Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1

2
class MetasploitModule < Msf::Exploit::Remote
3
  include Exploit::Remote::Tcp
4
  Rank = ManualRanking
5

6
  def initialize(info = {})
7
    super(update_info(info,
8
                      'Name'           => 'Exploit Auto-Targeting for Linux',
9
                      'Description'    => %q{ This module is a test bed for automatic targeting for Linux exploits. },
10
                      'Author'         => [ 'thelightcosine' ],
11
                      'License'        => MSF_LICENSE,
12
                      'Privileged'     => true,
13
                      'DefaultOptions' =>
14
                        {
15
                          'WfsDelay'     => 10,
16
                          'EXITFUNC' => 'thread'
17
                        },
18
                      'Payload'        =>
19
                        {
20
                          'Space'        => 3072,
21
                          'DisableNops'  => true
22
                        },
23
                      'Platform'       => 'linux',
24
                      'Arch'           => [ARCH_X86, ARCH_X64],
25
                      'Targets'        =>
26
                        [
27
                          ['Linux Heap Brute Force (Debian/Ubuntu)',
28
                           {
29
                             'Platform'      => 'linux',
30
                             'Arch'          => [ ARCH_X86 ],
31
                             'Nops'          => 64*1024,
32
                             'Bruteforce' =>
33
                               {
34
                                 'Start' => { 'Ret' => 0x08352000 },
35
                                 'Stop'  => { 'Ret' => 0x0843d000 },
36
                                 'Step'  => 60*1024,
37

38
                               }
39
                           }
40
                          ],
41

42
                          ['Linux Heap Brute Force (Gentoo)',
43
                           {
44
                             'Platform'      => 'linux',
45
                             'Arch'          => [ ARCH_X86 ],
46
                             'Nops'          => 64*1024,
47
                             'Bruteforce' =>
48
                               {
49
                                 'Start' => { 'Ret' => 0x80310000 },
50
                                 'Stop'  => { 'Ret' => 0x8042f000 },
51
                                 'Step'  => 60*1024,
52

53
                               }
54
                           }
55
                          ],
56

57

58

59
                          ['Linux Heap Brute Force (Mandriva)',
60
                           {
61
                             'Platform'      => 'linux',
62
                             'Arch'          => [ ARCH_X86 ],
63
                             'Nops'          => 64*1024,
64
                             'Bruteforce' =>
65
                               {
66
                                 'Start' => { 'Ret' => 0x80380000 },
67
                                 'Stop'  => { 'Ret' => 0x8045b000 },
68
                                 'Step'  => 60*1024,
69

70
                               }
71
                           }
72
                          ],
73

74
                          ['Linux Heap Brute Force (RHEL/CentOS)',
75
                           {
76
                             'Platform'      => 'linux',
77
                             'Arch'          => [ ARCH_X86 ],
78
                             'Nops'          => 64*1024,
79
                             'Bruteforce' =>
80
                               {
81
                                 'Start' => { 'Ret' => 0xb800f000 },
82
                                 'Stop'  => { 'Ret' => 0xb80c9000 },
83
                                 'Step'  => 60*1024,
84

85
                               }
86
                           }
87
                          ],
88

89
                          ['Linux Heap Brute Force (SUSE)',
90
                           {
91
                             'Platform'      => 'linux',
92
                             'Arch'          => [ ARCH_X86 ],
93
                             'Nops'          => 64*1024,
94
                             'Bruteforce' =>
95
                               {
96
                                 'Start' => { 'Ret' => 0x80365000 },
97
                                 'Stop'  => { 'Ret' => 0x80424000 },
98
                                 'Step'  => 60*1024,
99

100
                               }
101
                           }
102
                          ],
103

104
                          ['Linux Heap Brute Force (Slackware)',
105
                           {
106
                             'Platform'      => 'linux',
107
                             'Arch'          => [ ARCH_X86 ],
108
                             'Nops'          => 64*1024,
109
                             'Bruteforce' =>
110
                               {
111
                                 'Start' => { 'Ret' => 0x8033c000 },
112
                                 'Stop'  => { 'Ret' => 0x80412000 },
113
                                 'Step'  => 60*1024,
114

115
                               }
116
                           }
117
                          ],
118

119
                          ['Linux Heap Brute Force (OpenWRT MIPS)',
120
                           {
121
                             'Platform'      => 'linux',
122
                             'Arch'          => [ ARCH_MIPSBE ],
123
                             'Nops'          => 64*1024,
124
                             'Bruteforce'    =>
125
                               {
126
                                 'Start' => { 'Ret' => 0x55900000 },
127
                                 'Stop'  => { 'Ret' => 0x559c0000 },
128
                                 'Step'  => 60*1024,
129
                               }
130
                           }
131
                          ]
132
                        ],
133
                      'DisclosureDate' => '1999-01-01'
134
          ))
135
  end
136

137
  def exploit
138
    print_status("This exploit doesn't actually do anything")
139
    print_status "Target Selected: #{target.name}"
140
  end
141

142

143
end
144