CVE-2021-3156 #35

Odvir · 2024-11-20T16:51:20Z

This is my code, it is still unable to properly install sudo though.

…ulnerability) and CVE-2021-44228 (Log4j)

…emote Code Execution (RCE))

…un of install.sh, moved build and run into ansible

olegbck

Please don't forget to remove the venv directory

CVE-2021-3156/ubuntu.yml

olegbck · 2024-11-21T11:06:50Z

CVE-2021-3156/cvex.yml

@@ -0,0 +1,3 @@
+blueprint: ubuntu2204
+ubuntu: 
+  playbook: ubuntu.yml


I can't find the exploit execution code in cvex.yml

You are right, I didn't realize I accidentally deleted it when trying to clean up code

olegbck · 2024-11-21T11:08:07Z

CVE-2021-3156/ubuntu.yml

+        remote_src: yes
+
+    # Compile and install the vulnerable sudo version
+    - name: Compile and install vulnerable sudo


It fails:

2024-11-21 12:00:20,277 - INFO - [ubuntu] TASK [Compile and install vulnerable sudo] *************************************
2024-11-21 12:00:21,582 - INFO - [ubuntu] fatal: [ubuntu]: FAILED! => {"changed": true, "cmd": "./configure --prefix=/usr --enable-static\nmake\nmake install\n", "delta": "0:00:00.492920", "end": "2024-11-21 11:00:19.482098", "msg": "non-zero return code", "rc": 127, "start": "2024-11-21 11:00:18.989178", "stderr": "configure: error: in /opt/sudo/sudo-1.8.31':\nconfigure: error: no acceptable C compiler found in $PATH\nSee config.log' for more details\n/bin/sh: 2: make: not found\n/bin/sh: 3: make: not found", "stderr_lines": ["configure: error: in /opt/sudo/sudo-1.8.31':", "configure: error: no acceptable C compiler found in $PATH", "See config.log' for more details", "/bin/sh: 2: make: not found", "/bin/sh: 3: make: not found"], "stdout": "configure: Configuring Sudo version 1.8.31\nchecking for gcc... no\nchecking for cc... no\nchecking for cl.exe... no", "stdout_lines": ["configure: Configuring Sudo version 1.8.31", "checking for gcc... no", "checking for cc... no", "checking for cl.exe... no"]}

yeah the installation of the sudo is failing right now, I tried a bunch of ways around it but its just not working

olegbck · 2024-11-26T11:42:05Z

It still fails at this stage:

2024-11-26 12:41:22,494 - INFO - [ubuntu] TASK [Compile and install vulnerable sudo] *************************************
2024-11-26 12:41:23,638 - INFO - [ubuntu] fatal: [ubuntu]: FAILED! => {"changed": true, "cmd": "./configure --prefix=/usr --enable-static\nmake\nmake install\n", "delta": "0:00:00.398282", "end": "2024-11-26 11:41:22.855052", "msg": "non-zero return code", "rc": 127, "start": "2024-11-26 11:41:22.456770", "stderr": "configure: error: in /opt/sudo/sudo-1.8.31':\nconfigure: error: no acceptable C compiler found in $PATH\nSee config.log' for more details\n/bin/sh: 2: make: not found\n/bin/sh: 3: make: not found", "stderr_lines": ["configure: error: in /opt/sudo/sudo-1.8.31':", "configure: error: no acceptable C compiler found in $PATH", "See config.log' for more details", "/bin/sh: 2: make: not found", "/bin/sh: 3: make: not found"], "stdout": "configure: Configuring Sudo version 1.8.31\nchecking for gcc... no\nchecking for cc... no\nchecking for cl.exe... no", "stdout_lines": ["configure: Configuring Sudo version 1.8.31", "checking for gcc... no", "checking for cc... no", "checking for cl.exe... no"]}

Odvir · 2024-12-07T06:43:05Z

It still fails at this stage:

2024-11-26 12:41:22,494 - INFO - [ubuntu] TASK [Compile and install vulnerable sudo] *************************************
2024-11-26 12:41:23,638 - INFO - [ubuntu] fatal: [ubuntu]: FAILED! => {"changed": true, "cmd": "./configure --prefix=/usr --enable-static\nmake\nmake install\n", "delta": "0:00:00.398282", "end": "2024-11-26 11:41:22.855052", "msg": "non-zero return code", "rc": 127, "start": "2024-11-26 11:41:22.456770", "stderr": "configure: error: in /opt/sudo/sudo-1.8.31':\nconfigure: error: no acceptable C compiler found in $PATH\nSee config.log' for more details\n/bin/sh: 2: make: not found\n/bin/sh: 3: make: not found", "stderr_lines": ["configure: error: in /opt/sudo/sudo-1.8.31':", "configure: error: no acceptable C compiler found in $PATH", "See config.log' for more details", "/bin/sh: 2: make: not found", "/bin/sh: 3: make: not found"], "stdout": "configure: Configuring Sudo version 1.8.31\nchecking for gcc... no\nchecking for cc... no\nchecking for cl.exe... no", "stdout_lines": ["configure: Configuring Sudo version 1.8.31", "checking for gcc... no", "checking for cc... no", "checking for cl.exe... no"]}

ok I got rid of this section so that it doesn't error anymore

olegbck · 2024-12-07T08:28:03Z

I get this:

2024-12-07 09:24:35,334 - INFO - [ubuntu] Executing 'python3 /opt/exploit/sudo_exploit.py'...
2024-12-07 09:24:35,483 - INFO - [ubuntu] [*] Checking for CVE-2021-3156 vulnerability...
[-] System does not appear vulnerable or incorrect sudo version.
[-] Exiting: System is not vulnerable or exploit unsuccessful.

2024-12-07 09:24:35,487 - INFO - [ubuntu] Executing 'id'...
2024-12-07 09:24:35,616 - INFO - [ubuntu] uid=1000(vagrant) gid=1000(vagrant) groups=1000(vagrant),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd)

Does it work on your side?

Odvir · 2024-12-07T23:51:57Z

I get this:

2024-12-07 09:24:35,334 - INFO - [ubuntu] Executing 'python3 /opt/exploit/sudo_exploit.py'...
2024-12-07 09:24:35,483 - INFO - [ubuntu] [*] Checking for CVE-2021-3156 vulnerability...
[-] System does not appear vulnerable or incorrect sudo version.
[-] Exiting: System is not vulnerable or exploit unsuccessful.
2024-12-07 09:24:35,487 - INFO - [ubuntu] Executing 'id'...
2024-12-07 09:24:35,616 - INFO - [ubuntu] uid=1000(vagrant) gid=1000(vagrant) groups=1000(vagrant),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd)

Does it work on your side?

no. I wasn't able to install the vulnerable sudo on the machine, I just removed the code that caused the error. This is just what I had done by the deadline we had

giovannivigna and others added 30 commits October 24, 2024 08:01

Initial commit

98cafa4

Adding CVE-2020-1938 (Apache Tomcat AJP Arbitrary File Read/Include V…

52e374d

…ulnerability) and CVE-2021-44228 (Log4j)

Create exploit.sh

636fe7f

Add files via upload

3ace1d6

Add files via upload

426a7ff

Adding CVE-2021-42013 (Apache HTTP Server 2.4.50 - Path Traversal & R…

6bc4698

…emote Code Execution (RCE))

Removed unused linux.crt and linux.key files

ae2709a

(CVE-2021-42013) Pre-download vulnerable Apache server

4549350

Added CVE-2021-41773

977a953

fix apache setup in playbook

71f915c

fix Apache configuration

80d7197

Added CVEX record for CVE-2019-18276

cfb8692

Added CVE-2018-9206

ac63a0e

update CVE-2015-1427

ec26fa6

Modified Dockerfile to only product vulnerable image, deleted extra r…

f403d52

…un of install.sh, moved build and run into ansible

Update cvex.yml

e031d76

Adding CVE-2022-22965

141f372

fix bugs

4434589

added app files to data

98da6bc

update docker install

c1799f8

Merge pull request ucsb-seclab#5 from yuheho7749/main

0117f93

CVE-2019-18276

Merge pull request ucsb-seclab#8 from SuyueGuo/main

83d252e

CVE-2015-1427

Delete CVE-2021-41773/output.txt

76aa94e

Delete CVE-2022-22965/data/.DS_Store

9bdc19a

Delete CVE-2022-22965/.DS_Store

0479719

Delete .DS_Store

9cc942a

(CVE-2021-42013) Fixed extraction of vulnerable Apache

558c33b

add CVE-2020-16846

04d5054

Merge pull request ucsb-seclab#3 from realmatthewpeng/main

b431c93

CVE-2021-41773

Merge pull request ucsb-seclab#7 from ShanmukhaSahiti/main

dc69b41

CVE-2022-22965

olegbck and others added 13 commits November 7, 2024 09:58

Merge pull request ucsb-seclab#4 from Irreflexive/main

ef6e542

CVE-2021-42013

change setup directory

23f9a79

remove udp flag from netcat

adc7efe

added tar file, updated docker to use that instead

51ad753

Merge pull request ucsb-seclab#6 from justinthecao/main

4e96847

CVE-2018-9206

Merge pull request ucsb-seclab#9 from praneeth-bala/main

5504f55

CVE-2020-16846

Update cvex.yml

f5c18a2

Merge pull request ucsb-seclab#1 from J-avery32/CVE-2014-6271

66d1b80

CVE-2014-6271

CVE-2024-3660

a0e58b4

Merge pull request ucsb-seclab#2 from Anshuman-UCSB/main

d23d764

CVE-2024-3660

kind of giving up, my sudo isnt working

5ee4f9c

Add large file with Git LFS

fa6c57c

Merge branch 'main' of github.com:Odvir/CVEX-records

e233c03

olegbck reviewed Nov 21, 2024

View reviewed changes

correcting things as told in PR

b9d9dfa

Odvir added 2 commits December 6, 2024 22:31

Merge branch 'ucsb-seclab:main' into main

d305317

getting rid of the sudo install that is causing errors

b63b2e1

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CVE-2021-3156 #35

CVE-2021-3156 #35

Odvir commented Nov 20, 2024

olegbck left a comment

olegbck Nov 21, 2024

Odvir Nov 21, 2024

olegbck Nov 21, 2024

Odvir Nov 21, 2024

olegbck commented Nov 26, 2024

Odvir commented Dec 7, 2024

olegbck commented Dec 7, 2024

Odvir commented Dec 7, 2024

CVE-2021-3156 #35

Are you sure you want to change the base?

CVE-2021-3156 #35

Conversation

Odvir commented Nov 20, 2024

olegbck left a comment

Choose a reason for hiding this comment

olegbck Nov 21, 2024

Choose a reason for hiding this comment

Odvir Nov 21, 2024

Choose a reason for hiding this comment

olegbck Nov 21, 2024

Choose a reason for hiding this comment

Odvir Nov 21, 2024

Choose a reason for hiding this comment

olegbck commented Nov 26, 2024

Odvir commented Dec 7, 2024

olegbck commented Dec 7, 2024

Odvir commented Dec 7, 2024