Module: Msf::Post::Linux::Priv

Includes:
Common
Defined in:
lib/msf/core/post/linux/priv.rb

Instance Method Summary collapse

Methods included from Common

#clear_screen, #cmd_exec, #cmd_exec_get_pid, #command_exists?, #get_env, #get_envs, #has_pid?, #peer, #report_virtualization, #rhost, #rport

Instance Method Details

#binary_of_pid(pid) ⇒ Object


59
60
61
62
63
64
65
66
67
68
# File 'lib/msf/core/post/linux/priv.rb', line 59

def binary_of_pid(pid)
  binary = read_file("/proc/#{pid}/cmdline")
  if binary == "" #binary.empty?
    binary = read_file("/proc/#{pid}/comm")
  end
  if binary[-1] == "\n"
    binary = binary.split("\n")[0]
  end
  return binary
end

#cp_cmd(origin_file, final_file) ⇒ Object


39
40
41
42
# File 'lib/msf/core/post/linux/priv.rb', line 39

def cp_cmd(origin_file, final_file)
  file_origin = read_file(origin_file)
  cmd_exec("echo '#{file_origin}' > #{final_file}")
end

#grep_cmd(file, string) ⇒ Object


123
124
125
126
127
128
129
130
131
132
133
# File 'lib/msf/core/post/linux/priv.rb', line 123

def grep_cmd(file, string)
  result = []
  lines = read_file(file).split("\n")

  lines.each do |line|
    if line.include?(string)
      result.insert(-1, line)
    end
  end
  return result
end

#head_cmd(file, nlines) ⇒ Object


111
112
113
114
115
# File 'lib/msf/core/post/linux/priv.rb', line 111

def head_cmd(file, nlines)
  lines = read_file(file).split("\n")
  result = lines[0..nlines-1]
  return result
end

#is_root?Boolean

Returns true if running as root, false if not.

Returns:

  • (Boolean)

13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
# File 'lib/msf/core/post/linux/priv.rb', line 13

def is_root?
  if command_exists?('id')
    user_id = cmd_exec('id -u')
    clean_user_id = user_id.to_s.gsub(/[^\d]/, '')
    if clean_user_id.empty?
      raise "Could not determine UID: #{user_id.inspect}"
    end
    return (clean_user_id == '0')
  end
  user = whoami
  data = cmd_exec('while read line; do echo $line; done </etc/passwd')
  data.each_line do |line|
    line = line.split(':')
    return true if line[0] == user && line[3].to_i == 0
  end
  false
end

#nchars_file(file) ⇒ Object


82
83
84
85
86
87
88
89
90
91
92
# File 'lib/msf/core/post/linux/priv.rb', line 82

def nchars_file(file)
  nchars = 0
  lines = read_file(file).split("\n")
  nchars = lines.length()
  lines.each do |line|
    line.gsub(/[ ]/, ' ' => '')
    nchars_line = line.length()
    nchars = nchars + nchars_line
  end
  return nchars
end

#nlines_file(file) ⇒ Object


105
106
107
108
109
# File 'lib/msf/core/post/linux/priv.rb', line 105

def nlines_file(file)
  lines = read_file(file).split("\n")
  nlines = lines.length()
  return nlines
end

#nwords_file(file) ⇒ Object


94
95
96
97
98
99
100
101
102
103
# File 'lib/msf/core/post/linux/priv.rb', line 94

def nwords_file(file)
  nwords = 0
  lines = read_file(file).split("\n")
  lines.each do |line|
    words = line.split(" ")
    nwords_line = words.length()
    nwords = nwords + nwords_line
  end
  return nwords
end

#pidsObject


44
45
46
47
48
49
50
51
52
53
54
55
56
57
# File 'lib/msf/core/post/linux/priv.rb', line 44

def pids()
  dir_proc = "/proc/"
  pids = []

  directories_proc = dir(dir_proc)
  directories_proc.each do |elem|
    elem.gsub( / *\n+/, "")
    if elem[-1] == '1' || elem[-1] == '2' || elem[-1] == '3' || elem[-1] == '4' || elem[-1] == '5' || elem[-1] == '6' || elem[-1] == '7' || elem[-1] == '8' || elem[-1] == '9' || elem[-1] == '0'
      pids.insert(-1, elem)
    end
  end

  return pids.sort_by(&:to_i)
end

#seq(first, increment, last) ⇒ Object


70
71
72
73
74
75
76
# File 'lib/msf/core/post/linux/priv.rb', line 70

def seq(first, increment, last)
    result = []
    (first..last).step(increment) do |i|
      result.insert(-1, i)
    end
    return result
end

#tail_cmd(file, nlines) ⇒ Object


117
118
119
120
121
# File 'lib/msf/core/post/linux/priv.rb', line 117

def tail_cmd(file, nlines)
  lines = read_file(file).split("\n")
  result = lines[-1*(nlines)..-1]
  return result
end

#touch_cmd(new_path_file) ⇒ Object

Multiple functions to simulate native commands added


35
36
37
# File 'lib/msf/core/post/linux/priv.rb', line 35

def touch_cmd(new_path_file)
  cmd_exec("> #{new_path_file}")
end

#wc_cmd(file) ⇒ Object


78
79
80
# File 'lib/msf/core/post/linux/priv.rb', line 78

def wc_cmd(file)
    [nlines_file(file), nwords_file(file), nchars_file(file), file]
end