Multi Escalate Metasploit pcap_log Local Privilege Escalation
Description
Metasploit < 4.4 contains a vulnerable 'pcap_log' plugin which, when used with the default settings, creates pcap files in /tmp with predictable file names. This exploits this by hard-linking these filenames to /etc/passwd, then sending a packet with a privileged user entry contained within. This, and all the other packets, are appended to /etc/passwd. Successful exploitation results in the creation of a new superuser account. This module requires manual clean-up. Upon success, you should remove /tmp/msf3-session*pcap files and truncate /etc/passwd. Note that if this module fails, you can potentially induce a permanent DoS on the target by corrupting the /etc/passwd file.
Author(s)
- 0a29406d9794e4f9b30b3c5d6702c708
Platform
BSD,Linux,Unix
Development
Module Options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
- Collect and share all the information you need to conduct a successful and efficient penetration test
- Simulate complex attacks against your systems and users
- Test your defenses to make sure they’re ready
- Automate Every Step of Your Penetration Test
Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.
– Jim O’Gorman | President, Offensive Security