chinmay1743/af_packet.cPrueba de concepto para verificar los privilegios de af_packet.c con el fin de validar los privilegios adquiridos por cualquier hacker tras la explotación exitosa de CVE-2021-22600
Prueba de concepto para verificar los privilegios de af_packet.c con el fin de validar los privilegios adquiridos por cualquier hacker tras una explotación exitosa de CVE-2021-22600
Es solo una muestra de prueba de concepto generada por un LLM y no cubre todos los casos. La idea básica detrás de esta prueba de concepto es verificar con qué tipo de privilegios se ejecuta el código objetivo (por ejemplo, en espacio de usuario o espacio de kernel) para comprender las implicaciones de su explotación con cualquier exploit construido alrededor de CVE-2021-22600. Este código no es, de ninguna manera, un exploit de la CVE mencionada. Lo probé en Ubuntu dentro de una VM. Su experiencia puede variar según el entorno.
Pasos para compilar el código y ejecutarlo:
gcc program.c -o runme
chmod +x runme
./runme
sudo ./runme
Salida de ejemplo al ejecutar como usuario normal:
<..SNIP..>
=== AF_PACKET privilege probe ===
UID=1000 EUID=1000
WARNING: couldn't read CapEff from /proc/self/status. Continuing anyway.
Stage 1: try AF_PACKET + SOCK_DGRAM (no CAP_NET_RAW required by kernel check)
socket(AF_PACKET, SOCK_DGRAM, ETH_P_ALL) => FAILED: Operation not permitted (errno=1)
Stage 2: try AF_PACKET + SOCK_RAW (kernel checks CAP_NET_RAW for SOCK_RAW)
socket(AF_PACKET, SOCK_RAW, ETH_P_ALL) => FAILED: Operation not permitted (errno=1)
RAW socket creation failed: you cannot reach packet_set_ring() from user-land without CAP_NET_RAW.
Common results:
- errno=EPERM (Operation not permitted) : you lack CAP_NET_RAW
- errno=EACCES : sometimes indicates policy or network namespace restrictions
Notes:
- The kernel enforces CAP_NET_RAW at socket creation: look for a check like
if (sock->type == SOCK_RAW && !capable(CAP_NET_RAW)) return -EPERM;
in net/packet/af_packet.c (this is why PACKET_RX_RING is unreachable without that socket).
- If you run this program as root or with CAP_NET_RAW, the RAW socket will succeed and
setsockopt(PACKET_RX_RING) will attempt to configure the ring (it may still fail with EINVAL
if your parameters are invalid, but you will have invoked packet_set_ring()).
=== Done ===
<..SNIP..>
Salida de ejemplo al ejecutar como sudo / usuario root:
<..SNIP..>
=== AF_PACKET privilege probe ===
UID=0 EUID=0
CapEff (hex) = 0x000001ffffffffff
-> CAP_NET_RAW (bit 12) = YES
Stage 1: try AF_PACKET + SOCK_DGRAM (no CAP_NET_RAW required by kernel check)
socket(AF_PACKET, SOCK_DGRAM, ETH_P_ALL) => OK (fd=3)
Stage 2: try AF_PACKET + SOCK_RAW (kernel checks CAP_NET_RAW for SOCK_RAW)
socket(AF_PACKET, SOCK_RAW, ETH_P_ALL) => OK (fd=3)
Since RAW socket creation succeeded, we likely have CAP_NET_RAW (or are root).
Stage 3: try setsockopt PACKET_RX_RING (this invokes packet_set_ring in kernel)
setsockopt(PACKET_RX_RING) => OK
Notes:
- The kernel enforces CAP_NET_RAW at socket creation: look for a check like
if (sock->type == SOCK_RAW && !capable(CAP_NET_RAW)) return -EPERM;
in net/packet/af_packet.c (this is why PACKET_RX_RING is unreachable without that socket).
- If you run this program as root or with CAP_NET_RAW, the RAW socket will succeed and
setsockopt(PACKET_RX_RING) will attempt to configure the ring (it may still fail with EINVAL
if your parameters are invalid, but you will have invoked packet_set_ring()).
=== Done ===
<..SNIP..>