Linux Privilege Escalation (via snapd)

Project Goal:

Exploiting the vulnerability called "Dirty_Sock" (CVE-2019-7304) in the REST API for Canonical's snapd daemon (a default service in Ubuntu Linux), to gain root access.

Ramil Mustafayev's Guide: https://kryptohaker.medium.com/linux-privilege-escalation-via-snapd-using-dirty-sock-exploit-and-demonstration-of-cve-2019-7304-892716cf99ca

Set up:

This vulnerability was exploited in snapd versions older than 2.37, due to an incorrectly validated and parsed remote socket address when performing access controls on its UNIX socket. This also affected some Unix and Linux distros at that time (e.g., Ubuntu 16.04). Therefore, to implement this exploitation, we need snapd 2.32 and Ubuntu 16.04

I obtained the Debian package of snapd 2.32 from https://launchpad.net/ubuntu/+source/snapd

First, I check the Ubuntu Machine to see if it is vulnerable to exploitation by using the commands cat /etc/lsb-release (Which Shows the Ubuntu version with its description) and uname -a (Which Checks the information on the current computer and operating system). Then, we are sure that this machine is exploitable.

The next step is to start the snapd service by using the command systemctl start snapd (In reality, when attackers exploit this flaw, the snapd service needs to be started by the admin, otherwise they won't be able to launch it successfully). Then, we can check the version of snapd to make sure it is vulnerable.

Next, I will check the user's privileges by using the commands id (Displaying the user and group information) and tail /etc/passwd (The /etc/passwd file is used to keep track of every registered user). The results below show that the attacker with the "coby" username is a normal user, who has the lowest access to the system.

Exploitation:

To launch this attack, we will utilize the dirty_sock script, having two versions, and obtained from https://github.com/initstring/dirty_sock. While Version One requires an outbound Internet connection and running the SSH service, Version Two can be run directly without any requirements.

In the dirty_sockv2.py, which will be used in this exploitation, some key components should be focused on. The first key component in this script is the variable TROJAN_SNAP, which is a base64-encoded string representing an installable snap package. This package is an empty "devmode" snap that has a bash script in the install hook, which will create a new user ("devmode" (developer mode) is a special installation mode that allows snaps to bypass strict confinement for development and debugging purposes).

Another considerable component in this script is the create_sockfile() function. This function exploits the insecure parsing in "snapd's ucrednet.go" file to generate a random socket file and slip the dirty sock, ;uid=0;, allowing us to overwrite the UID variable.

To implement this exploitation, I simply execute the dirty_sockv2.py in the terminal. After successfully running the dirty_sock exploit, we can see that a dirty_sock account with the same password was automatically created by the script.

Then, I check the /etc/passwd to see the list of registered users, and see a new user called "dirty_sock" was created.

By using the su command, I can log into the "dirty_sock" account using the discovered credentials. After successfully logging in, I can check the privileges of this user and see that it is in the sudo group. This means the attacker has already gained full control of the system and can do anything with the highest privileges.

Conclusion:

The CVSS score of this vulnerability is 8.8 (High Severity), meaning it can cause a huge impact on the system if it is exploited. This vulnerability has a high severity, since it doesn't require a high privilege to exploit. When an attacker already has some foothold on the system (e.g., a low-privilege user), they can escalate privileges to root, making this vulnerability a serious local security threat, especially in multi-user or cloud environments.