leviathan
125ce8a08b
Adds the infrastructure the 7 🟡 PRIMITIVE modules can wire into for
full-chain root pops.
core/offsets.{c,h}: four-source kernel-symbol resolution chain
1. env vars (IAMROOT_MODPROBE_PATH, IAMROOT_INIT_TASK, …)
2. /proc/kallsyms (only useful when kptr_restrict=0 or root)
3. /boot/System.map-$(uname -r) (world-readable on some distros)
4. embedded table keyed by uname-r glob (entries are
relative-to-_text, applied on top of an EntryBleed kbase leak;
seeded empty in v0.2.0 — schema-only — to honor the
no-fabricated-offsets rule).
core/finisher.{c,h}: shared root-pop helpers given a module's
arb-write primitive.
Pattern A (modprobe_path):
write payload script /tmp/iamroot-mp-<pid>.sh, arb-write
modprobe_path ← that path, execve unknown-format trigger,
wait for /tmp/iamroot-pwn-<pid> sentinel + setuid bash copy,
spawn root shell.
Pattern B (cred uid): stub — needs arb-READ too; modules use
Pattern A unless they have read+write.
On offset-resolution failure: prints a verbose how-to-populate
diagnostic and returns EXPLOIT_FAIL honestly.
core/module.h: + bool full_chain in iamroot_ctx
iamroot.c: + --full-chain flag (longopt 7, sets ctx.full_chain)
+ help text describing primitive-only-by-default + the
opt-in to attempt the full chain.
Makefile: add core/offsets.o + core/finisher.o to CORE_SRCS.
Build clean on Debian 6.12.86; --help renders the new flag.
100 lines
3.9 KiB
C
100 lines
3.9 KiB
C
/*
|
|
* IAMROOT — core module interface
|
|
*
|
|
* Every CVE module exports one or more `struct iamroot_module` entries
|
|
* via a registry function. The top-level dispatcher (iamroot.c) walks
|
|
* the global registry to implement --scan, --exploit, --mitigate, etc.
|
|
*
|
|
* This is intentionally a small interface. Modules carry the
|
|
* complexity; the dispatcher just routes.
|
|
*/
|
|
|
|
#ifndef IAMROOT_MODULE_H
|
|
#define IAMROOT_MODULE_H
|
|
|
|
#include <stddef.h>
|
|
#include <stdbool.h>
|
|
|
|
/* Standard result codes returned by detect()/exploit()/mitigate().
|
|
*
|
|
* These map to top-level exit codes when iamroot is invoked with a
|
|
* single-module operation:
|
|
*
|
|
* IAMROOT_OK exit 0 detect: not vulnerable / clean
|
|
* IAMROOT_VULNERABLE exit 2 detect: confirmed vulnerable
|
|
* IAMROOT_PRECOND_FAIL exit 4 detect: preconditions missing
|
|
* IAMROOT_TEST_ERROR exit 1 detect/exploit: error
|
|
* IAMROOT_EXPLOIT_OK exit 5 exploit: succeeded (root achieved)
|
|
* IAMROOT_EXPLOIT_FAIL exit 3 exploit: attempted but did not land
|
|
*
|
|
* Implementation note: copy_fail_family's df_result_t shares these
|
|
* numeric values intentionally so the family code can return its
|
|
* existing constants without translation.
|
|
*/
|
|
typedef enum {
|
|
IAMROOT_OK = 0,
|
|
IAMROOT_TEST_ERROR = 1,
|
|
IAMROOT_VULNERABLE = 2,
|
|
IAMROOT_EXPLOIT_FAIL = 3,
|
|
IAMROOT_PRECOND_FAIL = 4,
|
|
IAMROOT_EXPLOIT_OK = 5,
|
|
} iamroot_result_t;
|
|
|
|
/* Per-invocation context passed to module callbacks. Lightweight for
|
|
* now; will grow as modules need shared state (host fingerprint,
|
|
* leaked kbase, etc.). */
|
|
struct iamroot_ctx {
|
|
bool no_color; /* --no-color */
|
|
bool json; /* --json (machine-readable output) */
|
|
bool active_probe; /* --active (do invasive probes in detect) */
|
|
bool no_shell; /* --no-shell (exploit prep but don't pop) */
|
|
bool authorized; /* user typed --i-know on exploit */
|
|
bool full_chain; /* --full-chain (attempt root-pop after primitive) */
|
|
};
|
|
|
|
struct iamroot_module {
|
|
/* Short id used on the command line: `iamroot --exploit copy_fail`. */
|
|
const char *name;
|
|
|
|
/* CVE identifier (or "VARIANT" if no CVE assigned). */
|
|
const char *cve;
|
|
|
|
/* One-line human description. */
|
|
const char *summary;
|
|
|
|
/* Family this module belongs to (e.g. "copy_fail_family"). Modules
|
|
* with shared infrastructure live in the same family. */
|
|
const char *family;
|
|
|
|
/* Affected kernel range, prose. Machine-readable range goes in
|
|
* the module's kernel-range.json (consumed by CI). */
|
|
const char *kernel_range;
|
|
|
|
/* Probe the host. Should be side-effect-free unless ctx->active_probe
|
|
* is true. Return IAMROOT_VULNERABLE if confirmed,
|
|
* IAMROOT_PRECOND_FAIL if not applicable here, IAMROOT_OK if patched
|
|
* or otherwise immune, IAMROOT_TEST_ERROR on probe error. */
|
|
iamroot_result_t (*detect)(const struct iamroot_ctx *ctx);
|
|
|
|
/* Run the exploit. Caller has already passed the --i-know gate. */
|
|
iamroot_result_t (*exploit)(const struct iamroot_ctx *ctx);
|
|
|
|
/* Apply a temporary mitigation. NULL if none offered. */
|
|
iamroot_result_t (*mitigate)(const struct iamroot_ctx *ctx);
|
|
|
|
/* Undo --exploit (e.g. evict from page cache) or --mitigate side
|
|
* effects. NULL if no cleanup applies. */
|
|
iamroot_result_t (*cleanup)(const struct iamroot_ctx *ctx);
|
|
|
|
/* Detection rule corpus — embedded so the binary is self-
|
|
* contained. Each may be NULL if this module ships no rules for
|
|
* that format. Strings are NUL-terminated; concatenated in the
|
|
* order modules register. */
|
|
const char *detect_auditd; /* auditd .rules content */
|
|
const char *detect_sigma; /* sigma YAML content */
|
|
const char *detect_yara; /* yara rules content */
|
|
const char *detect_falco; /* falco rules content */
|
|
};
|
|
|
|
#endif /* IAMROOT_MODULE_H */
|