Add an exploit for CVE-2023-6546 #18790
Conversation
|
Nice one :) The github URL is incorrect , the correct one is https://github.com/Nassim-Asrir/ZDI-24-020 |
There was a problem hiding this comment.
Thanks @jvoisin for this module. I left a few comments and suggestions for you to review when you get a chance. Specifically, I recommend using a precompiled binary and patching it with the payload and offsets from the ruby code.
| os_id = cmd_exec('grep ^ID= /etc/os-release')[3..] | ||
| output = cmd_exec "echo '#{payload_path} & exit' | #{executable_path} #{os_id}" |
There was a problem hiding this comment.
If we use a precompiled binary, everything can be embedded by patching it. The payload, the offsets, etc. This would avoid having two binaries on disk.
There was a problem hiding this comment.
Is there an example somewhere in metasploit on how to do this properly?
There was a problem hiding this comment.
Sure, this module is a good example:
https://github.com/rapid7/metasploit-framework/blob/a75013e51a4e72394a9b2ab4a8c00b5861a2cc52/modules/evasion/windows/process_herpaderping.rb
There was a problem hiding this comment.
I seems that I can't manage to compile a static musl binary with correct pthread support, as the call to sched_setscheduler invariably fails.
documentation/modules/exploit/linux/local/gsm_multiplex_priv_esc.md
Outdated
Show resolved
Hide resolved
|
@Nassim-Asrir, since this module will use your exploit, a LICENSE is required. I couldn't find one, so I submitted a PR with a standard |
| #define VERBOSE | ||
| #define NUM_SPRAY 300 | ||
| #define EXPLOIT_TRIES 10 | ||
| #define PYTHON_PAYLOAD "import os; os.setresgid(0, 0, 0); os.setresuid(0, 0, 0); os.execl('/bin/bash', 'bash', '-c', 'export HISTFILE=/dev/null;chmod u-s /usr/bin/python3 /usr/libexec/platform-python 2>/dev/null; rmmod n_gsm; id; exec /bin/bash --norc --noprofile');" |
There was a problem hiding this comment.
The payload is assuming /usr/bin/python3 or /usr/libexec/platform-python exist. This might not work on systems with python2 or with different paths.
If I understand this correctly, this sets sgid and suid to 0 on the python process and spawn a shell as the root user. I'm wondering if it would be possible to be more generic and not rely on python exclusively. I believe we can execute our proper binary payload directly without the need of invoking python. Also, Metasploit payloads have the capability of setting suid themself (PrependSetuid option).
So, the idea would be to just execute the exploit binary, with the embedded payload, instead of:
output = cmd_exec "echo '#{payload_path} & exit' | #{executable_path} #{os_id}"
There was a problem hiding this comment.
It might™ be possible to not rely on the python interpreter, but since the payload is carefully crafted to call chmod u+s python, it's less trivial than what I've done, namely:
- if the payload is
ARCH_PYTHON, inline it and compile the exploit locally (is there a mixin to do this by the way?) - otherwise, use an external binary
What do you think?
Several things were changed in the original exploit.c: - Allow python payload to use an inline payload, so that a secondary binary isn't needed. There is likely some way to do this with other things than python, but since the "make the python interpreter setuid" command is hardcoded in the chain, it's less trivial than simply patching the python payload. - Offsets are moved onto the metasploit module, making them easier to modify and expand.
|
Thank you for updating this @jvoisin . I'm sorry I couldn't get back to your module earlier. I tried to run the module against Ubuntu 20.04.4 with different kernel versions and it failed. I also couldn't make the original exploit work neither. I'm wondering if the exploit works against Ubuntu on VM? Please, would you mind giving more details on the targets you've tested? |
|
It's been a long time now, and I've deleted my lab and I don't think I'll have the time to look at this in a while :/ |
Verification
List the steps needed to make sure this thing works
msfconsoleset verbose trueuse linux/local/gsm_multiplex_priv_escexploitset payload python/meterpreter/reverse_tcpexploitInlining the payload inside the exploit.messageThis should close #18719
CC @Nassim-Asrir