty Cow
  • Dirty Copy On Write
  • This is a kernel vulnerability
    • Both linux and android systems.
  • It allows privilege escalation
  • It was discovered (publicly) in October 2016
  • It was present in the Kernel since September 2007
  • A full patch was released in November 2017
• High Level Exploit
  • Dirty COW involves a race condition
  • The exploit allows a user to write to any file regardless of permissions.
  • We will use the exploit to modify the password file and gain full root access.
  • We could do other things as well.
• User privilege background
  • A user has both a name and a user id.
  • The user name
    • Used during the login process
    • The user name is listed in /etc/passwd

    • root:x:0:0:root:/root:/bin/bash
      bennett:x:1000:1000:Dan Bennett:/home/bennett:/bin/bash
      	    

    • The user password is listed in /etc/shadow

    • root:**** ENCRYPTED PASSWORD DELETED ****::0:99999:7:::
      bennett:**** ENCRYPTED PASSWORD DELETED ****:17054:0:99999:7:::
      	    

    • The system uses the username to retrieve the encrypted password from the shadow password file.
    • After that, the user name is really not used.
  • The userid
    • The userid is the third entry in the password file.
    • My userid is 1000
    • The userid for root is 0
    • All processes store the userid of the process.
    • A process with userid 0 has permission to
      • Modify any file.
      • Send any signal to any process.
      • Other special actions.
    • Someone with userid 0 has total control over the entire system.
  • A privilege escalation attack attempts to change the userid to be 0.
• Password are reasonably secure
  • A one way map
  • That is hard to break via brute force attacks.
• Let's play
  • The command id will tell you your current userid
    • type it now.
  • The command whoami will tell you the user name associated with the id.
    • type it now.
  • Look at /etc/passwd
    • ls -l /etc/passwd
    • more /etc/passwd
    • Try to edit it.
  • Try to look at /etc/shadow
    • ls -l /etc/shadow
    • more it.
• Experiment 1, what does mmap do?
  • You should be in a directory called cow
  • There are two programs there, we will look at example.C
  • The program uses mmap
    • mmap maps a file to memory.
    • this means we can do I/O to the map and it will be done to the file as well.
    • We can treat the map as an array for example.
  • mmap takes 6 parameters
    • address: If NULL, the kernel chooses a page-aligned address
    • length: the size of memory desired
    • protection:
      • PROT_READ : the map may be read
      • PROT_WRITE: the map may be written to
    • flags : How the map updates are shared with other processes
      • MAP_SHARED: the map is shared
      • MAP_PRIVATE: Create a private copy on write map.
        • IE if the process tries to write to the map, make a copy first then permit the write.
    • file : the file to map to memory
    • offset: where in the file to start mapping to memory

  • struct stat st;
    void * map;
    int f = open("./zzz", O_RDWR);
    fstat(f, &st);
    map = mmap(NULL, st.st_size, PROT_READ| PROT_WRITE, MAP_SHARED, f, 0);
    

    • This is low level *nix IO but it
      1. Opens a file for read/write
      2. Finds the size of the file.
      3. Creates a memory map with that file.
         • the map is available for both read and write.
  • So look at the program.
    • memcpy(dest, source, length)
    • Copies length bytes from the source to the destination.
    • The program
      1. Establishes a memory mapped file
      2. Copies from the file to a buffer
      3. Prints the buffer
      4. Copies from a buffer to a file
      5. Closes the map.
  • At this point, you should have some understanding of mmap
  • Make a file in your cow directory called zzz
  • Put at least 20 characters of text, preferably not including "New Content"
  • Run example
  • look at zzz
• The bug
  • We need to create a race condition, so we will use multiple processes
    • The parent
      • Open a memory map to a write protected file.
        • The map is marked: PROT_READ and MAP_PRIVATE
        • Writes to the map will cause a new copy of the map to be allocated.
      • Fork a child to write to the map.
      • Start a thread that tells the map we don't need it any longer.
    • The thread
      • madvise(address, length, advice)
        • MADV_DONTNEED: the program does not expect to need this map soon.
          • Free it to free up memory
          • If it is needed, a new copy will be made.
        • So the process just loops trowing away memory

        • void *madviseThread(void *arg) {
            int i, c = 0;
            for(i = 0; i < 20000; i++) {
              c += madvise(map, 100, MADV_DONTNEED);
            }
          }
          

    • The child
      • Writes a message to the file over and over again.
      • It does this via ptrace
        • Ptrace is used for debuggers to allow them to change the contents of variables.
        • This is essentially a write to the file.
  • So what happens
    • The child will attempt to write to a read only map
      • So a new (private) copy of the map will be created for writing.
      • And the child will write to it.
      • But when a new copy is made, there is never a check to see if you are allowed to write to the copy.

      • write:
        
           if (map read only) {
                newMap = Allocate a new map 
                write to newMap
           }
         

    • The thread will constantly tell the os to throw the map away

      delete:
      
              update map pointers
              delete temporary map
       

    • In a race condition

      
         if (map read only) {
              newMap = Allocate a new map 
       
      
              update map pointers
              delete temporary map
       
      
              write to newMap
         }
       

• The exploit
  • sudo cp /etc/passwd /tmp/zzz
  • sudo chmod go-w /tmp/zzz
  • Look at cow_attack.C
  • Compile and run it (make)
  • Look at /tmp/zzz
  • You may have to repeat the last steps several times.
  • Can you modify this code to give you system access?