Rich Mirch

Penetration Tester, Red Teamer, Security Researcher

Write-up for CVE-2018-15332 , CVE-2018-5529 , CVE-2018-5546 , CVE-2019-6617 — May 21, 2019

Write-up for CVE-2018-15332 , CVE-2018-5529 , CVE-2018-5546 , CVE-2019-6617

/Rich Mirch

Published write-ups for a few vulnerabilities I discovered and responsibly disclosed last year. One vulnerability took three fixes to finally resolve the issue. As a best practice, I always re-check the vulnerability after a patch is available because the fix may not properly resolve the issue or a new vulnerability is introduced. Kudos to the F5 Security Incident Response Team (SIRT). I will be posting additional detailed write-ups in the near future.

CVE-2018-15332 , CVE-2018-5529 , and CVE-2018-5546 – F5 BIG-IP APM client for Linux and macOS arbitrary file takeover vulnerability.

https://github.com/mirchr/security-research/blob/master/vulnerabilities/F5/CVE-2018-15332.txt

https://github.com/mirchr/security-research/blob/master/vulnerabilities/F5/CVE-2018-5529.txt

CVE-2019-6617 – F5 BIG-IP Resource Administrator Privilege Escalation. 

https://github.com/mirchr/security-research/blob/master/vulnerabilities/F5/CVE-2019-6617.txt

 

CVE-2019-6724 : Barracuda VPN Client Privilege Escalation on Linux and macOS — February 14, 2019

CVE-2019-6724 : Barracuda VPN Client Privilege Escalation on Linux and macOS

/Rich Mirch

The barracudavpn component of the Barracuda VPN Client prior to version 5.0.2.7 for Linux, macOS, and OpenBSD runs as a privileged process and can allow an unprivileged local attacker to load a malicious library, resulting in arbitrary code executing as root.

This post will walk through the process on how I found and exploited the vulnerability on Linux. The full PoC will  also work on macOS. When researching for potential vulnerabilities with privileged binaries a test system should be used to avoid causing damage or negative impacts.

Continue reading →

Linux persistence idea – using group passwords — January 9, 2019

Linux persistence idea – using group passwords

/Rich Mirch

A rarely used feature on Linux and UNIX systems is the ability to add a password to a group. The concept is similar to how users are handled. An encrypted hash is stored in the second field of the gshadow(5) file. Anyone with the password can execute the newgrp(1) command to temporarily change their GID without having to be a member of the group. The goal of this post is show how this feature can be leveraged to create persistence on a server in a semi stealthy way.

Continue reading →

CVE-2018-18629: Keybase Linux privilege escalation — December 21, 2018

CVE-2018-18629: Keybase Linux privilege escalation

/Rich Mirch

Recently I started using Keybase which is a Slack like application but provides end-to-end encryption. Version 2.8.0.20181017144746.3efc4cbf3c is vulnerable to a privilege escalation vulnerability allowing a low privileged user to execute arbitrary commands as root.

After executing the application using a low privileged account I noticed a process named keybase-redirector running as root. I was interested and wanted to understand how this worked. After checking the file permissions I found that the keybase-redirector was setuid root. I enjoy the challenge of finding vulnerabilities in privileged binaries so I started my research.

Continue reading →

CVE-2018-19788 PoC – polkit: Improper handling of user with uid > INT_MAX leading to authentication bypass — December 9, 2018

CVE-2018-19788 PoC – polkit: Improper handling of user with uid > INT_MAX leading to authentication bypass

/Rich Mirch/Leave a comment

While reviewing my Twitter feed I noticed a recent popular tweet from @0xdea.

I was intrigued and wanted to see if there was a way to leverage this to execute arbitrary code as root.

Continue reading →

CVE-2018-18556 – VyOS Privilege escalation via sudo pppd for operator users — November 5, 2018

CVE-2018-18556 – VyOS Privilege escalation via sudo pppd for operator users

/Rich Mirch/Leave a comment

Recently I found several ways to escape the restricted shell for an operator user in VyOS 1.1.8. VyOS is a Linux-based network operating system that provides software-based network routing, firewall, and VPN functionality. I plan to post information on the restricted shell escapes in the near future; For now read the blog by @dmbaturin detailing some of the methods.

This post will focus how root access was obtained using sudo after the restricted shell was escaped. One of my first post exploitation steps on Linux after a low privileged shell is obtained is to check if the user has sudo rules configured. Sudo is designed to limit privileges but often times it can be leveraged to elevate access.

Continue reading →