IssueTracker

Migrated from https://crbug.com/1077531 

<b>VULNERABILITY DETAILS</b>
Newline injection in an IPSec/L2TP VPN configuration can result in command execution as shill with capabilities. The capabilities can be leveraged to gain unrestricted root command execution.

This chain has been confirmed to work on non-dev-mode devices, however it will not work in guest mode since ARC is not running. Only the root file write -> command execution gadget is non functional in guest mode, the rest of the chain up to this stage works as expected.

<b>VERSION</b>
81.0.4044.127 (Official Build) (64-bit)
Platform 12871.76.0 (Official Build) stable-channel eve
Firmware Version Google_Eve.9584.195.0

<b>REPRODUCTION CASE</b>
=== Repro requirement: L2TP server ===
It’s necessary to have a standard IPSec/L2TP vpn server running for successful authentication necessary during the initial exploit. I used the Docker container ’hwdsl2/ipsec-vpn-server’ with the following environmental variables for credentials:

VPN_IPSEC_PSK=pskpassword
VPN_USER=user
VPN_PASSWORD=userpassword

=== Repro steps ===
Download and mount (via Files double click) pppd.rar, without renaming.
Navigate to ChromeOS Settings, open dev tools and paste in the following payload:

chrome.networkingPrivate.createNetwork(false, {
        "Name": "test",
        "Priority": 0,
        "Type": "VPN",
        "VPN": {
                "AutoConnect": true,
                "Host": "172.16.2.72",
                "IPsec": {
                        "AuthenticationType": "PSK",
                        "Group": "",
                        "SaveCredentials": false,
                        "PSK": "pskpassword"
                },
                "L2TP": {
                        "LcpEchoDisabled": false,
                        "Username": "username\npppoptfile=/media/archive/pppd.rar/pppd.conf\n[lac ignore]",
                        "Password": "userpassword"
                },
                "Type": "L2TP-IPsec"
        }
}, guid => {
    chrome.networkingPrivate.startConnect(guid);
    window.delvpn = () => chrome.networkingPrivate.forgetNetwork(guid);
})

Modifying the Host parameter to suit. PSK must match as configured for the Docker container.

The VPN connection will fail pretty quickly with a notification, but exploitation progress can be viewed at file:///tmp/err and file:///tmp/log

DETAILS
=== shill cmdexec ===
The ‘Username’ field of an L2TP configuration is inserted into xl2tpd.conf without escaping [1], allowing for newline injection and control over the fields in the config. This configuration file can include the pppoptfile line which contains the configuration for the pppd daemon executed once the ipsec tunnel is up.

By pointing this option to a file in a readable location (ie the mounted rar file in /media/archive), we can modify the configuration for the resulting pppd and insert an ‘init’ line, which will execute the provided argument (nominally to initialize the serial line).

This results in command execution as shill:shill, with a handful of capabilities, notably CAP_SETGID, CAP_KILL. [2]

[1] https://chromium.googlesource.com/chromiumos/platform2/+/refs/heads/master/vpn-manager/l2tp_manager.cc#160
[2] https://chromium.googlesource.com/chromiumos/platform2/+/refs/heads/master/shill/init/shill.sh#57

=== Symlink LSM bypass ===
Since there are no restrictions on setgid like there are on setuid, the command execution can change gid at will. By changing group to ‘disk’, the command execution can use the debugfs tool to modify the filesystem at /dev/mapper/encstateful (since encstateful is g+rw).

/var/cache/cups is removed if present, and /var/cache/echo is hardlinked to /var/cache/cups. Since the LSM check is by inode, and directory hardlinks share an inode, symlinks inside /var/cache/cups are now allowed.

Once changes are made, memory pressure is applied to evict the inode caches such that the changes to /var/cache/cups take effect. This bit takes variable amounts of time but is very reliable, it uses dd to write increasingly large files to a tmpfs until stat reports that the inodes for /var/cache/echo and /var/cache/cups match.

The highest I’ve seen it go on my 8gb Pixelbook is 18Gb. Sometimes Chrome is oom killed (and restarted) but I’ve not seen the exploit itself killed.

=== root chown ===
Now that symlinks are allowed in /var/cache/cups, we can race between the mkdir and chown in the cups init script [1] to swap in a symlink. Specifically, rss is targeted since the init script will make it 0775 [2], and therefore whatever we chown via symlink can be written using our setgid capability.

Cups can be triggered using setgid to lp followed by curl against the unix socket at /run/cups/cups.sock.

[1] https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/master/net-print/cups/files/init/cupsd.conf#32
[2] https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/master/net-print/cups/files/init/cupsd.conf#40

=== Ghostscript race ===
To be fast enough to win the race, a type confusion in Ghostscript was exploited. The type confusion is in .setlanguagelevel [1] which is disabled at runtime by default. A copy of the Ghostscript Init files are made and patched to enable .setlanguagelevel and other exploit primitives.
Exploitation of this vulnerability is not ChromeOS specific, however, the exploitation script does parse /proc/self/maps to bypass ASLR. /proc/self/mem is also used for egg hunting but only for reliability purposes rather than a strict need.

gs.ps will exploit this vulnerability to execute the shellcode stored in the file specified by SHELLCODEFILE. The shellcode in this case does as follows:

while(access("/var/cache/cups/rss", F_OK) != 0);
rmdir("/var/cache/cups/rss")
symlink("/run/containers/android-run_oci", "/var/cache/cups/rss")
exit(0)

[1] https://git.ghostscript.com/?p=ghostpdl.git;a=blob;f=psi/zmisc2.c;h=c47ef793595e04e2c3c41f3aa1a268e721f8080e;hb=HEAD#l161

=== File write root command execution ===
At this stage, /run/containers/android-run_oci is owned by cups:cups and is 0775. Again using setgid we can replace the config.json with a non-symlinked, editable copy, and add in a poststop hook which defines a command to be executed by arc-setup when the container stops. [1]

Using CAP_KILL we can now kill the container, the pid of which is stored in container.pid. After a few seconds arc-setup will have executed our defined poststop command.

The command is executed as root without restriction, in this case an ssh server is started in 31337. The root key can be found at the bottom of file:///tmp/log

[1] https://chromium.googlesource.com/chromiumos/platform2/+/HEAD/run_oci/run_oci.cc#932

=== Step by step exploitation of the entire chain ===
1. rar mount to provide pppoptfile in a shill readable location
2. Javascript snippet in the Settings devtools will create a VPN and initiate connection
3. xl2tpd.conf is modified by the newline injection to add an attacker controlled pppoptfile
4. When the IPSec connection is made, xl2tpd will start pppd with the attacker controlled pppd.conf
5. The init script in pppd.conf is executed as shill:shill with capabilities, which executes exploit.sh:

=== Step by step exploitation walkthrough of exploit.sh: ===
1. A combination of gid cups rm and debugfs (For items that are not gid writable/removable) is used to fully remove /var/cache/cups
2. Debugfs creates a hard link from /var/cache/echo to /var/cache/cups
3. Starting from the current Gb of ram and increasing by 1Gb each time, a mount namespace is created with a new tmpfs of this size, which is then written to using dd. The namespace automatically tidies itself up when the tmpfs becomes full. This is looped until the inode cache is evicted and the cups and echo directories share an inode
4. cups is executed (by gid lp curl --unix-socket to trigger the upstart socket listener) to chown /var/cache/cups (aka echo), such that it is cups gid writable again. cups is killed as only the init script was needed
5. The ghostscript shellcode and exploitation .ps file are dropped and executed as gid cups, spinning on the creation of /var/cache/cups/rss to replace with a symlink to /run/containers/android-run_oci
6. cups is executed again, this time chowning through the rss symlink as placed by the racer from 5
7. SSH files are dropped, the oci config.json is modified to include the poststop hook
8. The Android container is killed, causing the poststop hook (sshd) to be executed
9. /var/cache/cups and /var/cache/echo are cleaned up. If this is not done, or the exploit fails, the machine may be powerwashed on next boot.
10. The root ssh key is copied to the log file to make it accessible to validate.

<b>CREDIT INFORMATION</b>
Reporter credit: Rory McNamara