Zero-day vulnerability in Bash - Suidbash Google CTF Finals 2019 (pwn)

An actual 0-day in /bin/bash due to a bug in the privilege dropping feature. It was discovered by Ian Pudney and turned into a CTF challenge for the Google CTF 2019 Finals.
CVE-2019-18276
=[ 🔴 Stuff I use ]=
→ Microphone:* geni.us/ntg3b
→ Graphics tablet:* geni.us/wacom-...
→ Camera#1 for streaming:* geni.us/sony-c...
→ Lens for streaming:* geni.us/sony-l...
→ Connect Camera#1 to PC:* geni.us/cam-link
→ Keyboard:* geni.us/mech-k...
→ Old Microphone:* geni.us/mic-at...
US Store Front:* www.amazon.com...
=[ ❤️ Support ]=
→ per Video: / liveoverflow
→ per Month: / @liveoverflow
=[ 🐕 Social ]=
→ Twitter: / liveoverflow
→ Website: liveoverflow.com/
→ Instagram: / liveoverflow
→ Subreddit: / liveoverflow
→ Facebook: / liveoverflow
=[ 📄 P.S. ]=
All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.

[@LiveOverflow]

What do you think about interviews for videos like this?

[@SP-hz5tp]

Really nice to see the thought processes of the creator itself. I would love to see more like this.

[@Zooiest]

More!

[@qwerty123443wifi]

I like it, I'd like to see more things like this

[@swift87100]

A face reveal

[@Pcpiee]

pretty clever editing with first talking over a muted video and then to unmute right at the interesting part

[@jonathanhoyos8191]

Michael Cera and Ed Sheeran doing some binary exploration. Love you guys

[@AB-vu1yl]

SCREAMINGGGGGGGGGGG

[@wdai03]

Seth Rogen should get off John Hammonds channel and join in. I've been saying that for a while now

[@spv420]

I can’t unsee it

[@_JohnHammond]

im 12 what is this

[@quantumbracket6995]

TEMPLE OS

[@awecwec3720]

??

[@awecwec3720]

xd

[@awecwec3720]

@@quantumbracket6995 stfu

[@awecwec3720]

?

[@fishmoding]

Imagine if the developers didn't add that extra edge case for using setuid() as root... Shit this is what xkcd meant by 'we're only one linux exploit away from the world collapsing'

[@strongman6201]

Yeah what lang you use for robot

[@art_faith]

09:03

[@hatit8074]

Waaw, happy to John as well in the video. Man you guys rock. 🎉🎉🎉

[@JonathanSwiftUK]

Similar to earlier PRIMOS bug allowing you to create a library with the same name as the ring 0 routine which checks if you are superuser, then load it using PRIMOS BIND before loading final system library. Your routine gets linked / resolved first, and allows checks to that library name to always return yes. That exploit was done over 30 years ago, I know because I was there, although I didn't do it myself. You'd presume today all privileged routines would have a digital signature to verify authenticity. Good job on explaining this, nice and clear.

[@BGroothedde]

That's amazing, using an actual existing vulnerability in a CTF!

[@electricketchup]

Isn't that what most people do?

[@BGroothedde]

@@electricketchup No, most CTFs are simulated vulnerabilities. They are based on real-life examples of vulnerabilities. This was a real one.

[@AneeshDogra]

Beautiful. Its cool to know that I wasn't alone in thinking this game is broken. The last thing you mentioned happened to me multiple times and then by hit and trial I figured that it works in sh and not bash. Bash was dropping my privs all along :D

[@bringiton2100]

Maaaaaaannnnn i felt exactly the same. When I started learning about exploitation (I'm still learning) . It was soooooo frustrating when I was sure all my exploiting was good but some how I was not root !!!. Now finally I know why, thanks a lot from Mexico.

[@tcocaine]

We're all still learning.

[@Reelix]

The 4:20 person hiding with... bread was surprisingly effective. Rewatched that segment several times before I realized there was actually a person there (Their sleeve clips out the shot)

[@GeorgeTsiros]

maybe they did not agree with appearing in the video? 🤔

[@GeorgeTsiros]

or they identify as a baguette?

[@sarunint]

Wow, this video is mentioned in the CVE page.

[@pgoeds7420]

One approach is to run the bash shell with the flag file as input and hope to see the content in the syntax error. Of course if it was an actual command to chmod your shell you'd fail to make progress.

[@tempus_fugit__]

0:00 that's gynvael in the background

[@fikrialwahid655]

suidperl is oldest vulnerability but it's still relevant

[@goeo_]

just to note, he mentioned a script by tavis ormandy and github.com/taviso/ctypes.sh was quite googleable; and that could've been used to solve the chal too

[@Luculent]

So basically, you ask yourself "how badly can you possibly fuck this up" and you're set.

[@ethanp5215]

Noob question, I apologise for the wide gaps in my knowledge, but does this also effect Zsh/Fish? Would it require a separate CVE if it did affect them? Thanks If you're reading LiveOverflow, I truly love your videos. Always excited, too much for a grown man, when I see your videos

[@JimzZel]

I wish I could take you back into time. If I was 12 - 21. I could watch this all day :D

[@PacAnimal]

You can use bash loadable builtins to, for instance, get a builtin sleep function, to sleep for short times without spawning lots of processes.

[@BlackHermit]

So cool! It could really break many other CTFs, if you don't mind :)

[@svampebob007]

would you look at that, perfect video for a paranoid guy trying to learn linux and remote management by setting up his won server with various automation scripts written in bash.... I'm starting to reconsider my sms to systemctl script :O I'm actually having so much fun messing around with my computer and android to see what I can port/"export" (like read various sensors on the phone but using the data on the server) but I've caught myself implementing some backdoor by just being lazy or ignorant. This video really shows that you can't assume that anything "standard and well peer reviewed" can be trusted to do everything right all the time! how many people read the binaries and boasted about compiling their own linux distro while over looking this "oh so simple" bug. I also love how he just stumbled on it by being extra curious, not only did he want to make up some hypothetical bug, but he wondered if anybody did the same "error" he was about to do! love it!

[@gyroninjamodder]

Compiling software does not mean that you have read over the source code

[@nkusters]

No surprise to see that Tavis reference :P

[@R3dFlames]

Just managed to reproduce it on the CTF server. Even after you guys mentioned loadable builtins, I still didn't get it, because I didn't know code gets executed as soon as you "enable -f". Is that "initLibrary" thing even documented anywhere on this planet? Oh wait, that's just the name you gave it, and the "((constructor))" tells gcc or linux or _something_ somewhere to run this when the module gets loaded? As one can tell I don't know a whole lot about this arcane C magic :P

[@kevinalexander4959]

Vulnerabilities are everywhere, you just gotta be good enough to solve the puzzle and exploit. Just to think, our whole infrastructure these days is based on these machines. I wouldn't doubt every secure system in the world could be exploited by a talented enough hacker. Collapse of civilization caused by some Python and Pearl code.. *chuckles*

[@leon1985ist]

I idol the 3 of you guys thanks for your teachings

[@themadichib0d]

I mean he calls it the worlds least useful vulnerability but I can think of a lot of systems where this vulnerability would have worked essentially as a jail escape.

[@CyberMahir]

Pretty tricky and cool.. Love from India

[@saschamajewsky7990]

How do you create the drawing and text of the video? Do you got a program for that or is it just a graphic tablet?

[@PaulaJBean]

YAGNI, but implement it anyway: a way to embed foreign binary executable code in your shell. What were the bash author(s) thinking?

[@gyroninjamodder]

Because doing exec is extremely slow

[@bandie9101]

extensibility, plugin capability maybe?

[@thewhitefalcon8539]

Why don't you want this?

[@techchannel1781]

How loves zero days❤

[@LoukaJC]

"-I wonder how many people feel the same way.. -I feel the same way. Like 1000% of the me same way :') "

[@ZoomAnimationHere]

holy bash !

[@bernhardtrian7471]

I did kind of understand this video because of the similarity to Cisco User priviliges in their OS. The message was to gain back access to a priviliged mode with a bash execution , right ?

[@BB-dv8nu]

big brain moves

[@georgez5269]

I love this video so informative

[@ninocrudele]

It looks like more a challenge on knowing parameters than any other thing to be honest

[@wcodelyoko]

Wait, so I can escalate privileges on my school's pc? Nice!

[@olfmombach260]

This is *not* about escalating privileges to root, it's just lateral movement

[@wcodelyoko]

@@olfmombach260 Still, you can switch to a user with higer privileges

[@thewhitefalcon8539]

Does your school have this suidbash thing?

[@BakedRawr]

Dont understand everything yet aber sehr gutes Video! :)

[@afonsorafael2728]

so wait, you cat >/tmp/escape.c

[@gabuscus]

it's a heredoc, it writes until you type "EOF"

[@R3dFlames]

When I just tried this I just... built it on my machine, stripped the binary, and put it through base64--- actually no, that's still very big, but fortunately xz & unxz are also available on the CTF server, so yeah 😅 I was going with the examples in the bash source itself, and that kinda required me to ./configure the whole thing.

[@happygimp0]

You can also use something else other than EOF, you just need to end with the same string. Search for heredoc.

[@SauravKumar-tf3uv]

How do you create this video where only I can see the terminal and not the other aspects of ubuntu, like how do you hide it

[@LiveOverflow]

it's called video editing lol

[@SauravKumar-tf3uv]

@@LiveOverflow Thanks! Had Suspicions but now you confirmed it!!

[@kenstoudamire7366]

linux is beautiful!

[@cafeinoz5966]

Beautiful like "The Scream". I once tried kernel programming and all I got was a full beard and worsened mental health.

[@RakibFiha]

wow, did not know that enable -f has some hidden feature.

[@himashhimash6017]

Better way of explanation

[@pgoeds7420]

5:13 omitted to mention fsuid for Linux

[@nanthantamilctf8912]

Future liveoverflow:spoiler alert ()😁😁

[@Adowrath]

How exactly was the Saved UID involved here? I don't see it really..

[@gyroninjamodder]

In his custom builtin he restores the saved uid

[@Adowrath]

But he just sets his uid to 1001. Or is this an internal check of setuid, as in "allow this if [...] or if the uid parameter is equal to the saved UID"?

[@secureitmania]

Other than this video there is no single article about this CVE id, why?

[@ethanp5215]

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276

[@secureitmania]

@@ethanp5215 thank you very much.

[@secureitmania]

Is it vulnerable to all below 5.0 bash versions?

[@ethanp5215]

@@secureitmania You're very welcome I'm sorry I don't know, I'm just starting out I think "Through 5.0 patch 11" means that it is everything below that, but don't take my word for it

[@gyroninjamodder]

Because it's a rare configuration.

[@ffKingcreole]

this looks so usefull, how is it not more dangerous? :D

[@A1rPun]

You can't get root privileges. You can however read files from other non-root users.

[@learningcode6786]

intresting fact, Do you guys know that liveoverflow has a channel in P*rnHub. I am not kidding it is there. It is funny and there it is also this educational (seriously it is also about finding vulnerability there). Go check it out.

[@jmullentech]

lmao holy shit that is amazing!!!

[@learningcode6786]

@TheUmbrellaCorpX7[エヴ] just search it in p*rnhub you will find it, it is a channel not a single video

[@wdai03]

Well he does do penetration testing

[@rasmus9311]

This dude talks the same as Tarantino

[@dragon_warrior_]

Okay....In what lang they were speaking?

[@willlynas672]

So does /bin/sh not drop privileges?

[@adamrogers7682]

As I understand it, no. (However, i could be mistaken)

[@floatingblaze8405]

#NotificationSquad

[@aprizamsaputra9611]

Cool trick

[@joelosler]

What the song is on your intro?

[@muellerhans]

11:54 *So you can use this "here document" / "here file" [...].

[@ComeadeKat]

user@redstarOSX.... Did North Korea update redstarOS?

[@ComeadeKat]

*downgrade

[@dxsp1d3r]

John Hammond

[@-peridys8346]

good

[@doomzroxx3960]

With all being said..could someone exploit 6.20 🙏🙏

[@ali_p_q7920]

I could barely understand a thing in this one. Will this get patched? What does that mean for all Linux systems out there?

[@happygimp0]

Nothing, it needs a very special setup to be useful. And it gives you only access to other users, not root. Most people that would have such a script, which is needed, would have it as root.

[@ali_p_q7920]

@@happygimp0 I see. Thanks for answering. I really like to watch these videos covering the CTF, but my knowledge of hacking and of Linux in general is still on the humble side. To me the exploit seemed more powerful than it actually is, but with your explanation it makes more sense.

[@thewhitefalcon8539]

Nothing. I'd even say there's no vulnerability in bash here. None at all. What there is, is a failure of defense-in-depth that would otherwise cancel out the vulnerability that was introduced by this custom suidbash thing

[@henke37]

Cheating with a library initializer? How brutish. The elegant solution is clearly to implement a proper built in that lets you specify arbitrary userids to use.

[@thewhitefalcon8539]

No ethical software engineer would ever write a DestroyBaghdad function. They'd have to write a DestroyCity function, to which Baghdad could be given as a parameter.

[@GeorgeTsiros]

flag_haver... which means... semaphore 😁

[@algorithm5717]

Very nicely done

[@gyroninjamodder]

Using SHA256 for hashing passwords in 2019? Since they are using a high entry password they should be using Blake2.

[@j3r3miasmg]

IKTFB

[@lior_haddad]

Hi

[@happygimp0]

Can you add a link to more information in the description?

[@RyanTosh]

Usually when a video is first posted, there're more comments than views. Not so here. It appears KZbin's scared to mess up on a hacking channel (-:

[@schwingedeshaehers]

Or the users look before they comment

[@fghsgh]

Usually, it's more likes (comments) than views. And this can be explained easily, as people like the video before having watched enough into the video to have it counted as a view. Also, views are cached more than likes, so they're more slowed down.

[@RyanTosh]

@@fghsgh I know, I know, just a joke (-:

[@fghsgh]

@@RyanTosh Well some people don't know. Although on this channel, probably more people do than don't.

[@aldison5070]

Ed Sheeran 14:46

[@ronzz8933]

John Hammond

[@tylerufen]

needs more fab and uloos

[@hexfish3422]

This is inherently a shitty CTF problem because the description was absolutely useless. This challenge was created because the author wanted to brag and get attention for finding a vuln and wasted everyones' time while doing so. I hope Google doesn't let this happen again.

[@DavidKoseckyCZ]

bash != sh ..

[@danyrogers4220]

ph4t

[@agonymouse4864]

lmao! the guy interviewing has no idea what the author is talking about, his face is priceless haha..