From bbbb9177287bc8e035618a3f5f7dd67dcfe159cd Mon Sep 17 00:00:00 2001
From: jvazquez-r7 <juan_vazquez@rapid7.com>
Date: Wed, 24 Dec 2014 14:35:35 -0600
Subject: [PATCH] Do style cleaning on metadata

---
 .../local/desktop_privilege_escalation.rb     | 62 ++++++++++++-------
 1 file changed, 39 insertions(+), 23 deletions(-)

diff --git a/modules/exploits/linux/local/desktop_privilege_escalation.rb b/modules/exploits/linux/local/desktop_privilege_escalation.rb
index 6953a76af2..8eff6813de 100644
--- a/modules/exploits/linux/local/desktop_privilege_escalation.rb
+++ b/modules/exploits/linux/local/desktop_privilege_escalation.rb
@@ -1,5 +1,5 @@
 ##
-# This module requires Metasploit: http//metasploit.com/download
+# This module requires Metasploit: http://metasploit.com/download
 # Current source: https://github.com/rapid7/metasploit-framework
 ##
 
@@ -16,31 +16,47 @@ class Metasploit4 < Msf::Exploit::Local
 
   def initialize(info={})
     super( update_info( info, {
-        'Name'          => 'Desktop Linux Password Stealer and Privilege Escalation',
-        'Description'   => %q{
-This module steals the user password of an administrative user on a desktop Linux system when it is entered for unlocking the screen or for doing administrative actions using policykit. Then it escalates to root privileges using sudo and the stolen user password.
-
-It exploits the design weakness that there is no trusted channell for transferring the password from the keyboard to the actual password verificatition against the shadow file (which is running as root since /etc/shadow is only readable to the root user). Both screensavers (xscreensaver/gnome-screensaver) and policykit use a component running under the current user account to query for the password and then pass it to a setuid-root binary to do the password verification. Therefore it is possible to inject a password stealer after compromising the user account. Since sudo requires only the user password (and not the root password of the system), stealing the user password of an administrative user directly allows escalating to root privileges.
-
-Please note that you have to start a handler as a background job before running this exploit since the exploit will only create a shell when the user actually enters the password (which may be hours after launching the exploit). Using exploit/multi/handler with the option ExitOnSession set to false should do the job.
+      'Name'          => 'Desktop Linux Password Stealer and Privilege Escalation',
+      'Description'   => %q{
+        This module steals the user password of an administrative user on a desktop Linux system
+        when it is entered for unlocking the screen or for doing administrative actions using
+        policykit. Then it escalates to root privileges using sudo and the stolen user password.
+        It exploits the design weakness that there is no trusted channell for transferring the
+        password from the keyboard to the actual password verificatition against the shadow file
+        (which is running as root since /etc/shadow is only readable to the root user). Both
+        screensavers (xscreensaver/gnome-screensaver) and policykit use a component running under
+        the current user account to query for the password and then pass it to a setuid-root binary
+        to do the password verification. Therefore it is possible to inject a password stealer
+        after compromising the user account. Since sudo requires only the user password (and not
+        the root password of the system), stealing the user password of an administrative user
+        directly allows escalating to root privileges. Please note that you have to start a handler
+        as a background job before running this exploit since the exploit will only create a shell
+        when the user actually enters the password (which may be hours after launching the exploit).
+        Using exploit/multi/handler with the option ExitOnSession set to false should do the job.
+      },
+      'License'       => MSF_LICENSE,
+      'Author'        => ['Jakob Lell'],
+      'DisclosureDate' => 'Aug 7 2014',
+      'Platform'      => 'linux',
+      'Arch'          => [ARCH_X86, ARCH_X86_64],
+      'SessionTypes'  => ['shell', 'meterpreter'],
+      'Targets'       =>
+        [
+          ['Linux x86', {'Arch' => ARCH_X86}],
+          ['Linux x86_64', {'Arch' => ARCH_X86_64}]
+        ],
+      'DefaultOptions' =>
+        {
+          'PrependSetresuid' => true,
+          'PrependFork' => true,
+          'DisablePayloadHandler' => true
         },
-        'License'       => MSF_LICENSE,
-        'Author'        => [ 'Jakob Lell' ],
-        'DisclosureDate' => 'Aug 7 2014',
-        'Platform'      => %w{ linux },
-        'Arch'          => [ ARCH_X86 ],
-        'SessionTypes'  => [ 'shell', 'meterpreter' ],
-        'Targets'       =>
-          [
-            [ 'Linux x86',       { 'Arch' => ARCH_X86 } ],
-            [ 'Linux x86_64',       { 'Arch' => ARCH_X86_64 } ]
-          ],
-        'DefaultOptions' => { "PrependSetresuid" => true, "PrependFork" => true , "DisablePayloadHandler" => true},
-        'DefaultTarget' => 0,
+      'DefaultTarget' => 0,
       }
-      ))
+    ))
+
     register_options([
-        OptString.new("WritableDir", [ true, "A directory for storing temporary files on the target system", "/tmp" ]),
+      OptString.new("WritableDir", [ true, "A directory for storing temporary files on the target system", "/tmp" ]),
     ], self.class)
   end