Skip to content

Commit b03bd56

Browse files
kevinbackhousekevinbackhouse
committed
Exploit PoC for librelp/rsyslog CVE-2018-1000140.
1 parent e24a72f commit b03bd56

14 files changed

Lines changed: 453 additions & 0 deletions

File tree

‎rsyslog/CVE-2018-1000140_snprintf_librelp/Dockerfile‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
FROM ubuntu:artful
2+
3+
RUN apt-get update && \
4+
apt-get install -y \
5+
sudo tmux screen emacs git gdb net-tools \
6+
python python3 build-essential gcc \
7+
cmake bison flex libprotobuf-c-dev libreadline-dev libsqlite3-dev \
8+
libssl-dev libunwind-dev libz1 libz-dev make gawk protobuf-c-compiler \
9+
uuid-dev liblz4-tool liblz4-dev libprotobuf-c1 libsqlite3-0 \
10+
libuuid1 libz1 tzdata ncurses-dev tcl bc dh-autoreconf pkg-config \
11+
libgnutls28-dev libcurl4-gnutls-dev python-docutils libgcrypt20-dev \
12+
iproute2 nmap gnutls-bin
13+
14+
RUN mkdir /opt/work
15+
COPY build-all.sh /opt/work/
16+
COPY benevolent/ /opt/work/benevolent/
17+
COPY malicious/ /opt/work/malicious/
18+
WORKDIR /opt/work
19+
20+
RUN git clone https://github.com/rsyslog/libee.git
21+
RUN git clone https://github.com/rsyslog/libestr.git
22+
RUN git clone https://github.com/rsyslog/libfastjson.git
23+
RUN git clone https://github.com/rsyslog/liblogging.git
24+
RUN git clone https://github.com/rsyslog/librelp.git
25+
RUN git clone https://github.com/rsyslog/rsyslog.git
26+
27+
# Checkout versions with the bug
28+
WORKDIR /opt/work/libee
29+
RUN git checkout 1569d91bf33101f012cfc5b25beea68f2c6e25f2
30+
WORKDIR /opt/work/libestr
31+
RUN git checkout 75ea6e3b5a2187dbe48e7f5cec82311ca3a09c22
32+
WORKDIR /opt/work/libfastjson
33+
RUN git checkout v0.99.8
34+
WORKDIR /opt/work/liblogging
35+
RUN git checkout 5602f9dacbfc8e1912aa25f9e27be6aac13ac4ce
36+
WORKDIR /opt/work/librelp
37+
RUN git checkout v1.2.14
38+
WORKDIR /opt/work/rsyslog
39+
RUN git checkout v8.33.1
40+
41+
WORKDIR /opt/work
42+
RUN ./build-all.sh
43+
44+
# switch over to the 'semmle_build' user, since root access is no longer required
45+
RUN addgroup semmle_build --gid 1001
46+
RUN adduser semmle_build --disabled-password --uid 1001 --gid 1001
47+
RUN adduser semmle_build sudo
48+
RUN echo "semmle_build:x" | chpasswd
49+
RUN chown -R semmle_build:semmle_build /opt/work
50+
51+
USER semmle_build
52+
ENV HOME /opt/work
53+
WORKDIR /opt/work/benevolent/certs
54+
RUN pwd 1>&2
55+
RUN ls -al 1>&2
56+
RUN ./create-certs.sh
57+
WORKDIR /opt/work/malicious/kevcertz
58+
RUN pwd
59+
RUN ./create-certz.sh
60+
WORKDIR /opt/work/

‎rsyslog/CVE-2018-1000140_snprintf_librelp/README.md‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
# Docker
2+
3+
To build and run the Dockerfile:
4+
5+
```
6+
docker build . -t kev-rsyslog
7+
docker network create -d bridge --subnet 172.25.0.0/16 kev-rsyslog-network
8+
```
9+
10+
In terminal 1, start a container for the server:
11+
12+
```
13+
docker run --network=kev-rsyslog-network --ip=172.25.0.10 -h rsyslog-server -i -t kev-rsyslog
14+
```
15+
16+
If you want to use `gdb` to see the server crash, then start the server like this:
17+
18+
```
19+
docker run --network=kev-rsyslog-network --ip=172.25.0.10 -h rsyslog-server --cap-add=SYS_PTRACE --security-opt seccomp=unconfined -i -t kev-rsyslog
20+
```
21+
22+
In terminal 2, start a container for the benevolent client:
23+
24+
```
25+
docker run --network=kev-rsyslog-network --ip=172.25.0.20 -h rsyslog-client -i -t kev-rsyslog
26+
```
27+
28+
In the docker container for the benevolent client (terminal 1):
29+
30+
```
31+
sudo rsyslogd -f benevolent/rsyslog-server.conf
32+
```
33+
34+
In the docker container for the server (terminal 2), start the benevolent client:
35+
36+
```
37+
sudo rsyslogd -f benevolent/rsyslog-client.conf
38+
```
39+
40+
To see that the client has connected to the server:
41+
42+
```
43+
sudo netstat -ntp
44+
```
45+
46+
This will show something like this:
47+
48+
```
49+
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
50+
tcp 90 0 172.25.0.20:38866 172.25.0.10:2514 ESTABLISHED 28/rsyslogd
51+
```
52+
53+
In terminal 3, start a container for the malicious client:
54+
55+
```
56+
docker run --network=kev-rsyslog-network --ip=172.25.0.30 -h rsyslog-client -i -t kev-rsyslog
57+
```
58+
59+
In the docker container for the malicious client (terminal 3):
60+
61+
```
62+
sudo rsyslogd -f malicious/rsyslog-client.conf
63+
```
64+
65+
66+
Instructions for using TLS with rsyslog:
67+
68+
https://www.rsyslog.com/using-tls-with-relp/

‎rsyslog/CVE-2018-1000140_snprintf_librelp/benevolent/certs/ca.config‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
[ req ]
2+
default_bits = 2048
3+
distinguished_name = dn
4+
x509_extensions = san
5+
req_extensions = san
6+
extensions = san
7+
prompt = no
8+
9+
[ ca ]
10+
default_ca = ca_default
11+
12+
[ ca_default ]
13+
private_key = root-ca-key.pem
14+
certificate = root-ca.pem
15+
new_certs_dir = new_certs
16+
database = root-ca.index
17+
default_md = sha256
18+
serial = root-ca.serial
19+
email_in_dn = no
20+
default_days = 365
21+
policy = policy
22+
23+
[ policy ]
24+
countryName = optional
25+
stateOrProvinceName = optional
26+
localityName = optional
27+
organizationName = optional
28+
organizationalUnitName = optional
29+
commonName = supplied
30+
31+
[ dn ]
32+
countryName = US
33+
stateOrProvinceName = CA
34+
localityName = San Francisco
35+
organizationName = Wholesome Certifications Inc.
36+
commonName = wholesomecertifications.com
37+
emailAddress = webmaster@wholesomecertifications.com
38+
39+
[ san ]
40+
basicConstraints = CA:TRUE
41+
subjectAltName = @alt_names
42+
subjectKeyIdentifier = hash
43+
44+
[ alt_names ]
45+
DNS.1 = *.wholesomecertifications.com
46+
DNS.2 = *.wholesomecerts.com

‎rsyslog/CVE-2018-1000140_snprintf_librelp/benevolent/certs/clean.sh‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/bin/bash
2+
3+
# Delete all auto-generated files.
4+
5+
rm -f *~
6+
rm -rf new_certs
7+
rm -f root-ca*
8+
rm -f server-*.pem
9+
rm -f client-*.pem

‎rsyslog/CVE-2018-1000140_snprintf_librelp/benevolent/certs/client.config‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
[ req ]
2+
default_bits = 2048
3+
distinguished_name = dn
4+
x509_extensions = client_ext
5+
req_extensions = client_ext
6+
extensions = client_ext
7+
prompt = no
8+
9+
[ ca ]
10+
default_ca = ca_default
11+
12+
[ ca_default ]
13+
private_key = root-ca-key.pem
14+
certificate = root-ca.pem
15+
new_certs_dir = new_certs
16+
database = root-ca.index
17+
default_md = sha256
18+
serial = root-ca.serial
19+
email_in_dn = no
20+
default_days = 365
21+
policy = policy
22+
23+
[ policy ]
24+
countryName = optional
25+
stateOrProvinceName = optional
26+
localityName = optional
27+
organizationName = optional
28+
organizationalUnitName = optional
29+
commonName = supplied
30+
31+
[ dn ]
32+
countryName = US
33+
stateOrProvinceName = CA
34+
localityName = San Francisco
35+
organizationName = Wholesome Computing Inc.
36+
commonName = client.wholesomecomputing.com
37+
emailAddress = webmaster@wholesomecomputing.com
38+
39+
[ client_ext ]
40+
basicConstraints = CA:FALSE
41+
subjectAltName = @alt_names
42+
subjectKeyIdentifier = hash
43+
44+
[ alt_names ]
45+
DNS.1 = *.wholesomecomputing.com

‎rsyslog/CVE-2018-1000140_snprintf_librelp/benevolent/certs/create-certs.sh‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/bin/bash
2+
3+
mkdir new_certs
4+
touch root-ca.index
5+
touch root-ca.index.attr
6+
echo 00 > root-ca.crlnum
7+
openssl rand -hex 16 > root-ca.serial
8+
9+
# create self-signed certificate
10+
openssl req -config ca.config -new -x509 -sha256 -newkey rsa:2048 -nodes \
11+
-keyout root-ca-key.pem -days 365 -out root-ca.pem
12+
13+
# Create signing request for the server
14+
openssl req -config server.config -new -sha256 -newkey rsa:2048 -nodes \
15+
-keyout server-key.pem -days 365 -out server-request.pem
16+
17+
# Create signed certificate for the server
18+
openssl ca -config server.config -batch -days 365 -extensions server_ext -out server-cert.pem -infiles server-request.pem
19+
20+
# Create signing request for the client
21+
openssl req -config client.config -new -sha256 -newkey rsa:2048 -nodes \
22+
-keyout client-key.pem -days 365 -out client-request.pem
23+
24+
# Create signed certificate for the client
25+
openssl ca -config client.config -batch -days 365 -extensions client_ext -out client-cert.pem -infiles client-request.pem

‎rsyslog/CVE-2018-1000140_snprintf_librelp/benevolent/certs/server.config‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
[ req ]
2+
default_bits = 2048
3+
distinguished_name = dn
4+
x509_extensions = server_ext
5+
req_extensions = server_ext
6+
extensions = server_ext
7+
prompt = no
8+
9+
[ ca ]
10+
default_ca = ca_default
11+
12+
[ ca_default ]
13+
private_key = root-ca-key.pem
14+
certificate = root-ca.pem
15+
new_certs_dir = new_certs
16+
database = root-ca.index
17+
default_md = sha256
18+
serial = root-ca.serial
19+
email_in_dn = no
20+
default_days = 365
21+
policy = policy
22+
23+
[ policy ]
24+
countryName = optional
25+
stateOrProvinceName = optional
26+
localityName = optional
27+
organizationName = optional
28+
organizationalUnitName = optional
29+
commonName = supplied
30+
31+
[ dn ]
32+
countryName = US
33+
stateOrProvinceName = CA
34+
localityName = San Francisco
35+
organizationName = Wholesome Computing Inc.
36+
commonName = server.wholesomecomputing.com
37+
emailAddress = webmaster@wholesomecomputing.com
38+
39+
[ server_ext ]
40+
basicConstraints = CA:FALSE
41+
subjectAltName = @alt_names
42+
subjectKeyIdentifier = hash
43+
44+
[ alt_names ]
45+
DNS.1 = *.wholesomecomputing.com

‎rsyslog/CVE-2018-1000140_snprintf_librelp/benevolent/rsyslog-client.conf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
module(load="imuxsock")
2+
module(load="omrelp")
3+
module(load="imtcp")
4+
input(type="imtcp" port="514")
5+
action(type="omrelp" target="172.25.0.10" port="2514"
6+
tls="on"
7+
tls.caCert="/opt/work/benevolent/certs/root-ca.pem"
8+
tls.myCert="/opt/work/benevolent/certs/client-cert.pem"
9+
tls.myPrivKey="/opt/work/benevolent/certs/client-key.pem"
10+
tls.authmode="name"
11+
tls.permittedpeer=["server.wholesomecomputing.com"]
12+
)

‎rsyslog/CVE-2018-1000140_snprintf_librelp/benevolent/rsyslog-server.conf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
$DebugFile /opt/work/log.txt
2+
$DebugLevel 2
3+
4+
module(load="imuxsock")
5+
module(load="imrelp" ruleset="relp")
6+
input(type="imrelp" port="2514"
7+
tls="on"
8+
tls.caCert="/opt/work/benevolent/certs/root-ca.pem"
9+
tls.myCert="/opt/work/benevolent/certs/server-cert.pem"
10+
tls.myPrivKey="/opt/work/benevolent/certs/server-key.pem"
11+
tls.authMode="name"
12+
tls.permittedpeer=["client.wholesomecomputing.com"]
13+
)
14+
ruleset (name="relp") { action(type="omfile" file="/var/log/relp_log") }

‎rsyslog/CVE-2018-1000140_snprintf_librelp/build-all.sh‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/bin/bash
2+
3+
buildone() {
4+
cd $1
5+
autoreconf -fvi
6+
./configure $2 --enable-debug
7+
make
8+
make install
9+
cd ..
10+
}
11+
12+
buildone libestr
13+
buildone libee
14+
buildone libfastjson
15+
buildone liblogging
16+
buildone librelp --prefix=/usr
17+
buildone rsyslog --enable-relp

0 commit comments

Comments
 (0)