Exploitation on Debian 9.5 stretch about cve-2021-3156

[worawit]

exploit_nss_d9.py is likely to fail if any related configuration is not same as mine. When the exploit fail, "segmentation fault" is very likely. But your has no error.

exploit_userspec.py might fail but normally not this step.

So I suspect the sudo is patched. Do you check if sudo is vulnerable before running exploit?

[worawit]

It is possible to exploit this vuln on debian 9.

exploit_nss_d9.py is for debian 9 with default configuration. exploit_userspec.py is for many targets but need bruteforcing.

[xhat007]

I have the following output when running (exploit_nss_d9.py) :

xhat@debian:~/Desktop$ python exploit_nss_d9.py
usage: sudoedit [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p prompt]
[-u user] file ...

and when runing (exploit_userspec.py) :

xhat@debian:~/Desktop$ python exploit_userspec.py

curr size: 0x1600

exit code: 256
usage: sudoedit [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p
prompt] [-u user] file ...

curr size: 0x1b00

exit code: 256
usage: sudoedit [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p
prompt] [-u user] file ...

curr size: 0x1d80

exit code: 256
usage: sudoedit [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p
prompt] [-u user] file ...

curr size: 0x1ec0

exit code: 256
usage: sudoedit [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p
prompt] [-u user] file ...

curr size: 0x1f60

exit code: 256
usage: sudoedit [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p
prompt] [-u user] file ...

curr size: 0x1fb0

exit code: 256
usage: sudoedit [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p
prompt] [-u user] file ...

curr size: 0x1fd0

exit code: 256
usage: sudoedit [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p
prompt] [-u user] file ...

curr size: 0x1fe0

exit code: 256
usage: sudoedit [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p
prompt] [-u user] file ...

curr size: 0x1ff0

exit code: 256
usage: sudoedit [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p
prompt] [-u user] file ...

has 2 holes. very big one is bad

curr size: 0xc00

exit code: 256
usage: sudoedit [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p
prompt] [-u user] file ...

curr size: 0x1000

exit code: 256
usage: sudoedit [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p
prompt] [-u user] file ...

curr size: 0x1400

exit code: 256
usage: sudoedit [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p
prompt] [-u user] file ...

curr size: 0x1800

exit code: 256
usage: sudoedit [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p
prompt] [-u user] file ...

curr size: 0x1c00

exit code: 256
usage: sudoedit [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p
prompt] [-u user] file ...

Traceback (most recent call last):
File "exploit_userspec.py", line 736, in
main()
File "exploit_userspec.py", line 652, in main
cmnd_size = find_cmnd_size()
File "exploit_userspec.py", line 173, in find_cmnd_size
assert found, "Cannot find cmnd size"
AssertionError: Cannot find cmnd size

Thanks.

[xhat007]

Hi, @worawit

You are right the sudo version package comes patched on this linux DISTR. sorry my bad i didn't check before runing the exploit.

$ uname -a
Linux localhost 4.9.0-8-amd64 #1 SMP Debian 4.9.110-3+deb9u6 (2018-10-08) x86_64 GNU/Linux

$ cat /etc/*-release
PRETTY_NAME="Debian GNU/Linux 9 (stretch)"
NAME="Debian GNU/Linux"
VERSION_ID="9"
VERSION="9 (stretch)"
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

$ sudo --version
Sudo version 1.8.19p1
Sudoers policy plugin version 1.8.19p1
Sudoers file grammar version 45
Sudoers I/O plugin version 1.8.19p1

$ sudoedit -s '12345678901234567890'
usage: sudoedit [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p
prompt] [-u user] file ...

./thanks