open kmsg: Operation not permitted when execute CVE-2018-17182 PoC

[darkcyber]

Hi @jas502n

This question is related to Is Debian 9.5 stretch vulnerable to CVE-2018-17182

I have www-data shell, then execute ./puppeteer just like in this documentation. But I get the following error:

./puppeteer
Tue Oct  2 14:51:34 WIB 2018
puppeteer: open kmsg: Operation not permitted

Whenever I execute ./compile.sh I get the following error:

$ ./compile.sh
./compile.sh
gcc: error trying to exec 'cc1': execvp: No such file or directory
gcc: error trying to exec 'cc1': execvp: No such file or directory
gcc: error trying to exec 'cc1': execvp: No such file or directory

Where am I going wrong?

Thanks in advance.

[jas502n]

try chmod -R 777 ./* or chmod -R a+x ./*

[darkcyber]

after chmod -R 777 ./* I still get error, the same like above.

Anyway I have another question, what is the differences between puppeteer and puppet binary. Is this exploit can work without compile first?

Thanks

[jas502n]

You can compile first, then move to the target host, if there is no GCC on the target host, like a dirty cow vulnerability

[darkcyber]

After compile on other machine and try compiled binary on target, I still facing error puppeteer: open kmsg: Operation not permitted

Where I'm doing wrong?

[darkcyber]

I also try local root exploit on fresh install Debian 9.5 but still facing same issue kmesg: operation not permitted

[xhat007]

Same problem here ! (kmesg: operation not permitted) on Debian 9.5 Stretch

[xhat007]

@darkcyber @jas502n

It seems that the value of (kernel.dmesg_restrict) is set to 1 on debian 9.5 stretch, that why the exploit return this error (puppeteer: open kmsg: Operation not permitted)

I think the exploit will not work on this release ! because you need to be ROOT to change the value of (kernel.dmesg_restrict) to 0

command used : sudo sysctl kernel.dmesg_restrict=0

I runed the exploit again and it worked !

Source : https://unix.stackexchange.com/questions/390184/dmesg-read-kernel-buffer-failed-permission-denied