For a class on IT security, I want to demonstrate privilege escalation to the students. To do so, I looked through the exploit/linux/local list in the Metasploit Framework, finding (among others) exploit/linux/local/sock_sendpage from August 2009.I set up a VM with 32-bit Ubuntu Server 9.04 (http://old-releases.ubuntu.com/releases/9.04/ubuntu-9.04-server-amd64.iso) from April 2009. uname -r gives me 2.6.28-11-generic. According to the exploit's descriptionAll Linux 2.4/2.6 versions since May 2001 are believed to be affected: 2.4.4 up to and including 2.4.37.4; 2.6.0 up to and including 2.6.30.4So it seems that the Ubuntu server that I set up should be suitable for demonstration. However, I was not able to get it to work.I added a (regular) user on the server and SSH access works. From within the Metasploit Framework, I can create an SSH session using auxiliary/scanner/ssh/ssh_login. However, when I run the exploit, I get[*] Writing exploit executable to /tmp/mlcpzP6t (4069 bytes)[*] Exploit completed, but no session was created.I don't get any further information, not even when setting DEBUG_EXPLOIT to true. /tmp is writabe, also from within the Metasploit SSH session:$ sessions -c touch /tmp/test.txt[*] Running 'touch /tmp/test.txt' on shell session 1 ([redacted])$ sessions -c ls -l /tmp[*] Running 'ls -l /tmp' on shell session 1 ([redacted])total 0-rw-r--r-- 1 [redacted] [redacted] 0 2016-03-28 09:44 test.txtI also tried setting WriteableDir to the user's home directory on the server, but without any changes. What am I missing here? Is this version of Ubuntu server (that I have deliberately not updated!) not vulnerable?
Vulnerability demonstration on Ubuntu 9.04
ubuntu;security;privileges;metasploit
The 9.04 release was supported until October 23 2010. The vulnerability you found was reported in August 2009. It seems reasonable that, since the release was still current and supported at the time, the ISO was patched and what you downloaded was a version that is no longer vulnerable. Furthermore, you seem to have demonstrated quite nicely that it isn't vulnerable. After all, you tried the exploit and it looks like it failed. Why don't you try a newer exploit? Something like CVE-2013-2094 which should also affect Ubuntu, for example.