nuvious / pam-duress Goto Github PK

sudo pam_test $ USER
Credentials accepted.
Password:
Account is valid.
Authenticated

auth    [success=2 default=ignore]      pam_unix.so nullok
auth    [success=1 default=ignore]      pam_duress.so nullok
auth    requisite                       pam_deny.so
auth    required                        pam_permit.so
auth    optional        pam_ecryptfs.so unwrap
auth    optional                        pam_cap.so

---
 CHANGELOG.md  |  4 +++-
 src/duress.c  | 43 +++++++++--------------------------
 src/util.c    | 62 +++++++++++++++++++++++++++++++++++++++++++++------
 src/version.h |  4 ++--
 4 files changed, 71 insertions(+), 42 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md index 88bed64..b68edc9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,4 +2,6 @@
  - 1.0.0
    - Initial commit of prototype tested on Debian 10.
  - 1.0.1
-   - Fixed some potential memory leaks, linted, and adjusted documentation.
\ No newline at end of file
+   - Fixed some potential memory leaks, linted, and adjusted documentation.
+ - 1.1.0
+   - Fixed privilege escalation vulnerability that could allow an unprivileged user to run commands as root.
\ No newline at end of file
diff --git a/src/duress.c b/src/duress.c index 3252922..ca0b4b5 100644
--- a/src/duress.c
+++ b/src/duress.c
@@ -192,22 +192,6 @@ int is_valid_duress_file(const char *filepath, const char *pam_pass)  #endif //DEBUG
       unsigned char *duress_hash = sha_256_sum(pam_pass, strlen(pam_pass), file_bytes, st.st_size);
 
-#ifdef DEBUG
-      syslog(LOG_INFO, "Loaded Hash: ");
-      for (int i = 0; i < SHA256_DIGEST_LENGTH; i++)
-      {
-            syslog(LOG_INFO, "%02X", hash[i]);
-      }
-      syslog(LOG_INFO, "\n");
-      // Output the hash
-      syslog(LOG_INFO, "Computed Hash: ");
-      for (int i = 0; i < SHA256_DIGEST_LENGTH; i++)
-      {
-            syslog(LOG_INFO, "%02X", duress_hash[i]);
-      }
-      syslog(LOG_INFO, "\n");
-#endif //DEBUG
-
       int result = 1;
       if (memcmp(hash, duress_hash, SHA256_DIGEST_LENGTH))
       {
@@ -224,7 +208,7 @@ int is_valid_duress_file(const char *filepath, const char *pam_pass)
       return result;
 }
 
-int process_dir(const char *directory, const char *pam_user, const char *pam_pass)
+int process_dir(const char *directory, const char *pam_user, const char 
+*pam_pass, const char* run_as_user)
 {
       int ret = 0;
       struct dirent *de;
@@ -249,20 +233,15 @@ int process_dir(const char *directory, const char *pam_user, const char *pam_pas
             if (is_valid_duress_file(fpath, pam_pass))
             {
                   syslog(LOG_INFO, "File is valid.\n");
-                  char *cmd = (char *) malloc(strlen(pam_user) + strlen(SHELL_CMD) + strlen(fpath) + 21);
-                  if (sprintf(cmd, "export PAMUSER=%s; %s %s", pam_user, SHELL_CMD, fpath) < 0)
-                  {
-                        syslog(LOG_ERR, "Failed to format command. %s %s\n", SHELL_CMD, fpath);
-                  }
-                  else
-                  {
 #ifdef DEBUG
-                        syslog(LOG_INFO, "Running command %s\n", cmd);
-#endif //DEBUG
-                        system(cmd);
-                        ret = 1;
-                  }
+                  char *cmd = (char *) malloc(
+                        strlen(pam_user) * 2 +
+                        strlen(SHELL_CMD) +
+                        strlen(fpath) + 29);
+                  syslog(LOG_INFO, "Running command %s\n", cmd);
                   free(cmd);
+#endif //DEBUG
+                  ret = run_shell_as(pam_user, run_as_user, fpath);
             }
             free(fpath);
       }
@@ -273,8 +252,8 @@ int process_dir(const char *directory, const char *pam_user, const char *pam_pas
 
 int execute_duress_scripts(const char *pam_user, const char *pam_pass)  {
-      int global_duress_run = process_dir(GLOBAL_CONFIG_DIR, pam_user, pam_pass);
-      int local_duress_run = process_dir(get_local_config_dir(pam_user), pam_user, pam_pass);
+      int global_duress_run = process_dir(GLOBAL_CONFIG_DIR, pam_user, pam_pass, "root");
+      int local_duress_run = 
+ process_dir(get_local_config_dir(pam_user), pam_user, pam_pass, 
+ pam_user);
 
       if (global_duress_run || local_duress_run)
             return PAM_SUCCESS;
@@ -309,4 +288,4 @@ int pam_sm_setcred(pam_handle_t *pamh, int flags, int argc, const char **argv)  int pam_sm_chauthtok(pam_handle_t *pamh, int flags, int argc, const char **argv)  {
       return (PAM_SUCCESS);
-}
\ No newline at end of file
+}
diff --git a/src/util.c b/src/util.c
index cdc1738..22907cc 100644
--- a/src/util.c
+++ b/src/util.c
@@ -91,16 +91,64 @@ char *get_local_config_dir(const char *user_name)
     memcpy(config_dir + strlen(home_dir), LOCAL_CONFIG_DIR_SUFFIX, strlen(LOCAL_CONFIG_DIR_SUFFIX));
     config_dir[final_path_len - 1] = 0;
 
-    // Output the hash
-    for (size_t i = 0; i <= strlen(config_dir); i++)
-    {
-        syslog(LOG_INFO, "%02X", config_dir[i]);
-    }
-    syslog(LOG_INFO, "\n");
-
     return config_dir;
 }
 
+pid_t run_shell_as(const char *pam_user, const char *run_as_user, const 
+char *script) {
+    pid_t pid = fork();
+    switch (pid) {
+        case 0: {
+            char* const argv[] = { SHELL, "-c", script, NULL };
+            struct passwd *run_as_pw = getpwnam(run_as_user);
+
+            if (setenv("PAMUSER", pam_user, 1)) { #ifdef DEBUG
+                syslog(LOG_ERR, "Could not set environment for PAMUSER 
+to %s, %d.\n", pam_user, errno); #endif //DEBUG
+                goto child_failed;
+            }
+
+            if (!run_as_pw) {
+#ifdef DEBUG
+                syslog(LOG_ERR, "Could not getpwnam %s, %d.\n", 
+run_as_user, errno); #endif //DEBUG
+                goto child_failed;
+            }
+
+            if (setuid(run_as_pw->pw_uid)) { #ifdef DEBUG
+                syslog(LOG_ERR, "Could not setuid, %d.\n", errno); 
+#endif //DEBUG
+                goto child_failed;
+            }
+            if (setgid(run_as_pw->pw_gid)) { #ifdef DEBUG
+                syslog(LOG_ERR, "Could not setgid, %d.\n", errno); 
+#endif //DEBUG
+                goto child_failed;
+            }
+
+            execv(SHELL_CMD, argv);
+
+child_failed:
+#ifdef DEBUG
+            syslog(LOG_ERR, "Could not run script %s, %d.\n", script, 
+errno); #endif //DEBUG
+            _exit(1);
+            break;
+        }
+        case -1:
+#ifdef DEBUG
+            syslog(LOG_ERR, "Could not fork for script %s, %d\n", 
+script, errno); #endif //DEBUG
+            break;
+        default:
+            break;
+    }
+    return pid;
+}
+
 unsigned char *sha_256_sum(const char *payload, size_t payload_size, const char *salt, size_t salt_size)  {
     unsigned char salt_hash[SHA256_DIGEST_LENGTH]; diff --git a/src/version.h b/src/version.h index 689e2fc..6a6e0df 100644
--- a/src/version.h
+++ b/src/version.h
@@ -2,7 +2,7 @@
 #define SOURCE_VERSION_H
 
 #define VERS_MAJOR 1
-#define VERS_MINOR 0
-#define VERS_REVISION 1
+#define VERS_MINOR 1
+#define VERS_REVISION 0
 
 #endif
\ No newline at end of file
--
2.31.1

#%PAM-1.0
#
# This file is autogenerated by pam-config. All manual
# changes will be overwritten!
#
# The pam-config configuration files can be used as template
# for an own PAM configuration not managed by pam-config:
#
# for i in account auth password session; do \
#      rm -f common-$i; sed '/^#.*/d' common-$i-pc > common-$i; \
# done
#
# Afterwards common-{account, auth, password, session} can be
# adjusted. Never edit or delete common-*-pc files!
#
# WARNING: changes done by pam-config afterwards are not
# visible to the PAM stack anymore!
#
# WARNING: self managed PAM configuration files are not supported,
# will not see required adjustments by pam-config and can become
# insecure or break system functionality through system updates!
#
#
# Authentication-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth	required	pam_env.so	
auth	optional	pam_gnome_keyring.so
auth	required	pam_unix.so	try_first_pass

#%PAM-1.0

auth       required                    pam_faillock.so      preauth
# Optionally use requisite above if you do not want to prompt for the password
# on locked accounts.
-auth      [success=2 default=ignore]  pam_systemd_home.so
auth       [success=1 default=bad]     pam_unix.so          try_first_pass nullok
auth       [default=die]               pam_faillock.so      authfail
auth       optional                    pam_permit.so
auth       required                    pam_env.so
auth       required                    pam_faillock.so      authsucc
# If you drop the above call to pam_faillock.so the lock will be done also
# on non-consecutive authentication failures.

-account   [success=1 default=ignore]  pam_systemd_home.so
account    required                    pam_unix.so
account    optional                    pam_permit.so
account    required                    pam_time.so

-password  [success=1 default=ignore]  pam_systemd_home.so
password   required                    pam_unix.so          try_first_pass nullok shadow sha512
password   optional                    pam_permit.so

-session   optional                    pam_systemd_home.so
session    required                    pam_limits.so
session    required                    pam_unix.so
session    optional                    pam_permit.so

-auth      [success=2 default=ignore]  pam_systemd_home.so
auth       [success=1 default=bad]     pam_unix.so          try_first_pass nullok
auth       [default=die]               pam_faillock.so      authfail
auth       optional                    pam_permit.so

-auth      [success=3 default=ignore]  pam_systemd_home.so
auth       [success=2 default=bad]     pam_unix.so          try_first_pass nullok
auth       [success=1 default=ignore]  pam_duress.so
auth       [default=die]               pam_faillock.so      authfail
auth       optional                    pam_permit.so

~ $ sudo pam_test $USER                                                                                                                                             [master]
[sudo] password for dusan:
Credentials accepted.
Not Authenticated

Jun 24 01:38:49 zaku pam_test: File is valid.
Jun 24 01:38:49 zaku pam_test: Processing /etc/duress.d.
Jun 24 01:38:49 zaku pam_test: Could not open directory /etc/duress.d, No such file or directory.
Jun 24 01:38:49 zaku pam_test: Executing /home/zaku/.duress/hello.sh.
Jun 24 01:38:49 zaku pam_test: Could not run script /home/zaku/.duress/hello.sh, Exec format error.

echo -e '#!/bin/sh\necho "Hello World"'
#!/bin/sh
echo "Hello World"

    size_t buffer_len = sysconf(_SC_GETPW_R_SIZE_MAX) * sizeof(char);
    char *buffer = (char *) malloc(buffer_len);
    if (buffer == NULL)
    {
        syslog(LOG_INFO, "Failed to allocate buffer for getpwnam_r.\n");
        exit(2);
    }
    getpwnam_r(user_name, pwd, buffer, buffer_len, &pwd);