Project Title
Exploit generator for CVE-2021-3156 sudo
Installation
- Install dependencies ./install.sh
- Run exploit generator: ./run.sh
- If the system's sudo version is vulnerable, an exploit is generated for the installed version
- The exploit is generated in exploit.c and the binary ./exploit
Requirements
- gdb gcc make python3 python3-distro
- glibc with tcache
- Currently Ubuntu, Debian operating systems.
Tested
- Ubuntu 20.04.1
- Ubuntu 20.04.2
- Ubuntu 20.10
- Ubuntu 18.04.5
- Debian 10.7.0
Author
Vulnerability
- sudo escapes metacharacters in the parse_args function in main
- Later, in set_cmnd, escape characters that are not followed by a space are removed
- sudo assumes that parse_args is a precondition of set_cmnd.
- The problem is that the conditions are different in each parser. The first one runs if the mode is (MODE_RUN && MODE_SHELL). The second one runs if the mode is (MODE_RUN | MODE_EDIT | MODE_CHECK) AND (MODE_SHELL|MODE_LOGIN_SHELL)
- There is a way to skip the first parser but still run the second one: sudoedit -s
- set_cmnd calculates the size of the arguments and creates a chunk in the heap to concatenate them. Then it copies each argument until it finds a null byte and continues with the next one. If the input argument ends with a '\' set_cmnd skips the escape character, copies the null byte but continues copying the next argument as if it were the same one. This produces a heap buffer overflow.
- Therefore, if the last argument ends with '\' set_cmnd overflows the buffer with the content of the first environment variable. If this environment variable ends with '\' it will continue copying the next one.
Exploit Generator
- The method 2 described in (https://packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html) is used
- sudo uses glibc nsswitch to read the group database after the overflow.
- nsswitch creates a service_table data structure in the heap with all the databases and services of nsswitch.conf.
- The group services have the type struct service_user.
- The structure has a name field with the service name
- nsswitch dynamically loads a library libnss_[service_name]_.so.2 depending on the /etc/nsswitch.conf configuration for each service of the group database.
- The library pointer must be overwritten to NULL to avoid a crash. In addition, this causes the library to be loaded into memory again, this time a local library with the shellcode.
- The heap grooming or feng shui technique is used. "Local" environment variables of variable size are created to generate a layout in the heap that allows bringing the chunk where set_cmnd copies the arguments closer to the target, which is the service_user structure of group.
- Just before executing malloc from set_cmnd, the tcache of the heap is inspected to see the first chunks that are going to be recycled and their sizes.
- The chunks that form the nsswitch databases and services are ordered. They are traversed in an orderly manner. The memory address of the target chunk and the previous one is stored.
- A chunk within that range is searched in the tcache bin.
- Once the position of the chunk and its size are known, the exploit is generated.
- An argument ending with '\' and a null byte of the precise size is used so that said chunk is recycled.
- The precise 'local' environment variables are created to build the appropriate layout.
- Before these 'local' variables, an environment variable of the necessary size is generated to reach the target structure.
- The target structure is overwritten with null bytes using arrays of strings with the escape character '\' this causes a null byte to be written in set_cmnd
- The name of service_user is overwritten with 'x/x' so that the library 'libnss_x/x.so.2' is later loaded
- In the library, a constructor is created that executes a shellcode.
- Since sudo is executed with the suid bit, the shell belongs to root.
License
This project is under the GNU GPL License
lmol/cve-2021-3156
