Question

I am working on a exploit project which needs me to invoke a root shell from within the kernel. After searching through various documents and websites, I came to know that the only way to do that is to elevate the current process to root privileges and then execute instructions to invoke shell. This is because we cannot simply invoke a system call from kernel.

For the same, I have come across the call commit_creds (prepare_kernel_cred (0));, which can be used to grant root privilege to the process. However, I am using Red Hat Enterprise Linux 4.4 Base and it does not have the above call:

[dmazumd@bn19-62 ~]$ grep commit_cred /proc/kallsyms 
[dmazumd@bn19-62 ~]$ grep _cred /proc/kallsyms 
c0164655 T compute_creds
c01a7cdd t dummy_bprm_apply_creds.....

So, my question is, how to go about this?
I understand that the need is to set the uid of the process to zero which will provide it root privileges. AFAIK, the uid resides in struct_cred rather than struct_task now. And I am unaware if I can directly access these structures without the use of any API as mentioned above. Is there any other call to achieve the same? Or, is there any other approach?

PS: I am not asking for the exact answer to my question, any direction/help would be appreciated.

Answer 1

I could finally achieve root shell by first elevating the process to root status while inside kernel. This was achieved by using the call set_user(0) call which is defined inside /proc/kallsyms.

Once this is done, the process switches back to user space using iret and then spawns a shell. This shell has root privileges.