IGEL OS modules #20702
IGEL OS modules #20702
Conversation
|
@Zedeldi there are new persistence mechanisms to make things like starting the handler for long periods of time, and cleanup easier. I'd suggest moving your module to the persistence folder and using the mixin. See https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/example_linux_persistence.rb for the example. |
|
Thanks, I've moved the persistence module to |
|
@Zedeldi what is the best way to get a session on IGEL? I have installed a VM, but the application launcher does not have a way to run arbitrary commands (I don't see anything like 'terminal'), and though ssh seems open, the local user 
|
|
@bwatters-r7 No worries - it's a little unusual, as it's generally configured to be a thin client, so that level of access is normally restricted. If you open "Setup" (the spanner/wrench icon) > expand "Accessories" in the left sidebar > "Terminals" > Add button in top-right corner > "Ok", you should get a "Local Terminal" icon on your desktop, which will run as root by default, unless there's another user configured, in which case it should prompt you. You can use Alternatively, you can configure SSH via "System" > "Remote Access" > "SSH Access". There's another user called "ruser" designed for this, but you can allow root login too. |
|
While running the privesc, the network service restart command timed out, then when I checked the VM, the network connection was down, and the network service was hosed: I'm going to reset the VM and then increase the timeout for the network EDIT: |
|
I could replicate this when the payload exits with a segfault, causing the Status 203/EXEC suggests the file is missing, which is to be expected as the module cleans it up. I was in two minds about this, as - if the payload executes correctly - the session will be created, then the file can be deleted safely, removing the payload from tmpfs. However, if it fails, the systemd unit will try to execute a file that no longer exists. I could modify the module to not clean up the payload if preferred. It's worth noting that most of IGEL OS is read-only, as the majority of the system is mounted from SquashFS images, so any changes will be reset on reboot, with the exception of few persistent areas such as |
|
I increased the timeout for the restart command and swapped it to print output to the screen. It looks like it is getting the elevation, but I'm not getting the payload execution: |
Just tested by creating a session as user, then running the privilege escalation module to create a new session as root. It seems to work consistently when using |
|
@Zedeldi what IGEL version are you using? Could you run |
IGEL OS Workspace Edition 11.08.440. I'm happy with those suggested changes. I'll get them committed and add the check to the persistence module. |
|
I'm using v11.09.390, which is below the 11.10 that is vulnerable, but your v11.08 and my 11.09 go from Linux kernel 5.x to 6.x..... |
Co-authored-by: Brendan <[email protected]>
Co-authored-by: Brendan <[email protected]>
|
Not sure why yet, but it seems that def modify_service(config_file)
command = <<~COMMAND.strip
/usr/bin/python3 -c 'import pty; pty.spawn("/bin/bash")' << EOF
env SYSTEMD_EDITOR="/bin/cp #{config_file}" /config/bin/setup_cmd /config/bin/network edit
EOF
COMMAND
script_file = write_payload(command, datastore['WritableDir'], 0o700)
create_process(script_file)
endThis method relies on I notice that with Any ideas? |
I wonder if Also, thanks so much for the quick responses! |
|
Well, crud- I misunderstood our own guidance! |
|
No problemo! I've reverted |
|
FYI, I'm seeing |
|
Ah okay, unfortunately the patch date/version was a little sketchy, so it was half a guess. The patch was to disallow specific commands to be elevated by The patch to the privilege escalation vulnerability prevented any argument to be passed to It may be safer to go with any version under 11.09.310 (not including .310) then. It was over a year ago now, so my memory probably isn't quite accurate. |
bwatters-r7
left a comment
bwatters-r7
left a comment
There was a problem hiding this comment.
Thanks so much for these modules- three modules in one PR can seem daunting, but there's really only minor stuff here I'd like to see changed, so sweet job on your first PR to us!
We also review PRs as a group Thursday morning, so I expect there will be a few suggestions coming in tomorrow morning as well.
documentation/modules/exploit/linux/local/igel_network_priv_esc.md
Outdated
Show resolved
Hide resolved
|
@bwatters-r7 & @msutovsky-r7 - I believe all requested changes are now completed, but please let me know if there's anything else that needs improving. EDIT: Just confirming the vulnerable versions, as I believe the date vulnerability was patched in 11.09.310, but the network privilege escalation was patched later. Will create a |
|
I've added |
|
Sorry this took so long. Looks like there is a bug with HTTPS fetch payloads, but that's nothing to do with this PR. Test Output |
Release NotesAdds 3 new modules targeting the iGEL OS. One post module abusing the SUID permissions of the setup and date binaries, one privilege escalation abusing the same SUID binary permissions to modify the NetworkManager and restart the service, allowing arbitrary executables to be run as root, and one persistence module relying on root permissions to write a command to the iGEL registry to enable execution at startup as root. |
4 participants
Add 2x exploit modules and 1x post module for IGEL OS.
modules/exploits/linux/local/igel_network_priv_esc.rbmodules/exploits/linux/persistence/igel_persistence.rbmodules/post/linux/gather/igel_dump_file.rbdate -fVerification
See documentation: