chinmay1743/af_packet.caf_packet.c의 권한을 확인하기 위한 개념 증명(PoC)으로, CVE-2021-22600을 성공적으로 악용한 해커가 획득한 권한을 검증합니다.
CVE-2021-22600의 성공적인 익스플로잇 시 해커가 획득하는 권한을 검증하기 위해 af_packet.c의 권한을 확인하는 개념 증명
이는 LLM이 생성한 샘플 개념 증명일 뿐이며 모든 경우를 다루지 않습니다. 이 개념 증명의 기본 아이디어는 대상 코드가 어떤 권한으로 실행되는지(예: 사용자 공간 또는 커널 공간) 확인하여, CVE-2021-22600을 중심으로 구축된 모든 익스플로잇의 영향력을 이해하는 것입니다. 이 코드는 앞서 언급한 CVE의 익스플로잇이 아닙니다. VM 안의 우분투에서 테스트했습니다. 환경에 따라 결과가 다를 수 있습니다.
코드를 컴파일하고 실행하는 단계:
gcc program.c -o runme
chmod +x runme
./runme
sudo ./runme
일반 사용자로 실행한 샘플 출력:
<..SNIP..>
=== AF_PACKET privilege probe ===
UID=1000 EUID=1000
WARNING: couldn't read CapEff from /proc/self/status. Continuing anyway.
Stage 1: try AF_PACKET + SOCK_DGRAM (no CAP_NET_RAW required by kernel check)
socket(AF_PACKET, SOCK_DGRAM, ETH_P_ALL) => FAILED: Operation not permitted (errno=1)
Stage 2: try AF_PACKET + SOCK_RAW (kernel checks CAP_NET_RAW for SOCK_RAW)
socket(AF_PACKET, SOCK_RAW, ETH_P_ALL) => FAILED: Operation not permitted (errno=1)
RAW socket creation failed: you cannot reach packet_set_ring() from user-land without CAP_NET_RAW.
Common results:
- errno=EPERM (Operation not permitted) : you lack CAP_NET_RAW
- errno=EACCES : sometimes indicates policy or network namespace restrictions
Notes:
- The kernel enforces CAP_NET_RAW at socket creation: look for a check like
if (sock->type == SOCK_RAW && !capable(CAP_NET_RAW)) return -EPERM;
in net/packet/af_packet.c (this is why PACKET_RX_RING is unreachable without that socket).
- If you run this program as root or with CAP_NET_RAW, the RAW socket will succeed and
setsockopt(PACKET_RX_RING) will attempt to configure the ring (it may still fail with EINVAL
if your parameters are invalid, but you will have invoked packet_set_ring()).
=== Done ===
<..SNIP..>
sudo / root 사용자로 실행한 샘플 출력:
<..SNIP..>
=== AF_PACKET privilege probe ===
UID=0 EUID=0
CapEff (hex) = 0x000001ffffffffff
-> CAP_NET_RAW (bit 12) = YES
Stage 1: try AF_PACKET + SOCK_DGRAM (no CAP_NET_RAW required by kernel check)
socket(AF_PACKET, SOCK_DGRAM, ETH_P_ALL) => OK (fd=3)
Stage 2: try AF_PACKET + SOCK_RAW (kernel checks CAP_NET_RAW for SOCK_RAW)
socket(AF_PACKET, SOCK_RAW, ETH_P_ALL) => OK (fd=3)
Since RAW socket creation succeeded, we likely have CAP_NET_RAW (or are root).
Stage 3: try setsockopt PACKET_RX_RING (this invokes packet_set_ring in kernel)
setsockopt(PACKET_RX_RING) => OK
Notes:
- The kernel enforces CAP_NET_RAW at socket creation: look for a check like
if (sock->type == SOCK_RAW && !capable(CAP_NET_RAW)) return -EPERM;
in net/packet/af_packet.c (this is why PACKET_RX_RING is unreachable without that socket).
- If you run this program as root or with CAP_NET_RAW, the RAW socket will succeed and
setsockopt(PACKET_RX_RING) will attempt to configure the ring (it may still fail with EINVAL
if your parameters are invalid, but you will have invoked packet_set_ring()).
=== Done ===
<..SNIP..>