exploit on Rich Mirch

Exploiting Kaseya Unitrends Backup Appliance – Part 1

Fri, 20 May 2022 14:50:25 +0000

In 2021 I discovered several high and critical vulnerabilities in the Kaseya Unitrends backup appliance. This research was conducted and published as part of my day job. Part one details a chain of vulnerabilities by leveraging an insecure PostgreSQL database to ultimately gain shell access to the remote server. Visit https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-1 for the full write-up. Stay tuned for part two.

Metasploit module developed for CVE-2018-18556 VyOS Privilege Escalation

Fri, 25 Sep 2020 20:52:25 +0000

Today, a Metasploit module was merged for a vulnerability I found in 2018 with VyOS. This vulnerability was my first public InfoSec blog post. I appreciate bcoles for developing the exploit/linux/ssh/vyos_restricted_shell_privesc module. Read the Metasploit Wrapup for 9/25/2020. The full write-up can be found on this blog at CVE-2018-18556 – VyOS Privilege escalation via sudo pppd for operator users.

CVE-2018-1792 - IBM MQ Privilege Escalation: Fun with RUNPATH

Sun, 25 Aug 2019 16:37:18 +0000

Vulnerability Summary

IBM MQ for Linux and UNIX systems is vulnerable to a privilege escalation attack by forcing a setuid root binary to load a malicious library. A local attacker with access to the mqm account can execute arbitrary code as root. In October 2018 IBM published an advisory along with patches for several versions.

The goal of this post is to show how the RPATH/RUNPATH value could potentially be leveraged for privilege escalation. When specified at compile time this path is embedded in the binary and is the first path searched when searching for a library if the dependent library specified does not contain a slash. Details on how this works can be found in the ld.so man page.

CVE-2019-6724 : Barracuda VPN Client Privilege Escalation on Linux and macOS

Thu, 14 Feb 2019 15:31:43 +0000

The barracudavpn component of the Barracuda VPN Client prior to version 5.0.2.7 for Linux, macOS, and OpenBSD runs as a privileged process and can allow an unprivileged local attacker to load a malicious library, resulting in arbitrary code executing as root.

This post will walk through the process on how I found and exploited the vulnerability on Linux. The full PoC will also work on macOS. When researching for potential vulnerabilities with privileged binaries a test system should be used to avoid causing damage or negative impacts.

CVE-2018-18629: Keybase Linux privilege escalation

Fri, 21 Dec 2018 18:43:08 +0000

Recently I started using Keybase which is a Slack-like application but provides end-to-end encryption. Version 2.8.0.20181017144746.3efc4cbf3c is vulnerable to a privilege escalation vulnerability allowing a low privileged user to execute arbitrary commands as root.

After executing the application using a low privileged account I noticed a process named keybase-redirector running as root. I was interested and wanted to understand how this worked. After checking the file permissions I found that the keybase-redirector was setuid root. I enjoy the challenge of finding vulnerabilities in privileged binaries so I started my research.

CVE-2018-19788 PoC - polkit: Improper handling of user with uid > INT_MAX leading to authentication bypass

Sun, 09 Dec 2018 19:32:04 +0000

While reviewing my Twitter feed I noticed a recent popular tweet from @0xdea. https://twitter.com/0xdea/status/1070308598146850818 I was intrigued and wanted to see if there was a way to leverage this to execute arbitrary code as root.

First we need to understand what the value of INT_MAX is. Fortunately the getconf command can be used to find the value or you can find it in /usr/include/limits.h.

[root@localhost ~]# getconf INT_MAX
2147483647
[root@localhost ~]# grep 'define INT_MAX' /usr/include/limits.h
# define INT_MAX 2147483647

To exploit the vulnerability the user must have a UID value larger than 2147483647. I used the same value of 4000000000 that @0xdea posted.