401 unauthorized

[ignnniter]

Describe the bug
401 Unauthorized, login required.

Version used
Both, v2 first

Command input and ouput
python3 ./dirty_sockv2.py

Environment details
snap 2.34.2ubuntu0.1
snapd 2.34.2ubuntu0.1
series 16
ubuntu 16.04
kernel 4.4.0-138-generic

Additional context
Add any other context about the problem here.

[initstring]

EDITED
Can you confirm that the text above is the exact output from the snap version command? This looks a bit different than what I am used to seeing.

[initstring]

Also, if you ran v2 first and it looked like it completed successfully but then you tried again and you got 401 then please check the Troubleshooting section in the README.

[ignnniter]

[+] Slipped dirty sock on random socket file: /tmp/zmlrvhwtzw;uid=0;
[+] Binding to socket file...
[+] Connecting to snapd API...
[+] Deleting trojan snap (and sleeping 5 seconds)...
[!] System may not be vulnerable, here is the API reply:

HTTP/1.1 401 Unauthorized
Content-Type: application/json
Date: Tue, 26 Feb 2019 05:19:48 GMT
Content-Length: 119

{"type":"error","status-code":401,"status":"Unauthorized","result":{"message":"access denied","kind":"login-required"}}

[ignnniter]

Also, if you ran v2 first and it looked like it completed successfully but then you tried again and you got 401 then please check the Troubleshooting section in the README.

I checked if there's a created user after running the v2 first, unfortunately none.

[initstring]

I just re-ran the exploit on Ubuntu 16.04 - both versions succeed without issue.
Can you please post a screenshot of the output of snap version?'
Also please post the screenshot of snap list

The 401 error is expected from non-vulnerable versions of snapd.

Thanks!

[ignnniter]

Sure here it is:

https://imgur.com/a/Ehtkwch

[initstring]

Interesting. It appears that your snap version is returning the ubuntu package version number as opposed to the snapd version number itself.
You can see here: https://bugs.launchpad.net/snapd/+bug/1813365 the reference to "snap 2.34.2ubuntu0.1" being the fixed version, although the upstream snapd version is actually 2.37.1.
Long story short, you are running a version that has been patched.
I need to update my README. Thanks for helping me sort through this!

[ignnniter]

Welcome :)

Hello! I am trying to demonstrate this exploitation, however, I am getting also 401 status code despite my "ubuntu" version is 16.04 and snap version 2.21 (ubuntu lsb-release 16.04.2 LTS). I would be glad if you help me for solving this issue.

PS. I am demonstrating it in order to complete my course work for education purposes.