7ddffc790c
Merge pull request #19460 from gardnerapp/game_overlay
...
Land #19460 , CVE-2023-2640, CVE-2023-32629 Game Overlay Ubuntu Privilege Escalation
2024-12-18 14:44:57 -06:00
59229ee612
Update payload name, fix payload escapes & quotation, add unix cmd support
2024-12-17 16:52:24 -06:00
bca3626cf2
peer review
2024-12-04 18:39:43 -05:00
0f6da56a52
vcenter sudo module
2024-11-21 04:34:15 -05:00
441a3215b2
Catch up to head on other branch
2024-11-19 08:59:22 -06:00
6bd049e346
operator working
2024-11-18 20:09:13 -05:00
19770cf870
Remove unneeded file and rudocop corrections
...
Update modules/exploits/linux/local/gameoverlay_privesc.rb
Co-authored-by: Brendan <bwatters@rapid7.com >
Give bwatters7 credit, add docs
Experiment with randomized bash copy and Rex::File.join
remove unused line
Add missing parenthesis
fix problem with bash copy
Remove rex::join, call proper method for generating payload
add exploit::exe mixin, bash copy randomization
Rubocop changes
Remove nc
2024-11-18 17:01:08 -06:00
6e09722f67
Rubocop changes and arch tracking for payload
...
Update modules/exploits/linux/local/gameoverlay_privesc.rb
Co-authored-by: Brendan <bwatters@rapid7.com >
Rubocop changes
2024-11-18 16:59:37 -06:00
c6425f7245
Break out command building to make it easier to read
...
Update modules/exploits/linux/local/gameoverlay_privesc.rb
Co-authored-by: Brendan <bwatters@rapid7.com >
2024-11-18 16:58:56 -06:00
e506c34e13
Update modules/exploits/linux/local/gameoverlay_privesc.rb
...
Co-authored-by: Brendan <bwatters@rapid7.com >
2024-11-18 16:57:17 -06:00
883a0f8985
Update modules/exploits/linux/local/gameoverlay_privesc.rb
...
Co-authored-by: Brendan <bwatters@rapid7.com >
2024-11-18 16:57:17 -06:00
51194ad0c9
Rebase and maintain authorship
...
Rebase and change payload delivery
Rebase and remove cmdstager
Update modules/exploits/linux/local/game_overlay_privesc.rb
Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com >
remove CmdStager Mixin
Add PrependSetuid
Remove python from exploit
Remove generate_payload_exe and add dynamic directory to upper mount layer
Change where payload is dropped
Remove FileUtils module
Call proper method for generating payload
Seperate exploit and triggering of payload
Seperate exploit and triggering payload
test
2024-11-18 16:55:59 -06:00
c927f22d66
Update modules/exploits/linux/local/game_overlay_privesc.rb
...
Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com >
2024-11-18 16:44:33 -06:00
5edec2525f
Rebase and Squash
...
init
Add moduel scaffolding
Add Opts, check and exploit methods
Rubocop changes
Add checks for vunerable kernel versions
Write check for distro type
Finish protoype of check add exploit
Make changes to check method
Add checkcode
Add x86 for payload compatability
remove check, add kernel version
add codenam, transform keys in vuln
Note
minor spelling change
Add description
Add cve references
Start trying to drop payloads on disk
Change description, include modules for file upload, use proper methods for writing payload
continue trying to upload
Use write_file instead of upload_and_chmodx
remove upload_dir opt
expirement w g1vi exploit
Include cmd_stage module, add generate_payload_exe, run payload in new namespace
Add missing call to setcap, fix description
Fix unterminated string, fix directory for calling python copy
Rubocop changes
Create dynamic payload
Add mkdir_p and WritableDir opts
Update modules/exploits/linux/local/game_overlay_privesc.rb
Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com >
Revert back to python exploit, add dynamic writable dir
Add todos
Remove FileUtils
Change module name
Add checkcodes
Add more checkcodes
2024-11-18 16:41:38 -06:00
f38661d6c3
pod user working
2024-11-18 07:30:21 -05:00
773355f0e8
making bcenter lpe progress
2024-11-04 16:26:08 -05:00
8ba4332c33
Merge remote-tracking branch 'upstream/master' into vcenter_privesc
2024-11-03 13:56:14 -05:00
811678a793
Add openrc to exploits/linux/local/service_persistence.rb
...
Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com >
2024-10-02 12:54:33 +02:00
dbc020a745
Merge pull request #19441 from Takahiro-Yoko/cve_2023_0386_priv_esc
...
Land #19441 , Add module: Linux Priv Esc (OverlayFS copying bug) CVE-2023-0386
2024-09-26 14:07:17 -05:00
6d541b625f
Remove unnecessary shell_path
2024-09-24 08:18:30 +09:00
130f146819
Apply suggestions from code review
...
Change to call setgid and setuid in the exploit before executing the payload
Co-authored-by: Brendan <bwatters@rapid7.com >
2024-09-24 08:06:26 +09:00
30704c494a
Remove unnecessary strip_comments
2024-09-15 10:00:43 +09:00
83a31c8a2a
Land #19454 , Persistence post module using motd
2024-09-13 09:02:22 -04:00
6d659e3aa8
Add modules/exploits/linux/local/motd_persistence.rb
2024-09-12 17:41:47 +02:00
5e71490b66
Fix a typo when the kernel is not Ubuntu
2024-09-09 14:19:20 -04:00
8ddf8a04ff
Remove options
2024-09-07 12:44:37 +09:00
8366252ba2
Not call payload directory
2024-09-07 12:28:40 +09:00
692531bb87
Call payload directory
2024-09-07 12:16:04 +09:00
2b63f8bb88
Rename exploit
2024-09-07 10:29:41 +09:00
731780ca1a
Formatting
2024-09-07 09:21:30 +09:00
9e832eb483
Use exploit_path variable
2024-09-07 09:19:17 +09:00
fd7321dd3f
Strip_comments
2024-09-06 22:58:31 +09:00
b34e807277
Remove unnecessary directory existing check
2024-09-06 22:05:34 +09:00
a40fbb2a7b
Remove unnecessary check
2024-09-06 22:04:51 +09:00
d4ac300d73
Fix typo
2024-09-06 21:59:16 +09:00
7a921bbeff
Update modules/exploits/linux/local/cve_2023_0386_overlayfs_priv_esc.rb
...
Use kernel_version.btween
Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com >
2024-09-06 21:45:32 +09:00
cd97b08c62
Move C code to separate file
2024-09-06 21:09:39 +09:00
1cc562c863
Use mkdir function
2024-09-06 12:55:51 +09:00
920ef70105
Exploit dir existing check
2024-09-06 12:53:18 +09:00
b243b86157
Update modules/exploits/linux/local/cve_2023_0386_overlayfs_priv_esc.rb
...
use linux/x64/meterpreter_reverse_tcp
Co-authored-by: Brendan <bwatters@rapid7.com >
2024-09-06 08:51:20 +09:00
dc81711301
Make timeout user configurable
2024-09-06 08:24:14 +09:00
afb8c6c27c
Strip comments
2024-09-05 23:13:08 +09:00
3d20dd6ddf
Add module:
...
Linux Priv Esc (OverlayFS copying bug) CVE-2023-0386
2024-09-05 22:54:55 +09:00
c8084e4504
Create vcenter_sudo_lpe.rb
2024-08-19 20:02:05 -04:00
80ee458410
Land #19151 , Add Flowmon Priv Esc Feature Module
...
Privilege escalation module for Progress Flowmon unpatched feature
2024-05-29 11:35:53 -04:00
cc7aeb4364
Fix module cleanup
2024-05-29 08:39:06 -04:00
2c6fc11639
Responded to comments, clean up /etc/sudoers file
2024-05-23 16:56:35 -04:00
1b55b6512f
Rubocop fixes
2024-05-22 12:43:27 -07:00
b3bc4a6c68
Update progress_flowmon_sudo_privesc_2024.rb
2024-05-21 13:48:20 -07:00
de99a74540
Update modules/exploits/linux/local/progress_flowmon_sudo_privesc_2024.rb
...
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com >
2024-05-21 13:45:36 -07:00
Brendan