module

Libuser roothelper Privilege Escalation

Try Surface Command
Back to search
Disclosed
2015-07-24
Created
2018-06-14

Description

This module attempts to gain root privileges on Red Hat based Linux
systems, including RHEL, Fedora and CentOS, by exploiting a newline
injection vulnerability in libuser and userhelper versions prior to
0.56.13-8 and version 0.60 before 0.60-7.

This module makes use of the roothelper.c exploit from Qualys to
insert a new user with UID=0 in /etc/passwd.

Note, the password for the current user is required by userhelper.

Note, on some systems, such as Fedora 11, the user entry for the
current user in /etc/passwd will become corrupted and exploitation
will fail.

This module has been tested successfully on libuser packaged versions
0.56.13-4.el6 on CentOS 6.0 (x86_64);
0.56.13-5.el6 on CentOS 6.5 (x86_64);
0.60-5.el7 on CentOS 7.1-1503 (x86_64);
0.56.16-1.fc13 on Fedora 13 (i686);
0.59-1.fc19 on Fedora Desktop 19 (x86_64);
0.60-3.fc20 on Fedora Desktop 20 (x86_64);
0.60-6.fc21 on Fedora Desktop 21 (x86_64);
0.60-6.fc22 on Fedora Desktop 22 (x86_64);
0.56.13-5.el6 on Red Hat 6.6 (x86_64); and
0.60-5.el7 on Red Hat 7.0 (x86_64).

RHEL 5 is vulnerable, however the installed version of glibc (2.5)
is missing various functions required by roothelper.c.

Authors

Qualys
bcoles bcoles@gmail.com

Platform

Linux

Architectures

x86, x64

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/linux/local/libuser_roothelper_priv_esc
    msf exploit(libuser_roothelper_priv_esc) > show targets
        ...targets...
    msf exploit(libuser_roothelper_priv_esc) > set TARGET < target-id >
    msf exploit(libuser_roothelper_priv_esc) > show options
        ...show and set options...
    msf exploit(libuser_roothelper_priv_esc) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today