finished impl for CVE-2023-0386

[747745124]

No description provided.

[olegbck]

Everything seems to be working, but:

Please run the exploit from the "command" parameter in cvex.yml. Do not run it from the Ansible playbook. This way the playbook only installs the vulnerable service, CVEX takes a screenshot of the VM with it, and only then CVEX runs the exploit.

[747745124]

I pushed the new changes, there might be ssh connection problem since it requires reboot.

For local testing, I add a function named _reconnect for src/cvex/ssh.py, and modify the apis to something simiilar to this.

    def upload_file(self, local: str, dest: str):
        """
        Upload a file to the remote server. Retry on connection loss.
        """
        self.log.info("Uploading %s -> %s...", local, dest)
        try:
            self.ssh.put(local, dest)
        except (paramiko.SSHException, OSError) as e:
            if "Socket is closed" in str(e):
                self.log.warning("SSH connection lost during upload. Attempting to reconnect...")
                self._reconnect()
                self.upload_file(local, dest)
            else:
                raise

    def download_file(self, local: str, dest: str):
        """
        Download a file from the remote server. Retry on connection loss.
        """
        self.log.info("Downloading %s -> %s...", dest, local)
        try:
            self.ssh.get(dest, local)
        except (paramiko.SSHException, OSError) as e:
            if "Socket is closed" in str(e):
                self.log.warning("SSH connection lost during download. Attempting to reconnect...")
                self._reconnect()
                self.download_file(local, dest)
            else:
                raise

[olegbck]

Remove unnecessary empty lines

[olegbck]

Remove this command. The intention is to have a clean Ansible playbook that could be shared.

[olegbck]

Having binaries is not great. Can we have the source code and then build it during the Ansible run? Or, if it is super long and tedious process, could you at least add the source code of the binaries to the data folder?

Thank you for the SSH _reconnect() function, I believe I had encountered it sporadically as well. Could you please create a pull request with these changes on https://github.com/ucsb-seclab/CVEX/?

[olegbck]

It gives me this:

2024-11-20 12:33:22,381 - INFO - [ubuntu] Executing 'cd /usr/local/bin && ./exp'...
2024-11-20 12:33:22,474 - INFO - [ubuntu] [+] exploit success!

2024-11-20 12:33:22,474 - INFO - [ubuntu] exp: mkdir ./ovlcap: Permission denied
sh: 1: ./ovlcap/upper/file: not found

Why do we see "Permission denied" after "exploit success!"? Is it OK?

[747745124]

in my local test without ansible, it gives "exploit success!", followed by: sh: ... (waiting for prompt), i'll look into this

[olegbck]

I just thought... is it really that hard to build the source code? Shouldn't it be a simple gcc run, no? Could you please try to build it in the Ansible playbook and then use that version during execution?

[747745124]

I just thought... is it really that hard to build the source code? Shouldn't it be a simple gcc run, no? Could you please try to build it in the Ansible playbook and then use that version during execution?

yes i'll do that. previously it was troublesome to do on a different ubuntu version, you'll have to modify the package source, since the ubuntu version might be no longer supported. I'll modify to compile locally.

[olegbck]

To install gcc, we need to add build-essential to the Install dependencies task of ubuntu.yml.

Building exp.c:

gcc exp.c -lcap -o exp

Building fuse.c:

gcc fuse.c -o fuse -D_FILE_OFFSET_BITS=64 -lfuse

What is the gc binary? Is it shellops.c?

Also, "Permission denied" still remains. exp tries to execute ./ovlcap/upper/file and fails to do so because the file is empty:

sh: 1: ./ovlcap/upper/file: Permission denied